Resolution of the Board

of the National Bank

of the Kyrgyz Republic

of 14 December 2022
No. 2022-П-14/78-5-(ПС)

On Amendments to the Resolution of the Board of the National Bank

of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements

for the Provision of Remote/Distance Services in the Kyrgyz Republic"

of 15 April 2015 No. 22/3

In accordance with Articles 5, 9 and 64 of the Constitutional Law of the Kyrgyz Republic "On the National Bank of the Kyrgyz Republic", the Board of the National Bank of the Kyrgyz Republic resolves:

• 1. To introduce amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for the Provision of Remote/Distance Services in the Kyrgyz Republic" of 15 April 2015 No. 22/3 (attached).

• 2. This resolution shall enter into force upon the expiration of 15 (fifteen) days from the day of its official publication.

• 3. To the Legal Department:

  • from the day of receipt of the relevant documents, within 3 (three) working days, to publish this resolution on the official website of the National Bank of the Kyrgyz Republic;

  • after official publication, to send this resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Normative Legal Acts of the Kyrgyz Republic.

• 4. To the Payment Systems Department, within 3 (three) working days, to bring this resolution to the attention of commercial banks, non-bank financial and credit organizations, payment system operators and payment organizations.

• 5. To entrust control over the execution of this resolution to the member of the Board of the National Bank of the Kyrgyz Republic supervising the Payment Systems Department.

Chairman K. Bokontaev

Annex
to the Resolution of the Board of the National Bank of the Kyrgyz Republic of 14 December 2022 No. 2022-П-14/78-5-(ПС)

Amendments

to the Resolution of the Board of the National Bank of the Kyrgyz Republic

"On Approval of the Regulation "On Minimum Requirements

for the Provision of Remote/Distance Services

in the Kyrgyz Republic" of 15 April 2015 No. 22/3

To introduce the following amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for the Provision of Remote/Distance Services in the Kyrgyz Republic" of 15 April 2015 No. 22/3":

in the Regulation "On Minimum Requirements for the Provision of Remote/Distance Services in the Kyrgyz Republic", approved by the above-mentioned resolution:

• 1) to restate paragraph 3 as follows:

"3. Within the framework of this Regulation, banking and payment services may be provided remotely/distantly through ATMs, automated self-service terminals (payment terminals), internet banking, mobile banking, mobile application and other methods of remote/distance servicing that do not contradict the legislation of the Kyrgyz Republic.";

• 2) in paragraph 3-1:

  • in the first sentence, replace the word "bank" with the words "provider of remote/distance services (service provider)";

  • in the second sentence, replace the word "Bank" with the words "Service provider";

• 3) to supplement the Regulation with paragraph 3-2 as follows:

"3-2. When providing remote/distance services, service providers are obliged to comply with the relevant requirements of normative legal acts regulating issues in terms of timeliness, security, reliability of payments and prevention of fraudulent operations.";

• 4) to restate paragraph 4 as follows:

"4. Terms and definitions used in this Regulation shall be understood in the meaning in which they are used in banking legislation and legislation in the sphere of the payment system of the Kyrgyz Republic.

This Regulation also uses the following terms and definitions:

• 1) Authentication – the procedure for establishing the authenticity of a user by verifying and comparing the characteristics of the presented identifier (PIN code, password, etc.).

• 2) Personal account – a special user section in the remote/distance service system of the service provider, which allows access to data on the status of the account/credit limit and movement of funds, as well as to other banking and payment services, including sending applications, confirmations and instructions to the service provider.

• 3) Mobile application of the service provider (mobile application) – one of the tools of remote/distance service systems, allowing the service provider to provide the user with banking and payment services in a remote/distance manner. Mobile applications of the service provider also include mobile applications of agents provided for by the Regulation "On Regulation of the Activities of Payment Organizations and Payment System Operators".

• 4) User's obligations to the NFCO – obligations of the user arising from obtaining a loan from the NFCO, as well as through the management of the personal account.

• 5) User – an individual, legal entity or individual entrepreneur using banking and payment services through the remote/distance service system.

• 6) Provider of remote/distance services (service provider) – banks, non-bank financial and credit organizations (hereinafter – NFCO), payment system operators and payment organizations that have a license/certificate of the National Bank for the right to carry out certain banking and payment services provided for by the legislation of the Kyrgyz Republic.

• 7) Remote/distance servicing system – a set of telecommunications, digital and information technologies, software and equipment that ensure communication between the user and the service provider for the provision of banking and payment services in a remote/distance manner using ATMs, payment terminals, internet banking, electronic wallet, mobile banking, mobile application and other methods of remote/distance servicing.

• 8) Remote/distance servicing – a method of providing services by the service provider on the basis of instructions transmitted by the user in a remote/distance manner using remote/distance servicing systems.

