Payment organization license in Uzbekistan, end to end

You have a working payments product — a wallet, a bill-payment app, a merchant checkout — and you want to run it in Uzbekistan under your own name rather than as a white label on a local bank. In Uzbek law that means becoming a payment organization (to'lov tashkiloti): a company that is not a bank but is licensed by the Central Bank to provide payment services.

Short answer

Providing payment services in Uzbekistan without a Central Bank license is prohibited; payment agents and sub-agents working for a licensed bank or payment organization are the only exception. To get the license you need:

• a joint-stock company with 20 billion UZS of charter capital paid in cash before you file;
• owners who meet the fit and proper requirements (foreign owners are capped at 50% unless they are themselves regulated financial firms meeting a €20 million capital test);
• managers with a degree and two years in finance or IT;
• owned or long-leased premises, and servers in a data center meeting the Oʻz DSt 2875:2014 standard;
• a full risk, security and AML/CFT file.

The Central Bank decides within 30 days of a complete application. The license has no expiry date, but it can be suspended or revoked, and keeping your capital and security up to standard is a condition of keeping it.

The rules sit in three acts: the payments law (ZRU-578), the Central Bank's licensing regulation (reg. 3431) and its supervision regulation (reg. 3434). This guide walks through them in the order you will meet them. For the wider picture, see financial regulation in Uzbekistan.

Do you need a license?

The payments law (art. 14) lists nine payment services. A payment organization may provide all of them except three (art. 15): taking cash to credit bank accounts, issuing electronic money, and issuing bank cards. That leaves six services open to you:

Note on electronic money. Art. 15 bars issuing; only the issuer — the Central Bank or a bank — redeems (arts. 40, 44).

The same article lists what is not a payment service. One item matters to tech companies: providing the information and technology link between a merchant (a company or sole trader) and a payment service provider, when the provider itself transfers the accepted payments to the merchant and no third party is involved. Collection of cash, currency exchange without an account, and cash handed over directly between payer and payee are also outside the list.

The license requirement is in art. 15: providing payment services in Uzbekistan without the Central Bank's license is prohibited. Payment agents and sub-agents are exempt. They act on behalf of a licensed bank or payment organization, which is jointly liable with them to users (art. 19).

One business only. A payment organization may not do anything unrelated to payment services (art. 18). The law allows a short list of side activities: advertising, marketing, consulting and information services; software development and support; IT and data-processing services; building and securing information systems; cryptographic tools; postal services; and microfinance. If a side activity needs its own license, you need that license too.

Two licenses, two roles. The law separately licenses payment system operators — the company that runs a payment system, sets its rules and clears for its participant banks. This guide is about the payment organization license. Where the regulation sets a different rule for operators, we say so.

Owners and foreign capital

The licensing regulation (reg. 3431, ch. 3) lets residents and non-residents, companies and individuals, be shareholders. Three rules shape a foreign-owned structure.

The 50% cap. Non-resident individuals, and non-resident companies that are not international financial institutions, foreign payment system operators, foreign payment organizations or other credit organizations, may together hold no more than 50% of the charter capital (p.8). “Other credit organizations” are defined: a holding company set up to manage financial firms, or a company licensed abroad for banking, microfinance, insurance, leasing or mortgage refinancing.

Above 50%: the €20 million test. A foreign financial organization of the kinds just listed may hold more than 50% only if its own charter capital is at least the equivalent of €20 million (p.9). If it is smaller, the Central Bank may take into account the foreign supervisor's assessment of the firm's capacity. The text does not promise that this will be enough.

Corporate shareholders must have a track record. A company that is a shareholder must be duly registered and have operated for at least one year (p.10). A newly formed holding vehicle does not qualify on its own.

Who cannot be an owner (p.11). The beneficial owner or a shareholder may not be:

• a person who cannot show where the money for the capital came from;
• a person whom Uzbek or foreign law bars from holding the shares;
• a public association, religious organization, public fund, NGO, extra-budgetary fund, political party or trade union;
• a state body, except where legislation provides otherwise;
• an individual who fails the reputation test below;
• a company or individual declared insolvent.

