Return to the home page of TheLink.kzKazakhstan Communication Services Rules

Fines for Wi-Fi without authorization in Kazakhstan: what the law actually says

Updated: September 2026 · Reference material, not legal advice — see the disclaimer at the end

In short

In Kazakhstan the owner of a public internet access point must identify the user before granting access. The requirement sits in the Communication Services Rules; the wording in force since 12 July 2026 allows two methods: a subscriber number with a one-time SMS password, and authorization through the eGov portal with a digital signature. It applies to cafes, restaurants, hotels, shopping and business centres, coworkings and waiting areas. Liability for breaches of communications law sits in Article 637 of the Administrative Offences Code, although the special provision on public access points was repealed in 2017 — details below.

Diagram: the guest connects, the router shows the portal, the guest confirms identity, the session is logged and access opens — Four steps between the guest and the internet

If inspectors or a data request arrive

A sequence that saves time and nerves. It works the same for an administrative inspection and for a request for connection data.

1Do not switch the guest network off: a disabled Wi-Fi does not answer questions about how it used to work
2Record who came and on what basis: the body, the document, the subject of the inspection or request
3Show how identification is organised: the captive portal, how the number is confirmed, the session log
4Answer a written request in writing and within the stated deadline, attaching the connection log for the period
5If identification was not in place at the time, switch it on immediately: it closes the question going forward and shows good faith

Set up in a day; the hardware usually stays as it is

What the law says

The duty to identify users at public internet access points is set out in the Communication Services Rules approved by Order No. 171 of 24 February 2015. The authorization methods were revised twice in a row: by the order of 17 September 2025 (effective 4 October 2025) and by Order No. 322/НҚ of 17 June 2026 (effective 12 July 2026), which rewrote clauses 110–112. The governing industry act remains the Law on Communications of 5 July 2004. The rules have been re-approved several times, so it is worth checking the current wording on the official portal adilet.zan.kz.

What changed on 12 July 2026

Order No. 322/НҚ rewrote clauses 110–112 of the rules. Two ways to connect a guest remain: the "automatic operator system" added in the 2025 wording is gone from the list. An anonymous "password on the wall" still fits none of them.

A subscriber number in the "Login" field and a one-time password received over SMS
Authorization through the eGov portal using a qualified digital signature
Where there is no mobile coverage — access against an identity document, with an electronic user log (clause 115)

Liability: what the Administrative Offences Code says

Liability for breaching Kazakhstan communications law sits in Article 637 of the Administrative Offences Code. The scale below is from part one of that article; treat it as a way to size the risk, not as a ready-made classification of your case.

Category	Fine in MCI	≈ KZT in 2026*
Individual	10	≈ 43 250 ₸
Small business / officials	20	≈ 86 500 ₸
Medium business	40	≈ 173 000 ₸
Large business	100	≈ 432 500 ₸

* Calculated at the 2026 MCI of 4,325 KZT. The MCI is set annually by the state budget law — check the current figure when calculating.

Is the provision everyone cites still in force?

An important detail missing from most write-ups. Subclause 9-1 of clause 1 of Article 637, which expressly covered breaches of the rules on providing internet access at public access points, was repealed by Law No. 128-VI of 28 December 2017. Material from 2016–2017 and a large share of Wi-Fi vendors still cite it as current law — that is incorrect. The identification duty itself remained and was clarified in 2025–2026. Confirm the classification and any amount for your situation with a qualified lawyer.

Primary sources

Links go to the official legal information portal. Check the current wording there rather than in retellings.

Who this applies to

The requirement covers any owner of a public internet access point where guests join a shared network: cafes and restaurants, hotels and guest houses, shopping centres, business centres, coworkings, waiting areas. Organising access is the venue owner’s responsibility, not that of the operator who merely ran a line into the building.

Who inspects and what they can request

State oversight of communications is exercised by the authorised body of the relevant ministry; administrative offence reports are drawn up by authorised officials under Article 804 of the Administrative Offences Code. Separately, bodies conducting operational-search activity, including national security bodies, may request data on connections to your network — for example when an offence was committed through it. In practice the trigger is a complaint, an enquiry or a specific incident rather than a scheduled sweep of venues. For an owner the conclusion is single: the authorization log must exist and be exportable at any moment.

How to meet the requirement without manual work

Formally you can organise identification by hand — have a manager keep a notebook of guest phone numbers. In practice it does not hold: a paper log proves no link between a given session and a given user, eats staff time and collapses on the first busy evening. The TheLink.kz platform handles it automatically:

Guest authorization with a one-time SMS code: the session is tied to the phone number, as the rules require
Branded captive portal instead of a raw router page: a marketing channel instead of a liability risk
Works without hardware replacement in most cases (MikroTik, Keenetic, H3C, Cisco, Aruba, UniFi)
One-time setup, then the system runs in the cloud without administrative effort; servers and guest data stay in Kazakhstan

Frequently asked questions

Is authorizing guest Wi-Fi mandatory for a cafe or hotel in Kazakhstan?

Yes. The Communication Services Rules require the owner of a public internet access point to grant access only after the user has been authorized. A shared password on the wall, or an open network without identification, does not meet that.

Which authorization methods are allowed in 2026?

Since 12 July 2026, two: entering a subscriber number and receiving a one-time password by SMS, and authorization through the eGov portal with a digital signature (clauses 110–112 of the Rules as amended by Order No. 322/НҚ). The "automatic operator system" from the 2025 wording has been removed. The exception is settlements without mobile coverage: there access is granted against an identity document and an electronic log is kept (clause 115).

Is the fine for Wi-Fi without authorization really up to 100 MCI?

That figure is repeated with reference to subclause 9-1 of clause 1 of Article 637 of the Administrative Offences Code, but that subclause was repealed by Law No. 128-VI of 28 December 2017. Liability for communications breaches under Article 637 exists, but the classification and amount for a specific case should be confirmed by a lawyer rather than taken from decade-old articles.

Who can inspect and what can they request?

State oversight of communications is carried out by the authorised body of the relevant ministry. Separately, bodies conducting operational-search activity, including national security bodies, may request data on connections to your network. The usual trigger is a complaint, an enquiry or an incident.

What exactly must a venue owner retain?

Data that links a given session to an identified user: the confirmed subscriber number, session start and end times, and the device network identifiers. The log must be exportable for a requested period.

Do I need to replace routers to comply?

In most cases no. The hardware needs to support a captive portal and work with an external authorization server — MikroTik, Keenetic, TP-Link Omada, UniFi, Cisco, Aruba and other professional lines all do.