On Amendments and Additions to the Board of the National Bank of the Republic of Kazakhstan Resolution No. 200 of August 31, 2016 on Approving Requirements for Organizational Measures and Software and Technical Means Ensuring Access to Payment Systems

NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		BOARD RESOLUTION
June 30, 2026 Astana city		No. 74 Astana city

On Amendments and Additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 200

"On Approving the Requirements for Organizational Measures and Software and Technical Means Ensuring Access to Payment Systems"

The Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. Make the following amendments and additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 200 "On Approving the Requirements for Organizational Measures and Software and Technical Means Ensuring Access to Payment Systems" (registered in the Registry of State Registration of Normative Legal Acts under No. 14289):

in the Requirements for Organizational Measures and Software and Technical Means Ensuring Access to Payment Systems, approved by the said Resolution:

rephrase paragraph 3 in the following wording:

"3. The Requirements use the concepts provided for by the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated April 3, 2026 No. 53 "On Approving the Requirements for Ensuring Information Security of Banks, Branches of Banks-Non-residents of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations" (registered in the Registry of State Registration of Normative Legal Acts under No. 38336) (hereinafter – Requirements No. 53), and the following concepts:

1) authentication – a set of measures to confirm the authenticity of system users when exchanging payment and information messages, when remotely connecting to a virtual environment with an installed payment system terminal, as well as to confirm the authenticity of payment and information messages;

2) software and hardware complex – a combination of software and technical means jointly used for the interaction of a payment system user with the Center;

3) hypervisor – software or hardware-software that allows creating and running multiple operating systems simultaneously on the same server or computer;

4) certification authority – a legal entity that certifies the correspondence of the public key of an electronic digital signature to the private key of the electronic digital signature, as well as confirms the validity of the registration certificate;

5) access control means – technical, software or other means that allow recording information about access to objects;

6) key information – cryptographic keys (public and private) or other information that allows carrying out cryptographic transformations of information;

7) operational risk – risk associated with disruptions in the operation of digital systems or internal processes, errors, failures or disruptions in the management of the payment system, including as a result of external events;

8) unauthorized access – access to digital and software resources in violation of the legislation of the Republic of Kazakhstan, as well as the access procedure established by the payment system user;

9) means of protection against unauthorized access – a combination of technical and (or) software means implementing the functions of authentication, separation of access rights, control of actions of payment system users;

10) non-standard situation – a failure (disruption) in the functioning of the software and technical complex of the payment system user as a result of the realization of operational risk;

11) payment system user – a legal entity that has concluded a contract with the Center for the provision of services in the payment system, and the operator (operating center) of other payment systems;

12) digital system of the payment system user – software of the payment system user used for forming or transforming electronic documents intended for further forwarding to the payment system via the payment system terminal;

13) software and technical complex of the payment system user – technical, software or other means ensuring the operation of the payment system user in the payment system, including the digital system, the payment system user's workstation, communication means (data transmission) with the payment system;

14) main center of the software and technical complex of the payment system user (hereinafter – main center) – the software and technical complex of the payment system user ensuring the operation of the payment system user in the payment system in normal (daily) mode;

15) backup center of the software and technical complex of the payment system user (hereinafter – backup center) – the backup software and technical complex of the payment system user ensuring the operation of the payment system user in the payment system in the event of non-standard situations or during scheduled test work in the main center;

16) data processing center of the payment system user – an object of digital infrastructure intended for hosting and ensuring the functioning environment of the software and technical means of the payment system user used for access to the payment system;

17) payment system user workstation – a personal computer on which the payment system terminal is installed, ensuring access to the payment system, or a combination of a software and hardware complex, including a virtual environment with an installed payment system terminal, a physical resource (server) on which it is deployed, and a personal computer with configured remote connection via secure communication channels to this virtual environment, which together ensure access to the payment system;

18) payment system user workstation administrator – a person who directly carries out administration of the payment system terminal, the virtual environment on which it is installed, and the hypervisor on which the virtual environment operates;

19) security department of the payment system user – a structural unit of the payment system user ensuring the security and protection of the digital and software resources of the payment system user;

20) payment system user workstation security officer – a person who ensures the installation and functioning at the payment system user's workstation of information protection means against unauthorized access, leakage, including via electromagnetic channels in the case of installing the payment system terminal on a personal computer, the hypervisor on which the virtual environment operates, remote connection via secure communication channels to the virtual environment on which the payment system terminal is installed, as well as carrying out monitoring of their operability and compliance with security requirements;

21) payment system user workstation operator – a person who directly carries out the preparation, transmission and reception of payment system messages using the key information of the payment system user, as well as the development and registration of key information in the certification authority of the Center in the presence of the payment system user workstation security officer;

22) payment system terminal – special software ensuring access to the payment system, installed at the payment system user;

23) payment system terminal application – special software intended for remote work with the payment system terminal;

24) physical resource (server) – a hardware-software complex representing computing equipment used for hosting and functioning of software and (or) virtual environment.";

rephrase paragraph 5 in the following wording:

"5. In the case of installing the payment system terminal on a personal computer, the payment system user's workstation is located in a room at the location of the payment system user with restricted access (hereinafter – Room).

