A new Presidential Decree (No PQ-153 dated 30 April 2025) aims at bolstering cybersecurity measures in Uzbekistan and targeting cybercrimes across the country. The full text is available here

Is it relevant for your company and business?

The new measures affect a wide range of organizations, primarily banks, payment system operators, payment organizations, as well as potentially any companies working with personal data and conducting electronic transactions.

How can the changes impact your business?

Companies should be aware that regulators may soon exercise broader powers to publicly disclose the identities of institutions that have failed to implement adequate safeguards. This form of “name and shame” could have significant reputational repercussions for businesses if cyber vulnerabilities lead to fraud, data breaches or other incidents of online crime.

The amendments are proposed to strengthen liability for offences committed in the field of information technology. Particularly noteworthy are the proposals to publicize the names of financial institutions that fail to prevent cyberattacks and to introduce tighter obligations on banks to safeguard clients’ funds and data. Additionally, the legislation contemplates further measures to prevent the misappropriation of individuals’ money from bank cards and to enhance mechanisms allowing for the recovery of material damage that arises from cybercrimes. These developments reflect the government’s broader endeavor to protect citizens and businesses from the escalating risks posed by online threats.

These proposals may extend beyond reputational risk by imposing heavier penalties and mandatory compensation for victims of cybercrime. Companies could face increased liability not only for direct losses resulting from data theft or fraud, but also for secondary consequences, such as reputational damage and disruption to consumer confidence. These new measures, while imposing added responsibilities, can also provide businesses with more stable legal frameworks for addressing cyber-risks. Early and thorough compliance can thus minimize legal exposure, fortify operational resilience and strengthen stakeholder and client trust.

1. Strengthening responsibility and coordination. The Ministry of Internal Affairs has been appointed as the authorized body for implementing a unified practice for combating cybercrime and coordinating the interactions of all responsible state bodies.
2. Further compliance obligations. The Ministry of Internal Affairs is instructed to develop by the end of 2025, a draft law “On Combating Crimes Committed Using Information Technologies,” which is expected to introduce further compliance obligations.
3. Liability of “bank drop” holders. Administrative and criminal liability is expected to be introduced for individuals who allowed the use of their bank cards, bank accounts, SIM cards, electronic wallets (electronic accounts) in cybercrimes.
4. Liability for noncompliance with information security and cybersecurity requirements. The liability is expected to be introduced irrespective of the existence of any consequences of such noncompliance (for example, absence of damage).
5. Financial liability of intermediaries. In the event of a cybercrime due to noncompliance with information security requirements, banks, payment organizations and other organizations will be required to compensate affected individuals for the material damage.
6. Naming and shaming. A practice will be introduced for the monthly publication of a list of banks and payment organizations in whose systems the highest number of cybercrimes have been recorded (due to vulnerabilities and deficiencies), which may entail significant reputational risks.
7. Cybercrime prosecution. A new procedure will be introduced requiring an opinion by the State Cybersecurity Center on compliance with cybersecurity requirements during the preliminary investigation and pre-trial investigation of committed cybercrimes.

What actions should you take?

• Conduct a cybersecurity audit: Assess your current security measures and identify vulnerabilities.
• Enhance fraud prevention systems: Implement modern anti-fraud and antivirus protection tools, advanced fraud detection and cybersecurity protocols to prevent unauthorized access to customer funds in line with new requirements.
• Train employees: Ensure staff members are aware of cybersecurity risks and best practices.
• Stay informed: Follow updates on cybersecurity regulations and ensure compliance with new legal requirements.
• Make operational adjustments: Businesses will need to invest in cybersecurity infrastructure, employee training, and compliance measures to avoid penalties.
• Seek legal consultation: Seek professional legal advice to ensure your business is fully compliant with the new regulations.

The introduction of new measures to combat cybercrime in Uzbekistan requires businesses to take a comprehensive approach to information security issues, strengthen internal controls and constantly monitor changes in legislation. Timely compliance with the new requirements will minimize legal and financial risks and strengthen the trust of your clients and partners.

If you have questions about how these changes impact your business, feel free to contact us. We’re here to help you navigate the evolving regulatory landscape.

These recent announcements build on Uzbekistan’s existing cybersecurity legislation, which has been discussed in some detail in our earlier publications: “Uzbekistan: Cybersecurity obligations for companies” (June 2023) and “Uzbekistan adopts Cybersecurity Law” (April 2022).