Resolution of the Board of the National Bank of the Kyrgyz Republic of 22 May 2024 No. 2024-П-14/23-2-(ПС)

On Amendments to Certain Regulatory Legal Acts

of the National Bank of the Kyrgyz Republic

In accordance with Articles 5, 9 and 64 of the Constitutional Law of the Kyrgyz Republic "On the National Bank of the Kyrgyz Republic", the Board of the National Bank of the Kyrgyz Republic resolves:

1. To introduce amendments to the following resolutions of the Board of the National Bank of the Kyrgyz Republic (attached):

• "On Approval of the Regulation "On Bank Payment Cards in the Kyrgyz Republic" of 9 December 2015 No. 76/8;

• "On Approval of the Regulation "On Licensing of Activities of Payment Organizations and Payment System Operators" of 2 September 2019 No. 2019-П-14/46-1-(ПС);

• "On Approval of the Regulation "On Regulation of Activities of Payment Organizations and Payment System Operators" of 30 September 2019 No. 2019-П-14/50-2-(ПС);

• "On Approval of the Regulation "On Requirements for Ensuring Information Security of Payment System Operators and Payment Organizations" of 31 March 2023 No. 2023-П-14/21-1-(ПС).

2. This resolution shall enter into force upon the expiration of 15 (fifteen) days from the day of its official publication.

3. To the Legal Department:

• from the day of receipt of the relevant documents, within 3 (three) working days, to publish this resolution on the official website of the National Bank of the Kyrgyz Republic;

• after official publication, to send this resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Regulatory Legal Acts of the Kyrgyz Republic.

4. To the Payment Systems Department, after official publication, within 3 (three) working days, to bring this resolution to the attention of commercial banks, payment system operators and payment organizations of the Kyrgyz Republic.

5. To the "Secretariat of the Board" Division, within 3 (three) working days, to bring this resolution to the attention of the relevant structural subdivisions, regional departments and the Representative Office of the National Bank of the Kyrgyz Republic in Batken Oblast.

6. To entrust control over the execution of this resolution to the member of the Board of the National Bank of the Kyrgyz Republic supervising the Payment Systems Department.

Chairman K. Bokontaev

Annex
to the Resolution of the Board of the National Bank of the Kyrgyz Republic of 22 May 2024 No. 2024-П-14/23-2-(ПС)

Amendments

to Certain Regulatory Legal Acts

of the National Bank of the Kyrgyz Republic

1. To introduce the following amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Bank Payment Cards in the Kyrgyz Republic" of 9 December 2015 No. 76/8:

in the Regulation "On Bank Payment Cards in the Kyrgyz Republic", approved by the above-mentioned resolution:

• in paragraph 5:

the twelfth paragraph shall be restated as follows:

"Virtual POS terminal – a web interface replacing a physical POS terminal and interacting with the bank's/payment organization's system for performing transactions for payment for goods and services by means of bank payment cards and other remote servicing instruments and relating to the acquirer's peripheral devices. A virtual POS terminal may also be used for replenishing bank accounts, taking into account the criteria for assessing the degree (level) of risk of the bank/payment organization, in accordance with internal regulatory documents, as well as for complying with the requirements of the legislation of the Kyrgyz Republic.";

to supplement with the thirty-third paragraph of the following content:

"Payment by payment QR code – non-cash payment for goods or services using a mobile application of a bank/payment system or other devices by means of reading two-dimensional barcode symbols (QR code).";

the thirty-fourth paragraph shall be restated as follows:

"Peripheral (acquiring) devices – terminals, ATMs, payment terminals and applications, deposit machines, mobile devices and other devices constituting the technical infrastructure / instrument for accepting and servicing bank payment cards, accepting payments by QR code and other remote servicing instruments.";

the fifty-first paragraph shall be restated as follows:

"Acquirer – a bank, payment organization, MCC, MCO, which are the owners of peripheral devices ensuring the possibility of conducting authorization or transactions through their peripheral devices in accordance with the technologies and regulatory acts of the relevant payment systems and the legislation of the Kyrgyz Republic.";

the fifty-second paragraph shall be restated as follows:

"Acquiring – activity related to the ownership and servicing of a network of peripheral devices for accepting payments using bank payment cards and other payment instruments/technologies on the basis of agreements with trade and service enterprises on accepting and conducting payments and settlements for goods and services in accordance with the rules of the relevant payment systems.";

to supplement with paragraphs fifty-three, fifty-four, fifty-five and fifty-six of the following content:

"Depending on the instruments used for conducting payments, acquiring is divided into the following main types:

• Trade acquiring – a service provided by an acquirer to trade and service enterprises (hereinafter – TSE) for the installation of POS terminals and other peripheral devices for accepting and conducting non-cash payments and settlements using various payment instruments on the basis of a concluded agreement.

