On Approval of the Rules for Organizing the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)

Astana city

On Approval of the Rules for Organizing the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)

In accordance with paragraph 2-1 of Article 25-1 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. To approve the attached Rules for Organizing the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan).

2. To recognize as no longer in force the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated July 16, 2024 No. 43 "On Approval of Requirements for the Procedure for Carrying Out the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud and Its Interaction with Persons Participating in Its Activities" (registered in the State Registration Register of Normative Legal Acts under No. 34772).

3. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1) together with the Legal Department of the National Bank of the Republic of Kazakhstan, state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on the official internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after state registration of this resolution, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of the measure provided for by subparagraph 2) of this paragraph.

4. Control over the execution of this resolution shall be assigned to the supervising Deputy Chairman of the National Bank of the Republic of Kazakhstan.

5. This resolution shall enter into force after the day of its first official publication, but not earlier than August 31, 2025, with the exception of paragraphs 15 and 16 of the attached Rules, which shall enter into force on January 3, 2026.

Chairman		T. Suleimenov

"AGREED"

Agency of the Republic of Kazakhstan

for Regulation and Development of the

Financial Market

"AGREED"

Ministry of Internal Affairs

of the Republic of Kazakhstan

"AGREED"

Ministry of Digital Development,

Innovations and Aerospace

Industry

of the Republic of Kazakhstan

"AGREED"

Agency of the Republic of Kazakhstan

for Financial Monitoring

Appendix to the Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 54 dated August 25, 2025

Rules for Organizing the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)

Chapter 1. General Provisions

1. These Rules for Organizing the Activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan) (hereinafter – the Rules) are developed in accordance with paragraph 2-1 of Article 25-1 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law on Payments) and determine:

1) the procedure for carrying out the activities of the Payment Transaction Data Exchange Center for Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan) (hereinafter – the Anti-Fraud Center) and the interaction of the Anti-Fraud Center with persons participating in its activities (hereinafter – participants of the Anti-Fraud Center);

2) the procedure for the Anti-Fraud Center to form and maintain databases on events and attempts of payment transactions with signs of fraud and to provide access to them to participants of the Anti-Fraud Center;

3) the procedure and terms for refusal and suspension of execution of instructions by financial organizations, payment organizations (hereinafter – organization, organizations) upon receiving information from the Anti-Fraud Center about persons associated with payment transactions with signs of fraud;

4) the procedure, forms and terms for organizations to send to the Anti-Fraud Center information about all events and (or) attempts of payment transactions with signs of fraud;

5) the procedure and types of provision of a limited list of financial or payment services in the event a client is included in the databases on events and attempts of payment transactions with signs of fraud by an organization, as well as the procedure for a client (owner of a bank account, electronic wallet) to apply to the organization to obtain a limited list of financial or payment services;

6) the procedure for interaction of criminal prosecution bodies, national security and law enforcement bodies, organizations in order to identify and prevent other payment transactions that are recognized as illegal and (or) prohibited in accordance with the laws of the Republic of Kazakhstan (hereinafter – other payment transactions that are recognized as illegal and (or) prohibited). For the purposes of the Rules, other payment transactions that are recognized as illegal and (or) prohibited include payment transactions related to illegal production, circulation and (or) transit of drugs, organization of financial pyramid activities, making payments and (or) money transfers in favor of electronic casinos and internet casinos;

7) the procedure for returning money to a client specified in a notification from a criminal prosecution body, authorized by a prosecutor, on recognizing a transaction as fraudulent.

2. The Rules use the concepts provided for by the Law on Payments, the Law of the Republic of Kazakhstan "On Communications" and the Rules for Issuing Payment Cards, as well as the requirements for activities servicing operations with their use on the territory of the Republic of Kazakhstan, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 205 "On Approval of the Rules for Issuing Payment Cards, as well as Requirements for Activities Servicing Operations with Their Use on the Territory of the Republic of Kazakhstan" (registered in the State Registration Register of Normative Legal Acts under No. 14299).

3. The Anti-Fraud Center is the joint-stock company "National Payment Corporation of the National Bank of the Republic of Kazakhstan", which coordinates and takes measures aimed at identifying and preventing payment transactions with signs of fraud and other payment transactions in the manner provided for by Article 25-1 of the Law on Payments.

