Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 20 dated February 28, 2022 Approving Requirements for Internal Control Rules to Counter Money Laundering and Terrorist Financing

REPUBLIC OF KAZAKHSTAN NATIONAL BANK REPUBLICAN STATE INSTITUTION		REPUBLICAN STATE INSTITUTION NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN
DECISION OF THE BOARD February 28, 2022 Nur-Sultan city		DECISION OF THE BOARD No. 20 Nur-Sultan city

On Approval of Requirements for Internal Control Rules in Order to Counteract Legalization (Money Laundering) of Income Obtained by Criminal Means and Financing of Terrorism for Legal Entities Carrying Out Activities Exclusively Through Exchange Offices Based on a License of the National Bank of the Republic of Kazakhstan for Foreign Currency Cash Exchange Operations, and Legal Entities Whose Exclusive Activity is Collection of Banknotes, Coins, and Valuables

In accordance with paragraph three of part one of item 3-2 of Article 11 of the Law of the Republic of Kazakhstan "On Countering Legalization (Money Laundering) of Income Obtained by Criminal Means and Financing of Terrorism," the Board of the National Bank of the Republic of Kazakhstan DECIDES:

1. Approve the attached Requirements for Internal Control Rules in order to counteract legalization (money laundering) of income obtained by criminal means and financing of terrorism for legal entities carrying out activities exclusively through exchange offices based on a license of the National Bank of the Republic of Kazakhstan for foreign currency cash exchange operations, and legal entities whose exclusive activity is collection of banknotes, coins, and valuables.

2. Legal entities carrying out activities exclusively through exchange offices based on a license of the National Bank of the Republic of Kazakhstan for foreign currency cash exchange operations, and legal entities whose exclusive activity is collection of banknotes, coins, and valuables, shall bring their internal documentation into compliance with this Decision within three months from the date of entry into force of this Decision.

3. The Department of Cash Circulation (Kajmuratov Zh.T.) shall ensure in the manner established by the legislation of the Republic of Kazakhstan:

1. together with the Legal Department (Kasenov A.S.) state registration of this Decision in the Ministry of Justice of the Republic of Kazakhstan;

2. placement of this Decision on the official Internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3. within ten working days after state registration of this Decision, submission to the Legal Department of information on the execution of the measure provided for in subparagraph 2) of this item.

4. Control over the execution of this Decision shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan Vagapov D.V.

5. This Decision shall enter into force upon expiration of ten calendar days after the day of its first official publication.

Chairman	G. Pirmatov

APPROVED

Agency of the Republic of Kazakhstan for Financial Monitoring

Approved by the Decision of the Board of the National Bank of the Republic of Kazakhstan dated February 28, 2022 No. 20

Requirements for Internal Control Rules in Order to Counteract Legalization (Money Laundering) of Income Obtained by Criminal Means and Financing of Terrorism for Legal Entities Carrying Out Activities Exclusively Through Exchange Offices Based on a License of the National Bank of the Republic of Kazakhstan for Foreign Currency Cash Exchange Operations, and Legal Entities Whose Exclusive Activity is Collection of Banknotes, Coins, and Valuables

Chapter 1. General Provisions

1. These Requirements for Internal Control Rules in order to counteract legalization (money laundering) of income obtained by criminal means and financing of terrorism for legal entities carrying out activities exclusively through exchange offices based on a license of the National Bank of the Republic of Kazakhstan for foreign currency cash exchange operations, and legal entities whose exclusive activity is collection of banknotes, coins, and valuables (hereinafter – Requirements), are developed in accordance with the Law of the Republic of Kazakhstan "On Countering Legalization (Money Laundering) of Income Obtained by Criminal Means and Financing of Terrorism" (hereinafter – AML/CFT Law) and apply to legal entities carrying out activities exclusively through exchange offices based on a license of the National Bank of the Republic of Kazakhstan for foreign currency cash exchange operations, and legal entities whose exclusive activity is collection of banknotes, coins, and valuables (hereinafter – organizations).

2. Unless otherwise provided by the Requirements, the concepts used in the Requirements are used in the meanings specified in the Law on AML/CFT.

For the purposes of the Requirements, the following main concepts are used:

1. unusual operation (transaction) – an operation (transaction) subject to mandatory review in accordance with item 4 of Article 4 of the AML/CFT Law, taking into account signs of a suspicious operation defined by the authorized body conducting financial monitoring and taking other measures to counteract legalization (money laundering) of income obtained by criminal means, financing of terrorism, and financing of proliferation of weapons of mass destruction (hereinafter – authorized body for financial monitoring) in accordance with item 2 of Article 10 of the AML/CFT Law, as well as those developed by the organization independently;

2. beneficial owner – a natural person:
   who directly or indirectly owns more than twenty-five percent of participation shares in the charter capital or issued (excluding preferred and repurchased by the company) shares of the client – a legal entity; exercising control over the client in any other way; in whose interests the client carries out operations with money and/or other property;

3. dedicated communication channel – a method of electronic interaction of the organization by registering on the platform of the authorized body for financial monitoring;

4. one-time operation (transaction) – relations for providing services by the organization in the form of purchase, sale, or exchange by the client of cash foreign currency through an exchange office;

5. risks of legalization (money laundering) of income obtained by criminal means and financing of terrorism – risks of intentional or unintentional involvement of the organization in processes of legalization (money laundering) of income obtained by criminal means and financing of terrorism or other criminal activity;