• Internet acquiring – a service provided by an acquirer for accepting and conducting non-cash payments and settlements using payment cards and electronic money for goods and services sold through trade electronic platforms and online stores by means of a special web interface that ensures the transmission of payment information and preserves its confidentiality.

• Mobile acquiring – a service provided by an acquirer for accepting and processing non-cash payments and settlements using payment cards through a mobile application and a special mobile POS terminal (mPOS terminal) using a mobile phone or tablet.»;

• restate paragraph 53 as follows:

«53. To install a peripheral device at a merchant, the acquirer must conclude an agreement with the merchant on opening an account for settlements on transactions made using the terminal, and on the right to accept and service cards of the corresponding system. The agreement between the acquirer and the merchant must contain the following:

• the name of the merchant and its legal address;

• the rights and obligations of the merchant and the acquirer for accepting and servicing cards;

• the types of cards that the merchant must accept for servicing;

• prohibition for the merchant to establish an additional commission or a higher price (markup) for goods/services in case of payment by card or using a QR code;

• the amount of commissions;

• the main requirements for compliance with security rules by the merchant when using a POS terminal;

• the type of activity and the merchant's obligations to comply with the activity declared in the agreement. If the merchant's activity is subject to licensing, the acquirer must require the merchant's valid license to conduct this type of activity;

• requirements for the merchant's compliance with AML/CFT legislation, if the merchant is a financial institution or is included in the non-financial category of persons, in accordance with the legislation of the Kyrgyz Republic on AML/CFT;

• requirements prohibiting payments for operations prohibited by legislation;

• the main requirements for compliance with security when accepting cards by the merchant as a means of payment (authorization, cardholder identification, mandatory use of a PIN code by the cardholder when conducting a transaction or support of 3D-Secure functionality (unless otherwise provided by the rules of the relevant payment system), limits and other requirements) in accordance with the legislation of the Kyrgyz Republic;

• the procedure for refunding amounts on conducted operations disputed by the relevant system;

• the procedure for reimbursing the cost of goods purchased by card upon their return;

• the procedure for conducting, under the agreement, inspections of the merchant regarding the quality of card servicing, services provided, conditions of maintenance and operability of terminals, and storage of receipts;

• the procedure for interaction in case of detection of an operation with a stolen/lost cardholder card or unauthorized transactions by the merchant itself;

• the allocation of responsibility between the parties in case of unauthorized operations, violation of security procedures or other terms of the agreement and penalties imposed on each participant;

• the procedure for dispute resolution;

• the procedure for termination of the agreement;

• the requirement on security rules when performing a transaction in accordance with this Regulation.

The agreement may provide for other additional conditions. The rules for servicing and accepting cards of the corresponding system may be included in the agreement or additionally attached to it.»;

• add paragraph 53-1 as follows:

«53-1. When providing internet acquiring services for a merchant, the acquirer must verify the legal ownership of the merchant's website or websites through which the sale of goods/services is carried out.»;

• add paragraph 53-2 as follows:

«53-2. The agreement between the acquirer and the merchant concluded for the provision of internet acquiring services must contain the conditions provided for in paragraph 53 of this Regulation, as well as the following conditions:

• compliance of the merchant's website with the acquirer's requirements;

• the existence of requirements for cardholder authorization on the merchant's website.»;

• add paragraph 55-1 as follows:

«55-1. Before concluding an agreement with a merchant, the acquirer must verify the declared activity and the merchant's website specified in the agreement. These conditions must be regulated in the acquirer's internal documents.»;

• add paragraph 55-2 as follows:

