On Approval of the Rules for Forming a Risk Management and Internal Control System for Unencumbered Digital Asset Exchange Operators, Digital Financial Assets Platform Operators, and Digital Asset Trading Platform Operators — NBK — KZ


NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		DECISION OF THE BOARD
of April 29, 2026 Astana city		No. 47 Astana city

On Approval of the Rules for Forming

a Risk Management and Internal Control System

for Operators of Exchange of Unencumbered Digital Assets, Operators of a Digital Financial Assets Platform, and Operators of a Trading Platform for Digital Assets

In accordance with subparagraph 10) of part two of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan", the Board of the National Bank of the Republic of Kazakhstan DECIDES:

Approve the attached Rules for Forming a Risk Management and Internal Control System for Operators of Exchange of Unencumbered Digital Assets, Operators of a Digital Financial Assets Platform, and Operators of a Trading Platform for Digital Assets (hereinafter – the Rules).
Instruct the Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan to ensure, in the manner established by the legislation of the Republic of Kazakhstan:

1) jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this decision in the Ministry of Justice of the Republic of Kazakhstan;

2) publication of this decision on the official website of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this decision, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of the measure provided for in subparagraph 2) of this paragraph.

Entrust the Deputy Chairman of the National Bank of the Republic of Kazakhstan overseeing the implementation of this decision with control over its execution.
This decision enters into force on May 1, 2026, and is subject to official publication.

Suspend until July 12, 2026, the effect of:

subparagraphs 1), 8) and 27) of paragraph 2 of the Rules, establishing that during the suspension period, these subparagraphs shall operate in the following wording:

"1) information asset – a set of information and an object of information and communication infrastructure used for its storage and/or processing;

8) information security risk – the probable occurrence of damage as a result of violation of confidentiality, intentional violation of integrity or availability of information assets of the DAAO;

27) information technology risk – the probability of damage occurrence as a result of failure (violation of functioning) of information and communication technologies operated by the DAAO;";

subparagraph 16) of paragraph 2 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"16) operational risk – the risk of incurring expenses (losses) as a result of deficiencies or errors in the course of carrying out internal processes, committed by employees (human resources) and in the course of improper functioning of information systems, digital platforms (trading platforms) and technologies, as well as as a result of the influence of external events, except for strategic risk and reputational risk;";

subparagraph 24) of paragraph 2 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"24) risk management system – a set of interrelated elements: procedures, methodologies, information systems, combined into a single process for managing realized and potential risks within a level of risk acceptable to the shareholder (participant) and aimed at achieving goals and objectives of risk management. In the process of identifying and managing realized and potential risks affecting the activities of the DAAO, bodies of the DAAO, executive employees and employees of structural subdivisions (responsible employees) participate within the limits of their assigned competencies and responsibilities. The process of identifying and managing realized and potential risks includes risk assessment, risk measurement, risk control and risk monitoring;";

subparagraph 1) of paragraph 3 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"1) effective management of DAAO risks through their timely identification, measurement, control and monitoring to ensure compliance of DAAO activities with the chosen business model, corporate governance requirements, functioning of information systems, digital platforms (trading platforms) and management information systems, conducting permitted operations, asset and liability management, functioning of the DAAO accounting system and other information and communication systems of the DAAO, as well as the level of risks taken by it and the availability of a corresponding level of liquidity;";

subparagraphs 3), 4) and 5) of paragraph 7 of the Rules, establishing that during the suspension period, these subparagraphs shall operate in the following wording:

"3) conducting regular monitoring of accounting systems, other information and communication systems (digital platforms, trading platforms) in order to ensure uninterrupted, continuous operation of the process of providing digital asset services for the DAAO (except for the operator of exchange of unencumbered digital assets), accounting for rights to digital assets and other financial instruments, settlements in digital assets and/or money, as well as reflection of information contained in the corresponding accounting systems;

4) conducting annual internal audit of the software and technical support of the DAAO, including information and communication systems used by the DAAO in its activities;

5) development and implementation of projects aimed at further development and improvement of the activities of the DAAO in terms of functioning of accounting systems, information and communication systems (digital platforms, trading platforms), the process of providing digital asset services for the DAAO, accounting for the DAAO (except for the operator of exchange of unencumbered digital assets) rights to digital assets, settlements in digital assets, reflection of information contained in accounting systems, automation of certain operations carried out in the DAAO, as well as the process of collection, input, accounting, storage of information and other areas of activity of the DAAO;";

subparagraph 2) of paragraph 34 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"2) unavailability of technologies, including information and communication technologies (computer viruses, failure of computer hardware, loss of connection);";

subparagraph 2) of paragraph 42 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"2) ineffective strategies, policies and/or standards in the field of information technologies, deficiencies in the use of software;";

subparagraph 12) of paragraph 42 of the Rules, establishing that during the suspension period, this subparagraph shall operate in the following wording:

"12) probability of occurrence of errors and failures in the functioning of the software and technical support of the DAAO, including corresponding accounting systems, as well as in operated information and communication systems and technologies;";

Chapters 10 and 11 of the Rules, establishing that during the suspension period, these chapters shall operate in the following wording:

"Chapter 10. Information Technology Risk Management

The information technology risk management system includes, but is not limited to:

1) information technology risk management policy;

2) information technology risk management procedures;

3) management information system;

4) assessment of the effectiveness of the information technology risk management system by the internal audit department (internal audit responsible employee).

The DAAO determines the following participants of the information technology risk management system (but not limited to them):

1) DAAO risk management department (responsible employee);

2) information technology department (responsible employee).

The DAAO creates a structural subdivision (appoints a responsible employee) for risk management, whose functions include managing information technology risks, including:

1) development, implementation and development of the information technology risk management system;

2) participation in the development and approval of action plans for implementing the DAAO strategy in terms of ensuring the availability of information and communication technologies;

3) participation in the assessment of information technology risks;

4) monitoring the level of information technology risks;

5) interaction and consultation with structural subdivisions (responsible employee) of the DAAO on issues of information technology risk management;

6) planning the conduct and analysis of the results of the assessment of information technology risks conducted by the information technology department (responsible employee);

7) development and formation of a risk register, including information technology risks;

8) providing reports on the implementation of significant information technology risks and monitoring the implementation of measures to eliminate their consequences to the governing body (executive body, supervisory board – if any) of the DAAO;

9) providing reports or other information on the management of information technology risks to the governing body (executive body, supervisory board – if any) of the DAAO;

10) using the results of internal audit in terms of information technology risks.

