Payment licences in Uzbekistan: capital, documents and rules

A payment organization provides authorized payment services, while an operator runs a payment system. Both require a Central Bank licence (Art. 21 of Law No. ZRU-578), the legal form of a joint-stock company and capital of UZS 20 billion or UZS 50 billion; these requirements were introduced by Resolution No. PP-381 of 30 November 2023.

In brief:

• a payment organization services user payments, while an operator sets the system rules and provides its infrastructure
• minimum capital is UZS 20 billion for a payment organization and UZS 50 billion for an operator
• the Central Bank decides within 30 days (Art. 22 of Law No. ZRU-578) after receiving a complete application
• application review costs 220.000 soums, and the state duty for issuing a licence is 2.200.000 soums
• before applying, the company needs a two-year business plan, an operational payment model, risk management, AML controls and an information security system

Updated: 05 September 2026

Business models and capital

What a payment organization does and how an operator differs

A payment organization works with users and payment transactions, while an operator creates the rules and technical environment in which the participants interact. The law defines a payment organization as a non-bank legal entity (Art. 4 of Law No. ZRU-578) entitled to provide payment services. An operator is a legal entity that ensures operation of the system (Art. 7 of Law No. ZRU-578).

A payment system brings together the operator, participating banks and payment organizations; its participants are settlement banks (Art. 5 of Law No. ZRU-578). The law identifies five groups (Art. 13 of Law No. ZRU-578) as payment service providers: the Central Bank, banks, payment organizations, payment agents and payment subagents.

The complete list of payment services includes:

1. accepting and making payments through a bank account;
2. accepting cash for crediting to bank accounts, including accounts of third parties;
3. accepting cash for a payment without opening an account for the payer;
4. issuing and redeeming electronic money;
5. issuing bank cards;
6. distributing electronic money and bank cards;
7. accepting and processing electronic-money payments;
8. electronically processing a payment and sending the information to a bank;
9. accepting and transferring funds through money-transfer systems.

The law establishes these nine types of services (Art. 14 of Law No. ZRU-578), but any particular provider may perform only part of the list. A payment organization may not accept cash (Art. 15 of Law No. ZRU-578) for crediting to bank accounts, issue electronic money or issue bank cards. Those three services are reserved for banks and the Central Bank within their respective powers.

What legal form and capital are required

An ordinary commercial company entering this business must be a joint-stock company. The requirement has applied since 1 July 2024; from the same date an operator's minimum capital has been UZS 50 billion, while the minimum for a payment organization has been UZS 20 billion since 1 July 2025.

Members of the executive body must have higher education and at least two years of experience (Art. 27 of Law No. ZRU-578) in banking and finance or information and communications technology, and their business reputation must meet the statutory requirement. They must also be able to manage risk and make decisions within their authority. If they do not meet the requirements, the Central Bank may order their replacement; the order may be challenged in court.

These are the sector-specific conditions for a payments business. For incorporating the joint-stock company itself, obtaining a taxpayer number, opening an account and arranging an electronic signature, see the general business registration procedure. Those steps come before filing the licensing package with the Central Bank.

Licensing documents and procedure

How to obtain a payment licence

The applicant files an application and the sector-specific package with the Central Bank. The operator simultaneously seeks approval of the payment system rules; a payment organization submits its procedure for interacting with the operator and participants. After a positive decision, the Central Bank enters the company in the relevant register.

The decision is made within 30 days (Art. 24 of Law No. ZRU-578) from receipt of all documents, and notice is sent within three business days. If a refusal is based on remediable grounds, the applicant receives up to two months to refile; the repeated application is reviewed within ten days without another review charge.

The cost consists of two payments. The Central Bank charges 50% of one BRV, the base calculation unit, to review the application, which is [220.000 soums]. After a positive decision, the applicant pays the state duty for issuing the licence; for either an operator or a payment organization it is [2.200.000 soums].

Example. If a company files one application and receives one licence, the review charge is 220.000 soums and the state duty is 2.200.000 soums. Total mandatory licensing payments are 2.420.000 soums. Charter capital is outside this calculation: it is the company's own capital, not a payment to the state.

General business licensing rules do not replace the Central Bank's special procedure. The article on licences and permits explains the distinction between a licence, permit and notification; the timelines, documents and refusal grounds for a payment organization or operator come from the sector law and Central Bank regulations.