«55-2. The acquirer must periodically, at least once every 6 (six) months from the date of concluding the agreement with the merchant, verify the merchant's compliance with the actual activity specified in the agreement. If a discrepancy with the declared activity is detected or there is suspicion that the merchant is carrying out operations related to violation of AML/CFT legislation, or conducting operations prohibited by legislation, the acquirer has the right to stop providing acquiring services to the merchant and terminate the agreement unilaterally. At the same time, the acquirer must conduct final settlements with the merchant in accordance with the concluded agreement with the merchant.»;

• add paragraph 56-1 as follows:

«56-1. When providing internet acquiring services, the acquirer has the right to establish no more than 1 virtual POS terminal with one Merchant Category Code (hereinafter – MCC) on the website of the merchant with which it has concluded an agreement. At the same time, if the merchant has several types of activity, the MCC is assigned based on the main type.

If the virtual POS terminal is used by the merchant not in accordance with the established MCC, the acquirer has the right to stop providing acquiring services to the merchant and terminate the agreement.».

2. To introduce the following changes to the resolution of the Board of the National Bank of the Kyrgyz Republic «On approval of the Regulation «On licensing the activities of payment organizations and payment system operators» dated 2 September 2019 No. 2019-П-14/46-1-(ПС):

in the Regulation «On licensing the activities of payment organizations and payment system operators» approved by the above-mentioned resolution:

• restate paragraph 2-1 as follows:

«2-1. A payment system operator may combine its activity only with the activity of a payment organization.

A payment organization may combine its activity only with the activity of a payment system operator.

The payment system operator/payment organization has the right to engage only in those types of activities that are specified in the license, as well as to provide consulting/information services and carry out other activities that are ancillary to its main activity or necessary to ensure its main activity.

A payment organization, if it holds a payment system operator license, has the right, as an ancillary activity, to provide acquiring services for bank payment cards, subject to compliance with the requirements established by this Regulation and the regulatory legal acts of the National Bank.";

• in paragraph 8, the third sentence shall be amended to read as follows:

"The use of funds contributed for the purpose of forming the charter capital, in the amount of the required minimum charter capital, before the National Bank adopts a decision to issue/refuse to issue a license is prohibited.";

• supplement with paragraph 12-1 as follows:

"12-1. A payment organization, in order to provide acquiring services in favor of local merchants with the use of payment cards by installing POS terminals, must have a charter capital of not less than 20,000,000 (twenty million) soms.

The charter capital of a payment organization when carrying out acquiring of payment cards by installing POS terminals in aggregate must be not less than 30,000,000 (thirty million) soms when carrying out acceptance of payments:

• from payers for the payment of taxes, levies and payments subject to crediting to the Single Treasury Account of the authorized state body for forecasting and execution of the budget at the National Bank, in the presence of direct contracts with state bodies or local self-government bodies administering the payment of taxes, levies and payments;

• in favor of third parties – suppliers of goods/services – non-residents, in the presence of contracts with such suppliers/integration of technical platforms and carrying out financial settlements for cross-border payments.";

• paragraph 13 shall be amended to read as follows:

"13. If the payment system of a payment system operator, according to the significance criteria established in the Policy on supervision (oversight) of the payment system approved by Resolution of the Board of the National Bank of 15 July 2015 No. 38/4, is recognized as a systemically important/significant payment system, or the payment organization/payment system operator is recognized as a provider of critical services based on the results of 12 (twelve) months or more, then the minimum charter capital is established depending on the degree of significance of the payment system in the following amounts:

• 1) not less than 200000000 (two hundred million) soms, if the payment system is recognized as systemically important;

• 2) not less than 30000000 (thirty million) soms, if the payment system is recognized as significant;

• 3) not less than 20000000 (twenty million) soms, if the payment organization and/or payment system operator is recognized as a provider of critical services.

The payment organization or payment system operator, within 6 (six) months from the day of notification of the licensee about the decision of the Committee on the Payment System of the National Bank, must adopt a decision to increase the charter capital in the amount established in this paragraph of the Regulation and deposit the funds with the bank. In the event of failure to deposit the funds within the established time limits, the National Bank applies enforcement measures in accordance with the regulatory legal acts of the National Bank.

The requirements for the amount of charter capital in this paragraph are subject to compliance by payment organizations/payment system operators without taking into account the requirements for the amounts of charter capital established in paragraph 12-1 of this Regulation.";

• in paragraph 23, the words "15 (fifteen) working days" shall be replaced by the words "30 (thirty) calendar days";

• in paragraph 47, paragraph 10, after the words "communication services", shall be supplemented with the words "as well as state bodies participating in ensuring information security;".

