On Approval of Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Operators of Unbacked Digital Asset Exchange, Digital Financial Assets Platform, and Digital Assets Trading Platform

NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		DECISION OF THE BOARD
of April 10, 2026 Astana city		No. 33 Astana city

On Approval of Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Operators of Unbacked Digital Asset Exchange, Operators of Digital Financial Assets Platform, and Operators of Digital Assets Trading Platform

In accordance with the third paragraph of paragraph 3-2 of Article 11 of the Law of the Republic of Kazakhstan "On Countering Money Laundering, Terrorist Financing, and Proliferation Financing," the Board of the National Bank of the Republic of Kazakhstan DECIDES:

1. Approve the attached Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Operators of Unbacked Digital Asset Exchange, Operators of Digital Financial Assets Platform, and Operators of Digital Assets Trading Platform (hereinafter – Requirements).

2. The Department of Payment Systems and Digital Financial Technologies shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1. jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this decision in the Ministry of Justice of the Republic of Kazakhstan;

2. publication of this decision on the official website of the National Bank of the Republic of Kazakhstan after its official publication;

3. within ten working days after the state registration of this decision, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of the measure provided for in sub-paragraph 2) of this paragraph.

3. Supervision over the implementation of this decision shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan responsible for the relevant area.

4. This decision enters into force on May 1, 2026, and is subject to official publication.

Suspend until July 12, 2026, the effect of:

sub-paragraph 2) of paragraph 6 of the Requirements, establishing that during the suspension period, this sub-paragraph shall be in the following wording:

"2) the procedure for verifying the client (their representative) and the beneficial owner, including the use of automated information systems and software, to carry out internal control for AML/CFT/CPF purposes, including verification for inclusion in the list of organizations and individuals associated with terrorist and extremist financing, compiled in accordance with Article 12 of the AML/CFT/CPF Law (hereinafter – the List) and the list of organizations and individuals associated with the financing of proliferation of weapons of mass destruction, compiled in accordance with Article 12-1 of the AML/CFT/CPF Law (hereinafter – the CPF List);";

sub-paragraph 1) of paragraph 8 of the Requirements, establishing that during the suspension period, this sub-paragraph shall be in the following wording:

"1) obtaining access to all premises of the Subject, information systems, telecommunications facilities, documents and files, within the limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the Subject;";

paragraph 11 of the Requirements, establishing that during the suspension period, this paragraph shall be in the following wording:

"11. The organization for automating processes on internal control matters for AML/CFT/CPF uses automated information systems corresponding to the internal control requirements of the organization.";

sub-paragraph 2) of paragraph 16 of the Requirements, establishing that during the suspension period, this sub-paragraph shall be in the following wording:

"2) services with digital asset wallets of clients having signs of the client's use of transaction anonymization services complicating transaction tracking (mixers), including in combination with other high-risk factors;."

Chairman		T.M. Suleimenov

"AGREED"

Agency of the Republic of Kazakhstan for Financial Monitoring

Approved

by the Decision of the Board of the National Bank of the Republic of Kazakhstan of April 10, 2026 No. 33

Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Operators of Unbacked Digital Asset Exchange, Operators of Digital Financial Assets Platform, and Operators of Digital Assets Trading Platform

Chapter 1. General Provisions

1. These Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Operators of Unbacked Digital Asset Exchange, Operators of Digital Financial Assets Platform, and Operators of Digital Assets Trading Platform (hereinafter – Requirements) are developed in accordance with the third paragraph of paragraph 3-2 of Article 11 of the Law of the Republic of Kazakhstan "On Countering Money Laundering, Terrorist Financing, and Proliferation Financing" (hereinafter – AML/CFT/CPF Law).

The Requirements apply to operators of unbacked digital asset exchange, operators of digital financial assets platform, and operators of digital assets trading platform (hereinafter – Subject, Subjects).

2. Concepts used in the Requirements are applied in the meanings specified in the AML/CFT/CPF Law and the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan".