The DAAO creates a structural subdivision (appoints a responsible employee) for information technology, whose functions include:

1) conducting the assessment of information technology risks;

2) development of measures for processing information technology risks and providing reports on their implementation to the risk management department;

3) preparation and provision of reports on the implementation of significant information technology risks to the DAAO risk department, as well as on the elimination of their consequences;

4) development of action plans for implementing the DAAO strategy in terms of ensuring the availability of information and communication technologies for critical business processes.

Chapter 11. Information Security Risk Management

The information security risk management system includes, but is not limited to:

1) information security risk management policy;

2) information security risk management procedures;

3) management information system;

4) assessment of the effectiveness of the information security risk management system by the internal audit department (internal audit responsible employee).

The DAAO determines the following participants of the information security risk management system (but not limited to them):

1) DAAO risk management department (responsible employee);

2) information security department (responsible employee);

3) information technology department (responsible employee);

4) information owner departments.

The DAAO creates a structural subdivision (appoints a responsible employee) for risk management, whose functions include managing information security risks:

1) development, implementation and development of the information security risk management system;

2) participation in the development and approval of action plans for implementing the DAAO strategy in terms of ensuring information security;

3) creation and leadership of a working group for forming a list of critical information assets of the DAAO, including at least information owner departments;

4) participation in the assessment of information security risks;

5) monitoring the level of information security risks;

6) interaction and consultation with structural subdivisions of the DAAO (responsible employee) on issues of information security risk management;

7) planning the conduct and analysis of the results of the assessment of information security risks conducted by the information security department (responsible employee);

8) development and formation of a risk register, including information security risks;

9) providing reports on the implementation of significant information security risks and monitoring the implementation of measures to eliminate their consequences to the governing body (executive body, supervisory board – if any) of the DAAO;

10) providing reports or other information on the management of information security risks to the governing body (executive body, supervisory board – if any) of the DAAO;

11) using the results of internal audit in terms of information security risks.

The DAAO creates a structural subdivision (appoints a responsible employee) for information security, whose functions include:

1) conducting the assessment of information security risks;

2) development of measures for processing information security risks and providing reports on their implementation to the risk management department (responsible employee);

3) preparation and provision of reports on the implementation of significant information security risks to the DAAO risk department, as well as on the elimination of their consequences;

4) development of action plans for implementing the DAAO strategy in terms of ensuring information security.

The DAAO ensures the separate functioning of the structural subdivision (responsible employee) for risk management from the structural subdivision (responsible employee) for information security.

The risk management department (responsible employee) develops an internal document defining the procedure for managing information security risks, which includes, but is not limited to:

1) procedures for identification and classification of information assets, in order to identify critical information assets;

2) procedures for identification of vulnerabilities of critical information assets;

3) procedures for identification of potential threats to critical information assets;

4) procedures for identification of existing information security risk management measures;

5) procedures for assessing the probability and consequences of violation of confidentiality, integrity and availability of information assets, applying qualitative and/or quantitative assessment methods, including based on data on their implementation;

6) procedures for collection and storage of information on the implementation of significant information security risks;

7) procedures for forming a risk register, including information security risks;

8) procedures for monitoring the implementation of measures for processing information security risks.";


Chairman	T.M. Suleimenov

Approved

by the Decision of the Board

of the National Bank

of the Republic of Kazakhstan

of April 29, 2026 No. 47

Rules for Forming a Risk Management and Internal Control System for Operators of Exchange of Unencumbered Digital Assets, Operators of a Digital Financial Assets Platform, and Operators of a Trading Platform for Digital Assets

Chapter 1. General Provisions

These Rules for Forming a Risk Management and Internal Control System for Operators of Exchange of Unencumbered Digital Assets, Operators of a Digital Financial Assets Platform, and Operators of a Trading Platform for Digital Assets (hereinafter – the Rules) are developed in accordance with subparagraph 10) of part two of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan" (hereinafter – the Digital Assets Law) and define the procedure for forming a risk management and internal control system for operators of exchange of unencumbered digital assets, operators of a digital financial assets platform, and operators of a trading platform for digital assets (hereinafter – DAAO).
The Rules use the concepts provided for by the Digital Assets Law and the Law of the Republic of Kazakhstan "On the Securities Market", as well as the following concepts:

1) information asset – a set of information and an object of digital infrastructure used for its storage and/or processing;

2) fraud and unlawful incident risks – the probability of occurrence of financial losses and reputational risks, involvement of the DAAO in unlawful actions as a result of fraud by third parties and/or employees of the DAAO, use of services with digital assets in operations related to illegal production, circulation and/or transit of drugs, organization of activities of financial pyramids and for making payments and/or transfers of money to the benefit of electronic casinos and internet casinos, as well as foreign bookmakers and/or totalizators not having licenses for the right to engage in gambling business activities in the Republic of Kazakhstan;

3) price risk – the probability of occurrence of expenses (losses) as a result of a change in the cost of digital assets and financial instruments, arising in case of a change in the conditions of the digital asset market and financial markets affecting the market value of digital assets and financial instruments acquired at the expense of the DAAO's own assets;

4) reputational risk – the probability of occurrence of expenses (losses) as a result of negative public opinion or a decrease in trust in the DAAO;

5) back-testing – methods for checking the effectiveness of risk measurement procedures using historical data on the DAAO and comparing calculated results with current (actual) results from carrying out such operations;

6) currency risk – the probability of occurrence of expenses (losses) related to a change in exchange rates of foreign currencies in the course of the DAAO's activities. The danger of expenses (losses) arises from the revaluation of currency positions in monetary terms;

7) legal (juridical) risk – the risk of occurrence of expenses (losses) as a result of the DAAO's violation of the legislation of the Republic of Kazakhstan, including non-compliance of the DAAO's internal documents with the requirements of regulatory legal acts of the National Bank of the Republic of Kazakhstan, non-compliance of the DAAO's activity practice with its internal documents, and in relations with non-residents of the Republic of Kazakhstan – violation of the legislation of other states, as well as the conditions of concluded contracts;

8) cybersecurity risk – the probable occurrence of damage as a result of violation of confidentiality, intentional violation of integrity or availability of information assets of the DAAO;

9) credit risk – the probability of occurrence of expenses (losses) as a result of non-performance by the issuer of digital financial assets or a counterparty of its obligations on issued digital financial assets or concluded transactions in accordance with agreed conditions, as well as non-payment or untimely payment by clients of DAAO services;

10) corporate governance – a system of strategic and tactical management of the DAAO, representing a complex of relations between the highest body, governing body, executive body and other bodies of the DAAO, aimed at ensuring the effective functioning of the DAAO, protection of the rights and interests of its shareholders (participants), and providing shareholders (participants) with the opportunity for effective control and monitoring of the DAAO's activities;