4. In accordance with part two of paragraph 3 of Article 25-1 of the Law on Payments, the participants of the Anti-Fraud Center are:

1. organizations;

2) mobile operators;

3) criminal prosecution bodies;

4) national security bodies;

5) law enforcement bodies;

6) National Bank of the Republic of Kazakhstan (hereinafter – the National Bank);

7) authorized body for regulation, control and supervision of the financial market and financial organizations.

Chapter 2. Carrying Out the Activities of the Anti-Fraud Center and Interaction of the Anti-Fraud Center with Its Participants

5. The Anti-Fraud Center:

1) carries out collection, consolidation and storage of information on events and attempts of payment transactions with signs of fraud received from organizations, mobile operators, criminal prosecution, national security and law enforcement bodies;

2) processes and analyzes data on payments and (or) money transfers classified in accordance with established criteria as payment transactions with signs of fraud and (or) data on other payment transactions that are recognized as illegal and (or) prohibited, necessary for organizations, mobile operators, criminal prosecution bodies;

3) provides information necessary to prevent payment transactions with signs of fraud and (or) other payment transactions that are recognized as illegal and (or) prohibited, to organizations, mobile operators, criminal prosecution, national security and law enforcement bodies, including information on threats, vulnerabilities, prerequisites for the occurrence of events, as well as methods for their prevention and elimination of consequences;

4) ensures an appropriate regime for storage, protection and preservation of information, data and documents received in the course of its activities that constitute official, commercial, banking or other secrets protected by law;

5) carries out collection, processing and storage of personal data in anonymized form;

6) based on information from criminal prosecution, national security and law enforcement bodies, provides assistance in identifying and preventing other payment transactions that are recognized as illegal and (or) prohibited.

6. A participant of the Anti-Fraud Center connects to the Anti-Fraud Center by establishing technical interaction with the information system of the Anti-Fraud Center in the manner determined by the internal documents of the Anti-Fraud Center and agreed with the authorized body in the field of personal data protection, in compliance with the requirements for ensuring the security of protected information established by the Laws of the Republic of Kazakhstan "On Informatization", "On Personal Data and Their Protection", "On Banks and Banking Activities in the Republic of Kazakhstan" and "On Electronic Document and Electronic Digital Signature".

7. A message about a payment transaction with signs of fraud received from an organization and (or) a criminal prosecution body through the information system of the Anti-Fraud Center for inclusion of the sender of money and (or) the beneficiary (recipient of money) in the database on events of payment transactions with signs of fraud (hereinafter – the database on events) and (or) on attempts of payment transactions with signs of fraud (hereinafter – the database on attempts) is included in the database on attempts or on events immediately after receipt by the Anti-Fraud Center and becomes available to all participants of the Anti-Fraud Center.

The information system of the Anti-Fraud Center ensures sequential recording of the message sent by the organization about a payment transaction with signs of fraud to the Anti-Fraud Center, confirming:

1) sending of the message by the organization to the Anti-Fraud Center;

2) receipt of this message by the Anti-Fraud Center and its further sending to the participants of the Anti-Fraud Center;

3) delivery and receipt of the message by the participants of the Anti-Fraud Center;

4) response to the message from other participants of the Anti-Fraud Center.

8. Organizations, after receiving an instruction on payment and (or) money transfer, before its execution, verify the identification data, namely the individual or business identification number, bank account number and mobile phone number of their clients – the sender of money and (or) the beneficiary against the databases on attempts and events.

9. The National Bank daily receives from the Anti-Fraud Center information on payment transactions with signs of fraud in the form established by the internal documents of the Anti-Fraud Center operator.

10. The Anti-Fraud Center provides participants of the Anti-Fraud Center with access to information on mobile phone numbers of persons for whom there is information about participation in fraudulent payment transactions and unlawful incidents.

Chapter 3. Formation and Maintenance of Databases of the Anti-Fraud Center

11. To support its activities, the Anti-Fraud Center forms databases on events and on attempts, as well as other databases in accordance with the internal documents of the Anti-Fraud Center.

The Anti-Fraud Center provides participants with access to the databases on events and attempts in the manner established by the Rules, as well as by the internal documents of the Anti-Fraud Center.

12. The database on events is formed on the basis of messages about payment transactions with signs of fraud received from a criminal prosecution body regarding persons for whom there is confirmed information about participation in fraudulent payment transactions.

Exclusion of a person from the database on events is carried out on the basis of a message sent to the Anti-Fraud Center by the criminal prosecution body that included this person in the database on events, in the form established by the internal documents of the Anti-Fraud Center.