For the purposes of the Requirements, the following main concepts are used:

1. unusual operation (transaction) – an operation (transaction) of a client subject to mandatory review in accordance with paragraph 4 of Article 4 of the AML/CFT/CPF Law, taking into account the signs of determining a suspicious operation, defined by the authorized body carrying out financial monitoring and taking other measures to counter money laundering, terrorist financing, and proliferation financing (hereinafter – authorized body) in accordance with paragraph 2 of Article 10 of the AML/CFT/CPF Law, as well as those developed independently by the Subjects;

2. risks of money laundering, terrorist financing, and proliferation financing (hereinafter – AML/CFT/CPF risks) – risks of intentional or unintentional involvement of issuers in processes of money laundering, terrorist financing, and proliferation financing (hereinafter – AML/CFT/CPF);

3. AML/CFT/CPF risk management – a set of measures taken by the Subjects to identify, assess, monitor AML/CFT/CPF risks, as well as their minimization (with respect to services, clients, and operations carried out by clients);

4. threshold operation – a client's operation with money and/or other property subject to financial monitoring in accordance with paragraph 1 of Article 4 of the AML/CFT/CPF Law.

3. Internal control for the purpose of countering money laundering, terrorist financing, and proliferation financing (hereinafter – AML/CFT/CPF) is carried out by the Subjects for the purposes of:

1. ensuring compliance with the requirements of the AML/CFT/CPF Law;

2. maintaining the effectiveness of the Subjects' internal control system at a level sufficient to manage money laundering, terrorist financing, and proliferation financing risks (hereinafter – AML/CFT/CPF and associated risks (operational, reputational, legal));

3. minimizing AML/CFT/CPF risks;

4. excluding the involvement of the Subjects, their officials, and employees in AML/CFT/CPF processes.

4. Within the framework of organizing internal control for AML/CFT/CPF purposes, the management body or executive body of the Subject develops and adopts internal control rules, which must undergo an audit by the Subject's internal audit service or another authorized body (person) to conduct internal audit, assess the effectiveness of internal control for AML/CFT/CPF purposes, as well as independent audit if there is a decision by the management body or executive body of the Subject to conduct independent audit.

Internal control rules include programs provided for in Article 11 of the AML/CFT/CPF Law, which are developed independently by the Subjects in accordance with the Requirements and are internal documents of the Subjects or a set of such documents approved by the management bodies or executive bodies of the Subjects.

Chapter 2. Program for Organizing Internal Control for AML/CFT/CPF Purposes

5. In the manner established by the internal documents of the Subject, a person responsible for implementing and complying with internal control rules (hereinafter – responsible employee) is appointed from among the employees of the Subject, and/or the Subject's departments (hereinafter – responsible department) whose competence includes AML/CFT/CPF matters (hereinafter – responsible department), responsible for implementing and complying with internal control rules, are determined.

Requirements for the responsible employee, employees responsible for implementing and complying with internal control rules, or employees of the AML/CFT/CPF department are:

1. higher education;

2. work experience of at least 1 year in the field of AML/CFT/CPF or in the sphere of provision (rendering) or regulation of financial services and services related to digital assets;

3. impeccable business reputation.

6. The program for organizing internal control for AML/CFT/CPF purposes includes:

1. the procedure for recording information, as well as storing documents and information obtained during the implementation of internal control for AML/CFT/CPF purposes;

2. the procedure for verifying the client (their representative) and the beneficial owner, including the use of digital systems and software, to carry out internal control for AML/CFT/CPF purposes, including verification for inclusion in the list of organizations and individuals associated with terrorist and extremist financing, compiled in accordance with Article 12 of the AML/CFT/CPF Law (hereinafter – the List) and the list of organizations and individuals associated with the financing of proliferation of weapons of mass destruction, compiled in accordance with Article 12-1 of the AML/CFT/CPF Law (hereinafter – the CPF List);

3. the procedure for applying targeted financial sanctions, refusing clients the establishment of business relations and terminating business relations, refusing to carry out operations with money and/or other property, as well as terminating the action of sanctions upon exclusion of information about the client (their representative) and beneficial owner from the List and the CPF List;

4. the procedure for informing employees of the Subject, including the responsible employee, employees of the management bodies and executive bodies of the Subject, about facts of violation of the AML/CFT/CPF Law, as well as internal control rules, committed by employees of the Subject;

5. description of AML/CFT/CPF requirements established by legal entities that have control over the Subjects (if any);