In the case of installing the payment system terminal on a virtual environment, the physical resource (server) on which it is deployed is located in the data processing center of the payment system user, complying with the requirements of Chapter 9 of Requirements No. 53.

A personal computer with configured remote connection via secure communication channels to the virtual environment on which the payment system terminal is installed is located in the Room.

It is not allowed to locate in the Room workstations not intended for work with the payment system, except for workstations of employees performing the functions of payment system user workstation operators.";

rephrase paragraph 11 in the following wording:

"11. Video surveillance with the ability to record video signals is installed behind the entrance to the Room, as well as behind the personal computer on which the payment system terminal is installed, or the personal computer with configured remote connection via secure communication channels to the virtual environment on which the payment system terminal is installed. Launching the recording of video signals upon detection of object movement is allowed. The archive of video recordings is stored for at least the period of control of the integrity of seals or plaques on the system unit of the payment system user's workstation, established by the internal documents of the payment system user.

In the case of installing the payment system terminal on a virtual environment, video surveillance is additionally installed behind the data processing center of the payment system user, in which the physical resource (server) on which this virtual environment is deployed is located.

Video surveillance of the data processing center of the payment system user ensures observation of all passages, entrances to the data processing center of the payment system user. In the data processing center of the payment system user, the arrangement of video cameras excludes the presence of zones inside the room of the data processing center of the payment system user and in front of its entrance that are not covered by video surveillance.

Recording of video signals of the data processing center of the payment system user is carried out continuously or using a motion detector.

The archive of video recordings of the data processing center of the payment system user is stored for at least 3 (three) months.";

rephrase paragraph 24 in the following wording:

"24. The payment system terminal or its application is installed on a personal computer specifically allocated for these purposes, having an inventory number and a passport with detailed data on the configuration, software and hardware means installed on it, or on a virtual environment having an inventory number and a passport with a detailed description of the installed software, configuration parameters, as well as hardware characteristics of the physical resource (server) on which it is deployed, and the computing resources allocated for it.";

add paragraph 24-1 of the following content:

"24-1. In the case of installing the payment system terminal on a virtual environment, the payment system user uses a hypervisor that ensures isolation of the virtual environment from other digital systems.

The payment system user ensures separation of administrative access to the hypervisor, control of its configuration integrity, accounting of actions of the payment system user's workstation administrators, as well as installation of updates.";

rephrase paragraph 26 in the following wording:

"26. Work with the payment system terminal is carried out from the payment system user's workstation. In the case of installing the payment system terminal on a virtual environment, access to the payment system terminal is carried out from a personal computer intended for work with the payment system and located in the Room, via remote connection.

When remotely connecting to the payment system terminal, the payment system user ensures:

1) protection of communication channels with the payment system user's workstation using encryption and integrity control means, ensuring confidentiality and immutability of transmitted data;

2) use of authentication mechanisms for persons allowed to work with the payment system, using digital objects and identification means complying with the requirements of the legislation of the Republic of Kazakhstan on cybersecurity, on personal data and their protection;

3) implementation of automated logging and monitoring of actions of persons allowed to work with the payment system, with recording of access attempts and changes in the configuration of the payment system terminal;

4) separation of access rights for persons allowed to work with the payment system.

It is not allowed to install and use remote access systems at the payment system user's workstation when installing the payment system terminal on a personal computer. Built-in remote access services at the payment system user's workstation (personal computer) are deleted or disabled.";

rephrase paragraphs 30, 31 and 32 in the following wording:

"30. Key information is stored in the personal computer on which the payment system terminal is installed, or in the personal computer with configured remote connection via secure communication channels to the virtual environment on which the payment system terminal is installed, using software protection means ensuring its confidentiality, integrity and access control.

31. The presence of unauthorized copies of key information, including on the hard drive of the payment system user's workstation, is not allowed.

32. The procedure for storing and using key information at the payment system user's workstation excludes the possibility of unauthorized access to them.";

exclude paragraph 35;

exclude paragraph 37;

exclude sub-paragraphs 4) and 5) of paragraph 39;

rephrase paragraphs 40 and 41 in the following wording:

"40. At the payment system user's workstation, the implementation of protection functions against unauthorized access is ensured, including:

1) authentication of persons allowed to work with the payment system;

2) control and separation of access rights for persons allowed to work with the payment system;

3) registration of access events and actions of persons allowed to work with the payment system.

These functions are implemented using means of protection against unauthorized access, complying with the requirements of Chapter 9 of Requirements No. 53.

41. Means for detecting malicious software code and (or) programs are installed on the payment system user's workstation.

In the case of installing the payment system terminal on a virtual environment, the payment system user ensures the use of means for detecting malicious software code and (or) programs of built-in security functions of virtual environments; in the absence of such capabilities – confirmation from the manufacturer of testing the means for detecting malicious software code and (or) programs in virtual environments used by the payment system user.