What documents the Central Bank requires

The packages are similar, but an operator must additionally describe the payment system itself and its settlement model. The documents must allow the Central Bank to assess the business, owners, governance, resilience, AML processes and technical protection.

The non-bank operator list is set out in Article 22 of Law No. ZRU-578, and the list for a payment organization is in Article 24. A bank establishing a payment system submits a shorter set: the management board's decision, a two-year business plan and the system rules.

The refusal grounds form a closed list: improper preparation of documents, inaccurate or distorted information, or failure to meet the licensing requirements. The notice must state the reasons. Operations may begin only after the licence has been issued, and an operator also needs approval of its rules.

What rules and risk system an operator prepares

The payment system rules are the operator's central operating document. They must fully describe:

• the payment procedure, message formats and operating schedule;
• the operator's services and transactions within the system;
• participation conditions and interaction with participants;
• withdrawal of a payment order;
• handling a participant's insolvency;
• information security and cybersecurity;
• measures against a participant that breaches the rules.

This is the mandatory content of the system rules (Art. 8 of Law No. ZRU-578). A bank may not be restricted from participating in other systems. The rules and tariffs are published on the operator's website within three business days after approval and take effect 15 days later. The Central Bank must be notified of changes to rules or tariffs no later than 15 business days before they take effect.

A separate risk-management system must provide for identifying, monitoring and managing risks, business continuity and a recovery plan. The law permits liability limits, a guarantee fund held in a separate bank deposit, an order queue, intraday settlement, settlement within deposited funds and access to credit. The particular combination depends on the system model; this set of methods (Art. 9 of Law No. ZRU-578) does not remove the need to substantiate the risks.

A payment system is significant if its failure creates market risk and it meets Central Bank criteria based on market share or annual payment volume. Those significance criteria (Art. 6 of Law No. ZRU-578) trigger additional duties. The operator creates a risk-management body, uses at least two methods, publishes an annual operational analysis no later than the first quarter and conducts a self-assessment every three years (Art. 11 of Law No. ZRU-578). The results go to the Central Bank and are published within three business days; the separate provision (Art. 10 of Law No. ZRU-578) contains the full set of duties for a significant operator.

A payment becomes final when funds are credited to the receiving participant. An order sent before receipt of a decision to block the account or attach the funds remains irrevocable and final (Art. 12 of Law No. ZRU-578).

The user agreement must cover services, duration, fees, information, protection from unauthorized payments, refusal grounds, termination, claims, disputes and compensation for loss. This mandatory agreement content (Art. 16 of Law No. ZRU-578) must be aligned with how the product actually works before launch.

Electronic money, agents and security

May a payment organization issue electronic money

No. A payment organization cannot be an electronic-money issuer. The law recognizes only the Central Bank and banks (Art. 40 of Law No. ZRU-578) as issuers; electronic money issued in Uzbekistan is denominated only in the national currency.

A payment organization or another legal entity with the appropriate licence may nevertheless become an electronic-money system operator. The operator runs the system under an agreement with an issuing bank, may enter into agreements with holders and agents on the bank's behalf, and is jointly responsible with the issuer for loss caused by unauthorized access, errors or failures. This operator model (Art. 41 of Law No. ZRU-578) does not transfer the right of issuance.

Limits apply to individual transactions: an identified holder may make a single transaction of up to [44.000.000 soums], an unidentified holder up to [440.000 soums], and no more than [2.200.000 soums] may be stored without identification. These electronic-money limits (Art. 43 of Law No. ZRU-578) must be built into the product, monitoring and identification process.

How to work through payment agents and subagents

A payment organization may engage agents, and an agent may engage subagents. The service is supplied on behalf of a bank or payment organization, the user receives a confirming document, and the location address, details of the principal and intermediary, licence number and remuneration are disclosed in advance. The full agency procedure (Art. 19 of Law No. ZRU-578) requires a register of agents and subagents, reporting the information to the Central Bank and controlling the agreements. The principal is jointly liable to the user with the agent and subagent.

A payment organization may not conduct business unrelated to payment services. The law makes exceptions for advertising, marketing, consulting and information services; software development and support; ICT, data and database processing; systems and network security; cryptographic protection; postal services; and microfinance. This closed list of exceptions (Art. 18 of Law No. ZRU-578) does not replace a separate licence where the additional activity requires one.