6. the procedure for preparing and submitting to the management bodies and executive bodies of the Subject managerial reports on the results of the assessment of the effectiveness of internal control for AML/CFT/CPF purposes by the internal audit services of the Subject or the body authorized to conduct internal audit, as well as the conduct of independent audit;

7. the procedure for assessing, determining, documenting, and updating the results of AML/CFT/CPF risk assessment;

8. description of the functions of the AML/CFT/CPF department, including the procedure for interaction with other departments of the Subject, branches, subsidiaries in carrying out internal control for AML/CFT/CPF purposes, as well as the functions, powers of the responsible employee, the procedure for interaction of the responsible employee with the management bodies and executive bodies of the Subject;

9. the procedure for compliance and implementation of internal control rules, including the procedure for applying additional control measures taking into account the size, nature, and complexity of the Subject's organization and procedures for AML/CFT/CPF risk management and their reduction, by branches, representative offices, subsidiaries of the Subject located both in the Republic of Kazakhstan and abroad, if this does not contradict the legislation of the state of their location.

7. The functions of the responsible employee and the responsible department in accordance with the Program for Organizing Internal Control for AML/CFT/CPF Purposes include:

1. ensuring the availability of developed and agreed with the management bodies or executive bodies of the Subject internal control rules and/or amendments (additions) to them, as well as monitoring their compliance by the Subjects;

2. organizing the submission and controlling the submission of reports to the authorized body for financial monitoring in accordance with the AML/CFT/CPF Law;

3. informing the management bodies and/or executive bodies of the Subject about identified clients included in the List, CPF List, and measures taken to apply targeted financial sanctions;

4. making decisions on recognizing client operations as suspicious and the need to send reports to the authorized body for financial monitoring in the manner provided for by the internal documents of the Subjects;

5. making or agreeing with the management bodies and/or executive bodies of the Subject decisions on suspending or refusing to carry out client operations in cases provided for by the AML/CFT/CPF Law and/or contracts with clients, and in the manner provided for by the internal documents of the Subject;

6. sending requests to the management bodies and/or executive bodies of the Subject to make a decision on establishing, continuing, or terminating business relations with clients in cases and manner provided for by the AML/CFT/CPF Law and/or internal documents of the Subject;

7. informing the management bodies and officials of the Subject about identified violations of internal control rules in the manner provided for by the internal documents of the Subject;

8. preparing and agreeing with the management bodies and/or executive bodies of the Subject information on the results of the implementation of internal control rules and recommended measures to improve AML/CFT/CPF risk management systems and internal control for AML/CFT/CPF purposes for forming reports for the management bodies of the Subject and/or executive bodies of the Subject;

9. coordination on collecting quantitative and qualitative indicators for assessing the risk of the Subject's involvement in AML/CFT/CPF processes;

10. documenting decisions made regarding the client's operation (their representative) and the beneficial owner;

11. forming a client file based on data obtained as a result of implementing internal control rules;

12. ensuring confidentiality of information obtained in the course of performing their functions;

13. providing information to the authorized body for financial monitoring to carry out control over the implementation of legislation on AML/CFT/CPF.

8. To perform the assigned functions, the responsible employee and the responsible department are endowed with the following powers:

1. obtaining access to all premises of the Subject, digital systems, telecommunications facilities, documents and files, within the limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the Subject;

2. giving instructions to the departments of the Subject regarding the conduct of an operation;

3. ensuring the preservation of documents and files received from the departments of the Subject.

9. If there are employees in the branches of the Subject to whom the functions and powers provided for in paragraphs 7 and 8 of the Requirements are fully or partially assigned, the coordination of the activities of such employees is carried out by the responsible employee or responsible department.

10. The functions of the responsible employee, and the responsible department, on which the functions provided for in paragraphs 7 and 8 of the Requirements are assigned, are not combined with the functions of the internal audit service or the body authorized to conduct internal audit, as well as the functions of departments carrying out the operational (current) activity of the Subject.

Chapter 3. AML/CFT/CPF Risk Management Program

11. The organization for automating processes on internal control matters for AML/CFT/CPF uses digital systems corresponding to the internal control requirements of the organization.

