Resolution of the Board of the National Bank of the Kyrgyz Republic of 15 December 2021 No. 2021-П-12/70-1-(БС)

On Amendments to the Resolution of the Board

of the National Bank of the Kyrgyz Republic

“On the Procedure for Identification and Verification of Clients in Remote Mode”

of 13 May 2020 No. 2020-П-12/27-1-(НПА)

In accordance with Articles 20 and 68 of the Law of the Kyrgyz Republic “On the National Bank of the Kyrgyz Republic, Banks and Banking Activities”, the Board of the National Bank of the Kyrgyz Republic resolves:

• 1. To introduce amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic “On the Procedure for Identification and Verification of Clients in Remote Mode” of 13 May 2020 No. 2020-П-12/27-1-(НПА) (attached).
• 2. This Resolution shall enter into force upon the expiration of fifteen days from the day of its official publication.
• 3. To the Legal Department:

  • to publish this Resolution on the official website of the National Bank of the Kyrgyz Republic;

  • after official publication, to send this Resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Normative Legal Acts of the Kyrgyz Republic.

• 4. To the Department of Supervision Methodology and Licensing of Banks to bring this Resolution to the attention of commercial banks, the Legal Entity Association “Union of Banks of Kyrgyzstan”, the relevant structural subdivisions of the National Bank of the Kyrgyz Republic, regional departments and the representative office of the National Bank of the Kyrgyz Republic in Batken Oblast.
• 5. To entrust control over the execution of this Resolution to the member of the Board of the National Bank of the Kyrgyz Republic supervising the Department of Supervision Methodology and Licensing of Banks.

Chairman K. Bokontaev

Annex
to the Resolution of the Board of the National Bank of the Kyrgyz Republic of 15 December 2021 No. 2021-П-12/70-1-(БС)

Amendments to the Resolution of the Board

of the National Bank of the Kyrgyz Republic

“On the Procedure for Identification and Verification of Clients in Remote Mode”

1. To introduce the following amendments to the Resolution of the Board of the National Bank of the Kyrgyz Republic “On the Procedure for Identification and Verification of Clients in Remote Mode” of 13 May 2020 No. 2020-П-12/27-1-(НПА):

in the Procedure for Identification and Verification of Clients in Remote Mode approved by the above-mentioned Resolution:

• to restate paragraph 1 as follows:

“1. This Procedure for Identification and Verification of Clients in Remote Mode (hereinafter – the Procedure) determines the procedure for banks to conduct identification and verification of natural persons – citizens of the Kyrgyz Republic, including citizens of the Kyrgyz Republic engaged in entrepreneurial activity as an individual entrepreneur (hereinafter – clients), using client data obtained in electronic form without personal presence.”;

• to supplement with paragraph 5-1 as follows:

“5-1. When using software for remote identification and verification of clients, the bank must send a corresponding notification to the National Bank with a full description of the software and the methods of remote identification and verification of clients, in accordance with the requirements of the Procedure.”;

• to restate paragraph 6 as follows:

“6. Before the start of identification, the bank must carry out registration of the client in its own information systems through electronic interaction channels (website, mobile application, specialized software, messengers, etc.) indicating the client’s phone number, the identification tax number for a client who is an individual entrepreneur, and the data for filling out the client questionnaire.”;

• to restate paragraph 7 as follows:

“7. The bank also verifies the mobile phone number provided by the client by sending codes, passwords in an SMS message to the mobile phone number provided by the client or in another way during the client’s registration.”;

• to supplement with paragraph 11-1 as follows:

“11-1. Verification of data on the tax registration of a client – an individual entrepreneur must be carried out by requesting and/or checking data from the relevant information system of the tax service.”;

• to restate paragraph 15 as follows:

“15. Before conducting a video communication session, the bank must carry out registration of the client in its own information systems through electronic interaction channels (website, mobile application, specialized software, messengers, etc.) indicating the client’s phone number, the identification tax number of the client – an individual entrepreneur, and the data for filling out the client questionnaire.”;

• to supplement with paragraph 18-1 as follows:

“18-1. Verification of data on the tax registration of a client – an individual entrepreneur must be carried out by requesting and/or checking data from the relevant information system of the tax service.”;