3. To introduce the following amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On approval of the Regulation 'On regulation of the activities of payment organizations and payment system operators'" of 30 September 2019 No. 2019-P-14/50-2-(PS):

in the Regulation "On regulation of the activities of payment organizations and payment system operators" approved by the above-mentioned Resolution:

• paragraph 6:

supplement with paragraph eighteen as follows:

"Payment by payment QR code – non-cash payment for goods or services using a mobile application of a bank/payment system or other devices by reading two-dimensional barcode symbols (QR code).";

supplement with paragraph nineteen as follows:

"Acquiring – activity related to the ownership and servicing of a network of peripheral devices for accepting payments using bank payment cards and other payment instruments/technologies on the basis of contracts with merchants for the acceptance and processing of payments and settlements for goods and services in accordance with the rules of the respective payment systems.";

supplement with paragraphs twenty to twenty-three as follows:

"Depending on the instruments used for making settlements, acquiring includes the following main types:

• Merchant acquiring – a service provided by an acquirer to merchants (hereinafter – merchants) for the installation of POS terminals and other peripheral devices for accepting non-cash payments using various payment instruments on the basis of a concluded contract.

• Internet acquiring – a service provided by an acquirer for accepting non-cash payments using payment cards and electronic money for goods and services sold through trading platforms and online stores via a special web interface that ensures the transmission of payment information and maintains its confidentiality.

• Mobile acquiring – a service provided by an acquirer for accepting non-cash payments using payment cards through a mobile application and a special mobile POS terminal (mPOS terminal) using a mobile phone or tablet.»;

• supplement with Chapter 8 as follows:

«Chapter 8. Requirements for a payment organization carrying out acquiring activity

101. This Chapter defines the requirements for payment organizations providing services for accepting non-cash payments in favor of suppliers of goods/services (merchant service enterprises (hereinafter – MSEs, suppliers of state services, utility services, etc.) by means of peripheral devices (hereinafter – acquiring/acquiring activity/acquiring services) and the procedure for its provision. Payers make payments for goods and services in favor of suppliers through peripheral devices using payment cards and contactless payment technology systems.

102. A payment organization has the right to carry out acquiring activity only if it has a license of a payment system operator and the corresponding permission of the National Bank to carry out acquiring activity, as well as if it complies with the requirements established by this Regulation and the legislation of the Kyrgyz Republic, including in the field of AML/CFT.

103. A payment organization, in order to provide acquiring services, has the right to establish its own network of peripheral devices in accordance with the requirements of payment systems and to ensure the performance of the following operations:

• purchase of goods/services through POS terminals, virtual POS terminals;

• purchase of goods/services using QR codes;

• replenishment of bank accounts, transfer of funds.

A payment organization, within the framework of providing acquiring, is prohibited from dispensing cash.

104. To carry out acquiring, a payment organization must comply with the requirements for authorized capital established in the Regulation "On Licensing the Activities of Payment Organizations and Payment System Operators", approved by the resolution of the Board of the National Bank dated 2 September 2019 No. 2019-П-14/46-1-(ПС).

105. A payment organization must have internal regulatory documents on the provision of acquiring services that comply with the requirements of this Regulation and other regulatory acts of the National Bank.

106. A payment organization, in order to carry out acquiring activity, must send an application in the established form in accordance with Appendix 3 to this Regulation to the National Bank on its intention to carry out acquiring activity, with the attachment of documents confirming that the size of the authorized capital and the standard agreement with MSEs comply with the requirements of the National Bank.

107. The National Bank conducts an examination of the documents and a preliminary check of the payment organization's AML/CFT system and, if the payment organization's documents comply with the established requirements of this Regulation, sends a corresponding letter and includes it in the Register of payment organizations providing acquiring of bank payment cards on their own behalf.

The period for reviewing documents and conducting the preliminary check is 15 (fifteen) calendar days.

If a discrepancy in the submitted documents is discovered, the National Bank sends a letter on the revision of the documents.