12. For the purpose of organizing AML/CFT/CPF risk management, the Subject develops an AML/CFT/CPF risk management program, taking into account client risks and risks of using services for criminal purposes, including the risk of using technological achievements.

The AML/CFT/CPF risk management program includes:

1. the procedure for organizing AML/CFT/CPF risk management by the Subject by its structural subdivisions;

2. the methodology for assessing AML/CFT/CPF risks taking into account the main categories of risks (by client type, country risk, and service/product risk) with respect to the client's risk level, as well as the degree of exposure of the Subject's services (products) to AML/CFT/CPF risks;

3. the procedure for regular monitoring, analysis, and control of client risks and the degree of exposure of the Subject's products (services) to AML/CFT/CPF risks, providing for a list of preventive measures, the procedure and deadlines for their implementation, control over results in accordance with adopted measures;

4. the procedure for assigning, deadlines, and grounds for reviewing client risk levels;

5. the procedure for interaction with independent audit;

6. the procedure for taking measures to classify clients taking into account categories and risk factors, as well as other categories of risks established by the Subject;

7. the procedure for determining and assessing AML/CFT/CPF risks arising before the development (launch) of new products and new business practices, including new transmission mechanisms, as well as the use of new or emerging technologies for both new and existing products.

13. Types of clients, whose status and/or activity increase AML/CFT/CPF risk, include the following factors:

1. foreigners;

2. public officials, their spouses, close relatives, and representatives;

3. foreign financial organizations;

4. legal entities and individual entrepreneurs whose activity is related to intensive cash turnover, including:

organizers of gambling business, as well as persons providing services or receiving income from online casino activities outside the Republic of Kazakhstan;

persons providing tourist services, as well as other services related to intensive cash turnover;

5. insurance (reinsurance) organizations, insurance brokers carrying out activity in the "life insurance" industry;

6. persons carrying out activity as insurance agents;

7. persons carrying out intermediary activity in the purchase and sale of real estate;

8. non-profit organizations in the organizational and legal form of funds, religious associations;

9. persons located (registered) in foreign states specified in paragraph 15 of the Requirements, as well as branches and representative offices of such persons located in the Republic of Kazakhstan;

10. additional types of clients determined by the Subject (if any), whose status and/or activity increase AML/CFT/CPF risk.

14. Types of clients, whose status and/or activity decrease AML/CFT/CPF risk, include the following factors:

1. state bodies of the Republic of Kazakhstan, as well as legal entities over which control is exercised by state bodies;

2. organizations, shares of which are included in the official list of the stock exchange of the Republic of Kazakhstan and/or the stock exchange of a foreign state;

3. international organizations located on the territory of the Republic of Kazakhstan or participants of which is the Republic of Kazakhstan;

4. second-tier banks, insurance (reinsurance) organizations – residents of the Republic of Kazakhstan, professional participants of the securities market – residents of the Republic of Kazakhstan.

15. The Subject carries out an assessment of country (geographic) risk associated with providing services (products) to clients from foreign states specified in this paragraph, and carrying out operations with money and/or other property with the participation of such foreign states.

Foreign states, operations with which increase AML/CFT/CPF risk, are:

1. foreign states (territories) included in the list of states (territories) not fulfilling or insufficiently fulfilling the recommendations of the Financial Action Task Force (FATF), compiled by the authorized body for financial monitoring;

2. foreign states (territories) with respect to which international sanctions (embargoes) adopted by resolutions of the United Nations Security Council are applied;

3. foreign states characterized as offshore zones, indicated in the list of offshore zones approved in accordance with sub-paragraph 12) of part two of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan";

4. foreign states (territories) determined by the Subject as representing high AML/CFT/CPF risk based on other factors (information on the level of corruption, illegal production, circulation and/or transit of drugs, information on support for international terrorism, and others).

16. Services of the Subject, as well as methods of their provision, increasing AML/CFT/CPF risk, include:

1. services with digital asset wallets of clients having a high AML/CFT/CPF risk as a result of conducting verification of digital asset wallets;

2. services with digital asset wallets of clients having signs of the client's use of transaction anonymization services complicating transaction tracking (mixers), including in combination with other high-risk factors;

3. services and operations with digital asset wallets not serviced by digital asset service providers.