11) compliance risk – the probability of occurrence of losses as a result of non-compliance by the DAAO and its employees with the requirements of civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on combating the legalization (laundering) of proceeds obtained criminally, financing of terrorism and financing of the proliferation of weapons of mass destruction (hereinafter – AML/CFT/CPF), on joint-stock companies, on limited and additional liability partnerships, internal documents of the DAAO regulating the procedure for providing services and conducting operations in the digital asset market, as well as the legislation of foreign states affecting the activities of the DAAO;

12) critical type of activity – a type of activity, the uninterrupted implementation of which depends on the stability of the DAAO as a whole;

13) policy for investing own assets – a document defining the list of investment objects, goals, strategies, conditions and restrictions on investment activities regarding the DAAO's own assets, conditions for hedging and diversification of the DAAO's own assets;

14) conflict of interest – a situation in which a contradiction arises between the personal interest of officials of the DAAO, its shareholders (participants) and/or its employees and the proper performance of their official powers or property and other interests of the DAAO and/or its employees and/or clients, which will entail adverse consequences for the DAAO and/or its clients. The DAAO, acting in the capacity of the DAAO, proceeds from the priority of the client's interests over its own interests, the interests of its employees, shareholders (participants) and affiliated persons;

15) operational risk – the probability of occurrence of expenses (losses) as a result of deficiencies or errors in the course of carrying out internal processes, committed by employees (human resources) and in the course of improper functioning of digital systems, digital platforms (trading platforms) and technologies, as well as as a result of the influence of external events, except for strategic risk and reputational risk;

16) liquidity loss risk – a risk related to the possible non-performance or untimely performance by the DAAO of its obligations. The liquidity loss risk of digital assets is determined by the possibility of their quick realization with low costs and at acceptable prices;

17) strategic risk – the probability of occurrence of losses as a result of errors (deficiencies) committed in making decisions determining the strategic development of the DAAO and expressed in insufficient consideration of possible dangers inherent in the DAAO's activities, incorrect or insufficiently justified definition of promising areas of activity in which the DAAO will achieve an advantage over competitors, absence or incomplete provision of necessary resources and organizational measures ensuring the achievement of strategic goals of the DAAO's activities;

18) stress testing – methods for measuring the potential impact on the financial position of the DAAO of exceptional but possible events that affect the activities of the DAAO;

19) stress situations – unforeseen situations of occurrence of overloads, failures, errors and/or other malfunctions in the operation of systems (digital platforms, trading platforms) of the DAAO;

20) risk – the probability that expected or unforeseen events will have a negative impact on the activities of the DAAO, its capital and/or income;

21) risk profile – a set of types of risks and other information characterizing the degree of exposure of the DAAO to risks inherent in all types of activities of the DAAO for identifying weaknesses and determining the priority of subsequent actions within the risk management system;

22) risk appetite – an aggregated (aggregated) level (levels) of significant risks (limits of permissible risk size), which (which) the DAAO is ready to accept or intends to exclude when implementing the strategy;

23) risk management system – a set of interrelated elements: procedures, methodologies, digital systems, combined into a single process for managing realized and potential risks within a risk level acceptable to the shareholder (participant) and aimed at achieving risk management goals and tasks. In the process of identifying and managing realized and potential risks affecting the activities of the DAO, the DAO's bodies, executive employees, and employees of structural subdivisions (responsible employees) participate within the scope of their assigned competencies and responsibilities. The process of identifying and managing realized and potential risks includes risk assessment, risk measurement, risk control, and risk monitoring;

24) risk matrix – a toolset for identifying, assessing, and visualizing potential risks in the manner provided for by the DAO's internal document;

25) risk culture – processes, procedures, and internal rules of the DAO aimed at understanding, accepting, managing, and controlling risks to minimize their impact on the DAO's activities, as well as ethical norms and professional standards for all participants in the organizational structure;

26) organizational structure – the quantitative composition and system of management bodies (executive bodies), executive employees, and structural subdivisions of the DAO, reflecting the structure of subordination and accountability, as provided for by the internal document and/or the set of internal documents of the DAO;

27) digital technology risk – the probability of damage occurring due to the failure (violation of functioning) of digital technologies operated by the DAO;

28) internal audit service (responsible employee for internal audit) – a subdivision (responsible employee) of the DAO created in accordance with the legislation of the Republic of Kazakhstan on joint-stock companies and limited and additional liability partnerships, depending on the organizational and legal form of the DAO;

29) internal control system – a part of the risk management system, representing a set of internal control procedures and policies that ensure the DAO achieves long-term profitability goals and maintains a reliable system of financial and managerial reporting, contributing to compliance with the legislation of the Republic of Kazakhstan, the DAO's policies, internal rules and procedures, and reducing the risk of losses or reputational risk for the DAO;

30) internal documents – documents regulating the conditions and procedures for the activities of the DAO, its bodies, subdivisions (responsible employees), and employees of subdivisions.

Chapter 2. Organization of the Risk Management System

The purpose of these Rules is to define requirements for the formation of the DAO's risk management and internal control systems by ensuring:

1) effective risk management of the DAO through timely identification, measurement, control, and monitoring to ensure the DAO's activities correspond to its chosen business model, corporate governance requirements, functioning of digital systems, digital platforms (trading platforms), and managerial information systems, conducting permitted operations, asset and liability management, functioning of the DAO's accounting system, and other digital and communication systems of the DAO, as well as the level of risks it assumes and the availability of a corresponding level of liquidity;

2) proper corporate governance practices and an appropriate level of business ethics and risk culture;

3) compliance by the DAO and its employees with the requirements of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint-stock companies, on limited and additional liability partnerships, internal policies, procedures, and other internal documents of the DAO regulating the provision of services and conduct of operations in the digital asset market, as well as the legislation of foreign states affecting the activities of the DAO;

4) timely detection and elimination of deficiencies in the activities of the DAO and its employees;

5) creation in the DAO of adequate mechanisms for addressing unforeseen or emergency situations;

6) rational decision-making and actions in the interests of the DAO based on a comprehensive assessment of the information provided, in good faith, with due diligence and care (duty of care);

7) decision-making by employees and officials of the DAO in good faith;

8) distribution of risk management functions, duties, and authorities among all structural subdivisions and employees of the DAO, and their responsibility, taking into account the minimization of conflicts of interest;

9) separation of risk management and internal control functions from the operational activities of the DAO by building a three-lines-of-defense system, which includes:

first line – at the level of structural subdivisions or employees of business subdivisions of the DAO;

second line – at the level of the subdivision (responsible employee) for risk management and performing control functions;

third line – at the level of the subdivision (responsible employee) for internal audit regarding the assessment of the effectiveness of the risk management system's functioning;

The DAO applies a risk-oriented approach in forming the three lines of defense, which implies taking into account the size, significance, nature, scale, and complexity of the DAO's activities.