The organization, within 3 (three) working days from the date of exclusion of the person from the database on events, resumes expenditure operations on the bank account, electronic wallet, removes the blocking of the payment amount and (or) money transfer, and also notifies the client thereof in the manner established by the agreement concluded with the client.

13. The database on attempts is formed on the basis of messages about payment transactions with signs of fraud received from organizations regarding their clients for whom, in accordance with internal documents and (or) data from internal anti-fraud systems and (or) responsible structural subdivisions of organizations (established by internal documents of organizations), there are grounds (suspicions) for their participation in payment operations related to payment transactions with signs of fraud.

To include information in the database on attempts, the organization performs the following sequential actions:

1) the organization, in accordance with internal documents, or data from internal anti-fraud systems and (or) anti-fraud subdivisions of the organization, on the basis of Article 25-1 of the Law on Payments, identifies payment transactions with signs of fraud of the client and refuses to execute the instruction or suspends execution of the instruction and (or) expenditure operations on the bank account, electronic wallet, blocks the amount of payment and (or) money transfer for a period of not more than 5 (five) working days;

2) within 5 (five) working days from the date of suspension of execution of the instruction and (or) expenditure operations on the bank account, electronic wallet of the client or blocking of the amount of payment and (or) money transfer, conducts an analysis of the client's operations, including obtaining additional information from the client necessary to clarify the circumstances and make a decision;

3) in case of confirmation of grounds (suspicions) for the client's participation in payment operations related to payment transactions with signs of fraud, sends a message to the Anti-Fraud Center on inclusion of information in the database on attempts.

Exclusion of a person from the database on attempts is carried out on the basis of a message sent to the Anti-Fraud Center by the criminal prosecution body based on the results of the investigation or by the organization based on the results of consideration of the client's application about unjustified or erroneous inclusion of him in the database on attempts, in the manner and cases established by the internal documents of the Anti-Fraud Center.

The organization, within 3 (three) working days from the date of exclusion of the person from the database on attempts, resumes expenditure operations on the bank account, electronic wallet, removes the blocking of the payment amount and (or) money transfer, and also notifies the client thereof in the manner established by the agreement concluded with the client.

14. Criminal prosecution, national security and law enforcement bodies, for registered criminal cases, send to the Anti-Fraud Center the details of electronic means of payment used for other payment transactions that are recognized as illegal or prohibited (hereinafter – compromised electronic means of payment).

The Anti-Fraud Center forms and maintains a database on compromised electronic means of payment in real time in the manner established by Appendix 1 to the Rules.

Upon receiving information from the Anti-Fraud Center on compromised electronic means of payment, the organization blocks them until receiving, through the Anti-Fraud Center, an additional notification in the form of a resolution received through the Anti-Fraud Center from a criminal prosecution, national security, law enforcement body in the manner established by the Appendix to the Rules.

On the basis of the resolution received through the Anti-Fraud Center from a criminal prosecution, national security, law enforcement body, the organization decides to resume providing services to the client or refuse to provide services to the client.

15. The Anti-Fraud Center, to perform its functions, integrates with the database of identification codes of subscriber devices of mobile communications and (or) databases of mobile operators to confirm the registered subscriber number for the subscriber, including providing information about the person to whom the specified subscriber mobile number is registered, in particular the individual identification number, surname, name and patronymic (if any).

Mobile operators, upon identifying a subscriber number from which a call with signs of fraud was made, as well as upon identifying fraudulent actions on communication networks, notify the Anti-Fraud Center, providing information about the subscriber, including surname, name, patronymic (if any), individual identification number and subscriber numbers registered to the subscriber.

Mobile operators, upon receiving information from the Anti-Fraud Center, as well as in cases established by part two of this paragraph, suspend the provision of communication services to this subscriber number, including GSM gateways (SIM boxes) and IP telephony.

16. The Anti-Fraud Center, at the request of an organization, provides it with information on the status of the client's location on the territory of the Republic of Kazakhstan, obtained through the Anti-Fraud Center from databases of national security bodies.

17. Identification by second-tier banks, including on the basis of a client's application, of unlawful incidents related to illegal production, circulation and (or) transit of drugs, organization of financial pyramid activities, making payments and (or) money transfers in favor of electronic casinos and internet casinos, foreign bookmakers and (or) totalizators that do not have licenses for the right to engage in activities in the gambling business in the Republic of Kazakhstan (hereinafter – unlawful incidents), is carried out in compliance with the requirements established by the Rules for Forming a Risk Management and Internal Control System for Second-Tier Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan dated November 12, 2019 No. 188 (registered in the State Registration Register of Normative Legal Acts under No. 19632).