108. A payment organization must provide additional documents within 15 (fifteen) calendar days from the day of receipt of the written notification of the National Bank. Documents may be sent by email with subsequent dispatch of the original(s) of the documents. At the same time, the calculation of the period for reviewing the application and documents begins anew from the day of receipt of the additional documents (electronic/paper) that satisfy the requirements of this Regulation.

109. If documents are provided that do not comply with the requirements of this Regulation, or are incomplete, more than 3 (three) times, or in violation of the established deadlines, the National Bank refuses to review the documents and sends a written notification thereof.

110. Repeated submission of an application and documents for carrying out acquiring of bank cards is permitted upon the expiration of 6 (six) months from the day of the official refusal to review the documents or from the day of expiration of the period specified in paragraph 109 of this Regulation (in case of violation of this period).

Repeated submission of an application and documents for carrying out acquiring of bank cards is permitted only after elimination of the deficiencies and comments indicated by the National Bank during the initial review of the documents. If the comments indicated by the National Bank during the initial review of the documents are not eliminated, the National Bank has the right to refuse to review the documents without sending them again for revision within 15 (fifteen) calendar days from the date of their receipt by the National Bank.

111. A payment organization, in order to provide acquiring for accepting payment cards, must conclude an agreement with the relevant payment system using cards and its operator on participation in the system and obtain permission (license, certificate) to accept payments using cards of that system.

112. In case of termination of the provision of acquiring services, the payment organization must also inform the National Bank in the established form no less than one month before the actual termination of the provision of acquiring and carry out final settlements with MSEs.

113. Before concluding an agreement with an MSE, a payment organization must carry out a check of the declared activity and the MSE's website specified in the agreement. These conditions must be regulated in the internal documents of the payment organization.

114. A payment organization is obliged, at its own expense, to ensure acceptance and servicing of the national payment card in its own network at all peripheral devices. Any contractual relations of payment organizations with MSEs must not create barriers and restrictions for servicing national payment cards by other payment organizations.

115. Every peripheral device acquired by a payment organization for accepting payments using payment cards must ensure the functional compatibility of various types of cards for their mutual servicing and comply with the technical standards of payment systems.

116. The payment organization must place the following information on the peripheral device:

• name of the payment organization;

• name of the payment system whose cards are accepted for servicing;

• hotline telephone number;

• other necessary information for the client.

117. When providing internet acquiring services for merchants, the payment organization must verify the legal ownership of the website or websites of the merchant through which the sale of goods is carried out.

118. Software enabling mobile acquiring and implemented in portable devices must ensure the reliability and security of payments and be equipped with remote management capability.

119. To install a peripheral device at a merchant, the payment organization must conclude an agreement with the merchant for accepting payments made using a POS terminal and for the right to accept and service cards of the relevant system.

The agreement between the payment organization and the merchant must contain the following:

• name of the merchant and its legal address;

• rights and obligations of the merchant and the payment organization for accepting and servicing cards;

• types of cards that the merchant must accept for servicing;

• prohibition for the merchant to establish an additional commission or a higher price (markup) for goods/services in case of payment by card or using a QR code;

• amount of commissions;

• main requirements for compliance with security rules by the merchant when using a POS terminal;

• type of activity and obligations of the merchant to comply with the activity declared in the agreement. If the merchant's activity is subject to licensing, the payment organization must require a valid license of the merchant to conduct this type of activity;

• requirements for the merchant's compliance with legislation on AML/CFT, if the merchant is a financial institution or is included in the non-financial category of persons, according to the legislation of the Kyrgyz Republic on AML/CFT;

• requirements prohibiting payments for operations prohibited by legislation;

• main requirements for ensuring security when the merchant accepts cards as a means of payment (authorization, identification of the cardholder, mandatory use of a PIN code by the cardholder when conducting a transaction or support of 3D Secure functionality (unless otherwise provided by the rules of the relevant payment system), limits and other requirements according to the legislation of the Kyrgyz Republic;

• minimum security requirements for making payments and transfers using QR codes established by the Rules for Making Payments and Transfers Using Two-Dimensional Barcode Symbols (QR Code), approved by the resolution of the Board of the National Bank dated 11 December 2019 No. 2019-P-14/62-5-(PS);

• procedure for refunding amounts for conducted operations disputed by the relevant system (chargeback);