Information exchange between subdivisions (responsible employees) of the DAO on risk management and internal control issues is carried out in accordance with internal documents.

10) availability of documents developed for regulating the activities of the DAO, creating and functioning of effective risk management and internal control systems at the DAO, and corresponding to the strategy, organizational structure, risk profile of the DAO, and the requirements of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint-stock companies, on limited and additional liability partnerships, as well as their periodic review and updating;

11) compliance with existing procedures, processes, policies, and other internal documents of the DAO on risk management by building an effective internal control system.

The DAO conducts stress testing on the main risks to which the DAO's activities are exposed at least once a year in the manner provided for by the DAO's internal document.

Stress testing on operational risk regarding the organization and conduct of trading is conducted by testing the trading platform of the digital asset trading platform operator for:

1) modeling stress situations of the functioning of trading platform elements, including the number of user connections, throughput of information flows, speed of order submission and trade execution, failure of trading platform components on main and/or auxiliary servers;

2) selection, combination, and modeling of stress situations and parameters of the functioning of trading platform elements, including network connections, operating system, database, level of authorization (access) to the trading platform, number of users, information flows, trading volumes, load on the main and/or auxiliary server (indicating the level of critical load).

The DAO conducts back-testing at least once a year in the manner provided for by the DAO's internal document, namely, checks of the effectiveness of risk measurement procedures using historical data on the DAO's activities and comparing the results calculated as a result of stress testing with current (actual) results from transactions with digital assets and/or financial instruments.
The DAO submits the results of stress testing and back-testing with proposals for improving risk management procedures (if necessary) to the management body (executive body, supervisory board – if present), which uses the results of risk assessment and regular stress testing and back-testing when making decisions regarding the DAO's activities and transactions with digital assets and/or financial instruments.
The DAO's risk management system includes the following areas of its activities:

1) conducting and administering the settlement and/or trading process for transactions with digital assets and money;

2) collection, entry, storage, and dissemination of information provided by issuers of digital financial assets and DAO clients (the issuer of digital financial assets does not provide information to the unencumbered digital asset exchange operator);

3) regular monitoring of accounting systems, other digital and communication systems (digital platforms, trading platforms) to ensure uninterrupted, continuous provision of digital asset services for the DAO (except for the unencumbered digital asset exchange operator), accounting for rights to digital assets and other financial instruments, settlements in digital assets and/or money, as well as reflecting information contained in the corresponding accounting systems;

4) conducting annual internal audits of the software and technical support of the DAO, including digital and communication systems used by the DAO in its activities;

5) development and implementation of projects aimed at further development and improvement of the DAO's activities regarding the functioning of accounting systems, digital and communication systems (digital platforms, trading platforms), the process of providing digital asset services for the DAO, accounting for the DAO's (except for the unencumbered digital asset exchange operator) rights to digital assets, settlements in digital assets, reflecting information contained in accounting systems, automation of certain operations carried out in the DAO, as well as the process of collection, entry, accounting, storage of information, and other areas of the DAO's activities;

6) development and approval of internal documents, including the policy for investing the DAO's own assets in digital assets and/or financial instruments in accordance with the procedure provided for by the DAO's internal document;

7) creation and improvement of the organizational and functional management structure of the DAO;

8) providing information necessary for decision-making to interested bodies of the DAO and exchanging information between bodies and subdivisions (responsible employees) of the DAO;

9) monitoring compliance by the DAO and its employees with requirements established by the legislation of the Republic of Kazakhstan on digital assets, on the securities market, and the DAO's internal policy on risk management;

10) determining the procedure for organizing the DAO's work with clients, including determining procedures for consideration and resolution of disputes, as well as the procedure for application by operators of digital financial assets platforms and/or operators of digital asset trading platforms of appropriate measures in case of non-performance by clients, including issuers of digital financial assets and holders of digital financial assets, of their obligations;

11) formation, maintenance, and storage by the DAO of information about operations (transactions) in the DAO's accounting system.

The provisions of these Rules apply to the stock exchange in the part not regulated by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated December 19, 2015 No. 252 "On Approval of the Rules for Forming a Risk Management and Internal Control System for a Stock Exchange" (registered in the Registry of State Registration of Normative Legal Acts under No. 12999).

The provisions of these Rules apply to the central depository in the part not regulated by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated December 28, 2018 No. 318 "On Approval of the Rules for Forming a Risk Management and Internal Control System for a Central Depository" (registered in the Registry of State Registration of Normative Legal Acts under No. 18180).

The risk management system provides for, but is not limited to, the presence of the following internal documents:

1) DAO's risk management policy;

2) procedure (policy) for investing the DAO's own assets;

3) procedures for conducting internal control and internal audit;

4) procedures aimed at AML/CFT/CPF;

5) procedures for managing existing and potential conflicts of interest by the DAO;

6) procedures aimed at preventing the use of insider information by executive and other employees of the DAO;

7) procedure for conducting settlements for concluded transactions with digital assets;

8) procedures for transferring digital assets and the procedure for collecting and storing information about the sender and recipient of digital assets;

9) DAO's information policy;

10) safety instructions.

11) policies for managing fraud and unlawful incidents risk.

Risk culture supplements existing approved procedures, processes, and mechanisms of the DAO's activities and is an integral component of the risk management system.

The DAO annually assesses the risk management and internal control system (hereinafter – Annual Assessment) according to the form specified in Appendix to the Rules and in the manner provided for by the DAO's internal documents.
As a result of the Annual Assessment, a report on the assessment of compliance with risk management system requirements is prepared according to the form specified in the Appendix to the Rules, which is sent to the National Bank of the Republic of Kazakhstan no later than the first quarter of the year following the reporting year.
The tasks of forming the risk management system are:

1) timely identification of risks and threats;

2) improving the quality of assessment of maximum permissible values of risk indicators;

3) development of alternative risk control mechanisms;

4) ensuring timely measures to minimize and manage risks;

5) involvement of separate structural subdivisions of the DAO (separate lines of defense), including the risk management subdivision, in the risk monitoring and assessment process, as well as increasing the responsibility of DAO employees in the field of the risk management system.