6. management of risks of legalization (money laundering) of income obtained by criminal means and financing of terrorism – a set of measures taken by the organization to identify, assess, monitor risks of legalization (money laundering) of income obtained by criminal means and financing of terrorism (hereinafter – ML/TF), as well as their minimization (with respect to services, clients, as well as operations carried out by clients);

7. impeccable business reputation – the presence of facts confirming professionalism, integrity, absence of an unexpunged or unpardoned conviction, including absence of a court decision that has entered into legal force applying criminal punishment in the form of deprivation of the right to hold a managerial position in a financial organization, banking and/or insurance holding, and being a major participant (major shareholder) of a financial organization for life;

8. threshold operation – an operation with money and/or other property subject to financial monitoring in accordance with Article 4 of the AML/CFT Law and equal to or exceeding the threshold amount established by the AML/CFT Law;

9. business relations – relations for providing services (products) by the organization to the client based on a contract concluded in writing, except for services for purchase, sale, or exchange by the client of cash foreign currency through an exchange office.

3. Internal control in order to counteract legalization (money laundering) of income obtained by criminal means and financing of terrorism (hereinafter – AML/CFT) is carried out by the organization for the purposes of:

1. ensuring the organization's compliance with the requirements of the Law on AML/CFT;

2. maintaining the effectiveness of the organization's internal control system at a level sufficient for managing ML/TF risks and associated risks (operational, reputational);

3. excluding the involvement of the organization, its officials, and employees in ML/TF processes.

4. Within the framework of organizing internal control for AML/CFT, the organization develops internal control rules, including requirements for conducting by the organization's internal audit service or another body authorized to conduct internal audit, an assessment of the effectiveness of internal control for AML/CFT.

Internal control rules include programs provided for in Article 11 of the AML/CFT Law, which are developed by the organization independently in accordance with the Requirements and are an internal document of the organization or a set of such documents.

Chapter 2. Organization of the Internal AML/CFT System and Program of Organizing Internal Control for AML/CFT

5. In the manner established by the internal documents of the organization, an official responsible for monitoring compliance with internal control rules (hereinafter – responsible employee) is appointed in the organization, as well as employees or a subdivision of the organization whose competence includes AML/CFT issues (hereinafter – AML/CFT subdivision).

6. The Requirements for the responsible employee are:

1. higher education;

2. work experience in financial organizations of not less than two years (excluding experience in technical or auxiliary staff positions);

3. impeccable business reputation.

7. The program of organizing internal control for AML/CFT includes, but is not limited to:

1. description of the functions of the AML/CFT subdivision, including the procedure for interaction with other subdivisions and personnel of the organization, branches in carrying out internal control for AML/CFT, as well as the functions, powers of the responsible employee, the procedure for interaction of the responsible employee with authorized bodies and officials of the organization;

2. information about automated information systems and software used for carrying out internal control for AML/CFT and transmitting messages to the authorized body for financial monitoring via dedicated communication channels, including information about their developers;

3. procedure for recording information, as well as storage of documents and information obtained during the implementation of internal control for AML/CFT, taking into account the possibility of their use as evidence in court, so that they could be timely available to the authorized body for financial monitoring, as well as other state bodies in accordance with their competence;

4. procedure for informing employees of the organization, including the responsible employee, authorized bodies, and officials of the organization about facts of violation of the Law on AML/CFT, as well as internal control rules committed by employees of the organization that have become known to them;

5. description of AML/CFT requirements (if any) established by the legal entity that has control over the organization;

6. procedure for preparation and submission to authorized bodies and officials of the organization of management reporting on the results of the assessment of the effectiveness of internal control for AML/CFT by the organization's internal audit service or another body authorized to conduct internal audit;

7. procedure for making decisions by the responsible employee, authorized bodies, and/or officials of the organization on establishing, continuing, or terminating business relations with clients, on suspending or refusing to carry out client operations in cases provided for by the AML/CFT Law and/or contracts with clients, and in the manner provided for by the internal documents of organizations;

8. procedure for assessing, determining, documenting, and updating the results of the assessment of ML/TF risks.

8. Functions of the responsible employee and employees of the AML/CFT subdivision in accordance with the program of organizing internal control for AML/CFT include, but are not limited to:

1. ensuring the availability of developed and approved by the executive body of the organization internal control rules and/or amendments (additions) to them, as well as monitoring their compliance in the organization;

2. organizing the submission and controlling the submission of messages to the authorized body for financial monitoring in accordance with AML/CFT legislation;

3. ensuring the transmission to the authorized body for financial monitoring of information, data, and documents about clients and about operations carried out by them in accordance with the AML/CFT Law without notifying clients and other persons;

4. making decisions on recognizing client operations as suspicious and the need to send messages to the authorized body for financial monitoring in the manner provided for by the internal documents of the organization;

5. making or agreeing with the authorized body for financial monitoring or an official of the organization decisions on refusal to carry out client operations in cases provided for by the Law on AML/CFT, and in the manner provided for by the internal documents of the organization;

6. sending requests to the executive body of the organization for making a decision on establishing, continuing, or terminating business relations with clients in cases and in the manner provided for by the Law on AML/CFT and/or internal documents of the organization;

7. informing authorized bodies and officials of the organization about identified violations of internal control rules in the manner provided for by the internal documents of the organization;

8. preparation and agreement with the executive body of the organization of information on the results of the implementation of internal control rules and recommended measures for improving risk management systems and internal control for AML/CFT for the formation of reports to authorized bodies of the organization.

