On Amendments and Additions to Certain Resolutions of the Board of the National Bank of the Republic of Kazakhstan on Payment and Payment Services

NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		RESOLUTION OF THE BOARD
April 29, 2026 Astana city		No. 44 Astana city

On Amendments and Additions to Certain Resolutions of the Board of the National Bank of the Republic of Kazakhstan

on Payment and Payment Services

The Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. Approve the attached List of certain Resolutions of the Board of the National Bank of the Republic of Kazakhstan, to which amendments and additions are made regarding payment and payment services (hereinafter – the List).

2. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1) jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this Resolution in the Ministry of Justice of the Republic of Kazakhstan;

2) publication of this Resolution on the official Internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this Resolution, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of measures provided for in subparagraph 2) of this paragraph.

3. Control over the implementation of this Resolution shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan in charge.

4. This Resolution shall enter into force upon the expiration of ten calendar days after the day of its first official publication, except for:

paragraphs three, four, five, six, seven, eight, nine, ten, eleven, twelve, thirteen, fourteen, fifteen, sixteen, seventeen, eighteen, nineteen, forty, forty-one, forty-two, forty-three, forty-four, forty-five, forty-six, forty-seven, forty-eight, forty-nine, fifty, fifty-one, fifty-two, fifty-three, fifty-four, fifty-five, fifty-six, fifty-seven, fifty-eight, fifty-nine, sixty, sixty-one, sixty-two, sixty-three, sixty-four, sixty-five, sixty-six, sixty-seven, sixty-eight, sixty-nine, seventy, seventy-one, seventy-two, seventy-three, seventy-four, seventy-five, seventy-six, seventy-seven, seventy-eight, seventy-nine, eighty, eighty-one, eighty-two, eighty-three, eighty-four, eighty-five, eighty-six, eighty-seven, eighty-eight, eighty-nine, ninety, ninety-one, ninety-two, ninety-three, ninety-four, ninety-five, ninety-six, ninety-seven, ninety-eight of paragraph 1 of the List, which shall enter into force from July 12, 2026;

paragraphs twenty, twenty-one, twenty-two, twenty-three, twenty-four, twenty-five, twenty-six, twenty-seven, twenty-eight, twenty-nine, thirty, thirty-one, thirty-two, thirty-three, thirty-four, thirty-five, thirty-six of paragraph 1 of the List, which shall enter into force upon the expiration of six months after the day of the first official publication of this Resolution;

paragraphs three, four, five, six, seven, eight, nine, ten, eleven, twelve, thirteen, fourteen, nineteen, twenty, twenty-seven, twenty-eight, twenty-nine, thirty, thirty-one, thirty-two, thirty-three, thirty-four, thirty-five, thirty-six, fifty-six, fifty-seven, fifty-eight, fifty-nine, sixty, sixty-one, sixty-two, sixty-three, sixty-four, sixty-five, sixty-six, sixty-seven, sixty-eight, sixty-nine, seventy, seventy-one, seventy-two, seventy-three, seventy-four, seventy-five, seventy-six, seventy-seven, seventy-eight, seventy-nine, eighty, eighty-one, eighty-two, eighty-three, eighty-four, eighty-five, eighty-six, eighty-seven, eighty-eight, eighty-nine, ninety, ninety-one, ninety-two, ninety-three, ninety-four, ninety-five, ninety-six, ninety-seven, ninety-eight, ninety-nine, one hundred, one hundred-one, one hundred-two, one hundred-three, one hundred-four, one hundred-five, one hundred-six, one hundred-seven, one hundred-eight, one hundred-nine, one hundred-ten, one hundred-eleven, one hundred-twelve, one hundred-thirteen, one hundred-fourteen, one hundred-fifteen, one hundred-sixteen, one hundred-seventeen, one hundred-eighteen, one hundred-nineteen, one hundred-twenty, one hundred-twenty-one, one hundred-twenty-two, one hundred-twenty-three, one hundred-twenty-four, one hundred-twenty-five, one hundred-twenty-six, one hundred-twenty-seven, one hundred-twenty-eight, one hundred-twenty-nine, one hundred-thirty of paragraph 3 of the List, which shall enter into force from July 12, 2026;

paragraphs forty, forty-one, forty-two, forty-three, forty-four, forty-five, forty-six, forty-seven, forty-eight, forty-nine, fifty, fifty-one, fifty-two, fifty-three, fifty-four and fifty-five of paragraph 3 of the List, which shall enter into force upon the expiration of six months after the day of the first official publication of this Resolution;

Appendix 1 to the List, which shall enter into force from July 12, 2026;

subparagraphs 2), 3) of paragraph 2, part three of paragraph 23, paragraph four of part six of paragraph 24, part seven of paragraph 24 and Chapter 4 of the Rules for Providing Electronic Banking Services, which shall enter into force from July 19, 2026;

part nine of paragraph 24 of the Rules for Providing Electronic Banking Services, which shall enter into force from July 12, 2026;

Appendices 4, 5, 6 to the List, which shall enter into force from July 12, 2026.

5. Suspend until July 12, 2026, the effect of:

paragraphs sixteen, seventeen, eighteen of paragraph 3 of the List, establishing that during the suspension period, these paragraphs shall operate in the following wording:

“4. To pass the registration in the National Bank, a payment organization submits to the National Bank through the web portal of the ‘e-government’ an application in the form according to Appendix 1 to the Rules, containing, among other things, information about the head (members) of the executive body of the payment organization (with copies of the diploma(s) and a document confirming the employment activity of the head (member) of the executive body of the payment organization in accordance with the Labor Code of the Republic of Kazakhstan).

Documents provided for in subparagraphs 2), 3), 4), 5), 6) and 7) of paragraph 2 of Article 16 of the Law on Payments and Payment Systems are also attached to the application.

A copy of the diploma(s) is not submitted in the case of integration of the web portal of the ‘e-government’ with relevant state information systems, through which such information is obtained, except for diplomas of foreign organizations of higher and (or) postgraduate education.”;

paragraphs twenty-four, twenty-five, twenty-six of paragraph 3 of the List, establishing that during the suspension period, these paragraphs shall operate in the following wording:

“15-2. An employee of the National Bank authorized to receive and register correspondence, on the day of receipt of the application, carries out its reception, registration and forwarding for execution to the department responsible for providing the state service for registration (hereinafter – the responsible department). If the application is received after the end of working hours, on weekends and holidays according to the labor legislation of the Republic of Kazakhstan, reception of applications is carried out on the next working day.

When an application is submitted by a payment organization through the web portal of the ‘e-government’, the status of acceptance of the request for the provision of a state service is automatically displayed in the personal account, indicating the date and time of receipt of the result.

The National Bank receives from relevant state information systems through the ‘e-government’ gateway information about documents confirming the identity of the head of the payment organization, and about the state registration (re-registration) of the legal entity, as well as copies of the diploma(s) of the head of the payment organization, taking into account the provision of part three of paragraph 4 of the Rules.”;

paragraph one of paragraph 2 of the Rules for Providing Electronic Banking Services, establishing that during the suspension period, this paragraph shall operate in the following wording:

“2. The Rules use concepts provided for by the laws of the Republic of Kazakhstan ‘On Banks and Banking Activity in the Republic of Kazakhstan’ (hereinafter – the Law on Banks and Banking Activity), ‘On Electronic Document and Electronic Digital Signature’, ‘On Informatization’, ‘On Payments and Payment Systems’ (hereinafter – the Law on Payments and Payment Systems), as well as the following concepts:”;

part eight of paragraph 24 of the Rules for Providing Electronic Banking Services, establishing that during the suspension period, this part shall operate in the following wording:

“Biometric authentication via IDP is carried out using available sources.”.

Chairman	T.M. Suleimenov

AGREED

Ministry of Justice

Republic of Kazakhstan

AGREED

Ministry of National Economy

Republic of Kazakhstan

AGREED

Ministry of Artificial Intelligence and Digital Development

Republic of Kazakhstan

AGREED

Agency of the Republic of Kazakhstan

for Regulation and Development

of the Financial Market

Appendix to the Resolution of the Board of the National Bank of the Republic of Kazakhstan of April 29, 2026 No. 44 ___

List of certain Resolutions

of the Board of the National Bank of the Republic of Kazakhstan,

to which amendments and additions are made

on Payment and Payment Services

1. Make the following changes to the Resolution of the Board of the National Bank of the Republic of Kazakhstan of August 31, 2016 No. 202 “On Approval of the Rules for the Issue, Use and Redemption of Electronic Money, as well as Requirements for Issuers of Electronic Money and Electronic Money Systems in the Territory of the Republic of Kazakhstan” (registered in the Registry of State Registration of Normative Legal Acts under No. 14298):

in the Rules for the Issue, Use and Redemption of Electronic Money, as well as in the Requirements for Issuers of Electronic Money and Electronic Money Systems in the Territory of the Republic of Kazakhstan, approved by the said Resolution:

paragraph 2 shall be worded as follows:

“2. The Rules use concepts provided for by Article 1 of the Law of the Republic of Kazakhstan ‘On Payments and Payment Systems’, as well as the following concepts:

1) cybersecurity – the state of protection of digital objects from violation of their confidentiality, integrity or availability;

2) cybersecurity threat – a set of conditions and factors creating prerequisites for the occurrence of a cybersecurity incident;

3) cybersecurity assurance – a process aimed at maintaining the state of confidentiality, integrity and availability of information assets of the operator of an electronic money system;