The DAO's risk management system includes identification, measurement, assessment, control, and monitoring of risk, which are carried out in accordance with the procedure provided for by the DAO's internal documents.
The head of the DAO's risk management subdivision (responsible employees for risk management) and/or employees of the DAO's risk management subdivision have higher education, possess professional competence and work experience of at least three years in the field of risk management, as well as knowledge of the financial legislation of the Republic of Kazakhstan and the legislation of the Republic of Kazakhstan on digital assets, the securities market.
Additional requirements for the head and employees of the risk management subdivision are established by the DAO.
The DAO identifies and differentiates the following types (categories) of risks in its activities:

1) operational risks;

2) legal (juridical) risks;

3) reputational risks;

4) market (price, currency, and interest rate) risks;

5) credit risks;

6) liquidity loss risks;

7) risks defined in accordance with the DAO's risk management policy.

The goals of the risk identification, assessment, and control process are:

1) timely identification of unidentified risks and threats;

2) improving the quality of assessment of maximum permissible values of risk indicators;

3) development of alternative risk control mechanisms;

4) ensuring timely measures to minimize and manage risks;

5) involvement of separate subdivisions of the DAO (responsible employees), including the risk management subdivision (responsible employee for risk management), in the risk identification and assessment process, as well as increasing the responsibility of DAO employees in the field of risk management.

The risk identification procedure is based on a thorough review and monitoring carried out by each subdivision of the DAO depending on the type of subdivision's activity jointly with the risk management subdivision (responsible employee for risk management).

Identified risks are analyzed according to the following characteristics:

1) frequency of risk occurrence;

2) scale of risk impact.

Based on the analysis results, risks are differentiated as acceptable and unacceptable depending on the value of the risk indicator defined as permissible.

The legal support subdivision (legal subdivision or responsible employee for legal support) of the DAO ensures the regulation of legal (juridical) risks arising from the DAO's violation of the requirements of the legislation of the Republic of Kazakhstan, including non-compliance of the DAO's internal documents with the requirements of normative legal acts of the National Bank of the Republic of Kazakhstan, non-compliance of the DAO's activity practices with its internal documents, as well as the conditions of concluded contracts.
The DAO's subdivision (responsible employee) for public relations jointly with the risk management subdivision ensures control, monitoring, and minimization of reputational risks in the manner provided for by the DAO's internal documents.
The DAO annually no later than April 1 of the year following the reporting year submits to the National Bank of the Republic of Kazakhstan a report on the assessment of compliance with risk management system requirements according to the form specified in the Appendix to the Rules.

Chapter 3. Business Model

The DAO's business model is a set of chosen strategy, products, and planning processes ensuring the competitiveness and sufficient level of profitability of the DAO.
The main principles in forming the DAO's business model are:

1) viability, expressed in the DAO's ability to ensure a sufficient level of profitability in the next 12 (twelve) months and based on budget planning and forecasting of financial indicators;

2) sustainability, expressed in the DAO's ability to ensure a sufficient level of profitability for a period of at least 3 (three) years and based on strategic planning and forecasting of financial indicators.

The DAO conducts regular analysis of the business model to assess its impact from strategic risks and risks inherent in the DAO's activities.

The DAO's activities are carried out within the chosen business model taking into account the volume of assets, nature and level of complexity of activities, organizational structure, and risk profile.

The DAO's strategy is approved by the management body (executive body, supervisory board – if present) of the DAO for a period of at least 3 (three) years.
The content (structure) of the DAO's strategy is determined by the DAO's internal documents.
The DAO's strategy is developed and improved taking into account the results of back-testing to exclude factors that previously negatively affected the DAO's activities.

Chapter 4. Risk Appetite Strategy

In order to build an effective risk management system, the management body (executive body, supervisory board – if present) of the DAO approves the risk appetite strategy as a separate document, or as a component of the DAO's strategy.
The risk appetite strategy defines clear boundaries of the volume of assumed risks within which the DAO's activities are carried out in the implementation of the general DAO strategy, and also defines the risk profile of the DAO's activities to prevent the realization of risks or minimize their negative impact on the DAO's activities. The risk appetite strategy is taken into account:

1) in the strategic and budget planning of the DAO, defined in Chapter 3 of the Rules;

2) in the formation of the DAO's organizational structure and compensation policy, defined in Chapter 5 of the Rules.

When developing the risk appetite strategy, the DAO takes into account the size of its assets, market share, nature, scale, and complexity of its activities.

Chapter 5. Corporate Governance

The main elements of an effective corporate governance system are:

1) organizational structure;

2) corporate values;

3) DAO's activity strategy;

4) distribution of duties and authorities in decision-making between the DAO's bodies;

5) mechanisms of interaction and cooperation between the DAO's bodies, external and internal auditors of the DAO;

6) risk management procedures and methodologies;

7) internal control system;

8) compensation system;

9) presence of a managerial reporting system;

10) transparency of corporate governance.

The DAO's organizational structure corresponds to the chosen business model, risk profile, scale and nature of activities, types and complexity of operations, minimizes conflicts of interest, and distributes risk management authorities between collegial bodies and structural subdivisions (responsible employees), and complies with requirements established by the laws of the Republic of Kazakhstan on joint-stock companies, limited and additional liability partnerships (depending on the organizational and legal form of the DAO).

The organizational structure is determined by the DAO taking into account the size of its assets, market share, nature, scale, and complexity of the DAO's activities.

Chapter 6. Business Continuity Management

The DAO carries out, in the manner determined by the DAO's internal document, an impact analysis, through which an assessment is made of:

1) impacts, damages, or losses to the DAO's personnel, premises, technology, or information;

2) violations of the requirements of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint-stock companies, on limited and additional liability partnerships;

3) loss of reputation.

The DAO identifies critical types of activities. The activity identified in the process of impact analysis, the loss of which has the maximum negative impact on the DAO in the short term and is subject to restoration in the shortest possible time, is a critical type of activity.
The DAO determines the resources and risk management measures for unforeseen circumstances necessary to maintain critical types of activities, which include, but are not limited to the following:

1) personnel (necessary number of employees, necessary skills and competencies);

2) premises (main and alternative sites, as well as premises requiring enhanced protection);

3) technologies (information-technology and telecommunications services supporting critical activities, as well as other technologies supporting critical activities, including perimeter security);

4) information (necessary information for performing critical activities, the volume of information requiring recovery, as well as methods and means of storing, protecting, and recovering information);

5) suppliers, external services, and supplies upon which the performance of critical activities depends;

6) financial resources (the volume of financial resources potentially available for executing the business continuity and recovery plan of the PUCA in the event of unforeseen circumstances).