9. To perform the assigned functions, the responsible employee and employees of the AML/CFT subdivision are endowed with the following powers, including, but not limited to:

1. obtaining access to all premises of the organization, information systems, telecommunications means, documents, and files, within limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the organization;

2. ensuring confidentiality of information obtained in the course of performing their functions;

3. ensuring the preservation of documents and files received from subdivisions of the organization.

10. If there are employees in the branches of the organization who are fully or partially assigned the functions and powers provided for in items 8 and 9 of the Requirements, coordination of the activities of such employees is carried out by the responsible employee.

11. Functions of the responsible employee, as well as functions of organization employees assigned the functions provided for in item 8 of the Requirements, do not coincide with the functions of the internal audit service or another body authorized to conduct internal audit, as well as functions of subdivisions carrying out operational (current) activity of the organization.

Chapter 3. ML/TF Risk Management Program

12. For the purpose of organizing ML/TF risk management, the organization develops an ML/TF risk management (risk assessment) program.

The ML/TF risk management program includes, but is not limited to:

1. procedure for organizing ML/TF risk management of the organization by its structural subdivisions;

2. methodology for assessing ML/TF risks taking into account main categories of risks (by client type, country risk, and service/product risk) regarding the client's risk level, as well as the degree of exposure of services (products) of the organization to ML/TF risks;

3. procedure for regular monitoring, analysis, and control of client risks and the degree of exposure of products (services) of the organization to ML/TF risks, providing for a list of preventive measures, procedure and deadlines for their implementation, control over results in accordance with adopted measures;

4. procedure for assigning, deadlines, and grounds for reviewing client risk levels.

13. The organization annually assesses the degree of exposure of services (products) of the organization to ML/TF risks, taking into account, at a minimum, the following specific categories of risks: risk by client type, country (geographic) risk, service (product) risk, and/or method of provision thereof.

The assessment of the degree of exposure of services (products) of the organization to ML/TF risks is accompanied by a description of possible measures aimed at minimizing identified risks, including changing procedures for client identification and monitoring of operations, establishing limits on carrying out operations, changing conditions for providing services (products), refusal to provide services (products).

14. Types of clients whose status and/or activity are subject to a high level of ML/TF risk include, but are not limited to:

1. foreigners;

2. public officials, their spouses and close relatives, as well as their representatives;

3. persons located (registered) in foreign states listed in item 16 of these Requirements, as well as branches and representative offices of such persons located in the Republic of Kazakhstan.

15. Types of counterparties whose status and/or activity reduce ML/TF risk include, but are not limited to:

1. National Bank of the Republic of Kazakhstan;

2. second-tier banks – residents of the Republic of Kazakhstan.

16. The organization carries out an assessment of country (geographic) risk associated with providing services (products) to clients from foreign states listed in this item, and carrying out operations with money and/or other property with the participation of such foreign states.

Foreign states, operations with which increase ML/TF risk, are:

1. foreign states (territories) included in the list of states (territories) not fulfilling or insufficiently fulfilling the recommendations of the Financial Action Task Force (FATF), compiled by the authorized body for financial monitoring;

2. foreign states (territories) with respect to which international sanctions (embargoes) adopted by resolutions of the UN Security Council are applied;

3. the following foreign states and/or parts of territories of foreign states characterized as offshore zones:
   United States of America (only in the part of territories of the US Virgin Islands, State of Wyoming, Guam Island, State of Delaware, and Commonwealth of Puerto Rico); Principality of Andorra; State of Antigua and Barbuda; Commonwealth of The Bahamas; State of Barbados; State of Belize; State of Brunei Darussalam; United Republic of Tanzania; Republic of Vanuatu; Republic of Guatemala; State of Grenada; Republic of Djibouti; Commonwealth of Dominica; Dominican Republic; New Zealand (only in the part of territory of the Cook Islands and Niue); Spain (only in the part of territory of the Canary Islands); Federal Islamic Republic of the Comoros; Cooperative Republic of Guyana; Republic of Costa Rica; People's Republic of China (only in the part of territories of the Special Administrative Region of Macau); Republic of Liberia; Lebanese Republic; Principality of Liechtenstein; Islamic Republic of Mauritania; Malaysia (only in the part of territory of the Labuan enclave); Maldives; Republic of Malta; Marianas Islands; Republic of the Marshall Islands; Kingdom of Morocco (only in the part of territory of the city of Tangier); Union of Myanmar; Republic of Nauru; Federative Republic of Nigeria; Netherlands (only in the part of territory of Aruba Island and dependent territories of the Netherlands Antilles); Republic of Palau; Republic of Panama; Portugal (only in the part of territory of Madeira Islands); Independent State of Samoa; Republic of Seychelles; State of Saint Vincent and the Grenadines; Federation of Saint Kitts and Nevis; State of Saint Lucia; Republic of Suriname; Kingdom of Tonga; Republic of Trinidad and Tobago; United Kingdom of Great Britain and Northern Ireland (only in the part of territories of Anguilla Island, Bermuda Islands, British Virgin Islands, Gibraltar, Cayman Islands, Montserrat Island, Turks and Caicos Islands); Sovereign Democratic Republic of Fiji; Republic of the Philippines; French Republic (only in the part of territories of French Guiana and French Polynesia); Republic of Montenegro; Democratic Republic of Sri Lanka; Jamaica;

4. foreign states (territories) determined by the organization as representing a high ML/TF risk based on other factors (information on corruption levels, illegal production, circulation, and/or transit of drugs, information on support for international terrorism, and others).