• 9) PIN code (Personal identification number) – a personal identification number that allows authenticating the user to perform an operation.»;

• 5) in paragraph 5:

  • the fourth paragraph shall be stated as follows:

«- develop an internal policy on information security risk management, defining the responsibility of the service provider when interacting with users, taking into account the requirements of regulatory legal acts in the field of information security, taking into account the risks associated with remote/distance servicing, as well as in the event of an emergency situation;»;

• the paragraph shall be supplemented with the fifth and sixth paragraphs as follows:

«- develop and maintain in an up-to-date state an internal regulatory document on the procedure for interaction and response in the event of emergency situations in accordance with the regulatory legal acts of the National Bank;

• develop a procedure for dispute resolution and refund of funds to the user for erroneous or unauthorized operations;»;

  • in the text in the official language, in the seventh paragraph, the word «перемещении» shall be replaced by the word «передаче»;

• 6) The Regulation shall be supplemented with paragraph 6-2 as follows:

«6-2. The service provider shall be responsible for the services provided, including unauthorized operations, except in cases where the operations occurred through the fault of the user himself, according to the list, procedure and conditions of the remote/distance servicing system.»;

• 7) The Regulation shall be supplemented with paragraph 7-1 as follows:

«7-1. The service provider is recommended to provide in the remote/distance servicing system special functions or other capabilities, including solutions provided by third parties, allowing persons with disabilities to use the services provided, as well as to inform them about these capabilities.»;

• 8) paragraph 9 shall be recognized as having lost force;

• 9) paragraph 10 shall be stated as follows:

«10. Remote/distance servicing must be provided on the basis of an agreement between the user and the service provider in accordance with the legislation of the Kyrgyz Republic, which must specify:

• user data (surname, name, patronymic, passport data (or data of other identity documents in accordance with the legislation of the Kyrgyz Republic) and other user data allowing his identification) in the case of providing him with services through the remote/distance servicing system;

• list of services provided;

• methods of providing services in a remote/distance manner and obtaining access to remote/distance servicing systems;

• rights, obligations and responsibility of the user and the service provider;

• types and amounts of commissions payable by the user;

• scheme of conversion from one currency to another, providing for various conversion options when the user performs operations in a currency different from the currency of his bank account, as well as the procedure for informing clients about the exchange rate when performing currency conversion operations;

• methods of providing by the service provider of statements on the movement of funds and the balance on the bank account, on the user's obligations to the NFKO or on the electronic wallet;

• basic requirements for user security compliance, including the procedure for authentication and confirmation of the client's rights to use remote/distance servicing systems (use of PIN code, passwords, limits, user actions in case of loss or theft of access devices);

• procedure for informing the service provider about the fact of loss, theft or use of access devices to the remote/distance servicing system by an unauthorized person;

• distribution of responsibility between service providers and users in case of loss, theft or use of access devices by an unauthorized person;

• conditions for suspension and termination of access to the remote/distance servicing system;

• methods of notifying the client in case of changes in the terms of the agreement;

• contact data for communication with the service provider, including outside working hours and on weekends (holidays);

• distribution of risks and responsibility between the parties in case of violation of security procedures or other terms of the agreement;

• procedure for consideration of disputes, submission/acceptance of complaints and claims of the user, conditions for their consideration and resolution;

• mechanism for determining the user on whose behalf the electronic signature is used, and the obligation to maintain confidentiality of the electronic signature key.»;

• 10) paragraph 13 shall be stated as follows:

«13. When performing access and servicing using ATMs and payment terminals:

• 1) remote/distance servicing through an ATM is carried out by means of bank payment cards or in another way for receiving cash, making money transfers and other non-cash payments, obtaining information on completed transactions on the bank account, issuing a receipt or SMS notification on all types of transactions performed to the mobile phone according to the agreement with the user.

• 2) the ATM/payment terminal transmits transaction data to the information system of the service provider. After completing the transaction processing, the ATM/payment terminal must provide a confirming document on the performed operation in accordance with the legislation of the Kyrgyz Republic, containing the following mandatory details:

  • receipt number;

  • date and time of the transaction/payment;

  • amount of the transaction/payment;

  • amount of the commission.

• 3) the service provider for remote/distance servicing through ATMs/payment terminals must:

  • inform clients about possible risks associated with the use of ATMs and payment terminals, as well as about precautionary measures;

  • regularly conduct security checks at the locations where ATMs and payment terminals are installed and document the results of the checks;

  • organize support centers (call centers) and ensure their daily and continuous operation;

  • place on the ATM/payment terminal an indication of the ownership of the bank/payment organization, logos of payment systems whose cards are accepted for servicing by the ATM and payment terminal.";

• 11) paragraph 14 shall be set out in the following wording:

"14. The service provider for remote/distance servicing through internet banking is obliged to:

• inform clients about possible risks and precautionary measures;

• inform clients about the need to comply with security rules and procedures when making payments through internet banking (on preventing the transfer of passwords, codes, keys to third parties);

• ensure confidentiality during the transmission of financial messages and payments;

• use secure network protocols;

• apply mechanisms to prevent fraudulent substitution of web pages of the internet banking server (user's personal account);

• use multi-factor authentication taking into account the risk assessment of the operation being performed (for example, password/code/one-time code and PIN code, biometric means, etc.);

• apply a policy providing for the use of complex passwords and their regular change;

• use mechanisms to prevent automatic password guessing;

• use mechanisms to block the session of connection to the internet banking server when the user is inactive beyond the established time interval.";