• procedure for reimbursing the cost of goods purchased by non-cash method using cards or QR code upon their return;

• procedure for conducting, within the framework of the agreement, inspections of the merchant regarding the quality of card servicing, services provided, conditions of maintenance and operability of terminals, storage of receipts;

• procedure for interaction in case of detection of an operation with a stolen/lost cardholder's card or unauthorized transactions by the merchant itself;

• distribution of responsibility between the parties in case of unauthorized operations and violations of security procedures or other terms of the agreement, and penalties imposed on each participant;

• procedure for dispute resolution;

• procedure for termination of the agreement;

• requirements for security rules when making payments in accordance with the requirements of the Regulation "On Bank Payment Cards in the Kyrgyz Republic".

The agreement may provide for other additional conditions. The rules for servicing and accepting cards of the relevant system may be included in the agreement or additionally attached to it.

120. The agreement between the payment organization and the merchant concluded for the provision of internet acquiring services must contain the conditions provided for in paragraph 119 of this Regulation, as well as the following conditions:

• compliance of the website or websites of the merchant with the requirements of the payment organization, as well as requirements for maintaining 3D Secure security technology;

• presence of requirements for authorizations of cardholders on the website or websites of the merchant.

121. In the agreement with the merchant, the payment organization must establish limits on the amount of a single operation, above which the merchant must request a supporting document from the cardholder (passport or other identity documents in accordance with the legislation of the Kyrgyz Republic). Data on the identity document must be entered in the receipt.

The payment organization must include in the agreement with the merchant an instruction (rules) describing cards, signs and/or a list of suspicious actions on the part of cardholders and the necessary measures that the merchant must take upon receiving a corresponding message from the payment system. At the same time, the payment organization must be guided by legislation regulating consumer protection issues, as well as other normative legal acts and recommendations of payment system operators related to ensuring the security of payments and settlements.

122. The payment organization must ensure training of authorized employees of the merchant on the rules for accepting and servicing cards, recognizing counterfeit cards or cases of possible fraud according to all security procedures established in the relevant system. Card servicing security procedures are not subject to disclosure to third parties, except for authorized employees of the merchant who accept and service payment cards in peripheral devices.

123. The TSP may install its own POS terminal or other devices for accepting payment subject to compliance with the established requirements and standards imposed by the payment organization, the relevant system and this Regulation. In the system, a POS terminal is defined as a device of the payment organization.

124. When providing internet acquiring services, the payment organization has the right to establish no more than 1 virtual POS terminal with one Merchant Category Code (hereinafter – MCC) on the website of the TSP with which it has concluded an agreement. At the same time, if the TSP has several types of activity, the MCC is assigned based on the main type.

If the virtual POS terminal is used by the TSP not in accordance with the established MCC, the payment organization has the right to cease providing acquiring services for the TSP and terminate the agreement.

125. The payment organization shall reimburse amounts for completed transactions using cards in favor of the TSP by crediting funds received from issuers for all cards based on processing results in accordance with the timeframes established by the regulations and operating procedure of the system, and the agreement.

Final settlements and accounting of obligations for acquiring services (reimbursement for accepted payments) are carried out through the bank accounts of the payment organization opened with the settlement bank, and the corresponding bank accounts of the TSP, or through electronic wallets in the manner provided for by the acquiring services agreement.

126. The payment organization must periodically, at least once a year, verify the compliance of the TSP with the actual activity specified in the agreement. If a discrepancy with the declared activity is detected or there is suspicion that the TSP is carrying out operations related to violation of legislation on AML/CFT, or the TSP is conducting operations prohibited by legislation, the payment organization has the right to cease providing acquiring services for the TSP and terminate the agreement unilaterally. At the same time, the payment organization must conduct final settlements with the TSP in accordance with the concluded agreement with the TSP, provided there are no other debts of the TSP and the payment organization to the issuing bank.

127. The payment organization must provide to the National Bank information on peripheral devices no later than the 10th day of the month following the reporting month, according to report form 8 in Appendix 1 to this Regulation.