17. Services (products) of the organization, as well as methods of their provision, subject to high ML/TF risk include, but are not limited to:

1. operations for purchase, sale, exchange of cash foreign currency through exchange offices for an amount exceeding 2,000,000 tenge, or an amount in foreign currency exceeding the equivalent of 2,000,000 tenge;

2. services for collection of banknotes, coins, and valuables provided to legal entities not listed in subparagraph 2) of item 23 of these Requirements.

18. When assessing the degree of exposure of services (products) of the organization to ML/TF risks in accordance with the categories and risk factors specified in items 14, 16, and 17 of the Requirements, the organization takes into account additional information affecting the final degree of risk, including, but not limited to:

1. number of messages sent by the organization to the authorized body for financial monitoring about suspicious client operations;

2. number of messages sent by the organization to the authorized body for financial monitoring about threshold operations of clients with cash money.

19. Within the framework of implementing the ML/TF risk management (risk assessment) program, the organization takes measures to classify clients taking into account the categories and risk factors specified in items 14, 16, and 17 of the Requirements, as well as other categories and risk factors established by the organization.

The risk level of a client (group of clients) is established by the organization based on the analysis of information about the client(s) obtained within the framework of procedures for client identification and monitoring of client operations, and is assessed on a scale for determining the risk level, which cannot consist of less than two levels.

Review of the risk level of a client (group of clients) is carried out by the organization as information about the client (group of clients) is updated.

Chapter 4. Client Identification Program

20. For the purpose of implementing the requirements of the Law on AML/CFT regarding customer due diligence, the organization develops a client identification program (their representatives) and beneficial owners.

Identification of a client (their representative) and beneficial owner involves an organization conducting measures to record and verify the accuracy of information about the client (their representative), identify the beneficial owner and record information about them, establish and record the intended purpose of business relations or a one-time transaction (deal), as well as obtaining and recording other information about the client (their representative) and beneficial owner required by these Requirements.

Depending on the client's risk level, the degree of measures conducted by the organization is expressed in standard, simplified, or enhanced identification of the client and beneficial owner, carried out in accordance with Appendices 1 and 2 to these Requirements.

21. Taking into account the requirements of paragraph 2 of Article 5 of the Law on AML/CFT, the organization conducts identification of the client (their representative) and beneficial owner, and establishes the intended purpose of business relations or a one-time transaction (deal) in cases:

1. establishing business relations with a client;

2. a client performing a one-time transaction (deal) for an amount exceeding 500,000 tenge, or an amount in foreign currency exceeding the equivalent of 500,000 tenge, including by performing several transactions (deals) in a calendar day in the form of purchase, sale, or exchange of cash foreign currency through an exchange office;

3. a client performing a threshold transaction (deal);

4. detecting a suspicious transaction (deal) by a client;

5. having grounds to doubt the accuracy of previously obtained data on individuals and legal entities.

When a client performs a transaction within established business relations, identification of the client (their representative) and beneficial owner is not conducted if it was performed when establishing such business relations, except for cases provided for in subparagraphs 3) and 4) of the first part of this paragraph, as well as the need to update previously obtained or obtain additional information in accordance with the client's risk level and Requirements.

22. Information obtained in accordance with paragraph 21 of these Requirements is entered (included) by the organization into the client dossier, which is stored by the organization throughout the period of business relations with the client and for at least five years from the date of their termination or completion of a one-time transaction (deal).

The organization maintains dossiers for individuals and legal entities, as well as for other groups of clients in accordance with the organization's internal documents.

23. Simplified identification is conducted by the organization:

1. when a client-individual performs a purchase, sale, or exchange of cash foreign currency through an exchange office, if the amount of such transaction exceeds 500,000 tenge, or an amount in foreign currency equivalent to 500,000 tenge;

2. when establishing business relations with the following types of clients:

government bodies of the Republic of Kazakhstan, including the National Bank of the Republic of Kazakhstan;

organizations whose shares are included in the official list of the stock exchange of the Republic of Kazakhstan and/or the stock exchange of a foreign state;

international organizations located on the territory of the Republic of Kazakhstan or participants of which is the Republic of Kazakhstan.

24. Enhanced identification is conducted by the organization:

1. upon assigning a high risk level to a client;

2. upon detection during monitoring and study of the client's transactions of a suspicious transaction (deal) or an attempt to commit it, except for situations where enhanced identification would lead to unintentional notification of the direction of a report on such a transaction to the authorized body for financial monitoring;

3. in case of doubts about the accuracy of information presented by the client;

4. in cases established by the organization's internal documents, including by decision of the responsible employee;

5. when establishing business relations with legal entities created in the organizational-legal form of state institutions or state enterprises, as well as national holding companies, or legal entities whose 100 percent of voting shares (participation interests) belong to the national holding company.

25. During the identification of the client (identification of the beneficial owner), the organization checks for the presence of such a client (beneficial owner) in the list of organizations and persons associated with terrorist financing and extremism, obtained in accordance with Article 12 of the Law on AML/CFT (hereinafter – the FT List), and in the list of organizations and persons associated with the financing of proliferation of weapons of mass destruction, obtained in accordance with Article 12-1 of the Law on AML/CFT (hereinafter – the WMD List)..

Regarding foreigners, other persons regarding whom the organization has information about their citizenship of a foreign state, as well as stateless persons, the organization, during the process of identifying the client (identifying the beneficial owner), conducts a check for belonging of such a client (beneficial owner) to a public official.