18. Within the framework of implementing the risk management program (risk assessment), the Subject takes measures to classify clients taking into account the risk categories and factors specified in paragraphs 13, 14, 15, and 16 of the Requirements, as well as other risk categories and factors established by the Subject.

The client's (group of clients') risk level is established by the Subject based on the analysis of information about the client(s) obtained through client identification and transaction monitoring procedures, and is assessed using a risk level scale that must consist of no fewer than two levels (low, high).

The client's (group of clients') risk level is reviewed by the Subject as information about the client (group of clients) is updated.

For clients (groups of clients) regarding whom risk assessment has not previously been conducted and/or with whom business relations have not previously been established, the Subject conducts an initial risk assessment based on data obtained before establishing business relations.

Chapter 4. Client Identification Program

19. To implement the requirements of the Law on AML/CFT/PF regarding customer due diligence, the Subject develops a client identification program (their representatives) and beneficial owners.

Client (representative) and beneficial owner identification consists of the Subject conducting measures to record and verify the accuracy of information about the client (representative), identify the beneficial owner and record information about them, establish and record the intended purpose of business relations or a one-time transaction (deal), as well as obtaining and recording other information about the client (representative) and beneficial owner required by the Requirements.

Depending on the degree of AML/CFT/PF risk, the degree of measures conducted by the Subject is expressed in the application of simplified or enhanced customer due diligence measures (representatives) and beneficial owners by conducting simplified or enhanced identification of clients (representatives), beneficial owners, in accordance with paragraph 7 of Article 5 of the Law on AML/CFT/PF.

Identification of the beneficial owner is carried out by taking appropriate (reasonable) measures to verify the identity of the client's beneficial owner, including by requesting additional information and/or documents from the client about the ultimate beneficial owner of the client.

If, as a result of taking customer due diligence measures, the beneficial owner of a legal entity client is not identified, it is permitted to recognize the sole executive body or the head of the collegial executive body of the legal entity client as the beneficial owner.

In the event of the absence or incomplete provision of information specified in the fourth part of this paragraph, the Subject suspends the transaction for a period of no less than 48 (forty-eight) hours until the required information is provided by the client.

In the event that the client fails to provide information necessary for the identification of the sender and/or recipient of digital assets, upon expiration of the established term, the Subject refuses to conduct the transaction.

20. Measures to identify the client's beneficial owner, establish its ownership and management structure are conducted based on constituent documents and the register of shareholders (register of participants) of such a client, the Register of Beneficial Owners of Legal Entities (hereinafter – Register of BO), posted on the internet resource of the authorized body for financial monitoring, or information obtained from other sources.

21. Information about identified beneficial owners is entered into the Register of BO.

22. Taking into account the requirements of paragraphs 2 and 3 of Article 5 of the Law on AML/CFT/PF, the Subject conducts identification of the client (representative) and beneficial owner, as well as establishes the intended purpose of business relations or a one-time transaction (deal) in cases:

1. establishing business relations with a client;

2. carrying out a one-time transaction (deal) by the client;

3. carrying out a threshold transaction (deal) by the client;

4. identifying a suspicious transaction (deal) of the client;

5. having grounds to doubt the accuracy of previously obtained data on individuals and legal entities.

23. Information obtained in accordance with paragraph 19 of the Requirements, as well as information about clients' digital asset wallets, including the address of the digital asset wallet, the name of the blockchain on which the digital asset wallet is opened, the type of wallet (hardware/software), are included (included) by the Subject in the client dossier, which is stored by the Subject throughout the entire period of business relations with the client and for no less than five years from the date of their termination or the completion of a one-time transaction (deal).

Documents and information about transactions with money and/or other property, including those subject to financial monitoring, suspicious transactions, as well as the results of the study of complex, unusually large, and other unusual transactions, are subject to storage by Subjects for no less than five years after the transaction is completed.

24. Simplified identification is conducted by the participant taking into account the requirements paragraph 7 of Article 5 of the Law on AML/CFT/PF when:

1. establishing business relations with providers of digital asset services, issuers of digital financial assets, digital miners, digital mining pools, second-tier banks of the Republic of Kazakhstan, organizations carrying out certain types of banking operations, insurance (reinsurance) organizations, professional participants of the securities market - residents of the Republic of Kazakhstan;

2. assigning a reduced AML/CFT/PF risk level to the client.