Upon detection of infection, this information is immediately reported to the security department of the payment system user.";

rephrase paragraphs 43 and 44 in the following wording:

"43. One system name of a person allowed to work with the payment system, by which this person is identified upon entry into the digital systems of the payment system user, corresponds to one physical person.

44. In the case of installing the payment system terminal on a personal computer, the system unit of the payment system user's workstation is sealed or placarded with indication on the sticker or plaque of the date of the last sealing or placarding and the inventory number of the personal computer.

In the case of installing the payment system terminal on a virtual environment, the system unit of the personal computer with configured remote connection via secure communication channels to this virtual environment is sealed or placarded with indication on the sticker or plaque of the date of the last sealing or placarding and the inventory number of the personal computer.";

rephrase paragraphs 49 and 50 in the following wording:

"49. The personal computer on which the payment system terminal is installed, or the physical resource (server) on which the virtual environment with the installed payment system terminal is deployed, and the personal computer with configured remote connection via secure communication channels to this virtual environment, are equipped with technical means of uninterrupted power supply, ensuring the functioning of equipment in the absence of voltage in the power grid for the time necessary for correct shutdown in the system, but no less than thirty minutes.

50. In the event of changes in the software through which communication between the payment system user and the Center is carried out, in the means of protection against unauthorized access of the payment system user's workstation, as well as in the technology of transmission of electronic documents prepared in the digital system of the payment system user, to the payment system user's workstation, the payment system user notifies the National Bank in written form within ten working days from the date of making changes to obtain a conclusion (information) on the compliance of its activities with the Requirements.";

rephrase the first paragraph of sub-paragraph 3) of paragraph 53 in the following wording:

"3) a journal of sealing and checking the integrity of seals and plaques of the system unit of the personal computer on which the payment system terminal is installed, or the personal computer with configured remote connection via secure communication channels to the virtual environment with the installed payment system terminal, indicating:";

in paragraph 56:

rephrase sub-paragraph 7) in the following wording:

"7) the procedure for transmitting electronic documents prepared in the digital system of the payment system user to the payment system user's workstation;";

add sub-paragraphs 11) and 12) of the following content:

"11) the procedure for providing remote connection to the payment system terminal on a virtual environment, including the conditions for providing access, the authentication mechanisms used, the separation of access rights for persons allowed to work with the payment system, as well as the registration and storage of information about connections;

12) the procedure for the functioning of the hypervisor on which the virtual environment operates, including the procedure for controlling the integrity and configuration of the hypervisor, installation of updates, administrative access, as well as accounting of actions of the payment system user's workstation administrators, monitoring of cybersecurity events and detection of attempts of unauthorized access.";

rephrase paragraph 61 in the following wording:

"61. The payment system user ensures:

1) the functioning of a backup communication channel (data transmission) with the payment system of the Center. The possibility of connecting the backup communication channel to the network (communication) equipment of the backup and (or) main center of the payment system is provided;

2) the functioning of a mechanism for dynamic switching of interaction from the main center to the backup center of the payment system of the Center.";

rephrase paragraph 63 in the following wording:

"63. In the event of a non-standard situation in the main center, the payment system user:

1) ensures the transfer of the software and technical complex of the payment system user to the backup center.

The standard regulatory time for transferring the software and technical complex of the payment system user to the backup center is no more than three hours from the moment the non-standard situation arises.

In the absence of the possibility of complying with the standard regulatory time, the payment system user takes necessary measures to transfer the operation of the payment system user to the backup center, taking into account the need to fulfill accepted obligations for payments and money transfers until the end of the operating day of the Center's payment system;

2) sends via a secure communication channel of the transport system "Financial Automated System of Transport Information" (hereinafter – FASTI) or other transport systems, including electronic document exchange systems, a letter to the National Bank about the decision to transfer the software and technical complex to the backup center within three hours after making such decision;

3) sends via a secure communication channel of FASTI or other transport systems, including electronic document exchange systems, a letter to the National Bank about the result of transferring the software and technical complex to the backup center within three hours after completing the transfer work;

4) sends via a secure communication channel of FASTI or other transport systems, including electronic document exchange systems, a letter to the National Bank about the result of transferring the software and technical complex back to the main center within three hours after completing the transfer work.";

rephrase the second part of paragraph 64 in the following wording:

"Information on the results of testing, indicating identified problems (if any) and measures taken to eliminate them, is submitted by the payment system user to the National Bank within ten working days after the day of completion of activities after transferring the software and technical complex from the backup center to the main center.".

2. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall ensure in the manner established by the legislation of the Republic of Kazakhstan:

1) together with the Legal Department of the National Bank of the Republic of Kazakhstan, state registration of this Resolution in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this Resolution on the official Internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this Resolution, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of measures provided for by sub-paragraph 2) of this paragraph.

3. Control over the implementation of this Resolution[1] shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan in charge.

4. This Resolution enters into force on July 12, 2026 and is subject to official publication.

Chairman	T.M. Suleimenov

Copy is correct:

Chief Specialist-Secretary of the Board Zh. Mukhambetova

1. On Amendments and Additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 200 "On Approving the Requirements for Organizational Measures and Software and Technical Means Ensuring Access to Payment Systems" ↑