• to restate the second sentence of paragraph 20 as follows:

“At the same time, remote identification using video communication must be carried out by a bank employee and/or using information systems, technologies, algorithms, software in accordance with the requirements of the Procedure.”;

• the title of the paragraph “§3. Interview during a video communication session” shall be replaced with the title “§3. Requirements for a video communication session”;

• to restate paragraph 28 as follows:

“28. During a video communication session, a bank employee who has undergone appropriate training on remote identification of clients must conduct an interview with the client, or the client must perform actions according to the algorithm embedded in the software, in the case of identification of the client without the participation of a bank employee.”;

• to restate paragraph 29 as follows:

“29. When conducting an interview with a client by a bank employee, the bank employee must introduce himself by stating his first name, last name, position held and the name of the bank.”;

• to restate paragraph 32 as follows:

«32. The bank must develop an appropriate questionnaire for conducting the interview or an algorithm of the client's actions for obtaining or verifying the information necessary for entering into the client's questionnaire, as well as reducing the risk of providing a pre-prepared video recording or carrying out other manipulations with the video image.»;

• paragraph 35 shall be set out in the following wording:

«35. Banks must use information systems and methods that ensure protection against unauthorized access by third parties to the procedure and results of identification.»;

• paragraph 38 shall be set out in the following wording:

«38. Photos, video and audio recordings must be stored in the initially specified quality determined in the bank's remote identification system. Technical requirements for quality are determined by the bank independently and are enshrined in the bank's internal documents.»;

• supplement with paragraph 42 in the following wording:

«42. When verifying the client's identity using artificial intelligence, machine learning or other forms of predictive algorithms for processing biometric data, in whole or in part, the bank must ensure the accuracy of determining genuine and counterfeit cases of client identification and verification in accordance with the requirements of Chapters 4 and 5 of this Procedure.»;

• supplement with paragraphs 44, 45, 46, 47, 48 and 49 in the following wording:

«44. Client identification software or information systems, corresponding technologies, algorithms for client identification must contain a "one-to-one" identification algorithm for comparing an image from a video stream with already known photographs in the client's identity documents and state databases. Comparison of the client's images must be carried out using means that determine the identity of individual fragments, elements of the face image with unique parameters obtained from the video stream with similar elements present in the images from the client's identity documents, including those obtained from state databases. Identification algorithms must take into account the possibility of checking for a live person attribute, excluding substitution of the video stream.

45. The implementation of client identification software must be accompanied by testing with determination of the level of accuracy of the algorithms used in the software for processing biometric data. If the amount of data for determining the accuracy of the decision at the initial stage of deployment is limited, the bank must establish additional security measures, especially for products that present a higher risk, or establish a limit for all products related to inaccurate identification and verification of clients.

46. When using software for remote identification and verification of clients, the bank must use an appropriate combination of authentication factors when establishing measures to verify the client's identity to a degree proportionate to the risks associated with inaccurate identification and verification of clients. The acceptable level of accuracy of the biometric data processing algorithms used is determined by the bank in accordance with possible ML/TF risks and internal restrictions on operations.

47. The internal regulatory document providing for risk thresholds and the acceptable level of accuracy of the bank's use of remote identification and verification of clients using biometric data processing software must be approved by the relevant committee and approved by the bank's board of directors.

48. The biometric data processing software used by the bank for remote identification and verification of clients must be subjected to verification by the Bank at least once every six months for the purpose of maintaining the acceptable level of accuracy of the biometric data processing algorithms used. At the same time, the results of the assessment of the biometric data processing system must be confirmed within the framework of a periodic external audit of the bank's information systems.

49. The use of biometric data processing software must cover verification of clients' biometric data against databases of state bodies, and must also ensure the availability of mechanisms for detecting fraud (substitution of biometric data).»;

in Appendix 1 to the Procedure for remote identification and verification of a client:

in Table 3 "List of types of risks and measures to minimize them, by types of operations":

• in the column "Measures to minimize risks (except for restrictions on transaction amounts)" of rows six, seven, eight, nine and ten, replace the word "bank" with the word "banks".