Managers and reputation

The heads of the executive body must have higher education and at least two years of experience in banking and finance or in information and communication technologies (payments law art. 27; reg. 3431 p.12). If a manager does not meet the requirement, the Central Bank may order the company to replace them; the order can be challenged in court.

The reputation test (reg. 3431 p.13, rewritten in June 2026) applies to the beneficial owner, shareholders and executives alike. Among its points:

• no unexpunged conviction for economic crimes, money laundering, terrorism or proliferation financing, crimes against the order of governance, organized crime, drug trafficking or IT crimes;
• not on the list of persons involved, or suspected of involvement, in terrorism or proliferation;
• no court ban on professional activity in finance;
• not having taken up a post abroad that required a foreign regulator's prior approval without getting it;
• not having caused, by action or inaction, the insolvency and compulsory liquidation of a company they ran, sat on the board of or controlled;
• no record of unexplained negative financial results at a company or branch they head or headed;
• no measures or sanctions for gross or serious violations applied by an Uzbek or foreign financial supervisor to a company they manage(d) or control(led).

The last two points look back at a person's whole career, not only their time in Uzbekistan. Collect the evidence for each executive and owner before you file.

Capital

20 billion UZS, in cash, in national currency. The minimum charter capital of a payment organization is 10 billion UZS from 1 July 2024 and 20 billion UZS from 1 July 2025 (reg. 3431 p.15). Since 1 July 2025 the 20 billion figure applies. (A payment system operator needs 50 billion UZS, p.14.)

How the capital must be formed (p.16):

• in the national currency, from money paid in by the shareholders;
• fully formed when you file the application, and kept on a bank account until the license is issued;
• not from borrowed or pledged funds, funds encumbered by other obligations, or proceeds of crime.

The business plan must also show the amount, composition and sources of the capital (p.28). And capital is not a one-time test: under the supervision regulation, breaching the capital requirement is a gross violation that can cost you the license (see Sanctions).

Corporate form. Payment organizations must be set up and operate as joint-stock companies (p.6). An LLC does not qualify.

Premises, IT and continuity

Chapter 7 of reg. 3431 (as amended in January 2026) sets the organizational, technical and security conditions. For a payment organization they include:

• Premises that you own or have leased for at least three years, meeting the security requirements (p.17).
• Qualified, experienced staff for payment services, management, internal control, risk management, information security and cybersecurity, and anti-fraud.
• Hardware and software of sufficient capacity for the nature and volume of your activity.
• A complaints system.
• Bank contracts. The list in p.17 also includes a bank's written consent (a contract copy) to provide acquiring services and, for a payment system, a bank's consent to be its settlement bank. The bank must manage its own credit, liquidity, security, fraud and AML/CFT risks under that contract.
• Information security. You must secure your systems, adopt an information security policy (p.18), and build them to the payment-systems security regulation, reg. 3513 (p.19). Servers must sit in data centers meeting the Oʻz DSt 2875:2014 standard; you need archiving, antivirus, network protection, monitoring, intrusion detection and access control; and night-time guarding and alarms. (A PCI DSS certificate is required of payment system operators, p.19.)
• Business continuity. You must prepare a continuity plan and backup plans based on an operational risk assessment and impact analysis, and submit them to the Central Bank (p.20). The plan must cover, among other things, recovery after disruptions, a failure action plan, stress-testing frequency and method, and how unfinished payments will be completed if you stop providing services (p.21).

The application file

The application goes to the Central Bank in electronic or written form on the form in annex 1 to reg. 3431. A non-bank applicant attaches (reg. 3431 p.23 and p.26; payments law art. 24):

1. Information on the shareholders on the annex 2 form (for individuals and for companies, with their stakes in UZS and percent).
2. The balance sheet and income statement at the latest reporting date.
3. Information on the heads and members of the executive body, with copies of documents on their education and career.
4. A business plan for the next two calendar years (p.28): market-based calculations of systems, processes, technical and financial resources with a two-year income and expense forecast; a profit and loss statement with volumes, client numbers, prices, transaction data and expected profitability; liabilities and fixed assets; the capital's amount, composition and sources; market position and a marketing plan by channel; and a description of your technical means and systems.
5. Information on the risk-management system, including how clients' money is kept safe (p.29): how risks are identified, assessed and reduced; who is responsible for internal control and compliance; how outsourced functions are monitored; how agents and sub-agents are monitored.
6. Information on security systems and control mechanisms.
7. A security policy with a detailed risk assessment and the measures that reduce information-security, cybersecurity, fraud and data-misuse risks.
8. A description of the measures ensuring compliance with AML/CFT/CPF legislation.
9. For a payment organization: the procedure of interaction with the payment system operator and its participants (p.26, p.30): the services, the interaction scheme, the flow of money and settlements, and which activities you may outsource. The Central Bank agrees this document together with the license application (law art. 24).