Identification by payment organizations, including on the basis of a client's application, of unlawful incidents is carried out in accordance with internal documents.

The Anti-Fraud Center forms and maintains a database of persons involved in unlawful incidents in real time. Inclusion of information on clients of an organization in the database of persons involved in unlawful incidents is carried out on the basis of a message from a second-tier bank or payment organization.

A message about an unlawful incident received from a second-tier bank or payment organization through the information system of the Anti-Fraud Center for inclusion of the sender of money and (or) the beneficiary (recipient of money) in the database of persons involved in unlawful incidents is included immediately after receipt by the Anti-Fraud Center of the message and becomes available to all participants of the Anti-Fraud Center.

A second-tier bank or payment organization, upon identifying an unlawful incident:

1) blocks the client's bank account or electronic wallet for a period of not more than 5 (five) working days;

2) within 5 (five) working days conducts an analysis of the client's operations, including obtaining additional information from the client necessary to clarify the circumstances and make a decision;

3) in case of confirmation of grounds (suspicions) for the client's participation in an unlawful incident, sends a message to the Anti-Fraud Center, indicating the type of unlawful incident (related to illegal production, circulation and (or) transit of drugs, organization of financial pyramid activities, making payments and (or) money transfers in favor of electronic casinos and internet casinos, foreign bookmakers and (or) totalizators that do not have licenses for the right to engage in activities in the gambling business in the Republic of Kazakhstan), for sending information on the unlawful incident to a law enforcement body for subsequent measures established by the laws of the Republic of Kazakhstan. The Anti-Fraud Center, for an incident related to:

• illegal production, circulation and (or) transit of drugs, sends information to internal affairs bodies;

• organization of financial pyramid activities, making payments and (or) money transfers in favor of electronic casinos and internet casinos, foreign bookmakers and (or) totalizators that do not have licenses for the right to engage in activities in the gambling business in the Republic of Kazakhstan, sends information to the economic investigation service.

Exclusion of a person from the database on unlawful incidents is carried out on the basis of a message sent to the Anti-Fraud Center by a law enforcement body based on the results of the measures taken.

A second-tier bank or payment organization, within 3 (three) working days from the date of exclusion of the person from the database of persons involved in other unlawful incidents, removes the blocking on the bank account or electronic wallet.

Chapter 4. Refusal to Execute or Suspension of Execution of Instructions by Organizations, the Procedure and Types of Provision of a Limited List of Financial and Payment Services to a Client, as well as the Procedure for Returning Money to a Client Specified in a Notification from a Criminal Prosecution Body, Authorized by a Prosecutor, on Recognizing a Transaction as Fraudulent

18. An organization refuses to make a payment and (or) money transfer when the information about the sender of money or the beneficiary of the payment and (or) money transfer matches the information available in the database on events at the time of making the payment or money transfer, except for cases of crediting payments provided for by subparagraph 1) of paragraph 22 of the Rules, in favor of a beneficiary whose information matches the information available in the database on events.

When refusing to execute an instruction on payment and (or) money transfer, the organization provides the client – the sender of money, in the manner established by the agreement concluded with the client, with information about the refusal to make the payment and (or) money transfer, indicating the reasons and grounds for refusal and the initiator of including the person in the database on events.

19. An organization suspends execution of an instruction and (or) blocks the amount of money when the information about the sender of money or the beneficiary matches the information available in the database on attempts in accordance with subparagraph 1) of paragraph 3-1 of Article 25-1 of the Law on Payments, and provides the client, in the manner established by the agreement concluded with the client, with information about the suspension of the payment and (or) money transfer, indicating the reasons and grounds for refusal and the initiator of including the person in the database on attempts.

If the sender of money, in the manner established by the agreement, confirms the intention to make a payment or money transfer in favor of a beneficiary included in the database on attempts, the organization resumes this payment and (or) money transfer in favor of the beneficiary.

Otherwise, the organization does not make the payment and (or) money transfer.