• 12) paragraph 15 shall be set out in the following wording:

"15. The service provider for remote/distance servicing through mobile banking, mobile applications is obliged to provide for the following:

• conditions for registration and identification of the user with the service provider;

• security rules and procedures when making payments using remote/distance servicing systems/mobile devices (preventing the transfer of information to third parties without the user's consent during the exchange and transmission of messages between the user and service providers; ensuring confidentiality during the transmission of financial messages and payments);

• adoption of necessary measures to protect user data;

• procedure for access to make payments;

• other conditions established in paragraph 10 of this Regulation.";

• 13) in the second sentence of paragraph 16, the words "and issuance of a receipt, card receipt, receipt of SMS confirmation" shall be replaced by the words "and/or receipt of a confirming document on the performed payment (issuance of a receipt, receipt of SMS confirmation, etc.)";

• 14) in paragraph 21:

  • the sixth paragraph shall be set out in the following wording:

"- determination and assessment of limits on transactions being conducted;";

• in the seventh paragraph, the words "electronic wallets" shall be replaced by the words "remote/distance servicing systems";

• in the eighth paragraph, the word "internet banking" shall be excluded;

• 15) paragraph 26 shall be set out in the following wording:

"26. The application of appropriate identification methods must be determined in the risk assessment process. When using appropriate identification methods, the following aspects must be taken into account: type of remote/distance servicing systems (informational or operational), variety of systems (internet banking, mobile banking, mobile applications and others), client status (legal entity or individual), type of operations permitted by the system, volume and number of operations.";

• 16) in paragraph 28, the words "unauthorized actions" shall be replaced by the words "unauthorized operations";

• 17) in paragraph 29, the words "unauthorized actions" shall be replaced by the words "unauthorized operations";

• 18) paragraph 30 shall be set out in the following wording:

"30. The service provider, upon detecting facts of unauthorized access/operations, is obliged to immediately suspend access to the remote/distance servicing system and, if necessary, to the bank account and other instruments.";

• 19) in paragraph 31, the words "information system," shall be replaced by the words "remote/distance servicing system";

• 20) in paragraph 32, the words "notify the National Bank in writing about the provision" shall be replaced by the words "inform the National Bank in advance about the commencement or termination of the provision";

• 21) Appendix 1 shall be set out in the following wording:

"Information for the user

To ensure security in the process of conducting operations through remote/distance servicing and protection of data, users must be informed about their duties and responsibilities.

1. The user, when using internet banking:

• 1) must not disclose the login, password and other data to outsiders;

• 2) must not store their login and password and other data on access devices (personal computer, mobile phone, etc.) or other unprotected media;

• 3) must periodically change the password, while not using passwords with a low level of protection, such as a name or date of birth. The password must contain a combination consisting of at least 6 characters: letters (uppercase and capital), special characters and digits;";

• 4) must ensure the confidentiality of personal information, namely not disclose personal information (passport data, email address and other data) to outsiders;

• 5) must regularly check the history of operations and statements to track errors or unauthorized operations on the account and immediately inform the service provider about any cases of unauthorized operations;

• 6) it is necessary to verify the correctness and security of the web page, while:

  • before carrying out any online operations or providing personal information, one must make sure that the correct internet banking web page is being used. One must beware of fake web pages created for the purpose of fraud;

  • it is necessary to make sure the web page is secure by checking for Uniform Resource Locators (URL) that must begin with "https", and a secure connection sign must appear in the internet browser status;

  • always enter the URL of the web page directly into the internet browser and avoid redirection or links to other unreliable pages;

  • where possible, use a program that automatically encrypts or encodes the information transmitted during electronic operations;

• 7) one must protect one's access device (personal computer, mobile phone, etc.) from unauthorized access and malicious programs;

• 8) it is necessary to leave the site where electronic operations are carried out, even if the device is left unattended for a short period, and not forget to log out after carrying out electronic operations;

• 9) it is necessary to familiarize oneself with the security policy of the internet banking system:

  • it is necessary to carefully familiarize oneself with the terms of the internet banking system regarding making payments, transfers, debiting/crediting an account and other terms of banking services;

  • before entering personal financial information of the internet banking system, it is necessary to carefully familiarize oneself with the terms of use or dissemination of this information.

2. The user, when using mobile banking, a mobile application:

• must not disclose to unauthorized persons one's PIN code, password to the remote/distance servicing system, email password, or other information that could facilitate unauthorized access during remote/distance servicing on behalf of the user;

• it is necessary to periodically change one's PIN code and the password used for mobile banking, the mobile application;

• must not allow unauthorized persons to use one's mobile phone through which a banking operation is carried out;

• in the event of loss or theft of the mobile phone, immediately notify the service provider;

• must not send one's personal information containing a password or PIN code via email, social networks and other means of electronic data exchange;

• it is necessary to regularly check the transaction history and statements to track errors or unauthorized operations and immediately inform the service provider of any cases of unauthorized operations;

• must immediately inform the service provider if any questions arise regarding the security of access to the remote/distance servicing systems.

The necessary measures to ensure the safe storage of cards, their details, PIN code and the security of other data are defined in the regulatory legal acts of the National Bank.".