Fee. The Central Bank charges a review fee of 50% of the BRV (base calculation amount) (reg. 3431 p.24).

If the license is granted you also pay a state duty at the rate of the Law on state duty (p.5); the notice of the decision gives the account and the payment deadline (law art. 24). We do not quote the amount here.

Review and decision

Note on cure notices. The review clock stops meanwhile.

Sources: row 1 — law art. 24, reg. 3431 p.31; row 2 — law art. 24; row 3 — reg. 3431 pp.34–36; row 4 — law art. 24, reg. 3431 p.38; row 5 — law art. 24.

The Central Bank may visit your premises to verify the information and the technical and security conditions (reg. 3431 p.32).

Grounds for refusal are three (law art. 24; reg. 3431 p.33): improperly drawn-up documents, false or distorted information, or failing the license requirements. If the first two are curable, the Central Bank must give you time to fix them rather than refuse outright (p.34).

A refusal notice must state the reasons and the specific legal norms, and after a cure notice the Central Bank may not refuse on new grounds it did not raise in the notice (pp.37–38). An application filed after the re-filing window has closed is treated as new (p.40).

The license is issued for an unlimited term, cannot be transferred to anyone else, and the right to operate starts on the day it is issued (reg. 3431 pp.2–4). Your activity counts as started once all launch tests are complete and the services are offered for unrestricted use (p.50) — which matters for the one-year revocation ground below.

After the license

Reporting (reg. 3434, ch. 2; the last two rows: reg. 3431 pp.41–43 and law art. 24):

• Payment services provided: incl. number of users, agents and sub-agents and their addresses.
• Tests and risks: tests performed; threats to continuity, risks found, their assessment and mitigation.
• New name or address: application to re-issue the license within 5 working days of re-registration; re-issue within 5 working days, free.

Conduct rules in the payments law apply to every payment service provider. Among them:

• provide services only on the user's instruction and never change its details;
• tell the user the commission before the service;
• do not deduct the commission from the payment amount unless the payee's contract with its provider allows it;
• give a confirming document after each service;
• keep data identifying the payer and payee for at least five years;
• carry out customer due diligence under the AML/CFT law;
• keep payment information confidential (art. 17);
• remedy violations affecting the continuity of the payment system or information security within three months of the Central Bank's first instruction (art. 17).

The contract with users — often a public offer — must cover the matters listed in art. 16, and you may not raise commissions unilaterally above those agreed (except for international payments, with notice). When providing information about your activity you must state your license number (art. 15).

Agents. You may work through payment agents and sub-agents. You keep a register of them, control their compliance, report on them to the Central Bank, and are jointly liable with them to users (art. 19).

AML/CFT. A payment organization is subject to its own AML/CFT internal-control rules (reg. 3266) as well as the general AML/CFT law. If you need to build that framework, see our AML/CFT compliance service and the AML/CFT guide.

Inspections. The Central Bank may inspect a payment organization no more than once a year (an extraordinary inspection is allowed if the continuity of a significant payment system is disrupted), for no more than 30 calendar days (law art. 29; reg. 3434 p.19, p.23). It may also supervise remotely, including through control payments as a mystery client (reg. 3434 p.16). You may file objections to an inspection act within 3 working days (p.29).

Sanctions and revocation

The ladder. If a violation does not directly affect the continuity of the payment system, the Central Bank first notifies your management in writing, with at least 10 working days to fix it, and sends recommendations (law art. 30; reg. 3434 p.33). If it does affect continuity, it issues a binding instruction, again with at least 10 working days.

