Digital Trust in Kazakhstan: E-Signatures, Legal Status and Liability

It is important for businesses to understand that an electronic digital signature (EDS) is not merely a technical tool. Pursuant to paragraph 2 of Article 49 of the Digital Code, an electronic digital signature is equivalent to the handwritten signature of the signatory and has equal legal effect. However, it is important to take into account that this is possible only if several conditions are simultaneously met, as specified in paragraph 4 of the same article.

These conditions include:

• verification of the authenticity of the EDS using the public key;
• lawful possession of the private key by the signatory;
• use of the signature in accordance with the information contained in the certificate;
• issuance of the certificate by a certification authority accredited in the Republic of Kazakhstan or by a foreign certification authority registered with the trusted third party of the Republic of Kazakhstan.

In other words, in Kazakhstan, it is not merely the technical ability to “sign a document online” that matters, but compliance with the entire legal framework established by law. Failure to meet even one of the conditions set out in paragraph 4 of Article 49 of the Digital Code may undermine the legal validity of the signature and the legal effect of the document. This is particularly important where digital documents are used for corporate approvals, submission of documents to government systems, formalisation of authority, or execution of legally significant documents at the local level.

Issuance of Electronic Digital Signatures and the Practical Role of the National Certification Authority

The Digital Code of the Republic of Kazakhstan is based on the principle that what matters is not the name of a particular certification authority, but its compliance with statutory requirements. In this regard, an EDS may be issued by any certification authority that has the required level of accreditation or provides services in accordance with the applicable provisions. The relevant provisions are contained in Chapter 11 of the Digital Code, primarily Articles 52–60, which regulate the status of certification authorities, signature certificates and EDS keys, as well as matters relating to the refusal to issue and revocation of certificates.

However, in Kazakhstan, in the overwhelming majority of cases, the infrastructure of the National Certification Authority of the Republic of Kazakhstan is used in practice. It is through this infrastructure that the standard procedure for obtaining and using an EDS for businesses and for interaction with government digital systems is established. The practical procedure for issuing an EDS by the National Certification Authority provides for separate procedures for obtaining certificates for the chief executive, an employee authorised to sign and an employee of the organisation. An EDS is obtained through the pki.gov.kz website and the relevant e-government services. At the same time, the applicable secondary legislation must be taken into account to the extent that it does not conflict with the Digital Code and the regulatory legal acts adopted for its implementation.

Therefore, from a practical business perspective, the conclusion is relatively straightforward: although the law does not reserve the issuance of electronic digital signatures exclusively to the National Certification Authority of the Republic of Kazakhstan, in practice, an EDS issued by the National Certification Authority through the pki.gov.kz portal remains the standard and most commonly used solution for electronic document management in Kazakhstan and for access to government digital services.

An Electronic Digital Signature of a Legal Entity Is Used by a Specific Authorised Person

Pursuant to paragraph 2 of Article 58 of the Digital Code, the holder of an EDS public key certificate may be an individual or a legal entity in whose name the relevant certificate has been issued and who lawfully possesses the private key. At the same time, electronic documents on behalf of a legal entity are signed by a specific individual vested with the necessary authority.

In accordance with paragraph 2 of Article 61 of the Digital Code, the authority to sign on behalf of a legal entity, branch or representative office is verified by the digital system in which the signing is performed through the authority verification service of the Root Certification Authority of the Republic of Kazakhstan. Furthermore, paragraph 6 of Article 62 of the Digital Code provides that the head of a legal entity, or a person acting in their stead, may authorise an employee or another person designated by them to sign electronic documents. Each signatory must use an EDS public key certificate issued in their own name and the corresponding private key.

Accordingly, a company must not use a single shared EDS for the signing or submission of documents by several employees. Each person who will perform the relevant actions on behalf of the organisation must obtain a separate EDS, have their authority duly formalised, in particular by issuing a power of attorney and, where necessary, an internal administrative document, and be granted individual access to the relevant government and other digital systems.

Transferring an EDS to Another Person Is Contrary to the Law

Particular attention should be paid to the legal regime governing the EDS private key. Pursuant to paragraph 2 of Article 49 of the Digital Code, the legal validity of an electronic digital signature depends, among other things, on the person signing the electronic document lawfully possessing the private key. It follows that an arrangement whereby a document is formally signed by one person but is in fact created by another person using the former’s key does not comply with the requirements of the law.

Moreover, paragraph 3 of Article 51 of the Digital Code expressly establishes that private keys of electronic digital signatures are the property of the persons who lawfully possess them and that neither the transfer of private keys to other persons nor the use of such keys by other persons is permitted. This provision is further supported by subparagraph 3) of paragraph 4 of Article 58 of the Digital Code, under which the certificate holder is required to take measures to protect their private key against unauthorised access and use.

In practical terms, the conclusion is relatively straightforward. The head of a company, the head of a branch or another authorised signatory must not provide their EDS to an accountant, lawyer, assistant or any other employee, even where this is done solely “for convenience” and in the interests of the same company. Where another employee is in fact required to sign documents or submit them through a system, the appropriate solution is to obtain a separate EDS for that employee and duly formalise their authority. This approach follows from paragraph 3 of Article 51, subparagraph 3) of paragraph 4 of Article 58 and paragraph 2 of Article 61 of the Digital Code, as well as paragraphs 3 and 6 of the NCA Rules.