The PUCA conducts an analysis of unforeseen circumstance risks, which allows for the assessment of threats and vulnerabilities in critical activities and the resources used by them. As threats that have a negative impact on resources, the PUCA considers, but is not limited to, the following:

1) unavailability of workers;

2) unavailability of technologies, including digital and communication technologies (computer viruses, failure of computer hardware, loss of connection);

3) unavailability of supplies (water, electricity);

4) lack of access to buildings (premises);

5) unavailability of key suppliers, counterparties;

6) unavailability of key information;

7) unavailability of financial resources.

The PUCA ensures the development and existence of a plan (plans) for ensuring business continuity and/or recovery. The plan (plans) for ensuring business continuity and/or recovery must take into account its asset size, market share, nature, scale, and complexity of its activities.

Chapter 7. Market Risk Management

The executive body and/or the head of risk management (responsible employee for risk management) of the PUCA ensures the development of a market risk management policy and monitors and controls compliance by the PUCA and its employees with the market risk management policy, which corresponds to the scale of the PUCA's activities, the current market situation, strategy, size, and level of complexity of the PUCA's operations, and ensures the effective identification, measurement, monitoring, and control of the PUCA's market risk.
Methods (measures) for reducing the PUCA's market risks (limits, diversification norms, hedging, reserving, insurance, and other methods) are determined by the internal documents of the PUCA.

Chapter 8. Liquidity Loss Risk Management

The PUCA develops an effective process for the identification, assessment, monitoring, and control of liquidity loss risk, which includes detailed forecasting of cash flows for assets, liabilities, and off-balance sheet instruments at different time intervals.
The PUCA assesses all balance sheet and off-balance sheet items affecting the level of liquidity loss risk. The PUCA assesses the level of liquidity in the market to cover the PUCA's need for attracting funding for the purpose of regulating liquidity loss risk.
In managing liquidity loss risk, the PUCA takes into account the decline in asset value and the impact of their sale during stress on the level of liquidity, profitability, and capital.
The PUCA takes into account the interaction between liquidity loss risk and other types of risks to which it is exposed.

Chapter 9. Operational Risk Management

Operational risks include risks associated with:

1) uncertain and ineffective organizational structure of the PUCA, including the distribution of responsibility, reporting structure, and management;

2) ineffective strategies, policies, and/or standards in the field of digital technologies, deficiencies in the use of software;

3) ineffective personnel management and/or unqualified staff of the PUCA;

4) unauthorized use of accounting systems, digital platforms (trading platforms);

5) risks associated with inefficient construction of the PUCA's activity processes or weak control over compliance with internal rules;

6) unforeseen or uncontrollable external factors affecting the PUCA's activities;

7) the presence of deficiencies or errors in internal documents regulating the PUCA's activities;

8) violation of the transaction registration process, settlements with digital assets, reflection of information contained in accounting systems for individual operations performed in the PUCA, and the execution of operations in these systems;

9) improper use of confidential information provided by the PUCA's clients;

10) emergence of conflicts of interest between the PUCA's bodies and its subdivisions;

11) emergence of errors associated with the collection, input, storage, and dissemination of information;

12) probability of errors and failures in the functioning of the PUCA's software and technical support, including corresponding accounting systems, as well as in operated digital and communication systems and technologies;

13) probability of damage due to the use of imperfect technologies in the course of the PUCA's activities, including, among other things, processes for organizing the accounting of rights to digital assets, transaction registration, settlements of transactions with digital assets, reflection of information contained in accounting systems (for accounting purposes regarding digital financial assets platform operators, digital assets trading platform operators), execution of system administration functions;

14) emergence of errors when entering and changing data in accounting systems (for accounting purposes regarding digital financial assets platform operators, digital assets trading platform operators);

15) circumstances identified by the PUCA as potential risks.

When measuring, assessing, controlling, and monitoring operational risks, the PUCA applies one or more of the following methods:

1) application of key risk indicators;

2) formation of a risk matrix;

3) collection and analysis of internal loss data (maintenance of a loss database);

4) description (regulation) of business processes;

5) use of internal audit results.

The procedure for selecting methods of measurement, assessment, control, monitoring, and ways (measures) for reducing operational risks is established by the PUCA's internal document on operational risk management.

Chapter 10. Digital Technology Risk Management

The digital technology risk management system includes, but is not limited to:

1) digital technology risk management policy;

2) digital technology risk management procedures;

3) management information system;

4) assessment of the effectiveness of the digital technology risk management system by the internal audit subdivision (responsible employee for internal audit).

The PUCA defines the following participants in the digital technology risk management system (but not limited to them):

1) PUCA's risk management subdivision (responsible employee);

2) PUCA's digital technology subdivision (responsible employee).

The PUCA creates a structural subdivision (appoints a responsible employee) for risk management, whose functions include managing digital technology risks, including:

1) development, implementation, and development of the digital technology risk management system;

2) participation in the development and approval of action plans for implementing the PUCA's strategy regarding the availability of digital technologies;

3) participation in the assessment of digital technology risks;

4) monitoring the level of digital technology risks;

5) interaction and consultation with structural subdivisions (responsible employee) of the PUCA on issues of digital technology risk management;

6) planning the conduct and analysis of the results of digital technology risk assessments conducted by the digital technology subdivision (responsible employee);

7) development and formation of a risk register, including digital technology risks;

8) reporting to the management body (executive body, supervisory board - if available) of the PUCA on the implementation of significant digital technology risks and monitoring the execution of measures to eliminate their consequences;

9) providing reports or other information on digital technology risk management to the management body (executive body, supervisory board - if available) of the PUCA;

10) use of internal audit results regarding digital technology risks.

The PUCA creates a structural subdivision (appoints a responsible employee) for digital technologies, whose functions include:

1) conducting assessments of digital technology risks;

2) development of measures for processing digital technology risks and providing reports on their implementation to the risk management subdivision;

3) preparation and provision of reports on the implementation of significant digital technology risks to the PUCA's risk subdivision, as well as on the elimination of their consequences;

4) development of action plans for implementing the PUCA's strategy regarding the availability of digital technologies for critical business processes.

Chapter 11. Cybersecurity Risk Management

The cybersecurity risk management system includes, but is not limited to:

1) cybersecurity risk management policy;

2) cybersecurity risk management procedures;

3) management information system;

4) assessment of the effectiveness of the cybersecurity risk management system by the internal audit subdivision (responsible employee for internal audit).

The PUCA defines the following participants in the cybersecurity risk management system (but not limited to them):

1) PUCA's risk management subdivision (responsible employee);

2) PUCA's cybersecurity subdivision (responsible employee);

3) PUCA's digital technology subdivision (responsible employee);

4) subdivisions-owners of protected information.