If you fail to carry out an instruction, or breach AML/CFT/CPF legislation, it applies one of these sanctions (law art. 30; reg. 3434 p.35):

• a fine of up to 5 000 BRV;
• a restriction of certain services or operations for up to 6 months;
• suspension of the license for up to 10 working days. The Central Bank then tells payment system operators to disconnect you (reg. 3434 p.37), and must give you at least 5 working days to remove the cause (reg. 3431 p.46).

Revocation is possible only on the grounds listed in the law (art. 25); revocation on any other ground is not allowed:

• your own application;
• liquidation, or reorganization other than transformation (or a merger into an entity that holds the same license);
• not operating within one year of receiving the license, or suspending activity for more than six months;
• systematic or a single gross violation of the payments law;
• the licensing decision is found unlawful.

The licensing regulation adds one more case: violations affecting the continuity of the payment system or information security and cybersecurity that are not remedied within three months of the Central Bank's first instruction (reg. 3431 p.49). The law itself requires such violations to be remedied within that period (art. 17).

What “systematic” and “gross” mean (reg. 3434 p.38). Three or more violations of the payments law within a year are systematic. A single violation is gross if you:

• make, or create conditions for, unauthorized payments, including payments for goods and services whose sale is prohibited;
• repeat, within five years, an AML/CFT/CPF violation for which the Central Bank has already applied measures;
• fail to restore your operations fully within 12 hours after an unforeseen emergency;
• fail to keep payer and payee identification data for five years;
• breach the license requirements on shareholders, charter capital, or technical, security and continuity standards.

After revocation you must stop providing payment services and, within a month, remove the words “payment organization” from your name. The decision can be challenged in court; if the court finds the revocation unjustified, the Central Bank is liable for the damage (law art. 25).

The numbers

Common mistakes

This section is practice, not law.

• Planning on 10 billion UZS. Older summaries quote the 2024 figure. Since 1 July 2025 it is 20 billion.
• Funding the capital with a shareholder loan routed through the company. The regulation bars borrowed and pledged money; the Central Bank looks at the source of funds behind every contribution (reg. 3431 p.11, p.16).
• Using a fresh SPV as the shareholder. A corporate shareholder needs one year of operation. A new holding company will not pass p.10 on its own.
• A foreign majority without the €20 million test. If your foreign parent is not a regulated financial firm, foreign non-resident ownership stops at 50%.
• An LLC. The form must be a joint-stock company.
• Treating the AML/CFT and security documents as boilerplate. They are part of the license conditions, and a later breach of the security requirements is a gross violation.
• Launching late. If you do not start operating within a year of the license, the Central Bank may revoke it. “Operating” means tests completed and services open to unrestricted use.
• Adding a service you did not describe in the file. Providing payment services not covered by the license documents is one of the violations listed in reg. 3434 p.36.

Checklist

• Map your product against the nine services in art. 14 and confirm you need none of the three that art. 15 excludes for payment organizations.
• Choose the shareholding: check the 50% cap, the €20 million test and the one-year track record.
• Run the reputation test on every owner and executive, including their foreign history.
• Incorporate a joint-stock company; pay in 20 billion UZS in cash from shareholders' own funds, and keep it on a bank account.
• Sign an owned or ≥ 3-year lease on premises; contract a data center meeting Oʻz DSt 2875:2014; sign the acquiring bank contract.
• Build the file: business plan, risk management (incl. client money), security policy, AML/CFT measures, interaction procedure with the payment system.
• Prepare and submit the business continuity and backup plans.
• Pay the review fee and file; answer any cure notice within its deadline.
• After the license: set up daily automatic reporting, the monthly (5th) and yearly (1 April) returns, the 3-working-day incident reports and a 12-hour recovery plan.

Sources: Law No. ZRU-578 of 1 November 2019 “On Payments and Payment Systems” (arts. 14–19, 24–25, 27, 29–30); Central Bank Regulation on licensing payment system operators and payment organizations, reg. No. 3431 (resolution No. 8/3 of 18 April 2023, as amended to 4 June 2026); Central Bank Regulation on control and oversight of payment system operators and payment organizations, reg. No. 3434 (resolution No. 8/4 of 18 April 2023). Checked 6 October 2026.

Checked against the law in Lex on 6 October 2026 · Juris Advisory