25. Enhanced identification is conducted by the Subject:

1. when assigning a high AML/CFT/PF risk level to the client;

2. when identifying a suspicious transaction (deal) or an attempt to commit it during the monitoring and study of the client's transactions;

3. when conducting transactions exceeding the threshold amount established by paragraph 1 of Article 4 of the Law on AML/CFT/PF;

4. when having doubts about the accuracy of information provided by the client;

5. when having doubts about the origin of digital assets, as well as funds for the purchase of an unbacked digital asset;

6. when having a medium and high AML/CFT/PF risk level following the verification of the client's digital asset wallet using the transaction analysis and control system;

7. when there are signs of the client using services for transaction anonymization, complicating the tracking of the chain of digital asset holders;

8. in cases established by the Subject's internal documents, including by decision of the responsible employee.

26. Subjects ensure compliance with the requirements for the transaction analysis and control system established by the normative legal act of the National Bank of the Republic of Kazakhstan.

27. During the process of client identification (identification of the beneficial owner), the Subject checks for the presence of such a client (beneficial owner) in the List and the Proliferation Financing List.

28. Documents submitted by the client (representative) for the purpose of confirming information (except for information about the recipient of digital assets) about the client (representative) and beneficial owner are checked for validity.

Verification of the accuracy of the provided information (except for information about the recipient of digital assets) is carried out by comparing with data from originals or notarized copies of the corresponding documents submitted by the client (representative), or by comparing with data from available sources (databases), or by checking information in other ways.

29. The client identification program (representative) and beneficial owner includes:

1. the procedure for accepting clients for service, including the procedure and grounds for refusing to establish business relations and/or conducting a transaction, as well as terminating business relations;

2. the procedure for identifying the client (representative) and beneficial owner, including the features of the procedures for applying simplified and enhanced customer due diligence measures;

3. a description of measures aimed at identifying among individuals being serviced or being accepted for service, public officials, their spouses and close relatives, and accepting such clients for service (with written permission of the Subject's officials), subsequent review and updating of information about them with increased frequency established by the Subject's internal documents;

4. the procedure for checking the client (representative) and beneficial owner for presence in the List and the Proliferation Financing List;

5. features of identification when establishing business relations remotely (without the personal presence of the client or their representative);

6. features of exchanging information obtained during the identification of the client (representative) and beneficial owner within the framework of fulfilling AML/CFT/PF requirements established by the legal entity that has control over the Subject (if any);

7. a description of additional sources of information, including those provided by state bodies, for the purpose of identifying the client (representative) and beneficial owner;

8. the procedure for verifying the accuracy of information about the client (representative) and beneficial owner;

9. requirements for the form, content, and procedure for maintaining the client dossier, updating information contained in the dossier, indicating the frequency of updating information;

10. the procedure for ensuring Subject employees' access to information obtained during identification;

11. the procedure for assessing the client's risk level, grounds for assessing such risk;

12. a list of measures (procedures) aimed at identifying and identifying by the Subject the beneficial owners of clients, including a list of documents and information requested from the client, the procedure for the Subject's decision-making on recognizing an individual as a beneficial owner;

13. the procedure for ensuring transparency of digital asset transfers, including the procedure for obtaining, transferring, and storing information about the sender and recipient of digital assets when carrying out transactions with digital assets, as well as the procedure for Subject employees' actions in the absence, incompleteness, or contradiction of such information.

Within the framework of this procedure, the Subject ensures the obtaining and recording of the following information about the sender and recipient of digital assets:

information about the transaction, including the type of digital asset, amount, date and time of the transaction, the blockchain (distributed ledger) used, and other information provided by the Subject's internal documents.

about the sender of digital assets:

surname, first name, patronymic (if any) or name of the legal entity;

information allowing identification of the client;

address of the digital asset wallet or other unique identifier used to carry out the transaction;

if available – information about the provider of digital asset services servicing the sender;

about the recipient of digital assets:

surname, first name, patronymic (if any) or name of the legal entity;

address of the digital asset wallet or other unique identifier of the recipient;

if available – information about the provider of digital asset services servicing the recipient;

14. features of applying due diligence measures when transferring digital assets to digital asset wallet addresses not serviced by providers of digital asset services, or when receiving digital assets from such addresses, including risk-oriented measures to establish and verify information about the owner (beneficial owner) of such a digital asset wallet, conducting enhanced identification and enhanced monitoring of transactions in cases provided for by the Subject's internal documents;

15. additional measures (if any) for identifying the client (representative) and beneficial owner, included in the program by the Subject.