26. Documents submitted by the client (their representative) for the purpose of confirming information about the client (their representative) and beneficial owner are checked for validity.

27. The program for identification of the client (their representative) and beneficial owner includes, but is not limited to:

1. procedure for accepting clients for service, including procedure and grounds for refusal to establish business relations and/or conduct a transaction, as well as termination of business relations;

2. procedure for identification of the client (their representative) and beneficial owner, including features of simplified and enhanced identification procedures;

3. description of measures aimed at identifying among individuals under service or being accepted for service, foreigners, including public officials;

4. procedure for checking the client (their representative) and beneficial owner for presence in the FT List and WMD List;

5. features of identification when establishing business relations remotely (without personal presence of the client or their representative);

6. features of exchanging information obtained during the identification of the client (their representative) and beneficial owner within the framework of fulfilling AML/CFT requirements established by the legal entity that controls the organization (if any);

7. description of additional sources of information, including those provided by government bodies, for the purpose of identifying the client (their representative) and beneficial owner;

8. procedure for verifying the accuracy of information about the client (their representative) and beneficial owner;

9. requirements for the form, content, and procedure for maintaining the client dossier, updating information contained in the dossier, indicating the frequency of updating information;

10. procedure for ensuring access of organization employees to information obtained during identification;

11. procedure for assessing the client's risk level, grounds for assessing such risk.

Chapter 5. Program for Monitoring and Study of Client Transactions

28. For the purpose of implementing the requirements of the Law on AML/CFT regarding proper customer due diligence, as well as detecting and forwarding to the authorized body for financial monitoring reports on threshold and suspicious transactions, the organization develops a program for monitoring and study of client transactions.

29. Within the framework of the program for monitoring and study of client transactions, the organization conducts measures to update and/or obtain additional information about clients (their representatives) and beneficial owners, as well as to study client transactions and detect threshold, unusual, and suspicious transactions.

The results of monitoring and study of client transactions are used by the organization for annual assessment of the degree of exposure of the organization's services to ML/TF risks, as well as for reviewing client risk levels.

Information obtained within the framework of implementing the program for monitoring and study of client transactions is entered into the client dossier provided for in paragraph 22 of these Requirements, and/or stored by the organization throughout the period of business relations with the client and for at least five years from the date of their termination or completion of a one-time transaction (deal).

30. The frequency of updating and/or necessity of obtaining additional information about the client (their representative) and beneficial owner is established by the organization taking into account the client's (group of clients') risk level and/or the degree of exposure of the organization's services used by the client to ML/TF risks.

In cases provided for in paragraph 24 of these Requirements, the organization conducts enhanced identification of the client.

Updating information about a client (their representative) and beneficial owner with a high risk level is carried out no less than once a year.

Checking for the presence of a client (beneficial owner) in the FT List and WMD List (inclusion in the FT List and WMD List) does not depend on the client's risk level and is carried out as changes are made to the FT List and WMD List (updating the FT List and WMD List).

31. The program for monitoring and study of client transactions includes, but is not limited to:

1. list of signs of unusual and suspicious transactions, compiled based on signs defined by the authorized body for financial monitoring in accordance with paragraph 2 of Article 10 of the Law on AML/CFT, as well as developed by the organization independently;

2. distribution of responsibilities between departments (employees) of the organization for updating previously obtained and/or obtaining additional information about the client (their representative) and beneficial owner in cases provided for by the Requirements;

3. distribution of responsibilities between departments (employees) of the organization for detecting and transferring information between departments (employees) about threshold, unusual, and suspicious transactions;

4. description of the interaction mechanism between departments when detecting threshold, unusual, and suspicious transactions;

5. procedure, grounds, and deadline for the responsible employee's decision to qualify a client's transaction;

6. procedure for interaction between departments (employees) in making a decision to refuse to conduct a client's transaction (except for refusal due to the client or beneficial owner being in the FT List and WMD List), as well as to terminate business relations with the client;

7. procedure for interaction between departments (employees) in detecting clients and beneficial owners in the FT List and WMD List, as well as refusing to conduct transactions, servicing such clients, or terminating business relations with them;

8. procedure for recording (including methods of recording) and storing information about the results of studying unusual transactions, as well as information about threshold and suspicious transactions (including the transaction amount, transaction currency);

9. procedure for submitting to the authorized body for financial monitoring reports on threshold and suspicious transactions;

10. procedure for informing (if necessary) authorized bodies and organization officials about the detection of a threshold and suspicious transaction;

11. procedure for accepting and description of measures taken regarding the client and their transactions in case the client systematically and/or in significant volumes performs unusual and/or suspicious transactions.

32. Upon detection of a threshold, unusual, or suspicious transaction, the organization employee who detected the indicated transaction forwards a report on such a transaction to the responsible employee (AML/CFT department) in the manner, form, and timeframes established by the organization's internal documents.

One report may contain information about multiple transactions.

Reports on transactions specified in the first part of this paragraph, as well as the results of their study, are stored by the organization for at least five years from the date of termination of business relations with the client or completion of a one-time transaction (deal).

Chapter 6. Program for Training and Education of Organization Employees on AML/CFT Issues

33. The program for training and education of organization employees on AML/CFT issues is developed in accordance with requirements for preparation and training of employees approved by the authorized body for financial monitoring in accordance with paragraph 8 of Article 11 of the Law on AML/CFT.