128. A payment organization providing acquiring services must monitor transactions using cards according to the parameters established by the regulations and operating procedure of the relevant system, and also carry out measures to stop and/or prevent erroneous and unauthorized transactions. Payment organizations have the right to transfer these functions to a third-party processing center or to a participant of the relevant payment system in accordance with established contractual relations.";

• supplement with Appendix 3 as follows:

"Appendix 3 to the Regulation "On Regulation of the Activities of Payment Organizations and Payment System Operators"

Application

Hereby __________________________________________________ (full name of the payment organization) requests permission to provide acquiring services for merchant service providers for card acquiring by installing POS terminals and to be included in the register of payment organizations providing acquiring services.

Chairman of the Board/Head (signature, seal)
Signature decryption";

• Supplement the Appendix to this Regulation with report form 8 as follows:

"REPORT

on the Register of Peripheral Devices

Name of the payment organization:
__________________________________________________ TIN of the payment organization:
____________________________________________________________ OKPO of the payment organization:
____________________________________________________________ As of "" ______________ 20 year

No. in order

Type of peripheral device

ID of the peripheral device

Location of the peripheral device

Name of payment systems serviced by the peripheral device

Access period

Location

Region

District

Aiyl aimak

City/urban-type settlement/village

Street

1

2

3

4

5

6

7

8

9

10

11

Chairman of the Board (signature, seal)
Signature decryption

RULES

for completing the report on the Register of Peripheral Devices

1. The Register of Peripheral Devices reflects information on peripheral devices that provide remote access to a client's bank account by means of payment cards, as well as without the use of payment cards (payment terminals), indicating their specific location and minimal information about the device itself.

2. In column 2 "Type of peripheral device", the type of device is indicated: POS terminal-TSP, cash-in terminal, virtual POS terminal, mPOS or other peripheral device.

3. In column 3 "ID of the peripheral device", the identification numbers of the device are indicated, according to the registration numbers of payment organizations.

4. In column 4 "Location", the name of the place where the device is located is indicated (TSP, organization, etc.). For virtual POS terminals (V-POS), the web address is specified.

5. In column 5 "Oblast" the name of the oblast of the Kyrgyz Republic is specified in accordance with the reference book of the National Statistical Committee of the Kyrgyz Republic "Classifier of admin. terr. units – SOATE".

6. In column 6 "District" the name of the district of the oblast is specified in accordance with the reference book of the National Statistical Committee of the Kyrgyz Republic "Classifier of admin. terr. units – SOATE".

7. In column 7 "Aiyl aimak" the name of the aiyl aimak of the district is specified in accordance with the reference book of the National Statistical Committee of the Kyrgyz Republic "Classifier of admin. terr. units – SOATE".

8. In column 8 "City/urban-type settlement/village" the name of the city, district centers, urban-type settlement, village is specified in accordance with the reference book of the National Statistical Committee of the Kyrgyz Republic "Classifier of admin. terr. units – SOATE".

9. In column 7 "Street" the name of the street is specified. If peripheral devices are installed in places that do not have a specific address (street name, No.), then more detailed information is specified in column 4 "Location", i.e. the name of the organization, structural subdivision of the given organization, etc.

10. In column 10 "Name of payment systems serviced by the peripheral device", the name of the payment systems serviced by the given device is specified ("Elkart", VISA, MasterCard, UnionPay, etc.).

11. In column 11 "Access period" the time/period of access to the given device is specified.

A cover letter must be attached to the report, which reflects information on the changes made (installation/removal and relocation of banking equipment).

Reports/notifications must be submitted in the form and within the timeframes established by the National Bank. The payment organization is responsible for strict compliance with all conditions and requirements of this Regulation, including for the provision of timely and correct information.".

4. To introduce into the resolution of the Board of the National Bank of the Kyrgyz Republic "On approval of the Regulation "On requirements for ensuring information security of payment system operators and payment organizations" dated 31 March 2023 No. 2023-P-14/21-1-(PS) the following change:

The Regulation "On requirements for ensuring information security of payment system operators and payment organizations", approved by the above-mentioned resolution, shall be supplemented with chapter 5-1 "Requirements for the process of servicing bank payment cards" in the following wording:

"Chapter 5-1. Requirements for the process of servicing payment cards

40-1. When servicing payment cards, the PSO/PO must ensure compliance with the requirements of this Regulation.

40-2. When servicing payment cards, the PSO/PO or its processing center must have a valid certificate of conformity with the security requirements of the PCI DSS standard, and, accordingly, comply with the PCI DSS security requirements.".