On Approval of the Rules for the Operation of the Interbank Mobile Payment System

NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		DECISION OF THE BOARD
April 29, 2026 Astana city		No. 43 Astana city

On Approval of the Rules for the Operation

of the Interbank Mobile Payment System

In accordance with paragraph 4-1 of Article 5 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems," the Board of the National Bank of the Republic of Kazakhstan DECIDES:

1. Approve the attached Rules for the Operation of the Interbank Mobile Payment System.

2. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1. jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this decision in the Ministry of Justice of the Republic of Kazakhstan;

2. posting this decision on the official website of the National Bank of the Republic of Kazakhstan after its official publication;

3. within ten working days after the state registration of this decision, submitting to the Legal Department of the National Bank of the Republic of Kazakhstan information on the implementation of the measures provided for in sub-paragraph 2) of this paragraph.

3. Control over the implementation of this decision shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan in charge.

4. This decision enters into force on July 19, 2026, and is subject to official publication.

Chairman	T.M. Suleimenov

Approved by the Decision of the Board of the National Bank of the Republic of Kazakhstan dated April 29, 2026 No. 43

Rules for the Operation

of the Interbank Mobile Payment System

Chapter 1. General Provisions

1. These Rules for the Operation of the Interbank Mobile Payment System (hereinafter – the Rules) are developed in accordance with paragraph 4-1 of Article 5 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law on Payments and Payment Systems) and define the procedure for the operation of the interbank mobile payment system (hereinafter – the System), including the determination of participation conditions, services provided in the System, tariffs for System services, and the procedure for their coordination with System participants.

2. Money transfers resulting from clearing in the System are carried out using the funds of its participants in the interbank money transfer system (hereinafter – IBMTS).

3. The Rules use the concepts provided for in the Law on Payments and Payment Systems, as well as the following concepts:

1. System – a payment system designed to make payments and/or money transfers between clients of its participants via mobile applications, including using barcodes and biometric authentication means;

2. System Operator (hereinafter – Operator) – the Joint Stock Company "National Payment Corporation of the National Bank of the Republic of Kazakhstan," which serves as the National Center for the Management of the National Digital Financial Infrastructure;

3. Software and Technical Complex of the System – technical, software, or other means ensuring the operation of the System, including the digital system, System servers and terminals, communication means (data transmission);

4. Main Center of the Software and Technical Complex of the System (hereinafter – Main Center) – the software and technical complex of the System ensuring the operation of the System in normal (daily) mode;

5. Backup Center of the Software and Technical Complex of the System (hereinafter – Backup Center) – the backup software and technical complex of the System ensuring its operation in the event of non-standard situations or scheduled work in the Main Center;

6. Operating Day of the System (hereinafter – Operating Day) – the period of time during which the Operator receives and processes payments and money transfers;

7. Participant – a second-level bank, an organization carrying out certain types of banking operations, the National Postal Operator, having concluded a participation agreement with the Operator (hereinafter – Agreement);

8. Sender Participant – a Participant from whose position in the System money is transferred (debited);

9. Beneficiary Participant – a Participant to whose position in the System money is transferred;

10. Client of a Participant (hereinafter – Client) – an individual or legal entity that has concluded an agreement with a Participant for the provision of banking services;

11. Operational Interaction Regulation (hereinafter – Operational Documentation) – a set of Operator documents defining operational, technological, and organizational requirements, standards, exchange procedures, message formats, authentication and interaction procedures, requirements for Participants to provide Clients with services in the System, and the procedure for resolving disputes;

12. Applicant – a legal entity (second-level bank, organization carrying out certain types of banking operations, National Postal Operator) holding a license to carry out banking operations and having submitted an application for participation in the System;

13. Electronic Information Message (hereinafter – Information Message) – an electronic message having an electronic digital signature, not relating to payment messages and having an informational character, including statements;

14. Electronic Payment Message (hereinafter – Payment Message) – an electronic message having an electronic digital signature, on the basis of which payments and money transfers between Participants are carried out;

15. QR Code – a barcode (Quick Response Code) containing information about the payment participant.

Chapter 2. Conditions for Participation in the System

4. Conditions for participation in the System are concluding an Agreement with the Operator and participation in the IBMTS.

5. To participate in the System, the Applicant submits an application in automated form via the Operator's portal and provides the documents specified in paragraph 6 of the Rules.

The Operator's portal, providing access to the System, is located at https://cabinet.npck.kz.