Appendix 1

to the Requirements for Internal Control Rules to counter

money laundering,

obtained criminally, and terrorist financing for

legal entities carrying out activity

exclusively through exchange offices

based on a license

of the National Bank of the Republic of Kazakhstan

for exchange operations with cash foreign currency, and

legal entities whose exclusive activity

is collection of banknotes, coins, and valuables

Requirements for the content of the client dossier – individual

Information	Type of Identification
Standard	Simplified	Enhanced
1. General information about the individual
Surname, name, patronymic (if available)	✓✓	✓✓	✓✓
Date and place of birth	✓✓	✓✓	✓✓
Citizenship (if available)	✓✓	✓✓	✓✓
Individual identification number (if available)	✓✓	✓✓	✓✓
Type of identity document, number, series (if available)	✓	✓	✓
Name of the body issuing the identity document, date of issue and validity period	✓	✓	✓
Address of residence (registration) or place of stay (country/jurisdiction, postal code, city/town, street/district, house number and apartment number if available)	✓	✓	✓✓
Contact phone number	✓		✓✓
Place of work, position	✓		✓
Email address (if available)	✓		✓
2. Additional information about the individual - individual entrepreneur
Number, date of issue of the document confirming registration of the individual as an individual entrepreneur, including as head of a peasant (farm) household	✓		✓
Business identification number (if available)	✓✓		✓✓
Type of entrepreneurial activity	✓		✓
Number, date of issue, validity period of the license (if the type of activity carried out is licensed)	✓		✓✓
Address of place of entrepreneurial activity (country/jurisdiction, postal code, city/town, street/district, building number)	✓		✓✓
3. Additional information about the individual - foreigner
Number, date of issue, validity period of the visa (in case of presenting a foreign passport as an identity document) (except for citizens of states entering the Republic of Kazakhstan without a visa)	✓✓	✓✓	✓✓
Number, date of issue, validity period of the migration card (in case of presenting a foreign passport as an identity document) (for citizens of states entering the Republic of Kazakhstan without a visa)	✓✓	✓✓	✓✓
Belonging of the person to public officials or persons associated with them (their spouses, close relatives, and also representatives)	✓	✓	✓
4. Information about the representative of the individual
Surname, name, patronymic (if available)	✓✓	✓✓	✓✓
Date and place of birth	✓✓	✓✓	✓✓
Citizenship (if available)	✓✓	✓✓	✓✓
Individual identification number (if available)	✓✓	✓✓	✓✓
Type of identity document, number, series (if available)	✓	✓	✓
Name of the body issuing the identity document, date of issue and validity period	✓	✓	✓
Address of residence (registration) or place of stay (country/jurisdiction, postal code, city/town, street/district, building number)	✓	✓	✓✓
Contact phone number	✓		✓✓
Number, date of issue (signing), validity period (if available) of the document (power of attorney, contract, guardian certificate (conservatorship), other document) to perform legally significant actions on behalf of the individual (including, opening an account, disposing of the account) or note on representation by law	✓✓		✓✓
Surname, name, patronymic (if available) of the notary certifying the client's signature on the power of attorney issued to the client's representative, number and date of issue of the license for notarial activity or name of the body issuing the document	✓		✓
Number, date of issue, validity period of the visa (in case of presenting a foreign passport as an identity document) (except for citizens of states entering the Republic of Kazakhstan without a visa)	✓✓	✓✓	✓✓
Number, date of issue, validity period of the migration card (in case of presenting a foreign passport as an identity document)	✓✓	✓✓	✓✓
5. Information about the beneficial owner
Surname, name, patronymic (if available) of the individual(s) in whose interests business relations are established (transactions are performed), or note that the individual establishing business relations (performing the transaction) acts in their own interests	✓		✓✓
Citizenship (if available) of the beneficial owner	✓		✓
Individual identification number (if available) of the beneficial owner	✓		✓✓
Type of identity document, number, series (if available) of the beneficial owner	✓		✓
Name of the body issuing the identity document of the beneficial owner, date of issue and validity period	✓		✓
Contact phone number (if available) of the beneficial owner	✓		✓
Belonging of the beneficial owner – foreigner – to public officials or persons associated with them (their spouses, close relatives, and also representatives)	✓		✓
6. Information about sources of funding for the transactions performed
Sources of income of the individual, funding for the transactions performed (salary, dividends, income from entrepreneurial activity, other)	✓		✓✓
Accounts in other banks/financial organizations (if available) (name of the bank/financial organization where the account is held)	✓		✓
Characterization of financial status (real estate, valuables, share in capital/percentage of shares of a legal entity)			✓
7. Results of transaction monitoring and official information
Note on the client or their beneficial owner being in the list of persons associated with terrorist financing and extremism	✓	✓	✓
Note on the client or their beneficial owner being in the list of organizations and persons associated with financing of proliferation of weapons of mass destruction	✓	✓	✓
Services used by the individual in the organization (concluded contracts)	✓		✓
Results of the last transaction monitoring, including measures to verify the accuracy of the source of funding for the transactions performed	✓		✓
Risk level	✓	✓	✓
Date of obtaining (updating) information about the client	✓	✓	✓

Note:

✓ - necessity of recording the corresponding information;

✓✓ - necessity of recording the corresponding information and verifying its accuracy.

Requirements for the content of the client dossier:

1. The list of identity documents on the basis of which civil-law transactions are concluded for citizens of the Republic of Kazakhstan, foreigners, and stateless persons is determined in accordance with the requirements of paragraph 3 of Article 6 of the Law of the Republic of Kazakhstan "On Identity Documents".