4) security procedure – a complex of organizational measures and software and technical information protection means intended to verify the rights of the owner of electronic money to use electronic money and to detect errors and (or) changes in the content of messages transmitted and received by electronic means (hereinafter – electronic message) when using electronic money;

5) information on cybersecurity incidents, including information on violations, failures in digital systems – information on failures in the operation of digital infrastructure or its individual objects occurring separately or in series, creating a threat to their proper functioning and (or) conditions for illegal receipt, copying, distribution, modification, destruction or blocking of digital resources of the operator of an electronic money system;

6) cybersecurity incident – an event or a set of events negatively affecting the cybersecurity of a digital object;

7) perimeter of protection of digital infrastructure – a set of software and hardware means separating the digital infrastructure of the operator of an electronic money system from external information networks and ensuring protection from cybersecurity threats;

8) information asset of the operator of an electronic money system – a set of information and an object of digital infrastructure used for its storage and (or) processing;

9) digital infrastructure of the operator of an electronic money system (hereinafter – digital infrastructure) – a set of objects of digital infrastructure intended to ensure the functioning of the technological environment for the purpose of forming digital resources and providing access to them;

10) internal rules of an electronic money system – rules according to which the issue, sale, purchase, redemption of electronic money are carried out, as well as operations with their use in an electronic money system;

11) personal account of the owner of electronic money – a personal section of the owner of electronic money on the Internet resource of an electronic money system, through which the owner of electronic money has access to their electronic wallet to obtain the necessary information about the balance of electronic money, operations carried out on it, make payments and other operations using electronic money in the manner provided for by the internal rules of an electronic money system and contracts concluded between the operator of an electronic money system (hereinafter – operator) or issuer and the owner of electronic money. The list of services provided through the personal account of the owner of electronic money is established by the operator;

12) exchange operations with electronic money – operations for the exchange of electronic money issued by one issuer for electronic money of another issuer, which is a participant of another electronic money system;

13) forced redemption of electronic money – an operation for the redemption of electronic money, providing for the transfer of their equal nominal value to the bank account of the owner of electronic money or to the consolidated account of the issuer before it is claimed by a physical person;

14) cessation of the issue of electronic money – cessation of the issuer’s activity in providing a payment service, providing for the issuance of electronic money to a physical person or an agent of an electronic money system (hereinafter – agent) by exchange for an amount of money equal to their nominal value;

15) blocking of an electronic wallet – a complete or partial ban on the use of electronic money stored in the electronic wallet of the owner of electronic money.”;

paragraph 24 shall be worded as follows:

“24. After making a payment using electronic money, the owner is issued a sales receipt confirming the fact of carrying out an operation using electronic money, in the form of an electronic message or on paper (hereinafter – sales receipt).

The sales receipt contains the following details:

1) payment amount;

2) time and date of the payment;

3) serial number of the sales receipt;

4) name (code) and individual identification number, business identification number of an individual entrepreneur or legal entity;

5) transaction code or another code identifying the payment in an electronic money system;

6) identification code of the electronic wallet of the sender and recipient of electronic money (unique identifier, status of identification of the owner of electronic money);

7) contact phone numbers of the operator, including mobile;

8) information about the sender of electronic money (if available);

9) information about the recipient of electronic money (supplier of goods or services);

10) operation purpose code;

11) name of the payment service provider (payment intermediary), including foreign, in whose favor the transfer of electronic money from the sender is made for payment of services of third parties not represented in the electronic money system as service providers;

12) information on the redemption of electronic money (bank, bank account number).

The reflection of additional details in the sales receipt is permitted.

When transferring electronic money from the sender to the payment service provider (payment intermediary), including foreign, for payment of services of third parties not represented in the electronic money system as service providers, the payment organization must ensure the display of the full chain of participants of the operation in the payment document (receipt, invoice, statement).”;

the title of Chapter 6 shall be worded as follows:

“Chapter 6. Remote identification of the owner of electronic money – a physical person”;

paragraphs 51, 52, 53 and 54 shall be excluded;

the title of Chapter 7 shall be worded as follows:

“Chapter 7. Requirements for software and technical means and cybersecurity management systems of operators of electronic money systems that are payment organizations”;

in paragraph 55:

subparagraph 4) shall be worded as follows:

“4) search for information by criteria and parameters defined for this digital system, with saving the request, as well as sorting information by any parameters (defined for this digital system) and the ability to view information for previous dates, if such information is subject to storage in the digital system;”;

subparagraphs 11) and 12) shall be worded as follows:

“11) registration and identification of events occurring in the digital system with saving the following attributes: date and time of the start of the event, name of the event, user performing the action, record identifier, date and time of the end of the event, result of the event execution;

12) changing passwords of accounts of security assurance means of the perimeter of protection of digital infrastructure.”;

paragraphs 56, 57, 57-1, 58, 58-1, 58-2, 58-3, 59, 60, 61, 62, 63, 64, 65 shall be worded as follows:

“56. Operators of electronic money systems ensure the creation and functioning of a cybersecurity management system, which is part of the general management system of operators of electronic money systems, intended for managing the process of cybersecurity assurance.

Operators of electronic money systems approve internal documents regulating the cybersecurity management process, including cybersecurity policy.

The procedure and periodicity of review of internal documents specified in part two of this paragraph are determined by internal documents of operators of electronic money systems.

57. The cybersecurity management system ensures the protection of information assets of operators of electronic money systems, allowing a minimum level of potential damage to the business processes of operators of electronic money systems.

57-1. An operator of an electronic money system carries out an audit of the state of cybersecurity of the perimeter of protection of digital infrastructure not less than once a year. Based on the results of the audit, a report is compiled with an attachment of audit materials, which is brought to the attention of the head of the operator of the electronic money system.

58. The operator of an electronic money system ensures a proper level of the cybersecurity management system, its development and improvement.

58-1. An operator of an electronic money system that is a payment organization that has passed registration in the National Bank, for the purpose of separating responsibility and functions in the field of cybersecurity assurance, creates a cybersecurity department that is a structural subdivision separate from other structural subdivisions dealing with the creation, maintenance and development of digital objects, or appoints a person responsible for cybersecurity assurance who is not part of the staff of structural subdivisions dealing with the creation, maintenance and development of digital objects.

The cybersecurity department or the person responsible for cybersecurity assurance coordinates work on cybersecurity assurance and controls the implementation of cybersecurity requirements defined in the internal documents of the operator of the electronic money system.

The operator of an electronic money system ensures the professional development of employees of the cybersecurity department or the person responsible for cybersecurity assurance by conducting:

1) internal events (lectures, seminars);

2) external training (attending courses, seminars – not less than once every two years for each employee).

58-2. When hiring a new employee, no later than five working days from the date of hiring, the new employee is acquainted under signature with the main requirements for cybersecurity assurance (introductory briefing). The result of acquaintance is recorded in the corresponding briefing journal or other document confirming the completion of the briefing.

The requirements of this paragraph apply to operators of electronic money systems that are payment organizations that have passed registration in the National Bank.

58-3. The employment contract concluded with an employee of an operator of an electronic money system that is a payment organization that has passed registration in the National Bank contains the obligation of the employee to comply with cybersecurity assurance requirements and non-disclosure of confidential information.

59. The operator of an electronic money system, in order to ensure confidentiality, integrity and availability of information, carries out the following functions:

1) organizes a cybersecurity management system, carries out coordination and control of activities on cybersecurity assurance and measures to identify and analyze threats, counter attacks and investigate cybersecurity incidents;

2) provides methodological support for the process of cybersecurity assurance;

3) carries out the selection, implementation and application of methods, means and mechanisms for management, assurance and control of cybersecurity within its authority;

4) carries out the collection, consolidation, storage and processing of information on cybersecurity incidents;

5) carries out analysis of information on cybersecurity incidents;

6) ensures the implementation, proper functioning of software and technical means automating the process of cybersecurity assurance, as well as providing access to them;

7) defines restrictions on the use of privileged accounts;

8) organizes and conducts events to ensure awareness of employees of operators of electronic money systems on cybersecurity issues;

9) carries out monitoring of the state of the cybersecurity management system of operators of electronic money systems;

10) periodically (but not less than once a year) informs the management of the operator of an electronic money system about the state of the cybersecurity management system;

11) maintains the schemes of the perimeter protection of digital infrastructure and the list of administrators of security assurance tools in an up-to-date state;

12) installs firewalls on the perimeter of protection of digital infrastructure;

13) ensures secure access of users to Internet resources from the perimeter of protection of digital infrastructure;

14) in case of connecting laptops or other devices to information assets of an operator of an electronic money system, which is a payment organization registered with the National Bank, from outside the perimeter of protection of the operator of an electronic money system, licensed software for organizing secure access (encryption of the communication channel, ensuring two-factor authentication) is installed on these devices.

60. The operator of an electronic money system manages cybersecurity risks by specifying criteria for acceptable levels regarding information assets.

In the event of realization of cybersecurity risks, an action plan aimed at minimizing the occurrence of such risks is developed.

61. Information about cybersecurity incidents obtained during monitoring of activities to ensure cybersecurity is subject to consolidation, systematization, and storage.

62. The retention period for information about cybersecurity incidents is not less than 5 (five) years.

63. The operator of an electronic money system determines the procedure for taking urgent measures to eliminate a cybersecurity incident, its causes, and consequences.

64. The operator of an electronic money system keeps a log of cybersecurity incidents reflecting all information about the cybersecurity incident, taken measures, and proposed corrective measures.