The PUCA creates a structural subdivision (appoints a responsible employee) for risk management, whose functions include managing cybersecurity risks:

1) development, implementation, and development of the cybersecurity risk management system;

2) participation in the development and approval of action plans for implementing the PUCA's strategy regarding cybersecurity;

3) creation and leadership of a working group for forming a list of the PUCA's critical information assets, including at least the subdivisions-owners of protected information;

4) participation in the assessment of cybersecurity risks;

5) monitoring the level of cybersecurity risks;

6) interaction and consultation with structural subdivisions (responsible employee) of the PUCA on issues of cybersecurity risk management;

7) planning the conduct and analysis of the results of cybersecurity risk assessments conducted by the cybersecurity subdivision (responsible employee);

8) development and formation of a risk register, including cybersecurity risks;

9) reporting to the management body (executive body, supervisory board - if available) of the PUCA on the implementation of significant cybersecurity risks and monitoring the execution of measures to eliminate their consequences;

10) providing reports or other information on cybersecurity risk management to the management body (executive body, supervisory board - if available) of the PUCA;

11) use of internal audit results regarding cybersecurity risks.

The PUCA creates a structural subdivision (appoints a responsible employee) for cybersecurity, whose functions include:

1) conducting assessments of cybersecurity risks;

2) development of measures for processing cybersecurity risks and providing reports on their implementation to the risk management subdivision (responsible employee);

3) preparation and provision of reports on the implementation of significant cybersecurity risks to the PUCA's risk subdivision, as well as on the elimination of their consequences;

4) development of action plans for implementing the PUCA's strategy regarding cybersecurity.

The PUCA ensures the separate functioning of the structural subdivision (responsible employee) for risk management from the structural subdivision (responsible employee) for cybersecurity.

The risk management subdivision (responsible employee) develops an internal document determining the procedure for managing cybersecurity risks, which includes, but is not limited to:

1) procedures for the identification and classification of information assets, for the purpose of identifying critical information assets;

2) procedures for identifying vulnerabilities of critical objects of the digital infrastructure of information assets;

3) procedures for identifying potential threats regarding critical information assets;

4) procedures for identifying existing cybersecurity risk management measures;

5) procedures for assessing the probability and consequences of violations of the confidentiality, integrity, and availability of information assets, applying qualitative and/or quantitative assessment methods, including based on data on their implementation;

6) procedures for collecting and storing information on the implementation of significant cybersecurity risks;

7) procedures for forming a risk register, including cybersecurity risks;

8) procedures for monitoring the execution of measures for processing cybersecurity risks.

Chapter 12. Compliance Risk Management

The management body (executive body, supervisory board - if available) of the PUCA controls the PUCA's compliance risk management procedure, creates a compliance control subdivision (appoints a responsible employee) at the PUCA, appoints and dismisses the chief compliance controller, and approves the compliance risk management policy.

The compliance control subdivision (responsible employee) organizes procedures for compliance with the requirements of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint stock companies, on limited and additional liability partnerships, the legislation of foreign states affecting the activities of the PUCA, as well as the internal documents of the PUCA regulating the procedure for the PUCA to provide services and conduct operations in the financial market, and provides complete and reliable information to the management body (executive body, supervisory board - if available) of the PUCA regarding the presence of compliance risk.

The compliance control subdivision (responsible employee) is responsible for developing the compliance risk management policy, which is subject to approval by the management body (executive body, supervisory board - if available) of the PUCA and contains the main principles of compliance risk management, including the principles of creating a compliance culture at the PUCA, on the basis of which compliance risk is identified and managed at all levels of the PUCA's structure.

The compliance control subdivision (responsible employee) is responsible for developing the compliance risk management policy, ensuring compliance risk management, and coordinating the PUCA's activities on compliance risk management. The compliance control subdivision (responsible employee) ensures the compliance of the compliance risk management policy and procedures, including money laundering (AML), terrorist financing (TF), and proliferation financing (PF) risk (hereinafter referred to as AML/CFT/CPF), with the requirements of the legislation on AML/CFT/CPF.

The compliance control subdivision (responsible employee) is a structural subdivision (responsible employee) of the PUCA, independent from any activities of the structural subdivisions of the PUCA constituting the first line of defense.

The independence of the compliance control subdivision (responsible employee) is ensured by the following factors:

the compliance control subdivision (responsible employee) has the status of an independent structural subdivision;

employees of the compliance control subdivision (responsible employee for compliance control) do not hold concurrent positions in other structural subdivisions of the PUCA, except for holding the position of head of the risk management subdivision (responsible employee for risk management) and/or the AML/CFT/CPF subdivision (responsible employee for AML/CFT/CPF);

the head and employees of the compliance control subdivision are not in a situation where there may be a conflict of interest between their duties in managing compliance risk and any other duties assigned to them;

employees of the compliance control subdivision, within their competence, have access and, if necessary, demand any information from the structural subdivisions of the PUCA, subsidiary organizations of the PUCA, as well as attract employees of the PUCA and its subsidiary organizations to assist in performing the compliance control function.

The compliance control subdivision (responsible employee) performs the following functions (but not limited to):

1) development of an internal procedure, methods, and procedures for the identification, measurement, monitoring, and control of the PUCA's compliance risk on a consolidated basis;

2) development, implementation, and ensuring the existence of internal control rules for the purposes of AML/CFT/CPF;

3) formation of a compliance program (plan), which includes:

verification of compliance by PUCA subdivisions with the compliance risk management policy, taking into account the requirements of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint stock companies, on limited and additional liability partnerships;

training of personnel on compliance risk management issues;

4) assistance to the PUCA bodies in managing the PUCA's compliance risk;

5) consulting the management and employees of the PUCA on the norms of the civil and tax legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, on digital assets, on currency regulation and currency control, on the securities market, on accounting and financial reporting, on AML/CFT/CPF, on joint stock companies, on limited and additional liability partnerships, on rules, on policies related to compliance risk management, including informing about changes, except in cases where such a function is performed by the legal subdivision (responsible employee for legal support) of the PUCA;

6) control of the organization at the PUCA of work to familiarize PUCA employees with the requirements of the PUCA's internal documents regulating the procedure for the PUCA to provide services and conduct operations in the market;

7) coordination of the activities of the PUCA's subsidiary organizations on issues of compliance risk management, including AML/CFT/CPF risk;

8) mandatory participation in the process of introducing new products and services;

9) ensuring the organization at the PUCA of measures to identify, assess, and control conflicts of interest;

10) development of processes and procedures for preventing violations of the requirements of the legislation on AML/CFT/CPF, policies and procedures for compliance risk management, AML/CFT/CPF risk (hereinafter referred to as compliance requirements);