This is relevant not only from the perspective of the company’s internal document management arrangements, but also in terms of liability. The unlawful transfer of an EDS private key to another person entails administrative liability under paragraph 5 of Article 640 of the Code of the Republic of Kazakhstan on Administrative Offences, while the use of another person’s EDS private key entails liability under paragraph 6 of Article 640 of the Code of Administrative Offences of the Republic of Kazakhstan. Accordingly, the risk of liability arises both for the person who transferred the private key and for the person who actually used another person’s EDS.

Foreign Electronic Digital Signatures: Not Automatic Recognition, but a Special Recognition Mechanism

For foreign investors and international groups of companies, the use of foreign electronic signatures and foreign document-signing platforms, such as DocuSign, Adobe Sign or similar solutions, is particularly relevant. It is important to bear in mind that the mere fact that a document has been signed through such a platform does not automatically mean that the signature will be recognised in Kazakhstan as equivalent to a handwritten signature.

This is expressly provided for in paragraph 4 of Article 49 of the Digital Code of the Republic of Kazakhstan. This provision stipulates that a foreign electronic digital signature may have legal effect equivalent to a handwritten signature only where the certificate has been issued by a certification authority accredited in the Republic of Kazakhstan or by a foreign certification authority registered with the trusted third party of the Republic of Kazakhstan. In other words, Kazakhstan law does not provide for the automatic recognition of any foreign electronic signature solely because it is valid in another jurisdiction or used in international corporate practice.

Article 57 of the Digital Code provides for a special mechanism for the recognition of foreign electronic digital signatures. The trusted third party of the Republic of Kazakhstan is a digital system that, in the context of cross-border interaction, verifies the authenticity of a foreign EDS and an EDS issued in the territory of the Republic of Kazakhstan. The procedure for registering foreign certification authorities and verifying the authenticity of foreign electronic digital signatures is determined by the authorised state body.

Therefore, the use of DocuSign, Adobe Sign or another foreign platform does not in itself mean that a signature created through such a platform will be recognised in Kazakhstan as equivalent to a handwritten signature within the meaning of the Digital Code. Such recognition requires compliance with the requirements of subparagraph 4) of paragraph 2 of Article 49 and the mechanism provided for in Article 57 of the Code.

At the same time, the fact that a foreign electronic signature does not have the status of an EDS under Article 49 of the Digital Code does not automatically render the signed document invalid. In accordance with paragraph 3 of Article 152 of the Civil Code of the Republic of Kazakhstan, the exchange of electronic communications and other documents may confirm compliance with the written form of a transaction where such documents make it possible to identify the parties and determine the content of their expressed intentions. Accordingly, documents signed through foreign platforms may have legal effect in Kazakhstan; however, their evidentiary reliability depends on the type of document, the arrangements agreed between the parties, the ability to identify the signatory reliably and the preservation of information relating to the signing process.

Where legislation requires the mandatory use of an EDS, notarisation, state registration or the submission of a document through a state digital system, a foreign platform does not replace a Kazakhstan EDS. For ordinary commercial agreements, the use of a foreign platform may be permissible where the parties have agreed on such method of signing has been agreed, and it is possible to verify the identity of the signatory, their authority, the content of the document and the date of signing.

Accordingly, an EDS accepted by the relevant system should be used when interacting with government authorities and performing actions through government digital systems. For ordinary commercial document management, either a Kazakhstan EDS or other methods of electronic signing agreed by the parties may be used, subject to the requirements of Article 152 of the Civil Code of the Republic of Kazakhstan and the associated evidentiary risks.

Conclusion

The Digital Code of the Republic of Kazakhstan has preserved and systematised the formalised model for the use of electronic digital signatures, while distinguishing an EDS from other methods of digitally confirming an expression of intent.

For businesses, this means that an EDS should be regarded not merely as a convenient technical tool, but as a legally significant mechanism whose use must comply with statutory requirements. The legal validity of a signature directly depends on the status of the certificate, the identity of the signatory and compliance with the rules governing the possession and use of the private key.

The key practical conclusions for foreign investors are as follows. First, documents on behalf of a legal entity must be signed by a specific authorised person using a certificate issued in their name and the corresponding private key. Second, the transfer of an EDS private key to another employee is prohibited and creates a risk of administrative liability both for the person transferring the key and for the person using it. Third, in practice, the infrastructure of the National Certification Authority of the Republic of Kazakhstan remains the primary means of interacting with government digital systems. Finally, foreign signing platforms are not automatically recognised as Kazakhstan electronic digital signatures; however, documents signed through such platforms may, under certain conditions, satisfy the written-form requirements for transactions under Article 152 of the Civil Code of the Republic of Kazakhstan.

In this regard, a foreign company operating in Kazakhstan is advised to determine the persons authorised to sign documents electronically, ensure that each such person obtains a separate Kazakhstan EDS and prevent the transfer of private keys between employees.

A Kazakhstan EDS may be used to sign any legally significant electronic documents, both in dealings with government authorities and when using government digital systems, as well as in commercial document management with counterparties.

In certain cases, the parties may use foreign electronic signing platforms. However, it must be taken into account that such a signature is not automatically recognised as an EDS equivalent to a handwritten signature under Article 49 of the Digital Code. Therefore, the statutory requirements applicable to the form of the relevant document must be complied with, and the reliable identification of the signatory, confirmation of their authority and expression of intent, the integrity of the signed document and the preservation of evidence relating to the signing process must be ensured. Furthermore, a foreign platform may not be used in place of a Kazakhstan EDS where legislation or the relevant digital system expressly requires the document to be signed using an EDS recognised in the Republic of Kazakhstan.