65. The operator of an electronic money system provides the National Bank with information about the following identified cybersecurity incidents:

1) exploitation of vulnerabilities in application and system software;

2) unauthorized access to the digital system;

3) "denial of service" attack on the digital system or data transmission network;

4) infection of a server with malware or code;

5) commission of an unauthorized transfer of electronic money due to violation of cybersecurity controls;

6) cybersecurity incidents posing a threat to the stability of the activity of the operator of an electronic money system.

Information about cybersecurity incidents specified in this paragraph is provided by the operator of an electronic money system as soon as possible, but no later than 48 hours from the moment of detection, in the form of a cybersecurity incident card according to the form set out in Appendix 2 to the Rules.

Information on processed cybersecurity incidents is submitted in electronic format using the National Bank's platform for exchanging cybersecurity events and incidents.

A separate cybersecurity incident card is filled out for each cybersecurity incident.";

part one of paragraph 66 is to be worded as follows:

«66. An operator of an electronic money system, which is a payment organization registered with the National Bank, uses a static IP address for exchanging cybersecurity events and incidents and provides information about it within ten working days from the date of registration with the National Bank.»;

part three of paragraph 68 is to be worded as follows:

«In the absence of a server room (data center) for the operator of an electronic money system, the requirements of this paragraph apply to rented premises or premises where the digital objects of the operator of an electronic money system are located.»;

Appendix 2 is to be worded in accordance with Appendix 1 to this List of certain resolutions of the Board of the National Bank of the Republic of Kazakhstan, to which amendments and additions are made regarding payments and payment services (hereinafter – the List).

2. Make the following amendment to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 212 "On Approval of the Rules for Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Separate Types of Banking Operations to Provide Electronic Banking Services" (registered in the Registry of State Registration of Normative Legal Acts under No. 14337):

The Rules for Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Separate Types of Banking Operations to Provide Electronic Banking Services, approved by the said resolution, are to be worded in accordance with Appendix 2 to the List (hereinafter – Rules for Providing Electronic Banking Services).

3. Make the following changes and additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 215 "On Approval of the Rules for Organizing the Activity of Payment Organizations" (registered in the Registry of State Registration of Normative Legal Acts under No. 14347):

in the Rules for Organizing the Activity of Payment Organizations, approved by the said resolution:

part two of paragraph 1 is to be worded as follows:

«The procedure for organizing the activity of payment organizations includes the registration of payment organizations with the National Bank of the Republic of Kazakhstan (hereinafter – the National Bank), the maintenance by the National Bank of a register of payment organizations (hereinafter – the register), the provision of payment services by payment organizations, notification by payment organizations of the opening of branches, requirements for software and technical means of payment organizations and the cybersecurity management system.»;

paragraph 2 is to be worded as follows:

«2. The Rules use concepts provided for by the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law on Payments and Payment Systems), and the following concepts:

1) cybersecurity – the state of protection of digital objects against violation of their confidentiality, integrity, or availability;

2) cybersecurity threat – a set of conditions and factors creating prerequisites for the occurrence of a cybersecurity incident;

3) cybersecurity assurance – a process aimed at maintaining the state of confidentiality, integrity, and availability of information assets of a payment organization;

4) information asset of a payment organization – a combination of information and an object of digital infrastructure used for its storage and/or processing;

5) digital infrastructure of a payment organization (hereinafter – digital infrastructure) – a combination of objects of digital infrastructure intended to ensure the functioning of the technological environment for the formation of digital resources and providing access to them;

6) information about cybersecurity incidents, including information about violations and failures in digital systems – information about individually or serially occurring failures in the operation of digital infrastructure or its individual objects, creating a threat to their proper functioning and/or conditions for illegal obtaining, copying, distribution, modification, destruction, or blocking of digital resources of a payment organization;

7) cybersecurity incident – an event or a set of events negatively affecting the cybersecurity of a digital object;

8) perimeter of protection of digital infrastructure – a combination of software and hardware tools separating the digital infrastructure of a payment organization from external information networks and ensuring protection against cybersecurity threats.»

paragraph 4 is to be worded as follows:

«4. To pass registration with the National Bank, a payment organization submits to the National Bank through the "digital government" web portal an application in the form according to Appendix 1 to the Rules, containing, among other things, information about the head (members) of the executive body of the payment organization (with attached copies of the diploma(s) and a document confirming the employment activity of the head (member) of the executive body of the payment organization in accordance with the Labor Code of the Republic of Kazakhstan.

Documents provided for by subparagraphs 2), 3), 4), 5), 6) and 7) of paragraph 2 of Article 16 of the Law on Payments and Payment Systems are also attached to the application.

A copy of the diploma(s) is not submitted if there is integration of the "digital government" web portal with corresponding state digital systems through which such information is obtained, except for diplomas of foreign higher and/or postgraduate education institutions.»;

subparagraph 7) of paragraph 7 is to be worded as follows:

«7) the procedure for compliance with cybersecurity measures;»;

paragraph 12-1 is to be worded as follows:

«12-1. A payment organization that has passed registration with the National Bank, in case of the need to include additional payment services in the list of provided payment services, submits to the National Bank documents provided for by subparagraphs 2), 3), 4) and 7) of paragraph 2 of Article 16 of the Law on Payments and Payment Systems, with amendments and/or additions taking into account the planned payment services to be provided within ten calendar days from the date of making such amendments and/or additions.»;

paragraph 15-2 is to be worded as follows:

«15-2. An employee of the National Bank authorized to receive and register correspondence receives, registers, and directs the application for execution to the department responsible for providing the state service for registration (hereinafter – the responsible department) on the day of receipt of the application. If the application is received after the end of working hours, on weekends, and holidays according to the labor legislation of the Republic of Kazakhstan, applications are accepted on the next working day.

When a payment organization submits an application through the "digital government" web portal, the status of acceptance of the request for providing the state service is automatically displayed in the personal account, indicating the date and time of receiving the result.

The National Bank receives from corresponding state digital systems through the "digital government" gateway information about documents certifying the identity of the head of the payment organization and about the state registration (re-registration) of the legal entity, as well as copies of the diploma(s) of the head of the payment organization, taking into account the provisions of part three of paragraph 4 of the Rules.»;

part four of paragraph 15-4 is to be worded as follows:

«On the "digital government" web portal, the result of providing the state service for registration is sent to the payment organization to its personal account in the form of an electronic document certified by an electronic digital signature (hereinafter – EDS) of an authorized person.»;

paragraph 15-5 is to be worded as follows:

«15-5. Information about the stage of providing the state service for registration is updated automatically in the digital system for monitoring the provision of state services.»;

part one of paragraph 23-1 is to be worded as follows:

«23-1. Issuing consent for the voluntary reorganization of a payment organization is carried out upon submission by the payment organization to the National Bank through the "digital government" web portal of a decision on voluntary reorganization.»;

part four of paragraph 23-4 is to be worded as follows:

«On the "digital government" web portal, the result of providing the state service for voluntary reorganization is sent to the payment organization to its personal account in the form of an electronic document certified by an EDS of an authorized person.»;

paragraph 23-5 is to be worded as follows:

«23-5. Information about the stage of providing the state service for voluntary reorganization is updated automatically in the digital system for monitoring the provision of state services.»;

to add paragraph 24-1 of the following content:

«24-1. By payment organizations that are operators of electronic money systems, in cases provided for by the Law on Payments and Payment Systems, biometric authentication of owners of electronic money is carried out through the National Bank's Data Exchange Center for Identification Data (hereinafter – DECID), the functioning of which is provided for by the Law on Payments and Payment Systems.

Biometric authentication of owners of electronic money through DECID is carried out in the manner provided for by the Rules for Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Separate Types of Banking Operations to Provide Electronic Banking Services, approved by the Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 212 dated August 31, 2016 (registered in the Registry of State Registration of Normative Legal Acts under No. 14337).»;

paragraph 25 is to be worded as follows:

«25. When a payment organization provides payment services provided for by subparagraphs 1) and 4) of paragraph 3 of the Rules, the document confirming the fact of providing the payment service contains the following details:

1) document number, date and time of its issuance;

2) name of the payment organization;

3) transaction amount;

4) currency of the transaction;

5) amount of commission fee;

6) purpose of payment;

7) name of the service provider;

8) name of the payment service provider (payment intermediary), including foreign, participating in the transaction;

9) Merchant Category Code (MCC) (in case of providing a payment service provided for by subparagraph 4) of paragraph 3 of the Rules);

10) name or bank identification code of the bank, branch of a non-resident bank of the Republic of Kazakhstan, or organization carrying out separate types of banking operations, to which (to which) the payment organization provides information for making payment and/or transfer or accepting money for these payments in accordance with subparagraph 9) of paragraph 1 of Article 12 of the Law on Payments and Payment Systems (in case of providing a payment service provided for by subparagraph 4) of paragraph 3 of the Rules);

11) transaction identifier within the payment organization's system;

12) unique 12-digit transaction identifier (Reference Retrieval Number or Receiver Reference Number) and other technical details (in case of providing a payment service provided for by subparagraph 4) of paragraph 3 of the Rules).

The use of abbreviations, trade designations, acronyms, and codes allowing ambiguous interpretation is not allowed when indicating names.