30. Taking into account the requirements of Article 6 of the Law on AML/CFT/PF, the Subject conducts identification of the client (representative) and beneficial owner before establishing business relations.

Chapter 5. Client Transaction Monitoring and Study Program

31. To implement the requirements of the Law on AML/CFT/PF regarding customer due diligence, as well as to identify and forward to the authorized body for financial monitoring reports on threshold and suspicious transactions, the Subject develops a program for monitoring and studying client transactions.

32. Within the framework of the program for monitoring and studying client transactions, the Subject conducts measures to update and/or obtain additional information about clients (their representatives) and beneficial owners, as well as to study client transactions and identify threshold and suspicious transactions.

The frequency, depth, and intensity of studying the client's transactions are determined taking into account the client's risk level, based on the analysis of information about the size, significance, nature, scale, and complexity of the client's activities, as well as information about the source of financing of the transactions carried out by the client and/or the degree of exposure of the services used by the client to AML/CFT/PF risks, the carrying out (attempt to carry out) by the client of transactions (transactions) subject to financial monitoring, as well as taking into account the Subject's scenarios (schemes) of AML/CFT/PF and/or signs of unusual and suspicious transactions.

The results of monitoring and studying client transactions are used by the Subject for the annual assessment of the degree of exposure of the Subject's services to AML/CFT/PF risks, as well as for reviewing client risk levels.

Information obtained within the framework of implementing the program for monitoring and studying the client's transactions, including the study of complex, unusually large, and other unusual client transactions, is entered into the client dossier and stored by the Subject throughout the entire period of business relations with the client and for no less than five years from the date of their termination or the completion of a one-time transaction (deal).

33. The frequency of updating and/or the need to obtain additional information about the client (representative) and beneficial owner is established by the Subject taking into account the client's (group of clients') risk level and/or the degree of exposure of the Subject's services used by the client to AML/CFT/PF risks.

Updating information about the client (representative) and beneficial owner with a high risk level is carried out no less than once a year.

Checking for the presence of the client (beneficial owner) in the List and the Proliferation Financing List (inclusion in the List and the Proliferation Financing List) does not depend on the client's risk level and is carried out as changes are made to the Lists and the Proliferation Financing Lists (updating the List and the Proliferation Financing List).

34. The program for monitoring and studying client transactions includes:

1. a list of signs of unusual and suspicious transactions, compiled based on signs of defining a suspicious transaction approved by the authorized body for financial monitoring in accordance with paragraph 2 of Article 10 of the Law on AML/CFT/PF, as well as those developed independently by the Subject;

2. the procedure for identifying the client's transaction having characteristics corresponding to typologies, schemes, and methods of legalization (money laundering) of criminal proceeds and terrorist financing approved by the authorized body for financial monitoring in accordance with paragraph 5 of Article 4 of the Law on AML/CFT/PF;

3. distribution of responsibilities among Subject employees for updating previously obtained and/or obtaining additional information about the client (representative) and beneficial owner in cases provided for by the Requirements;

4. distribution of responsibilities among Subject employees for identifying and transferring information between employees about threshold, unusual, and suspicious transactions, as well as transactions having characteristics corresponding to typologies, schemes, and methods of legalization (money laundering) of criminal proceeds and terrorist financing;

5. a description of the interaction mechanism between departments when identifying threshold, unusual, and suspicious transactions, as well as transactions having characteristics corresponding to typologies, schemes, and methods of legalization (money laundering) of criminal proceeds and terrorist financing;

6. the procedure, grounds, and term for the responsible employee's decision on qualifying the client's transaction;

7. the procedure for employee interaction in making a decision to refuse to conduct the client's transaction (except for refusal due to the client, beneficial owner being in the List and the Proliferation Financing List), as well as terminating business relations with the client;