20. Upon receipt by an organization of a client's application about the client's identification of a payment transaction with signs of fraud:

1) the organization servicing the sender of money conducts an analysis (examination) of the operation, based on the results of which it sends to the Anti-Fraud Center a message about a payment transaction with signs of fraud, indicating the details of the client and the organization servicing the beneficiary;

2) the Anti-Fraud Center, after receiving the message specified in subparagraph 1) of this paragraph, immediately includes information about the beneficiary in the database of attempts, with simultaneous notification of the organization servicing the beneficiary, in order to suspend execution of the instruction to credit money to the beneficiary's bank account and (or) electronic wallet and to clarify the grounds for the beneficiary's receipt of the money;

3) after receiving from the Anti-Fraud Center the notification specified in subparagraph 2) of this paragraph, the organization servicing the beneficiary suspends crediting of money to the beneficiary's bank account and (or) electronic wallet within the amount of the operation;

4) if it is impossible to suspend crediting of money to the beneficiary's bank account and (or) electronic wallet, the organization servicing the beneficiary suspends execution of the client's instructions and (or) debit operations on the bank account or electronic wallet, blocks the amount of the payment and (or) transfer of money on the beneficiary's bank account and (or) electronic wallet, and immediately notifies the beneficiary thereof in the manner established by the agreement. Suspension of execution of the client's instructions and (or) debit operations on the client's bank account and (or) electronic wallet, and (or) blocking of the amount of the payment and (or) transfer of money is carried out for the purpose of clarifying the grounds for the beneficiary's receipt of the money.

21. When debit operations on a bank account or electronic wallet are suspended, the client, if necessary, applies to the organization in the manner established by the agreement to obtain a limited list of financial or payment services.

Based on the results of consideration of the client's application, the organization, no later than 7 (seven) calendar days from the date of the client's application, makes a decision to refuse or provide a limited list of financial and (or) payment services to the client, with notification of the client of the decision made in the manner established by the agreement.

If there is blocked money in the client's bank account or electronic wallet within the framework of a transaction with signs of fraud, termination of business relations with the client is impossible until the corresponding decision of the criminal prosecution bodies is received.

22. When a client is included in the databases of events or attempts, the organization, in accordance with internal rules, makes a decision to refuse to provide financial and (or) payment services or to provide a limited list of financial and (or) payment services.

The list of financial and (or) payment services provided is determined by the organization in accordance with internal rules, and includes, among other things, services for:

1) crediting payments received to the client's bank account in the form of payment for labor leave, wages, expenses for official business trips and (or) other payments by the employer, pension, scholarship, allowance and (or) other social payment in accordance with the legislation of the Republic of Kazakhstan;

2) issuance of cash credited to the client's bank account in the form of payment for labor leave, wages, expenses for official business trips and (or) other payments by the employer, in the absence of information from the organization about the fraudulent nature of payments for crediting these payments;

3) issuance of cash credited to the client's bank account in the form of pension, scholarship, allowance and (or) other social payment in accordance with the legislation of the Republic of Kazakhstan;

4) payment of taxes, utility and social payments, other mandatory payments to the budget, penalties and fines, as well as payments to repay a loan, within the amount of money credited in accordance with subparagraph 1) of this paragraph.

23. Return of money by the organization servicing the beneficiary of a payment and (or) transfer of money recognized as a transaction with signs of fraud is carried out upon receipt of a notification in the form of a resolution from a criminal prosecution body, authorized by a prosecutor, received through the Anti-Fraud Center (hereinafter – the resolution), on recognition of the transaction as fraudulent and the need to return the money to the person specified in the resolution.

The return of money is carried out by the organization only within the amount blocked in the manner provided for by Article 25-1 of the Law on Payments, using a payment order and a payment instruction.

If the amount of money specified in the resolution exceeds the amount blocked in the manner provided for by Article 25-1 of the Law on Payments, the organization carries out partial execution of the resolution only within the amount blocked in the manner provided for by Article 25-1 of the Law on Payments. The remainder of the amount specified in the resolution is subject to return on the basis of a court decision that has entered into legal force.

Transfer of money in favor of the beneficiary specified in the resolution is carried out no later than the next operational day from the moment of receipt of the resolution.

The resolution contains the following details of the beneficiary in whose favor the return of money is made:

1) surname, name, patronymic (if any) for individuals, name for legal entities;

2) bank identification code of the bank in which the bank account is opened;

3) individual identification code of the client;

4) individual identification number or business identification number of the client;

5) amount of money.

The resolution contains the following details of the sender of money from whose bank account the return of money is made:

1) surname, name, patronymic (if any) for individuals, name for legal entities;

2) bank identification code of the bank in which the bank account is opened or bank identification code of the bank in which the account of the electronic money system operator is opened;

3) individual identification code of the client or individual identification code of the electronic money system operator;

4) individual identification number or business identification number of the client.

