Signing documents with a digital signature has become routine for every company in Kazakhstan: invoices in the e-invoicing system (IS ESF), tax reports in the Taxpayer's Cabinet, contracts, acts of completed work, HR orders and tender bids. In September 2026 new rules for issuing and revoking certificates of the National Certification Authority (NCA RK) came into force, and the Digital Code explicitly prohibits handing a private key to anyone else. Yet in most offices digital signature document signing still looks exactly as it did five years ago: one director, one USB token, one computer with NCALayer and a queue of documents waiting for a signature. Hours are lost every week, and sometimes everything stops because of the message "connection to NCALayer was interrupted".
At West Star Ltd we work on 1C integration, electronic signatures and process automation for companies in Kazakhstan. Over the past year clients have kept bringing us the same question: can the electronic signature stop being a bottleneck without breaking the law? It can. But first you need to understand where the time actually goes and what you are allowed to automate.
Where time is lost in digital signature document signing
The signature itself takes seconds. The time goes into everything around it. An accountant prepares a batch of acts in 1C, exports the files and forwards them to the director in a messenger. The director is travelling, and the key is in the office safe. When the director gets back, NCALayer refuses to start after a browser update, and half a day disappears into reinstalling it. In our experience, for a company issuing several hundred invoices a month, manual signing consumed 15–20 hours a month of accounting and management time combined, and almost all of it was waiting and switching between windows.
The second source of loss is mistakes. A document is signed with the wrong key: the authentication key instead of the signing key, or a personal key instead of an employee-of-organisation key. The draft is signed instead of the final version. Nobody checked the certificate expiry date, and it ran out on the day the report was due. Every such mistake means resending, calls to the counterparty and sometimes a late-filing penalty.
The third source is grey workarounds. To avoid waiting for the director, the key and its password are handed to an accountant or manager. That is convenient until an audit. Since 2025, Article 640 of the Administrative Code of Kazakhstan penalises both handing over a key and using someone else's: for large businesses the fine is 200 MCI, or 865,000 tenge at the 2026 monthly calculation index of 4,325 tenge. The tax authorities can notice, for example, that reports of different companies are filed from the same IP address. That alone is not proof, but it is a reason to ask questions.
The correct setup exists and is provided for by NCA rules: the "employee with signing authority" certificate. The company issues a key to a specific employee, who signs documents on behalf of the organisation within the granted authority. This is where lawful automation begins: everyone who signs must have their own key.
Three levels of e-signature automation
We split electronic signature automation into three levels. They can be introduced one after another, and each already pays off.
Level one: order at the workstations. It sounds dull, but it is half the job. Build a register of every key in the company: whose key it is, what type, where it is stored and when it expires. Set reminders 30 and 7 days before expiry. Update NCALayer only from the official NCA RK website (pki.gov.kz) and keep a single current version on each computer. If 1C runs over remote desktop, configure NCALayer to start on different ports: by default it listens on port 13579, and RDP sessions can use a range up to 13679. Most errors like "connection to NCALayer was interrupted" come down to port conflicts, an outdated version or an antivirus blocking the local connection. We collected a detailed breakdown in our article on why NCALayer is not working and how to fix it.
Level two: batch signing from the accounting system. Instead of exporting files and signing them one by one, the document is signed right where it was created. In 1C this works through built-in NCALayer support: the accountant selects a list of acts or invoices, clicks one button, enters the password once and the system signs the whole batch. Web applications follow the same principle: the page talks to NCALayer on the user's computer over a secure local connection, receives a signature in CMS or XML format and stores it with the document. The key point is that the key never leaves the employee's computer; the system only passes data to it and collects the result. In our experience, batch signing cuts the time for a hundred documents from an hour to a few minutes.
Level three: approval routes and signing from a smartphone. The document moves along the chain by itself: the accountant prepares it, the lawyer approves it, the manager signs it. The manager gets a notification in Telegram or by email, opens the document and signs it with a QR code in eGov Mobile or with a cloud signature, with no token and no trip to the office. Several Kazakhstani providers already offer cloud signatures for legal entities, and QR signing through eGov Mobile connects to external systems via Smart Bridge. Bear in mind that getting the connection approved can take time. Such a route is almost always built around an electronic document management system, where signing becomes just one of the steps.