It is permitted for the payment organization to add additional details to the document confirming the fact of providing the payment service regarding the provided payment service.»;

the heading of Chapter 6 is to be worded as follows:

«Chapter 6. Requirements for Software and Technical Means of Payment Organizations and Cybersecurity Management System»;

in paragraph 34:

subparagraph 4) is to be worded as follows:

«4) search for information by criteria and parameters defined for a given digital system, with saving the query, as well as sorting information by any parameters (defined for a given digital system) and the ability to view information for previous dates, if such information is subject to storage in the digital system;»;

subparagraphs 11) and 12) are to be worded as follows:

«11) registration and identification of events occurring in the digital system with saving the following attributes: date and time of the start of the event, name of the event, user performing the action, record identifier, date and time of the end of the event, result of the event execution;

12) changing passwords of accounts of security assurance tools for the perimeter of protection of digital infrastructure.»;

paragraphs 35, 36, 36-1, 37, 37-1, 37-2, 37-3, 38, 39, 40, 41, 42, 43 and 44 are to be worded as follows:

«35. Payment organizations ensure the creation and functioning of a cybersecurity management system, which is part of the overall management system of the payment organization, designed to manage the process of ensuring cybersecurity.

The payment organization approves internal documents regulating the cybersecurity management process, including the cybersecurity policy.

The procedure and frequency of review of the internal documents specified in part two of this paragraph are determined by the internal documents of the payment organization.

36. The cybersecurity management system ensures the protection of information assets of the payment organization, allowing for a minimal level of potential damage to the business processes of the payment organization.

36-1. The cybersecurity department or the person responsible for ensuring cybersecurity conduct security assessments no less than once a year. Based on the results of the assessment, the cybersecurity department or the person responsible for ensuring cybersecurity prepares a report with attached assessment materials, which is brought to the attention of the head of the payment organization.

37. The payment organization ensures an adequate level of the cybersecurity management system, its development, and improvement.

37-1. In the payment organization, for the purpose of separating responsibilities and functions in the field of ensuring cybersecurity, a cybersecurity department is created, which is a structural unit separate from other structural units dealing with the creation, maintenance, and development of digital objects, or a person responsible for ensuring cybersecurity is appointed who is not part of the staff of structural units dealing with the creation, maintenance, and development of digital objects.

The cybersecurity department or the person responsible for ensuring cybersecurity coordinates work on ensuring cybersecurity and monitors compliance with cybersecurity requirements defined in the internal documents of the payment organization.

The payment organization ensures the professional development of employees of the cybersecurity department or the person responsible for ensuring cybersecurity by conducting:

1) internal events (lectures, seminars);

2) external training (attending courses, seminars – no less than once every two years for each employee).

37-2. Upon hiring a new employee, no later than five working days from the date of hiring, the new employee is introduced to the main requirements for ensuring cybersecurity (introductory briefing) under signature. The result of the introduction is recorded in the corresponding briefing journal or other document confirming the completion of the briefing.

37-3. The employment contract concluded with an employee of the payment organization contains the obligation of the employee to comply with requirements for ensuring cybersecurity and non-disclosure of confidential information.

38. The payment organization carries out the following functions to ensure the confidentiality, integrity, and availability of information of the payment organization:

1) organizes the cybersecurity management system, coordinates and monitors activities to ensure cybersecurity and measures to identify and analyze threats, counter attacks, and investigate cybersecurity incidents;

2) provides methodological support for the process of ensuring cybersecurity;

3) selects, implements, and applies methods, means, and mechanisms for managing, ensuring, and controlling cybersecurity within its authority;

4) collects, consolidates, stores, and processes information about cybersecurity incidents;

5) analyzes information about cybersecurity incidents;

6) ensures the implementation and proper functioning of software and technical means automating the process of ensuring cybersecurity, as well as providing access to them;

7) defines restrictions on the use of privileged accounts;

8) organizes and conducts events to ensure awareness of employees of the payment organization on cybersecurity issues;

9) monitors the state of the cybersecurity management system of the payment organization;

10) periodically (but no less than once a year) informs the management of the payment organization about the state of the cybersecurity management system of the payment organization;

11) maintains the schemes of the perimeter protection of digital infrastructure and the list of administrators of security assurance tools in an up-to-date state;

12) installs firewalls on the perimeter of protection of digital infrastructure;

13) ensures secure access of users to Internet resources from the perimeter of protection of digital infrastructure;

14) in case of connecting laptops or other devices to information assets of the payment organization from outside the perimeter of protection of the payment organization, licensed software for organizing secure access (encryption of the communication channel, ensuring two-factor authentication) is installed on these devices.

39. The payment organization manages cybersecurity risks by specifying criteria for acceptable levels regarding information assets.

In the event of realization of cybersecurity risks, an action plan aimed at minimizing the occurrence of such risks is developed.

40. Information about cybersecurity incidents obtained during monitoring of activities to ensure cybersecurity is subject to consolidation, systematization, and storage.

41. The retention period for information about cybersecurity incidents is not less than 5 (five) years.

42. The payment organization determines the procedure for taking urgent measures to eliminate a cybersecurity incident, its causes, and consequences.

43. A log of cybersecurity incidents is kept in the payment organization reflecting all information about the cybersecurity incident, taken measures, and proposed corrective measures.

44. The payment organization provides the National Bank with information about the following identified cybersecurity incidents:

1) exploitation of vulnerabilities in application and system software;

2) unauthorized access to the digital system;

3) "denial of service" attack on the digital system or data transmission network;

4) infection of a server with malware or code;

5) commission of an unauthorized transfer of funds due to violation of cybersecurity controls;

6) cybersecurity incidents posing a threat to the stability of the activity of the payment organization.

Information about cybersecurity incidents specified in this paragraph is provided by the payment organization as soon as possible, but no later than 48 hours from the moment of detection, in the form of a cybersecurity incident card according to the form set out in Appendix 7 to the Rules.

Information on processed cybersecurity incidents is submitted in electronic format using the National Bank's platform for exchanging cybersecurity events and incidents.

A separate cybersecurity incident card is filled out for each cybersecurity incident.»;

part one of paragraph 45 is to be worded as follows:

«45. For connecting to the National Bank's platform for exchanging cybersecurity events and incidents, the payment organization uses a static IP address and provides information about it within ten working days from the date of passing registration with the National Bank.»;

part three of paragraph 47 is to be worded as follows:

"In the absence of a server room (data center) in a payment organization, the requirements of this paragraph apply to rented premises or premises where the digital objects of the payment organization are located."

rephrase the title of Chapter 7 as follows:

"Chapter 7. Procedure for updating information on the registration of a payment organization in the digital system 'State Database 'E-licensing';

rephrase paragraph 50 as follows:

"50. Updating information on the registration of a payment organization in the digital system 'State Database 'E-licensing' is carried out in the following cases:

1) change of the name of the payment organization;

2) inclusion of additional payment services in the list of payment services provided;

3) exclusion of certain payment services from the list of payment services provided."

rephrase paragraphs 52 and 53 as follows:

"52. The National Bank makes the corresponding changes to the information on the registration of a payment organization in the digital system 'State Database 'E-licensing'.

53. In the event of the exclusion of a payment organization from the registry of payment organizations, the National Bank makes the corresponding record of the termination of the registration in the digital system 'State Database 'E-licensing'.";

rephrase Appendices 1 and 2 in accordance with Appendices 3 and 4 to the List;

in Appendix 5:

in the List of Main Requirements for Providing the State Service "Issuing Consent for Voluntary Reorganization (Merger, Consolidation, Division, Separation, Transformation) of Payment Organizations":

rephrase line 2 as follows:

"

2.	Methods of providing the state service	Web portal 'digital government' www.egov.kz, www.elicense.kz (hereinafter - portal).

";

rephrase line 7 as follows:

"

7.	Schedule of the service provider, the State Corporation and digital objects	1) service provider - from Monday to Friday from 9.00 to 18.30 with a lunch break from 13.00 to 14.30, except weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. Schedule for receiving documents and issuing results of the state service - from Monday to Friday from 9.00 to 17.30 with a lunch break from 13.00 to 14.30; 2) portal - around the clock, except for technical breaks due to maintenance work (if the service recipient contacts after the end of working hours, on weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan, receiving applications and issuing the results of the state service is carried out on the next working day).

";

rephrase Appendices 6 and 7 in accordance with Appendices 5 and 6 to the List.