11) development independently or jointly with structural subdivisions and officials of the PUCA of recommendations and corrective measures to eliminate identified violations of compliance requirements, facts of involvement of the PUCA, employees of the PUCA, and services of the PUCA in illegal activities related to the illegal production, circulation, and/or transit of narcotics, organization of financial pyramid activities, execution of money and/or digital asset transfers in favor of electronic casinos and internet casinos, foreign bookmakers and/or totalizators not having licenses to engage in gambling business activities in the Republic of Kazakhstan, and deficiencies in the PUCA's work related to compliance risk management, and providing relevant information to the management body (executive body, supervisory board - if available) of the PUCA;

12) development and maintenance of a compliance risk reporting system and periodic provision of information on compliance risk management issues to the management body (executive body, supervisory board - if available) of the PUCA;

13) development of an internal procedure for interaction and coordination of compliance risk management work with structural subdivisions of the PUCA, including the internal audit subdivision (responsible employee);

14) coordination of work on collecting quantitative and qualitative indicators for assessing the risk of the PUCA's involvement in AML/CFT/CPF risks and transmitting information to the National Bank of the Republic of Kazakhstan annually no later than February 5 of the year following the reporting year.

The Chief Compliance Controller (Compliance Controller) is responsible for the performance of the functions defined by this paragraph, the proper implementation by the compliance control subdivision (responsible employee) of processes and procedures for preventing and corrective measures to eliminate violations of compliance requirements.

Separate functions of compliance risk management in accordance with the PUCA's internal documents are delegated to other structural subdivisions of the PUCA if necessary, provided there is no conflict of interest.

The compliance risk management system includes, but is not limited to:

1) compliance risk management policy and procedures;

2) AML/CFT/CPF risk management policy and procedures, including a customer acceptance policy. When developing and implementing procedures for making decisions on accepting clients for service, the PUCA takes into account inherent risk factors;

3) assessment of the effectiveness of the compliance risk management system by the internal audit subdivision (responsible employee).

The compliance risk management system is based on 3 (three) lines of defense:

PUCA employees;

compliance control subdivision (responsible employee);

internal audit subdivision (responsible employee).

Chapter 13. Internal Control

The PUCA's internal control system is created for:

1) ensuring the operational and financial efficiency of the PUCA's activities by checking the effectiveness and profitability of the PUCA's activities and determining the probability of losses;

2) ensuring the reliability, completeness, and timeliness of financial and management information by checking the accuracy and quality of the PUCA's financial and management reporting;

3) ensuring that internal documents defining the PUCA's internal policies and procedures comply with the requirements of the legislation of the Republic of Kazakhstan on digital assets, on the securities market, on joint stock companies, on limited and additional liability partnerships;

4) preventing the involvement of the Digital Asset Service Provider (DASP) and its employees, DASP clients, in unlawful activities, including fraud, deception, money laundering/terrorist financing/predicate offenses (ML/TF/POF), illegal production, circulation and/or transit of narcotics, organizing financial pyramid activities, making payments and/or transfers of value using digital assets in favor of electronic casinos and internet casinos, as well as foreign bookmakers and/or totalizators that do not have licenses to engage in gambling business activities in the Republic of Kazakhstan.

The internal control system consists of 5 (five) interconnected elements:

1) managerial control;

2) risk identification and assessment;

3) implementation of control and separation of powers;

4) information and interaction;

5) monitoring and correction of deficiencies.

The functioning of the internal control system occurs on the principle of continuous sequential passage of the following three stages:

1) formation of the internal control system (taking into account the results of effectiveness assessment) by including procedures in the internal documents of the DASP;

2) use in work of the internal control system procedures defined by the internal documents of the DASP;

3) conducting an assessment of the effectiveness of the internal control system.

The compliance control department (responsible employee) of the DASP performs internal control functions.

Chapter 14. Internal Audit

The internal audit service is created (the responsible internal audit employee is appointed) for the purpose of solving tasks arising in the implementation by the management body (executive body, supervisory board – if any) of the DASP of functions to ensure the presence and functioning of an adequate internal control system by providing an objective assessment of the state of the internal control system and recommendations for its improvement.

The goal of internal audit is to assess the adequacy and effectiveness of internal control and risk management systems for all aspects of the DASP's activities, monitor compliance with the DASP's internal rules and procedures, execution of recommendations of internal and external auditors, impact measures and requirements of the National Bank of the Republic of Kazakhstan established regarding the DASP's activities, ensure timely and reliable information about the state of performance of functions and tasks assigned to DASP subdivisions and employees, as well as provide effective and efficient recommendations for improving work.

The head and employees of the internal audit service (responsible internal audit employee) are appointed by the management body (executive body, supervisory board – if any) of the DASP and have access to all necessary documents related to the activities of the audited subdivision (responsible employee) of the DASP, as well as its branches and representative offices, including those constituting commercial and official secrets.
Requirements for the head and employees of the internal audit service, their powers, and their remuneration system are determined by the management body (executive body, supervisory board – if any) of the DASP.
The head and employees of the internal audit service (responsible internal audit employee) do not hold other positions, are not members of the collegial body of the DASP, and do not combine duties in the DASP and/or subsidiary organizations of the DASP.

Appendix

to the Rules for Forming a Risk Management and Internal Control System for Unencumbered Digital Asset Exchange Operators, Digital Financial Assets Platform Operators, and Digital Asset Trading Platform Operators

Report

on the assessment of compliance with risk management system requirements

(name of the unencumbered digital asset exchange operator, digital financial assets platform operator, digital asset trading platform operator (hereinafter – digital asset service provider)

Reporting period: for the year "______"


No.	Reference to the corresponding paragraph, part, subparagraph, clause of the Rules	Assessment of compliance with Rule requirements	Identified deficiencies	Accepted (planned) measures to eliminate deficiencies (content of the measure, deadlines for execution)	Responsible performers (surname, first name, patronymic (if any), position, contact information)
1	2	3	4	5	6

General assessment of compliance with risk management system requirements: _______

Explanation for filling out the form

Assessment of compliance with risk management system requirements is carried out using a three-point system based on the following criteria (compliant, partially compliant, non-compliant):

1) the assessment "compliant" is issued when the digital asset service provider fulfills the risk management system requirement criterion without any significant deficiencies;

2) the assessment "partially compliant" is issued when deficiencies are detected that are not considered sufficient to raise serious doubts about the ability of the digital asset service provider to achieve compliance with a specific risk management system requirement criterion;

3) the assessment "non-compliant" is issued when the digital asset service provider fails to fulfill the risk management system requirement criterion.

In the event that certain risk management system requirements do not apply to the digital asset service provider, compliance assessment for that requirement criterion is not carried out and is marked with the corresponding record "not applicable".