Uzbekistan Bans Linking Third-Party Bank Cards to Payment Applications

Tashkent, Uzbekistan (UzDaily.com) — Uzbekistan has introduced new requirements for the use of payment services, including Click, Paynet, and other mobile applications. The changes are aimed at strengthening cybersecurity and preventing fraud.

The Ministry of Justice, together with the Central Bank, has registered a Regulation on minimum requirements for ensuring information security and preventing fraudulent transactions in the remote provision of financial services to individuals. The document was registered on 21 January 2026, under No. 3759.

Under the new rules, only a bank account, bank card, or electronic wallet belonging to the user or the user’s close relatives may be linked to a user account. P2P transfers through such an account are permitted exclusively within these limits.

When registering and linking a bank card in a mobile application, a mandatory verification is carried out to ensure that the phone number corresponds to the individual’s personal identification number. If a discrepancy is detected, user registration and card linking are not permitted.

Credit and payment organizations are required to conduct biometric user identification using “liveness” factors, which eliminates the possibility of identity verification through photographs or other static images.

To enhance protection, the regulation stipulates that after three consecutive incorrect entries of a one-time SMS code, user actions in the mobile application are temporarily blocked for 15 minutes. In addition, when logging in from a new device or recovering a password, all previously linked bank cards are automatically removed from the application.

At the same time, the transaction history related to bank cards is deleted from the device. Re-linking bank cards is allowed only after the user undergoes biometric identification again.