Appendix 1
to the List of some resolutions

Board of the National Bank

of the Republic of Kazakhstan,

in which changes

and additions are made regarding payments

and payment services

Appendix 2
to the Rules for the issuance,

use and redemption

of electronic money, as well as requirements for issuers

electronic money and systems

electronic money

on the territory

of the Republic of Kazakhstan

Form

Cybersecurity Incident Card

No.	General Information
Characteristics of the cybersecurity incident	Information about the cybersecurity incident
1	Name of the cybersecurity incident
2	Date and time of detection (dd.mm.yyyy and hh:mm with time zone UTC+X)
3	Place of detection (organization, branch, segment of digital infrastructure)
4	Source of information about the cybersecurity incident (user, administrator, cybersecurity administrator, employee of the cybersecurity department or technical means)
5	Methods used in the implementation of the cybersecurity incident (social engineering, malware injection)
Content of the cybersecurity incident
6	Symptoms, signs of the cybersecurity incident
7	Main events (exploitation of vulnerabilities in application and system software; unauthorized access to the digital system; denial of service attack on the digital system or data transmission network; server infection with malware or code; unauthorized transfer of funds; cybersecurity incidents posing a threat to the stability of the electronic money system operator's activities)
8	Affected assets (physical level of digital infrastructure, network equipment level, network application and service level, operating system level, technology process and application level, and electronic money system operator's business process level)
9	Status of the cybersecurity incident (completed cybersecurity incident, attempt to commit a cybersecurity incident, suspicion of a cybersecurity incident)
10	Damage
11	Threat source (identified identifiers)
12	Intentionality (intentional, accidental)
Actions taken regarding the cybersecurity incident
13	Actions taken (vulnerability identification, blocking, recovery)
14	Planned actions aimed at minimizing the occurrence of cybersecurity risks
15	Notified persons (full name (if any) of officials, names of government agencies, organizations)
16	Attracted specialists (full name (if any), place of work, position, phone number)

Responsible Cybersecurity Worker

---

(full name (if any) (signature)

Date "____" ______ 20 ___ year

Appendix 2
to the List of some resolutions

Board of the National Bank

of the Republic of Kazakhstan,

in which changes

and additions are made regarding payments

and payment services

Approved

by the resolution of the Board

of the National Bank

of the Republic of Kazakhstan

of August 31, 2016 No. 212

Rules for the provision of electronic banking services by banks, branches of non-resident banks

of the Republic of Kazakhstan and organizations carrying out certain types of banking operations

Chapter 1. General Provisions

1. These Rules for the provision of electronic banking services by banks, branches of non-resident banks of the Republic of Kazakhstan and organizations carrying out certain types of banking operations (hereinafter - Rules) are developed in accordance with subparagraph 37) of the second paragraph of part two of paragraph 19 of the Regulation on the National Bank of the Republic of Kazakhstan, approved by the Decree of the President of the Republic of Kazakhstan dated December 31, 2003 No. 1271 "On Approval of the Regulation and Structure of the National Bank of the Republic of Kazakhstan", and determine the procedure for the provision of electronic banking services by banks, branches of non-resident banks of the Republic of Kazakhstan and organizations carrying out certain types of banking operations (hereinafter - banks).

The procedure for the provision of electronic banking services by banks includes the provision of electronic banking services, security procedures, measures against unauthorized access, suspension and termination of the provision of electronic banking services, storage of electronic documents when providing electronic banking services.

The Rules do not apply to services related to the acceptance of payments using payment cards on behalf of persons selling goods and services on the Internet (internet acquiring).

2. The Rules use concepts provided for by the laws of the Republic of Kazakhstan "On Banks and Banking Activity in the Republic of Kazakhstan" (hereinafter - Law on Banks and Banking Activity), "On Payments and Payment Systems" (hereinafter - Law on Payments), digital legislation of the Republic of Kazakhstan, as well as the following concepts:

1) authentication - confirmation of the authenticity and correctness of the composition of an electronic document in accordance with the requirements of the security procedure;

2) operational documentation of the open banking system operator - internal documents approved by the open banking system operator, defining technical and organizational requirements for the interaction of participants of the open banking system, including application programming interface (API) standards, cybersecurity requirements, service availability levels and indicators, request processing times, formats and other requirements of the open banking system operator;

3) open banking system operator - the national center for managing the national digital financial infrastructure, carrying out the collection, storage and processing of client consents of participants of the open banking system to provide electronic banking services by third-party payment service providers based on the client's consent, identification of clients of participants of the open banking system, maintenance of the registry of authorized payment service providers, information exchange between payment service providers;

4) one-time (single-use) code - a unique sequence of electronic digital symbols created by software and technical means at the client's request and intended for single use when providing the client with access to electronic banking services;

5) dynamic identification - a procedure for establishing the identity of a client with the aim of unambiguously confirming his rights to receive electronic banking services by using a one-time (single-use) code;

6) security procedure - a set of organizational measures and software and technical means for information protection intended for identifying the client when composing, transmitting and receiving electronic documents with the aim of establishing his rights to receive electronic banking services and detecting errors and/or changes in the content of transmitted and received electronic documents;

7) access code - a unique sequence of electronic digital symbols (from four to six digits) established by the client or automatically generated by payment service provider systems, used to log in to the mobile application and/or confirm the operations performed by the client, including making payments and transfers;

8) unique user identifier - a digital, letter or containing other symbols code assigned by the bank to the client to log in to the bank system, in which access to electronic banking services is provided;

9) password - a set of digital, letter and other symbols created to confirm the rights to log in to the bank system to receive electronic banking services;

10) Data Exchange Center (CDE) - a digital system providing interaction with financial and payment organizations for the exchange of client data from available sources for conducting identification procedures, including biometric authentication of clients;

11) CDE Rules - internal rules of the national center for managing the national digital financial infrastructure regulating the procedure for providing CDE services to banks when conducting identification (authentication) procedures for clients;

12) electronic document - a document in which information is presented in electronic-digital form and verified by identification means, composed by the sender and containing no distortions and/or changes made to it after composition, in the manner provided for by the Rules;

13) electronic payment services - electronic banking services related to the conduct of payments and/or money transfers, foreign exchange operations using a bank account and carrying out other types of banking operations not related to information banking services.

Chapter 2. Provision of Electronic Banking Services

3. Electronic banking services are provided via remote access systems, including via the Internet resource and/or mobile application.

4. When opening an Internet resource or mobile application for the provision of electronic banking services, the bank notifies the National Bank (hereinafter - National Bank) in writing within ten working days after the day of opening the Internet resource or mobile application.

The notification contains:

1) the domain name and electronic address of the Internet resource, as well as the identifier of the mobile application, including links to mobile applications in the corresponding app stores;

2) the list of electronic banking services provided via the Internet and mobile application;

3) confirmation of the presence in the bank of approved security procedures and protection against unauthorized access when providing electronic banking services.

5. When changing the domain name, electronic address of the Internet resource or identifier of the mobile application, the bank notifies the National Bank in writing within ten working days from the date of changes.

6. The bank provides electronic banking services only for banking operations provided for by the license issued by the authorized state body.

Before providing electronic banking services, the bank ensures that the client is informed about the amount of the commission charged in monetary terms for the electronic banking services provided.

When providing payment services through an electronic terminal, it is permissible to indicate the amount of the commission charged in monetary terms after the client has deposited cash into the terminal.

7. The bank develops and approves procedures and takes measures to prevent the use of existing or implemented methods and technologies for providing electronic banking services in schemes for legalization (money laundering) of proceeds obtained criminally, terrorism financing and financing of the proliferation of weapons of mass destruction.

When providing electronic banking services, the bank applies the necessary measures provided for by the Law of the Republic of Kazakhstan

"On Countering the Legalization (Money Laundering) of Proceeds Obtained Criminaly, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction" (hereinafter - Law on AML/CFT/WMD), and also ensures the implementation of the functions of a currency control agent.

8. Electronic banking services are provided using identification means provided for by the Law on Payments and Payment Systems, in accordance with the procedure established by the Rules. The provision of electronic banking services by a bank to a client using an electronic digital signature is carried out if the client has an electronic digital signature certificate issued by an accredited certification center of the Republic of Kazakhstan or a foreign certification center registered in the trusted third party of the Republic of Kazakhstan.

9. Electronic banking services are provided to the client based on a contract for the provision of electronic banking services or a banking service contract containing a condition for the provision of electronic banking services (hereinafter - contract).

10. The contract contains the following conditions:

1) the list of electronic banking services;

2) the procedure and maximum term for the provision of electronic banking services;

3) methods (method) of providing electronic banking services and accessing them (via the Internet, telecommunications means, digital technologies, software and equipment or other devices);

4) the amounts of commissions charged or the indication of the Internet resource containing information about them, and the procedure for their collection;

5) the procedure and terms for the bank to provide confirmation of the sending and/or receipt of electronic documents, on the basis of which the client is provided with electronic banking services;

6) the rights and obligations of the parties;

7) security procedures, as well as the procedure for authentication and confirmation of the client's rights to receive electronic banking services;

8) the liability of the parties for non-performance or improper performance of their obligations under the contract;

9) grounds for suspension, termination of the provision of electronic banking services, indicating the procedure and form of notification of the client;

10) the procedure for submitting claims and methods for resolving disputes arising when the bank provides electronic banking services;

11) contact phone numbers and addresses, including for contacting the bank on issues related to the provision of electronic banking services;

12) a condition on the bank's confidentiality of information received from the client when providing electronic banking services;

13) the client's right to terminate the contract;

14) the procedure for determining the exchange rate applied when providing electronic banking services in foreign currency.

It is permissible to include other conditions in the contract not contained in this paragraph.

11. When concluding a contract, the bank provides the client with information about electronic banking services.

12. If the contract refers to an electronic document posted on the bank's Internet resource and containing additional conditions to the contract, the bank ensures that the client has unrestricted access to the specified electronic document during the term of the contract.

13. If the bank provides an electronic banking service via the Internet, the procedure and conditions for providing electronic banking services are determined by the bank's internal documents, which are posted on the bank's Internet resource.

14. Electronic payment services are provided to legal entities using the following identification methods: electronic digital signature, dynamic identification, biometric authentication of their authorized persons.

15. Electronic payment services are provided to individuals using one of the following identification methods: electronic digital signature, dynamic identification, biometric authentication or unique user identifier and password.

16. Banks, when providing electronic banking services, carry out identification of the client's identity using biometric authentication means when:

1. exceeding the total amount of money transfers by a client - an individual to another client - an individual of two million tenge within a calendar day. Biometric authentication is carried out in conjunction with the use of dynamic identification;
2. changing the access code and/or password to the mobile application;
3. primary registration of the client in the mobile application and/or Internet resource of the bank.