Microfinance requires registration with the Central Bank (Art. 11 of Law No. ZRU-765) in addition to a payment licence. The company then becomes subject to the rules for microfinance organizations concerning formation, participants, registration, prudential standards, supervision and client protection.

What security and internal-control requirements apply

Operational AML processes, information protection, access management and incident response must be in place before launch. A provider performs customer due diligence and identification, includes mandatory payer and recipient details in the payment document, and retains identification information for at least five years (Art. 17 of Law No. ZRU-578).

The operator and provider protect payment data during its creation, processing, transmission and storage. This requires separation of authority, protection of networks, servers and channels, access monitoring, incident detection, response and root-cause analysis. The law separately requires multifactor authentication, a protected channel, event logs and encryption using licensed tools; the entire protection framework (Art. 53 of Law No. ZRU-578) must correspond to the product architecture.

A security status report must be filed annually with the Central Bank by 1 April (Art. 55 of Law No. ZRU-578). A detected information-security or cybersecurity breach must be promptly reported to the Central Bank (Art. 57 of Law No. ZRU-578), together with measures taken to mitigate its consequences.

The operator and provider are responsible for compliance with the protection requirements. The user bears the risk of loss if an unauthorized payment results from the user's fraud or failure to protect identifiers; this allocation of responsibility (Art. 56 of Law No. ZRU-578) must be accurately reflected in the agreement and customer instructions.

Reporting, supervision and closure

What and when to report to the Central Bank

Notifications and reporting form part of the licensing regime and apply whether or not an inspection is under way. The main deadlines are collected below.

The Central Bank may request information, including personal data, establish reporting forms and deadlines, and analyze the reports. These supervisory powers (Art. 28 of Law No. ZRU-578) mean that register data, agreements, logs, reports and the information system's actual operation must be consistent.

How inspections work and what sanctions the Central Bank may impose

A scheduled inspection may take place no more than once a year; an unscheduled inspection may follow a disruption to uninterrupted operation of a significant system. An inspection may be thematic or comprehensive and lasts no more than 30 days (Art. 29 of Law No. ZRU-578). Central Bank representatives receive documents and explanations, visit operating locations and gain access to information systems other than program source code.

If a breach does not directly affect continuity, the Central Bank notifies the governing bodies and allows at least ten business days for remediation. If it has a negative effect, the Central Bank issues an order with the same minimum period. For failing to comply with an order or breaching AML law, the Central Bank may select one sanction: a fine of up to 2.200.000.000 soums (Art. 30 of Law No. ZRU-578), restriction of particular services or transactions for up to six months, or suspension of the licence for up to ten business days.

Separate liability is owed to the payer. For delaying a payment, the provider pays 0.1% per day (Art. 58 of Law No. ZRU-578), capped at 10% of the delayed payment. The same formula applies if an erroneous payment caused by the provider is not corrected by the next business day.

Example. A payment of UZS 100,000,000 is delayed for 12 days. The penalty is UZS 100,000,000 × 0.1% × 12 = UZS 1,200,000. This is below the UZS 10,000,000 cap, so the limit does not reduce the result.

How to reorganize or cease the business

A payment organization is reorganized by decision of its shareholders with notice to the Central Bank. The filing contains the conditions, form, procedure and timeline of the reorganization, a financial forecast, audit report, two-year business plan for the new organization and the procedure for its interaction with participants. The Central Bank may issue recommendations within 15 business days (Art. 26 of Law No. ZRU-578). After filing the information, the organization publishes notice in the media and on its website within 15 calendar days; the resulting company must obtain a new licence.

For voluntary cessation, an operator applies to have its licence withdrawn. A liquidation requires the decision and reasons, a plan for satisfying obligations to participants and creditors, a balance sheet showing the availability of funds, and information about the liquidator. This operator package (Art. 23 of Law No. ZRU-578) must show how transactions and settlements will be completed.

After withdrawal, a payment organization stops providing services, returns the licence within ten days and removes the words “payment organization” from its name within one month. The Central Bank publishes the decision within one day; these consequences of withdrawal (Art. 25 of Law No. ZRU-578) apply from the date of the decision. Withdrawal may be challenged in court.