2. Verification of the accuracy of the presented information is carried out by comparing with data from originals or notarized copies of the corresponding documents submitted by the client (their representative), comparing with data from available sources (databases), verifying information by other means, including site visits. Within the framework of verifying the accuracy of information necessary for identification, visual comparison of the photo placed on the identity document with the client (client's representative) is also carried out.

3. Information about migration cards is not required for citizens of states belonging to the Eurasian Economic Union.

Appendix 2

to the Requirements for Internal Control Rules to counter

money laundering,

obtained criminally, and terrorist financing for

legal entities carrying out activity

exclusively through exchange offices

based on a license

of the National Bank of the Republic of Kazakhstan

for exchange operations with cash foreign currency, and

legal entities whose exclusive activity

is collection of banknotes, coins, and valuables

Requirements for the content of the client dossier – legal entity

Information	Type of Identification
Standard	Simplified	Enhanced
1. General Information about the Legal Entity
Full name and, if available, abbreviated name, including organizational-legal form	✓✓	✓✓	✓✓
Business identification number (if available)	✓ ✓	✓✓	✓✓
Type of document confirming registration, date of issue, number (if available)	✓	✓	✓
Name of the registering authority, date and place of registration (re-registration)	✓	✓	✓
Type(s) of activity carried out and code of the general classifier of economic activities (OKED) (if available)	✓	✓	✓
Number, date of issue, validity period of the license (if the type of activity carried out is licensed)	✓✓	✓	✓✓
Name of the authority issuing the license	✓	✓	✓
Address of the location in accordance with the document confirming registration (country, postal code, city/town, street/district, building number)	✓	✓	✓✓
Address of the actual location of the executive body (country, postal code, city/town, street/district, building number)	✓✓	✓	✓✓
Contact phone number	✓	✓	✓✓
Email address (if available)	✓	✓	✓✓
2. Additional Information on Foreign Legal Entities
Registration number (code) assigned by the authorized body in the state of registration	✓	✓	✓✓
3. Information on Ownership and Management Structure
Structure and names of bodies (supervisory body, executive body, other bodies) in accordance with the constituent documents	✓✓	✓	✓✓
Date of the latest edition of the constituent documents, on the basis of which the structure of the legal entity's bodies is established	✓✓	✓	✓✓
3.1. Information on the Personal Composition of the Supervisory Body
Surnames, first names, patronymics (if any) of natural persons and/or full names of legal entities included in the composition of the supervisory body	✓		✓
Citizenship (if any) of natural persons and/or state of registration of legal entities included in the composition of the supervisory body	✓		✓
Individual identification numbers (if any) or numbers, series (if any), dates of issue and validity periods of identity documents of natural persons included in the composition of the supervisory body	✓✓		✓✓
Business identification numbers (if any) or registration numbers (codes) assigned by the authorized body in the state of registration, for legal entities included in the composition of the supervisory body	✓✓		✓✓
Date of the latest edition of the constituent documents or date of extract from the register of shareholders (participants) or other document, on the basis of which the composition of the supervisory body is established	✓✓		✓✓
3.2. Information on the Personal Composition of the Executive Body
Surname, first name, patronymic (if any) of the person performing the functions of the sole executive body, or surnames, first names, patronymics (if any) of the head and members of the collegial executive body	✓✓	✓	✓✓
Date and place of birth of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓✓		✓✓
Citizenship (if any) of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓✓		✓✓
Individual identification number (if any) of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓✓		✓✓
Type of identity document, number, series (if any) of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓		✓
Name of the authority issuing the identity document of the person performing the functions of the sole executive body, or head and members of the collegial executive body, date of issue and validity period	✓		✓
Address of residence (registration) and/or place of stay (state/jurisdiction, postal code, city/town, street/district, house number and, if available, apartment number) of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓		✓
Contact phone number of the person performing the functions of the sole executive body, or head and members of the collegial executive body	✓		✓
Number and date of the document (order, protocol of the general meeting, protocol of the board of directors, decision of the sole shareholder (founder) or other similar document), on the basis of which the person performs the functions of the sole executive body or head or member of the collegial executive body	✓		✓✓
3.3. Information on the Personal Composition of Other Management Bodies (if any)
Surnames, first names, patronymics (if any) of the head and members of the management body	✓		✓
Date and place of birth of the head and members of the management body	✓		✓
Citizenship (if any) of the head and members of the management body	✓		✓
Individual identification number (if any) of the head and members of the management body	✓		✓
Type of identity document, number, series (if any) of the head and members of the management body			✓
Name of the authority issuing the identity document of the head and/or members of the management body, date of issue and validity period			✓
Number and date of the document (protocol of the general meeting, decision of the sole shareholder (founder) or other similar document), on the basis of which the person performs the functions of the head or member of the management body			✓
4. Information on the Representative of the Legal Entity
Surname, first name, patronymic (if any) of the representative of the legal entity (including the head of a branch (representative office) of the legal entity)	✓✓	✓✓	✓✓
Date and place of birth	✓✓	✓✓	✓✓
Citizenship (if any)	✓✓	✓✓	✓✓
Individual identification number (if available)	✓✓	✓✓	✓✓
Type of identity document, number, series (if any)	✓	✓	✓
Name of the authority issuing the identity document, date of issue and validity period	✓	✓	✓
Address of residence (registration) or place of stay (state/jurisdiction, postal code, city/town, street/district, house number and, if available, apartment number)	✓	✓	✓✓
Contact phone number	✓	✓	✓✓
Number, date and validity period (if any) of the document (order, power of attorney) granting the representative the right to perform legally significant actions on behalf of the legal entity (opening an account, disposing of the account)	✓✓	✓	✓✓
Surname, first name, patronymic (if any) of the person who signed the document (order, power of attorney) granting the representative the right to perform legally significant actions on behalf of the legal entity (opening an account, disposing of the account)	✓		✓
Number, date of issue, validity period of the visa (in case of presentation of a foreign passport as an identity document) (except for citizens of states entering the Republic of Kazakhstan without a visa)	✓✓	✓✓	✓✓
Number, date of issue, validity period of the migration card (in case of presentation of a foreign passport as an identity document)	✓	✓✓	✓✓
5. Information on the Beneficial Owner
Mark indicating the presence/absence of a natural person(s) to whom more than twenty-five percent of participation shares in the charter capital or issued shares (excluding preferred and repurchased by the company) of the legal entity belong directly or indirectly	✓		✓✓
Mark indicating the presence/absence of a natural person(s) exercising control over the legal entity on other grounds	✓		✓
Mark indicating the presence/absence of a natural person(s) in whose interests the legal entity establishes business relations (performs operations)	✓		✓
Surname, first name and, if available, patronymic of the beneficial owner	✓		✓
Citizenship (if any) of the beneficial owner	✓		✓
Individual identification number (if available) of the beneficial owner	✓		✓
Type of identity document, number, series (if any) of the beneficial owner	✓		✓
Name of the authority issuing the identity document of the beneficial owner, date of issue and validity period	✓		✓
Contact phone number (if available) of the beneficial owner	✓		✓✓
Belonging of the beneficial owner – a foreigner – to public officials or persons associated with them (their spouses, close relatives, and also representatives)	✓		✓
6. Additional Information on Branches (Representative Offices) of the Legal Entity
Name of the branch (representative office)	✓✓	✓✓	✓✓
Business identification number (if available)	✓✓	✓✓	✓✓
Type of document confirming registration, date of issue, number (if available)	✓	✓	✓
Name of the registering authority and date of registration (re-registration)	✓	✓	✓
Type(s) of activity carried out and OKED code (if available)	✓	✓	✓
Number, date of issue, validity period of the license (if the type of activity carried out is licensed)	✓✓	✓	✓✓
Address of the location of the branch (representative office) in accordance with the document confirming registration (country, postal code, city/town, street/district, building number)	✓	✓	✓✓
Contact phone number	✓	✓	✓✓
Email address (if available)	✓	✓	✓✓
7. Information on Sources of Financing of Operations Performed
Sources of income of the legal entity, financing of operations performed (income from entrepreneurial activity, dividends, voluntary property contributions and donations, other)	✓		✓✓
Accounts in other banks/financial organizations (if any) (name of the bank/financial organization where the account is held)	✓		✓
Characteristics of financial condition (real estate, valuables, share in capital/percentage of shares of another legal entity)			✓
Characteristics of the financial condition of the beneficial owner (real estate, valuables, share in capital/percentage of shares of another legal entity)			✓
8. Results of Monitoring Operations and Official Information
Mark indicating whether the client, his beneficial owner are in the list of persons associated with terrorist financing and extremism	✓	✓	✓
Mark indicating whether the client, his beneficial owner are in the list of organizations and persons associated with the financing of the proliferation of weapons of mass destruction	✓	✓	✓
Services used by the legal entity in its organization (concluded contracts)	✓		✓
Results of the last monitoring of operations, including measures to verify the reliability of the source of financing of operations performed	✓		✓
Risk level	✓	✓	✓
Date of receipt (update) of information	✓	✓	✓