17. When using dynamic identification to obtain electronic payment services by individuals and legal entities, a one-time (single-use) code is created by the bank and sent to the client in accordance with the terms of the contract concluded between them.

It is permissible for the client to use a device generating a one-time (single-use) code to obtain electronic payment services. The device generating a one-time (single-use) code is assigned to a specific authorized person of a legal entity for carrying out certain operations within the scope of their authority.

It is permissible to use one device generating a one-time (single-use) code by one authorized person of several affiliated legal entities serviced by one bank based on corresponding authorization documents. These powers are provided in accordance with paragraph 47 of the Rules for the opening, maintenance and closing of bank accounts of clients, approved by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 207 "On Approval of the Rules for the Opening, Maintenance and Closing of Bank Accounts of Clients" (registered in the Registry of State Registration of Normative Legal Acts under No. 14422).

The use of a device generating a one-time (single-use) code is carried out by entering a personal identification number into it and specifying a set of other identification means when accessing services (unique user identifier, password).

It is not permissible for an authorized person of a legal entity to use a device generating a one-time (single-use) code belonging to another authorized person.

18. When using dynamic identification, a new one-time (single-use) code must be created for each access to electronic payment services.

When a client accesses electronic payment services again, a new one-time (single-use) code must be created and used.

19. Information banking services are provided using one of the following identification methods: electronic digital signature, dynamic identification, biometric authentication or unique identifier and password. The password is used on a multiple basis or changed at the client's discretion.

20. The use of a unique user identifier and password specified in the bank system to access electronic payment services is not recognized as dynamic identification.

21. It is permissible for the bank to transfer to third parties, based on a contract for the provision of paid services, the execution of information and technological functions necessary for the provision of electronic banking services (hereinafter - outsourcing contract). The outsourcing procedure for providing electronic banking services is determined by the bank's internal documents and the outsourcing contract and is carried out in accordance with the requirements of paragraphs 16, 17 of Article 13 of the Law on Payments and Payment Systems.

Chapter 3. Conducting Biometric Authentication

via CDE

22. When providing electronic banking services, business relations with the client are established remotely in accordance with the Requirements for Due Diligence of Clients in Case of Remote Establishment of Business Relations by Financial Monitoring Subjects, approved by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated June 29, 2018 No. 140 "On Approval of the Requirements for Due Diligence of Clients in Case of Remote Establishment of Business Relations by Financial Monitoring Subjects" (registered in the Registry of State Registration of Normative Legal Acts under No. 17250).

23. Banks, when providing electronic banking services, for the purpose of identifying the client's identity, use the services of the CDE for providing biometric authentication when:

1) establishing business relations with the client remotely by opening a bank account;
2) creating by a bank, which is an accredited certification center of the Republic of Kazakhstan, an electronic digital signature and issuing an electronic digital signature certificate to the client, in cases provided for by part two of this paragraph;
3) exceeding the amount of a bank loan by the size established by a normative legal act of the authorized body for regulation, control and supervision of the financial market and financial organizations;
4) the bank conducting periodic updates of client data in accordance with the Law on AML/CFT/WMD.

In the event that the client has not previously been identified in person at the bank or using biometric authentication via the CDE, the bank creates the client's electronic digital signature and issues an electronic digital signature certificate upon the client passing biometric authentication via the CDE.

The client's consent for the creation of electronic digital signature keys and issuance of an electronic digital signature certificate, including those obtained when the client is present in the bank in person, is stored in the Centralized Database of Identification Data (CDID) with the possibility of the client revoking previously issued consents.

Consents of clients obtained via the CDID, as well as the results of biometric authentication by the CDID, are subject to storage in the CDID for no less than five years from the moment of their receipt and processing.

Banks ensure the storage of information about client consents, the client's photo image using liveness detection technology, and the recording of a video conference session with the client, as well as the results of biometric authentication used in providing electronic banking services, for no less than five years from the date of termination of business relations with the client.

24. In cases provided for by paragraph 23 of the Rules, the bank obtains the client's consent to conduct biometric authentication and the client's consent to the collection, processing, and provision, including to third parties if necessary, of his personal data, confirmed by means of an identification tool.

The bank conducts a video conference session with the client using devices available to the client and/or other devices of the bank, or uses the client's liveness detection technology using the CDID or independently chosen third-party solutions.

The substantive part of the video conference session (list of control questions, if any), as well as the list and volumes of services provided by banks, are established by the banks independently.

The bank transmits to the CDID the client's individual or business identification number and the client's photo image obtained from the video conference session or using the liveness detection technology of the interviewed person during biometric authentication.

The CDID, using software, determines the degree of compliance of the biometric indicators of the photo image obtained from the video conference session or when using the client's liveness detection technology with the client's photo image from available sources. Video recordings of client appeals are stored in the bank.

Banks transmit to the CDID the client's consent:

to the collection and processing of the client's personal data, including biometric data;

to conduct biometric authentication of the client using the CDID;

to the creation of electronic digital signature keys and issuance of an electronic digital signature certificate, including those obtained when the client is present in the bank in person.

The CDID carries out the collection and registration of the client's consent provided for by part 6 of this paragraph of the Rules, with the possibility of the client revoking them in accordance with the legislation of the Republic of Kazakhstan.

Biometric authentication via the CDID is carried out using available sources and/or biometric data of the national biometric authentication system, the functioning of which is provided for by the Digital Code of the Republic of Kazakhstan (hereinafter – the national biometric authentication system).

Photo images of clients transmitted by banks to the CDID from the video conference session or using the liveness detection technology are used by the CDID for the purposes of biometric authentication and/or filling the database of biometric data of the national biometric authentication system.

Banks receive information about the results of biometric authentication via the CDID in accordance with the CDID Rules.

25. The provision of additional services by the CDID to banks for client identification, provided for by the CDID Rules, is permitted. The CDID Rules are posted on the official Internet resource of the National Center for the Management of the National Digital Financial Infrastructure.

26. When providing electronic banking services, the bank uses a system and/or software and technical means that automate the process of countering unauthorized payments and/or money transfers.

Chapter 4. Provision of payment services and information banking services by a third-party payment service provider

27. It is permitted to provide the client with electronic banking services by a third-party payment service provider through the open banking system with his consent.

When interacting with the open banking system, the bank uses the CDID to register consent for the exchange of information about bank accounts and other information containing personal data and banking secrecy, as well as for initiating payments and money transfers through the remote access system of the third-party payment service provider.

28. The following electronic services are provided by third-party payment service providers:

providing access to information about the client's bank accounts opened with other payment service providers (hereinafter – the account aggregation service);

providing the client with the opportunity to initiate a payment and/or money transfer from the client's bank account opened with another payment service provider at the client's request;

information banking services.

The electronic services specified in the second and third paragraphs of part 1 of this paragraph are not provided for bank accounts whose operating mode in the remote access system of the payment service provider does not support the provision of information in real-time mode.

29. Electronic banking services through the open banking system are provided upon fulfillment of the following conditions:

1) the presence of a third-party payment service provider receiving access to the client's bank account in the registry of payment service providers authorized in the open banking system;

2) the presence of the client's consent to the collection and processing of personal data and information constituting banking secrecy, provided through the open banking system and confirmed by means of an identification tool (hereinafter – the client's consent provided through the open banking system).

30. Authorization of a third-party payment service provider includes its verification by the operator of the open banking system for compliance with operational documentation, the presence of positive testing results, and the first head of the third-party payment service provider registering in the open banking system by two-factor authentication.

The operator maintains a registry of payment service providers authorized in the open banking system and posts it on its Internet resource.

31. The operator of the open banking system refuses to authorize a third-party payment service provider to work in the open banking system in the following cases:

1) non-compliance with the requirements of the operational documentation of the operator of the open banking system;

2) failure to submit or submission of unreliable information and/or documents necessary for authorization in the open banking system;

3) failure to pass testing of the open banking system;

4) failure to observe necessary information protection measures;

5) the presence of facts of non-performance or improper performance of obligations by the third-party payment service provider in other payment systems of the National Bank;

6) the presence of a decision of a state body carrying out state regulation, control, and supervision of the financial market and financial organizations on suspension of action or revocation of a license to conduct banking operations.

32. The client's consent provided through the open banking system contains:

1) the name of the third-party payment service provider to whom consent is given;

2) the number of the bank account to which access is provided;

3) the type of service for which the client's consent is provided;

4) the date and time of provision, as well as the validity period of the consent.

33. To initiate an electronic banking service through the remote access system of the third-party payment service provider, the client authorizes in the remote access system of the third-party payment service provider by the method established in the contract between them.

34. After authorization in the remote access system of the third-party payment service provider, the client provides consent to the collection and processing of data through the open banking system.

35. Upon receipt or having previously received the client's consent provided through the open banking system, based on the request of the third-party payment service provider, the operator of the open banking system sends a request to the payment service provider servicing the client's bank account to obtain the information requested by the client.

The operator of the open banking system transmits the information obtained as a result of the service provision from the payment service provider servicing the client's bank account to the third-party payment service provider in compliance with the operational documentation of the operator of the open banking system.

36. When the client initiates the account aggregation service, the third-party payment service provider notifies the client of the result of the service provision in its remote access system and displays the corresponding information to the client.