Taxes, changes and application checks

What tax and additional regimes to consider

A payment licence does not determine the entire tax treatment. VAT exemption applies to financial services of payment systems (Art. 244 of the Tax Code) connected with transactions and simultaneous allocation of commission among payment participants. Turnover from other services and fixed remuneration must be classified separately under the Tax Code.

Until 31 December 2030, a special regime applies to payment-organization digital platforms serving individual entrepreneurs and self-employed persons. It covers registration, automatic tax calculation, documents, wallets, accounts, settlements and reporting; the full set of platform functions is established by Resolution No. PP-247 of 12 August 2025. For income of up to UZS 1 billion through such a platform, the payment organization is a tax agent (Art. 465 of the Tax Code). From 1 January 2026, it is also responsible for preparing reports and paying tax under the regime.

From 1 April 2026, payment organizations and payment system operators do not receive technology-park benefits, including the IT Park regime. This restriction concerns tax and customs incentives, not the ability to develop software as an authorized additional line of business.

This article does not calculate tax for every transaction. The general regime and reporting deadlines are covered in the article on turnover tax, while status conditions and benefits are covered in the IT Park article. Those materials are relevant when building the financial model but do not replace the sector licence.

What changed in 2025–2026

• Resolution No. PP-359 of 27 November 2025 allowed the Digital Government Project Management Center to process payments for public services as a payment organization without being a joint-stock company or meeting minimum capital. This is a specific exception for the named state institution.
• Resolution No. PP-388 of 26 December 2025 removed technology-park tax and customs benefits for payment organizations and operators from 1 April 2026.
• The regulation registered as No. 3759 on 21 January 2026 introduced, from 22 April 2026, minimum information-security and cybersecurity requirements and antifraud measures for remote financial services provided to individuals.
• The rules registered as No. 3817 on 15 April 2026 introduced a unified QR code from 16 April 2026: a payment organization may participate as an acquiring bank's agent and as a payment initiator.

What to check before filing the application

Before filing, the applicant should check both the documents and the business's practical readiness to operate under the stated model.

1. A joint-stock company has been incorporated, and its capital corresponds to the chosen role: payment organization or operator.
2. The managers can evidence their education, relevant experience and business reputation.
3. The two-year business plan matches the financial model, types of services and agreements with banks.
4. The operator has system rules and the settlement bank's consent; the payment organization has its procedure for interaction with the operator and participants.
5. The security policy covers architecture, access, antifraud controls, personal data, logs and incident response.
6. AML processes work in practice: identification, due diligence, monitoring, record retention and action on a suspicious transaction.
7. The compliance calendar covers agent registers, data changes, the security report, publication of rules and notices to the Central Bank.
8. Additional activities—microfinance, cryptography or another licensed business—have their own legal basis.

Frequently asked questions

How does a payment organization differ from a payment system operator?

A payment organization directly provides authorized payment services to users. An operator creates and maintains a payment system: it sets the rules, contracts with participants, processes messages or clearing, and ensures infrastructure, continuity and security. These are different licensed roles. A company should not treat a payment-organization licence as automatic authorization to act as an operator, or vice versa.

Can a payment organization be formed as an LLC?

As a general rule, no. Since 1 July 2024, payment organizations and payment system operators must be formed and operate as joint-stock companies. Resolution No. PP-359 made a separate exception for the state Digital Government Project Management Center when it processes payments for public services. That targeted exception does not extend to private applicants.

May a payment organization issue electronic money?

No. Electronic money may be issued by the Central Bank and banks. A payment organization may participate in a different role: with the appropriate licence, it may run an electronic-money system, act under an agreement with the issuing bank, conclude agreements on its behalf and organize transactions within the system. The right to issue electronic money does not pass to the operator.

How long does the application take and what does the licence cost?

The Central Bank decides within 30 days after receiving the complete package and sends notice within three business days. Application review costs 220.000 soums, and the state duty for one licence is 2.200.000 soums. If remediable reasons caused a refusal, the documents may be refiled within the specified period of up to two months; repeated review takes ten days and carries no separate charge.

Can payment services and microfinance be combined?

Yes, but Central Bank registration is required in addition to a payment licence. The payment organization must register as an organization carrying on microfinance activities. Once registered, it becomes subject to special requirements concerning participants, activities, prudential standards, supervision and client protection. Withdrawal of the payment licence also affects the company's entry in the microfinance register.