Note:

✓ - necessity of recording the relevant information;

✓✓ - necessity of recording the relevant information and verifying its reliability.

Requirements for the content of the client dossier:

1. The list of identity documents, on the basis of which civil-law transactions are concluded for citizens of the Republic of Kazakhstan, foreigners, and stateless persons, is determined in accordance with the requirements of paragraph 3 of Article 6 of the Law of the Republic of Kazakhstan "On Documents Confirming Identity".

2. Verification of the reliability of the information provided is carried out by comparing it with the data of originals or notarized copies of the corresponding documents presented by the client (his representative), comparison with data from available sources (databases), verification of information by other means, including site visits. Within the framework of verifying the reliability of information on personal identification, a visual comparison of the photograph placed on the identity document with the client (client representative) is also carried out.

3. Information related to registration and the presence of a license is also established in relation to international organizations, if the charters of such international organizations and/or agreements on the conditions of their stay on the territory of the state (states) do not provide for the carrying out of their activities, respectively, without registration and/or a license.

4. Information on migration cards is not required in relation to citizens of states belonging to the Eurasian Economic Union.

5. Information on the personal composition of the supervisory body of a commercial organization is obtained in relation to natural and/or legal entities included in the composition of the supervisory body and owning more than twenty-five percent of participation shares in the charter capital or issued shares of the commercial organization. Obtaining information on the personal composition of the supervisory body of a commercial organization in relation to natural and/or legal entities included in the composition of the supervisory body and owning twenty-five percent or less of participation shares in the charter capital or issued shares of the commercial organization is permitted.

Information on the personal composition of the supervisory body of a non-commercial organization is obtained in relation to natural and/or legal entities included in the composition of the supervisory body or being founders of the non-commercial organization, except in cases where the number of members of the supervisory body or the number of founders of the non-commercial organization exceeds five natural and/or legal entities.