37. When the client initiates a payment and/or money transfer, the payment service provider servicing the client's bank account executes the client's instruction received through the remote access system of the third-party payment service provider in the manner and timeframes established by the Law on Payments and Payment Systems, in compliance with the operational documentation of the operator of the open banking system.

38. If the client does not provide consent to the collection and processing of data in the open banking system, the electronic banking service is not provided.

39. The maximum validity period of the client's consent provided through the open banking system is no more than thirty calendar days.

The client has the right at any time before the expiration of the validity period to revoke the provided consent by initiating a corresponding request in the open banking system.

After the expiration of the validity period of the consent, the third-party payment service provider is not entitled to use the previously obtained information, except for storage purposes in accordance with the requirements of the legislation of the Republic of Kazakhstan.

40. All client consents to the collection and processing of data and revocations of such consents are registered and stored by the operator in the open banking system.

41. The third-party payment service provider ensures the use of client data exclusively in accordance with the purpose of collection of this data.

42. The third-party payment service provider is liable to the client and the payment service provider servicing the client's bank account for the consequences of unauthorized payments and/or fraudulent actions on payments and/or money transfers initiated through its remote access system.

Chapter 5. Security Procedures

43. The provision of electronic banking services by the bank is carried out in accordance with security procedures established by the bank's internal documents and the contract.

44. Security procedures ensure:

1) reliable identification (authentication) of the client and his right to receive the corresponding electronic banking services;

2) identification of the presence of distortions and/or changes in the content of electronic documents on the basis of which electronic banking services are provided to the client;

3) protection against unauthorized access to personal data and information constituting banking secrecy, and integrity of this information.

45. The provision of electronic banking services is considered authorized in the case of the client fulfilling the security procedures established by the bank's internal documents and the contract.

46. The bank ensures the storage of confirmation of the sending and/or receipt of messages on the basis of which electronic banking services are provided to the client.

47. On the Internet resource or mobile application, the bank provides the client with confirmation of the provision of electronic banking services in the manner and timeframes provided for by the contract.

48. When providing electronic banking services or payment services to individuals and legal entities, banks ensure security procedures against unauthorized access to electronic banking services and/or payments and money transfers.

Chapter 6. Measures against Unauthorized Access

49. Upon detection of unauthorized access to personal data and information constituting banking secrecy, their unauthorized modification, execution of a payment with signs of fraud or unauthorized payment and/or money transfer, and other unauthorized actions, the bank notifies the client, with respect to whom such actions were committed, no later than the next business day after their detection.

50. In the event of unauthorized actions specified in paragraph 49 of the Rules, the bank immediately takes all necessary measures to eliminate their consequences and prevent their occurrence in the future.

Chapter 7. Suspension and Termination of Provision

of Electronic Banking Services

51. The bank suspends or terminates the provision of electronic banking services to the client in the following cases:

1) violation by the client of the procedure and conditions for obtaining electronic banking services provided for by the contract;

2) malfunction of technical means ensuring the provision of electronic banking services;

3) on other grounds provided for by laws on banks and banking activity, on payments and payment systems, on AML/CFT/CPF, the Civil Code of the Republic of Kazakhstan (Special Part), and the contract.

52. In the event of suspension or termination of the provision of electronic banking services on the grounds provided for by paragraph 51 of the Rules, the bank notifies the client in the manner and timeframes established by the contract, except for cases of suspension or termination of the provision of electronic payment services provided for by subparagraph 3) of paragraph 51 of the Rules.

53. Upon elimination of the reasons that led to the suspension of the client's right to receive electronic banking services, the bank resumes providing electronic banking services to the client with subsequent written or electronic notification, except for cases of suspension or termination of the provision of electronic payment services provided for by subparagraph 3) of paragraph 51 of the Rules.

Chapter 8. Storage of Electronic Documents in the Provision of

Electronic Banking Services

54. Electronic documents are stored in the format in which they were formed, sent, or received, in compliance with their integrity and immutability, and do not require printing or other display of the content of the electronic document on a paper medium for storage purposes.

55. The procedure and timeframes for storage of electronic documents are determined by the bank's internal documents developed in accordance with the Law on Payments and Payment Systems and the Law on AML/CFT/CPF.

Appendix 3
to the List of some resolutions of the Board of the National Bank of the Republic of Kazakhstan, which are amended and supplemented on issues of payments and payment services

Appendix 1
to the Rules for organizing the activities of payment organizations

Form

National Bank of the Republic of Kazakhstan

Application

---

(name and business identification number of the payment organization)

requests to carry out accounting registration of the payment organization and include the payment organization in the registry of payment organizations

1. Location of the payment organization:

---

---

(index, city (region), district, street, house number (office) ______ ______ (telephone, fax, email address, Internet resource (if any)

2. Information on state registration (re-registration) of the payment organization:

---

---

(name of the document, number and date of issue, issued by)

3. List of planned payment services to be provided in accordance with [paragraph 3] of the Rules for organizing the activities of payment organizations:

1) ______;
2) ______;
3) ______

4. List of documents to be submitted in accordance with paragraph 2 of Article 16 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems":

1) ______;
2) ______;

5. Information on the head (members) of the executive body of the payment organization:

General information:

Surname, name, patronymic (if any)	______ (in accordance with the identity document, in case of change of surname, name, patronymic - indicate when and for what reason changes occurred)
Individual identification number
Data of the identity document	(name of the document, number, series (if any) and date of issue, issued by)
Place of residence	(place of residence, including home and office phone numbers, as well as email address)
Citizenship

Full list of places of work and positions:

No.	Period of work (month/year)	Name of the organization, positions held	Job responsibilities
1

Other information:

Presence of an unexpunged or unpardoned criminal record	Yes/no (if yes, then indicate the details of the court verdict, article of the Criminal Code of the Republic of Kazakhstan)
If previously was a head, member of the governing body, head, member of the executive body, chief accountant of a financial organization for a period of no more than one year prior to the decision to apply a recovery regime to the bank, revocation of the license of a financial organization, leading to its liquidation and/or cessation of activities in the financial market, or entry into legal force of a court act on forced liquidation of a financial organization or recognition of its bankruptcy in the manner determined by the legislation of the Republic of Kazakhstan or the legislation of the state, the resident of which is a financial organization – a non-resident of the Republic of Kazakhstan	Yes/no (if yes, then the name of the organization, position, details of the decision to apply a recovery regime to the bank, revocation of the license of a financial organization, leading to its liquidation and/or cessation of activities in the financial market, or the court act on forced liquidation of a financial organization or recognition of its bankruptcy in the manner determined by the legislation of the Republic of Kazakhstan or the legislation of the state, the resident of which is a financial organization – a non-resident of the Republic of Kazakhstan is indicated)
If previously was a head of the executive body, founder or first head of the founder – a legal entity of the payment organization, a major participant or the first head of a major participant – a legal entity of the payment organization for a period of no more than five years prior to its exclusion from the registry of payment organizations on the grounds provided for by subparagraphs 1) – 6), 9), 11) of paragraph 1 of Article 18 of the Law on Payments and Payment Systems, or a payment organization liquidated on the basis of a court act that has entered into legal force or recognized as bankrupt in the manner established by the legislation of the Republic of Kazakhstan	Yes/no (if yes, then the name of the organization, position, details of the decision of the authorized body or the court act that has entered into legal force on forced liquidation of the payment organization or recognition of its bankruptcy in the manner established by the legislation of the Republic of Kazakhstan is indicated)
Other information (if any)

I confirm that the attached information has been checked by me and is true and complete.

I agree to the use of information constituting a state secret contained in digital systems.

First head of the payment organization or person authorized to sign ______ ______ surname, name, patronymic (if any) signature

6. Information on founders (participants) of the payment organization:

Surname, name, patronymic (if any) / Name of the legal entity / Name of the foreign structure without legal entity status	______ (in accordance with the identity document, in case of change of surname, name, patronymic – indicate when and for what reason changes occurred / in accordance with the charter documents)
Individual identification number / Business identification number / Identification number
Data of the identity document	(name of the document, number, series (if any) and date of issue, issued by)
Place of residence / Place of registration of the legal entity or foreign structure without legal entity status	(place of residence, including home and office phone numbers, as well as email address / place of registration of the legal entity or foreign structure without legal entity status, including office phone numbers, as well as email address)
Citizenship / Country of registration