8. the procedure for interaction between Subject departments (employees) for identifying clients and beneficial owners located in the List and the Proliferation Financing List, as well as for the immediate freezing of transactions with money and/or other property of such clients;

9. the procedure for recording (including methods of recording) and storing information about the results of studying unusual transactions, as well as information about threshold and suspicious transactions (including the amount of the transaction, currency of the transaction) and transactions having characteristics corresponding to typologies, schemes, and methods of legalization (money laundering) of criminal proceeds and terrorist financing;

10. the procedure for submitting to the authorized body for financial monitoring reports on threshold and suspicious transactions;

11. the procedure for informing (if necessary) authorized bodies and Subject officials about the identification of a threshold and suspicious transaction;

12. the procedure for accepting and description of measures taken regarding the client and their transactions in the event of the client systematically and/or in significant volumes carrying out unusual and/or suspicious transactions;

13. additional measures (if any) for monitoring and studying client transactions, included in the program by the Subject.

35. In the event of doubts regarding the legality of qualifying a transaction as threshold, as well as when identifying an unusual or suspicious transaction and a transaction having characteristics corresponding to typologies, schemes, and methods of legalization (money laundering) of criminal proceeds and terrorist financing, the Subject employee who identified the transaction sends a report on such transaction to the responsible employee (AML/CFT/PF department) in the manner, form, and timeframes established by the Subject's internal documents.

Information about multiple transactions is sent either in one report or by several reports.

Reports on transactions specified in the first part of this paragraph, as well as the results of their study, are stored by the Subject for no less than five years from the date of termination of business relations with the client or the completion of a one-time transaction (deal).

36. In accordance with subparagraph 2) of paragraph 2 of Article 5 of the Law on AML/CFT/PF, all client transactions are subject to study:

1. on the grounds specified in paragraph 4 of Article 4 of the Law on AML/CFT/PF;

2. if they have characteristics of signs of a suspicious transaction.

A client's transaction is recognized as suspicious if, as a result of studying the transactions specified in the first part of this paragraph, the Subject has suspicions that the money and/or other property used to carry it out are proceeds from criminal activity, or the transaction itself is aimed at laundering AML/CFT/PF or other criminal activity.

The Subject independently makes a decision on recognizing (not recognizing) the client's transaction as a suspicious transaction based on the information and documents at its disposal characterizing the status and activities of the client (representative) and beneficial owner carrying out the transaction, as well as information about the client's financial and economic activities, financial position, and business reputation.

The difference between the time of carrying out the transaction and the time of recognizing such a transaction as suspicious does not exceed the time interval determining the frequency of studying the client's transaction in accordance with the Subject's internal control rules.

Financial monitoring subjects, for the purpose of preventing cases of legalization (money laundering) of proceeds obtained through criminal activity, terrorist financing, and financing of the proliferation of weapons of mass destruction, are obliged, upon recognizing a transaction as suspicious, to immediately report to the authorized body about such transaction before its carrying out.

Reports on completed transactions with money and/or other property that were not recognized as suspicious before their carrying out are submitted by financial monitoring subjects to the authorized body no later than twenty-four hours after the transaction is recognized as suspicious.

Chapter 6. Program for Training and Educating Subject Employees on AML/CFT/PF Issues

37. The purpose of the Training and Education Program for employees in the field of AML/CFT/PF (hereinafter – Training Program) is for Subject employees to acquire knowledge and form skills necessary for fulfilling the requirements of legislation in the field of AML/CFT/PF, as well as internal control rules and other internal documents of the subject in the field of AML/CFT/PF.

38. The AML/CFT/PF training program includes:

1. the procedure for continuous training of employees, including the training topics, methods, timeframes, and the department (person) responsible for conducting the training;

2. a list of Subject departments (employees) whose employees undergo training;

3. the procedure and forms for storing training results;

4. the procedure and forms for testing employees' knowledge on AML/CFT/PF issues.

39. The training program is developed in accordance with the requirements for training and educating Subject employees, approved by the authorized body for financial monitoring in accordance with paragraph 8 of Article 11 of the Law on AML/CFT/PF.