Server-side signing deserves a separate note. Technically, you can install the NCA cryptographic library on a server and sign documents automatically without human involvement, for example sending hundreds of e-invoices overnight. We build such solutions, but only under three conditions. First, the key is issued to a specific responsible employee. Second, that employee explicitly confirms the launch of every batch. Third, every operation is logged. Fully "unattended" signing with someone else's key is the same as handing over the key, just in software form.
Here is an example. A distributor with two warehouses issued about 600 e-invoices a month. The old routine: the accountant generated invoices in 1C, exported them and signed them one by one in IS ESF with the director's key, which was kept "just in case" on the accountant's computer together with the password. We suggested starting with authority, not technology. The chief accountant received their own employee certificate with signing authority, and the director's key went back to its owner. Then we set up batch submission of e-invoices from 1C: at the end of the day the accountant selects a list, enters their own key password once and sees the status of every document in a log. The manager now signs contracts with new clients via QR on a smartphone after a Telegram notification. Two months later, invoice work had dropped from roughly 12 hours a month to 2, and the risk of a fine for using someone else's key was gone entirely.
Note that the hardest part of this project was not the code but agreeing inside the company on who signs what. The integration took about three weeks; the discussion of authority and internal rules took almost as long. That is normal. When signing has depended on one person for years, changing the habit is harder than writing a 1C module.
If you are planning a similar integration, start with an audit: which documents are signed, in which systems, by whom and how often. Our e-signature and NCALayer service for business starts with exactly this kind of process map.
Limitations and risks
Digital signature automation is not a magic button. Here is what we tell clients honestly before any work begins.
- The law beats convenience. No system should store the password to someone else's key or sign "for the director" without the director's involvement. If a setup requires handing over a key, it should be rebuilt, not hidden.
- Dependence on external services. NCALayer, NCA OCSP services for checking certificate status, eGov Mobile and government portals are sometimes unavailable or change their protocols. After updates such as NCA's move to a new cryptographic standard in 2024, integrations had to be reworked. Budget for ongoing support.
- Certificates can be revoked. Under the new rules the NCA may, in certain cases, revoke a certificate without an application from its owner. The system should check key status before signing instead of hearing about the problem from a counterparty.
- Passwords cannot be recovered. The certification authority does not store passwords. A lost password means reissuing the key, and if the certificate has already expired, obtaining a new one from scratch.
- Not every counterparty is ready. Some partners still ask for a paper original or a signature in their own system. Automation reduces internal work but does not change other companies' processes.
- Workstation security. If a workstation is infected, automation only speeds up the damage. A separate user account, updates and a protected key storage device are mandatory.
What specialists, managers and owners should do
Accountants and lawyers should start with an inventory: list every key and every type of document that goes through signing, and note where each is created. At this step it usually becomes clear that 70–80% of documents originate in 1C and can be batch-signed right from there.
Managers need their own working key plus signing-authority keys for employees, and then stop being the single point of signature. Distribute authority: the chief accountant signs acts and invoices with their own key, you sign contracts, HR signs personnel documents. Digital signature document signing from a smartphone via QR removes the dependence on the office and the token.
Owners should look at the topic as risk management. A fine for someone else's signature is the smallest problem. Far worse is when a former employee leaves with the password to the director's key, and a month later something is signed on the company's behalf that nobody approved. A properly built setup with personal keys, an operations log and approval routes costs less than a single incident like that.
The electronic signature was meant to speed business up. If it slows your company down, the problem is almost never the signature itself, but the process built around it.
FAQ
Can digital signature document signing be legally automated without the director?
Yes, if documents are signed not by the director but by an employee holding their own "employee with signing authority" certificate issued for the organisation. You can automate preparation, batch submission and document routing, but the key must belong to the person signing and be used under their control.
What should I do when I see "connection to NCALayer was interrupted"?
Restart NCALayer, make sure the current version from the NCA RK website is installed, and check that an antivirus or another process is not occupying port 13579. When working over remote desktop, configure separate ports for separate sessions. If the error keeps coming back, reinstall the program completely and check its log.
How much time does batch signing save?
In our practice, signing a hundred acts or invoices drops from about an hour to a few minutes. Most of the savings come not from the signature itself but from eliminating file exports, forwarding and waiting for the manager.
Is a cloud signature suitable for legal entities?
Yes, Kazakhstani providers already offer cloud signatures for organisations, and they are convenient for signing from a smartphone. Before adopting one, check whether the systems you work with support it and how it fits into your accounting and document flow.