Presence of an unexpunged or unextinguished criminal record, or a court decision that has entered into legal force regarding the application of a criminal penalty in the form of deprivation of the right to hold a position of a managerial employee of a financial organization, a banking and/or insurance holding, and to be a major participant (major shareholder) of a financial organization	Yes/No (if yes, specify the details of the court verdict, article of the Criminal Code of the Republic of Kazakhstan)
If previously was a head, member of the governing body, head, member of the executive body, chief accountant of a financial organization, head or deputy head of a branch of a non-resident bank of the Republic of Kazakhstan, branch of a non-resident insurance (reinsurance) organization of the Republic of Kazakhstan, branch of a non-resident insurance broker of the Republic of Kazakhstan within a period of not more than one year prior to the decision by the authorized body to apply the restructuring regime to a bank, revocation of the license of a financial organization, branch of a non-resident bank of the Republic of Kazakhstan, branch of a non-resident insurance (reinsurance) organization of the Republic of Kazakhstan, branch of a non-resident insurance broker of the Republic of Kazakhstan, or the entry into legal force of a judicial act on the compulsory liquidation of a financial organization or its recognition as bankrupt in the manner established by the legislation of the Republic of Kazakhstan, or the entry into legal force of a judicial act on the compulsory termination of the activities of a branch of a non-resident bank of the Republic of Kazakhstan, branch of a non-resident insurance (reinsurance) organization of the Republic of Kazakhstan in cases established by the laws of the Republic of Kazakhstan	Yes/No (if yes, the name of the organization, position, details of the decision to apply the restructuring regime to a bank, revocation of the license of a financial organization, branch of a non-resident bank of the Republic of Kazakhstan, branch of a non-resident insurance (reinsurance) organization of the Republic of Kazakhstan, branch of a non-resident insurance broker of the Republic of Kazakhstan, or the entry into legal force of a judicial act on the compulsory liquidation of a financial organization or its recognition as bankrupt in the manner established by the legislation of the Republic of Kazakhstan, or the entry into legal force of a judicial act on the compulsory termination of the activities of a branch of a non-resident bank of the Republic of Kazakhstan, branch of a non-resident insurance (reinsurance) organization of the Republic of Kazakhstan in cases established by the laws of the Republic of Kazakhstan is specified)
If previously was a founder or first head of a founder – a legal entity of a payment organization, a major participant or first head of a major participant – a legal entity and/or a head of a governing body, head of an executive body of a payment organization within a period of not more than five years prior to its exclusion from the register of payment organizations on the grounds provided for in sub-items 1) – 6), 9), 11) of paragraph 1 of Article 18 of the Law on Payments and Payment Systems, or a payment organization liquidated on the basis of a court decision that has entered into legal force or recognized as bankrupt in the manner established by the legislation of the Republic of Kazakhstan	Yes/No (if yes, the name of the organization, position, details of the decision of the authorized body or the entry into legal force of a judicial act on the compulsory liquidation of a payment organization or its recognition as bankrupt in the manner established by the legislation of the Republic of Kazakhstan is specified)
If has registration, place of residence or place of location in offshore zones	Yes/No (if yes, the name of the offshore zone is specified)

Appendix 4
to the List of certain resolutions

of the Board of the National Bank of the Republic of Kazakhstan,

which are subject to amendments and additions

Appendix 2
to the Rules of Organization of Activities

of Payment Organizations

Form

List of Main Requirements for Providing the State Service

"Inclusion in the Register of Payment Organizations that have Passed Registration with the National Bank of the Republic of Kazakhstan"

1.	Name of the Service Provider	National Bank of the Republic of Kazakhstan
2.	Methods of Providing the State Service	Web portal of the "digital government" www.egov.kz, www.elicense.kz (hereinafter - the portal).
3.	Term for Providing the State Service	Within fifteen working days from the date of registration of the application and the full list of documents.
4.	Form of Providing the State Service	Electronic (automated).
5.	Result of Providing the State Service	Notification of passing registration for the provision of permission (right) to provide payment services by a payment organization, established by the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law), or a reasoned refusal. Form of the result of providing the state service: electronic
6.	Size of the fee charged from the service recipient when providing the state service, and methods of its collection in cases provided for by the legislation of the Republic of Kazakhstan	The service is provided free of charge.
7.	Work schedule of the service provider, the State Corporation and digital objects	1) of the service provider – from Monday to Friday from 9.00 to 18.30 hours with a lunch break from 13.00 to 14.30 hours, except for weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. Schedule for receiving documents and issuing results of providing the state service – from Monday to Friday from 9.00 to 17.30 hours with a lunch break from 13.00 to 14.30 hours; 2) of the portal – around the clock, except for technical breaks due to repair work (if the service recipient contacts after the end of working hours, on weekends and holidays, according to the labor legislation of the Republic of Kazakhstan, reception of applications and issuance of results of providing the state service is carried out on the next working day).
8.	List of documents necessary for providing the state service	1) application in the form according to Appendix 1 to the Rules of Organization of Activities of Payment Organizations, approved by the Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 215 dated August 31, 2016 (hereinafter – the Rules). 2) copy of the diploma (diplomas) of the head (member) of the executive body of the payment organization; 3) copy of the document confirming the employment activity of the head (member) of the executive body of the payment organization in accordance with the Labor Code of the Republic of Kazakhstan; 4) copies of documents confirming the formation of the charter capital; 5) charter; 6) document determining the procedure for interaction of the payment organization with the corresponding bank, branch of a non-resident bank of the Republic of Kazakhstan or organization carrying out certain types of banking operations, carrying out money transfers for the payment services provided; 7) information and documents confirming the presence in the staff (hiring) of the head of the structural unit responsible for the administration of digital objects, and the head of the compliance control service or another person assigned to conduct compliance control; 8) internal control rules for the purpose of counteracting the legalization (laundering) of proceeds obtained criminally, financing of terrorism and financing of the proliferation of weapons of mass destruction for payment organizations; 9) rules of activity of the payment organization, approved by the governing body of the payment organization. The list of mandatory conditions of the rules of activity of the payment organization is established in the Rules.
9.	Grounds for Refusal to Provide the State Service, established by the laws of the Republic of Kazakhstan	1) submission of incomplete and/or unreliable information that must be reflected in the documents specified in paragraph 2 of Article 16 of the Law; 2) submission of an incomplete list of documents or non-compliance of documents with the requirements of the Law and the Rules; 3) if the head of the executive body of the payment organization does not meet the requirements established in Article 19 of the Law; 4) if the payment organization, within one year from the date of its state registration (re-registration) in the State Corporation "Government for Citizens", did not apply for registration. In case of refusal of registration, the legal entity repeatedly submits an application for registration after eliminating the causes that led to the refusal of registration of the payment organization, or makes a decision to change its name or reorganization or liquidation. Failure to eliminate the causes that led to the refusal of registration of the payment organization is a ground for refusal to reconsider.
10.	Other requirements taking into account the features of providing the state service, including in electronic form and through the State Corporation	Addresses of places of providing the state service are posted on the portal and on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". The service recipient is granted access to obtain information on the procedure and status of providing the state service in remote access mode via the Unified Contact Center for questions on providing state services. Contact phone numbers of information services on questions of providing the state service are posted on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". Unified Contact Center for questions on providing state services: 8-800-080-7777, 1414.

Appendix 5
to the List of certain resolutions

of the Board of the National Bank

of the Republic of Kazakhstan,

which are subject to amendments

and additions on issues of payments

and payment services

Appendix 6
to the Rules of Organization of Activities

of Payment Organizations

Form

National Bank

of the Republic of Kazakhstan

Notification of Opening a Branch

---

(name, place of location and business identification

number of the payment organization)

hereby reports the opening of a branch:

• on the territory of the Republic of Kazakhstan (in case of opening):

---

(name, place of location and business identification

number of the branch of the payment organization)

Data on the manager:

---

(position, surname, first name, patronymic (if any)

List of payment services provided by the branch of the payment organization, in accordance with paragraph 3 of the Rules of Organization of Activities of Payment Organizations:

1) ______;
2) ______;
3) ______

• outside the Republic of Kazakhstan (in case of opening):

---

(name, place of location of the branch of the payment organization)

Data on the manager:

---

(position, surname, first name, patronymic (if any)

List of payment services provided by the branch of the payment organization in accordance with paragraph 3 of the Rules of Organization of Activities of Payment Organizations:

1) ______;
2) ______;
3) ______

I confirm that the attached information has been checked by me and is true and complete.

I agree (agree) to the use of information constituting a state secret contained in digital systems.

First head of the payment organization or person authorized to sign

---

surname, first name, patronymic (if any) signature

Appendix 6
to the List of certain resolutions

of the Board of the National Bank

of the Republic of Kazakhstan,

which are subject to amendments

and additions on issues of payments

and payment services

Appendix 7
to the Rules of Organization of Activities

of Payment Organizations

Form

Cybersecurity Incident Card

No	General Information
Characteristics of the cybersecurity incident	Information on the cybersecurity incident
1	Name of the cybersecurity incident
2	Date and time of detection (dd.mm.yyyy and hh:mm with indication of the time zone UTC+X)
3	Place of detection (organization, branch, segment of digital infrastructure)
4	Source of information on the cybersecurity incident (user, administrator, cybersecurity administrator, employee of the cybersecurity department or technical means)
5	Methods used in the implementation of the cybersecurity incident (social engineering, insertion of malicious code)
Content of the cybersecurity incident
6	Symptoms, signs of the cybersecurity incident
7	Main events (exploitation of vulnerabilities in application and system software; unauthorized access to the digital system; denial of service attack on the digital system or data transmission network; infection of the server with malicious software or code; commission of an unauthorized transfer of funds; cybersecurity incidents posing a threat to the stability of the activities of the payment organization)
8	Affected assets (physical level of digital infrastructure, network equipment level, network application and service level, operating system level, technological process and application level and business process level of the payment organization)
9	Status of the cybersecurity incident (completed cybersecurity incident, attempt to commit a cybersecurity incident, suspicion of a cybersecurity incident)
10	Damage
11	Threat source (identified identifiers)
12	Intentionality (intentional, accidental)
Measures taken for the cybersecurity incident
13	Actions taken (identification of vulnerability, blocking, restoration)
14	Planned actions aimed at minimizing the occurrence of cybersecurity risks
15	Notified persons (surname, first name, patronymic (if any) of officials, name of state bodies, organizations)
16	Attracted specialists (surname, first name, patronymic (if any) place of work, position, phone number)

Responsible employee for cybersecurity

---

(surname, first name, patronymic (if any) (signature)

Date "____" ______ 20 __ year