The resolution is executed by the organization servicing the beneficiary in the order of calendar priority of receipt (by date and time).

Chapter 5. Sending by organizations to the Anti-Fraud Center

information about all events and (or) attempts of payment transactions with signs of fraud

24. A message about a payment transaction with signs of fraud sent by an organization to the Anti-Fraud Center contains information about the status of its client:

1) who suffered from the actions of third parties aimed at stealing the client's money by deception or abuse of trust;

2) suspected of committing actions against a third person/persons aimed at stealing the money of the third person/persons by deception or abuse of trust.

25. A message about a payment transaction with signs of fraud is sent by the organization and (or) criminal prosecution body in electronic form in the format established by the internal documents of the Anti-Fraud Center, indicating the following details when making a payment and (or) transfer of money using:

1) a bank account: individual identification code, transaction amount, time and unique code of the payment transaction;

2) a payment card: incomplete card number, indicating the first 6 and last 4 digits, and (or) a unique identifier of the payment transaction (if any), assigned by the acquirer during its processing, transaction amount, time and unique code of the payment transaction;

3) an electronic wallet: wallet details, transaction amount, time and unique code of the payment transaction;

4) other additional details established by the internal rules of the Anti-Fraud Center.

A message about a payment transaction with signs of fraud is filled out by each organization independently for its client, with the mandatory indication of the client's surname, name, patronymic (if any) and their individual identification number.

26. The Anti-Fraud Center, upon receiving a message about a payment transaction with signs of fraud, assigns priority to this message in the manner established by the internal documents of the Anti-Fraud Center.

27. The organization identifies a payment transaction with signs of fraud on the basis of the following criteria (signs) approved by internal documents, but not limited to them:

1) inconsistency of the nature (atypical) of the operation conducted by the client, identified by the organization on the basis of analysis of usually performed operations (activities carried out by the client), in particular:

time (days) of the operation;

place of the operation (physical location of the client, place of the operation, and so on);

the device used to carry out the operation;

2) inconsistency of the parameters of the operation conducted by the client:

amount of the operation;

periodicity (frequency) of operations;

recipient (beneficiary) of money;

3) inconsistency of the volume of operations conducted by the client:

in favor of foreign service providers, including digital asset platforms;

in favor of suppliers of goods, works and services whose activities are not related to receiving large payments.

Appendix

to the Rules for Organizing the Activities of the Payment Transaction Fraud Data Exchange Center (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)

Algorithm of interaction

between participants of the Anti-Fraud Center

on electronic payment means used to carry out payment transactions that are recognized as illegal or prohibited

1. The criminal prosecution body, national security and law enforcement bodies, in registered criminal cases, identify the details of electronic payment means belonging to clients of financial organizations and payment organizations (hereinafter – Organizations) that are used (were used) in illegal and (or) prohibited payment operations (hereinafter – compromised electronic payment means).

2. The criminal prosecution body, national security and law enforcement bodies, in real time, send a list of compromised electronic payment means to the payment transaction fraud data exchange center (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan) (hereinafter – the Anti-Fraud Center). The criminal prosecution body attaches information about the registered criminal case for each electronic payment means.

3. Joint Stock Company "National Payment Corporation of the National Bank of the Republic of Kazakhstan", within 1 (one) hour from the moment of receiving the electronic payment means from the criminal prosecution body, national security, law enforcement body, determines its owner (the issuing bank of the payment card or the electronic money system in which the electronic wallet is opened) and sends it in a closed mode separately to each owner of the electronic payment means.

4. Each Organization carries out the following measures:

1) blocks the electronic payment means until receiving an additional notification in the form of a resolution received through the Anti-Fraud Center from the criminal prosecution body, national security, law enforcement body on further actions, and notifies the client thereof;

2) sends data on the owner of the electronic payment means to the Anti-Fraud Center, including the surname, name, patronymic (if any) and individual identification number of the owner, residency status, as well as other information at the request of the criminal prosecution body, national security, law enforcement body in accordance with the laws of the Republic of Kazakhstan;

3) on the basis of the notification in the form of a resolution received through the Anti-Fraud Center from the criminal prosecution body, national security, law enforcement body, the Organization makes a decision to resume the provision of services to the client or to refuse to provide services to the client.