6. To conclude an Agreement, the Applicant provides the Operator with the following documents:

1. a copy of the charter;

2. a copy of the certificate (extract) of state registration (re-registration) of the legal entity;

3. a copy of the certificate of registration for value-added tax;

4. a copy of the document appointing the first head;

5. a copy of the license to carry out banking operations;

6. information on the location and contacts of the Applicant (legal and actual address, contact phone numbers, email address);

7. information on the Applicant's employees authorized to interact with the System on its behalf (indicating surname, first name, patronymic (if any), contact phone number, email address);

8. a document confirming the authority of the Applicant's representative to sign the Agreement with the Operator (in cases where the Agreement is signed not by the first head of the Applicant);

9. a statement on familiarization with and compliance with the Rules and operational documentation in the form posted on the Operator's portal specified in paragraph 5 of the Rules.

7. The Operator considers the package of documents of the Applicant specified in paragraph 6 of the Rules within 3 (three) working days.

8. In case of compliance of the Applicant with the requirements of the Rules and the Operator's operational documentation, the Operator concludes an Agreement with the Participant.

The Agreement contains the following conditions:

1. subject of the Agreement;

2. rights and obligations of the parties;

3. liability of the parties;

4. procedure for changing and terminating the Agreement;

5. procedure for dispute resolution;

6. other conditions agreed upon by the parties.

9. The Agreement additionally contains the procedure for paying the Operator's services, compliance with cybersecurity regimes, confidentiality, preservation of banking secrecy and other secrets protected by law, and protection of personal data.

The form of the standard Agreement is approved by the Operator.

10. Connection of a Participant to the System is carried out by the Operator after the Participant completes the necessary technical works and conducts testing with the Operator. Based on the results of the connection testing, the Operator and the Participant sign an act of passing the testing.

Chapter 3. Services Provided in the System by the Operator and System Participants

11. Within the framework of the System's operation, the Operator provides Participants with the following services:

1. receipt, processing, and sending of payment and information messages and, on their basis, money transfers in accordance with the requirements of the operational documentation;

2. clearing of electronic payments made in the System, preparation and sending of information on the net positions of Participants;

3. transfer of net position amounts of Participants to the IBMTS based on the results of clearing conducted in the System;

4. performance of operational and technological functions of the System provided for by the Rules and defined by the Law on Payments and Payment Systems;

5. provision of final statements upon closing the Operating Day and provision of statements on the current account status upon request by Participants;

6. maintenance of the directory of Participants in the System.

12. The provision of services to a Participant in the System is suspended by the Operator in the following cases:

1. suspension of outgoing operations of the Participant on its correspondent account opened in the National Bank of the Republic of Kazakhstan (hereinafter – National Bank) on grounds provided for by the legislative acts of the Republic of Kazakhstan;

2. violation by the Participant of the requirements of the Rules, Agreement, or operational documentation;

3. written notification by the National Bank to the Operator about the suspension or revocation by the authorized body carrying out state regulation, control, and supervision of the financial market and financial organizations, of the license to carry out banking operations;

4. a court decision on the termination of the Participant's activities.

13. Participation in the System is resumed upon elimination of the causes specified in paragraph 12 of the Rules.

14. The following System services are mandatory for Participants to provide to Clients:

1. carrying out operations for payment and/or money transfer using simplified identifiers (hereinafter – transfer using a simplified identifier);

2. making mobile payments using a QR code (hereinafter – payment using a QR code).

15. To provide services in the System, Participants carry out the following functions:

1. formation and transmission to the Operator of payment messages according to Client instructions;

2. monitoring the status of their position in the System, including by sending requests and receiving statements from the Operator;

3. providing Clients with round-the-clock access to System services.

Chapter 4. Procedure for the Operation of the System

Paragraph 1. Procedure for Providing Services in the System

16. Payments and/or money transfers are carried out in the System based on Client instructions and payment messages of Participants.

17. Payments and money transfers in the System are carried out in the national currency of the Republic of Kazakhstan.

18. The Operating Day is equal to 24 (twenty-four) hours, the schedule of which is established by the Operator in accordance with the Appendix to the Rules.

19. Payment or information messages received by the Operator after the closing of the Operating Day are considered received in the next Operating Day.

20. Participants and the Operator exchange electronic messages in accordance with security procedures established by the Operator.

21. Security procedures are brought to the attention of Participants by the Operator within 15 (fifteen) working days after their approval by the Operator by publishing them on the Operator's official website.

22. The System functions based on the following principles:

interaction of Participants with the Operator via secure communication channels;

round-the-clock mode of receiving and processing payment messages of Participants;

indication in the payment message of one Sender Participant and one Beneficiary Participant;

absence of priorities for processing payment messages;

receiving and processing payment messages in real-time mode;

finality and irrevocability of electronic payments after their acceptance by the Operator for execution;

processing of electronic payments based on clearing;

use of limits on the maximum debit net position of a Participant;

limitation of the maximum amount of one payment and/or money transfer.

23. A payment message, after its acceptance by the Operator for execution, cannot be recalled, and the carried-out payment and/or money transfer cannot be canceled at the initiative of the parties participating in the implementation of the payment and/or money transfer.

24. A payment and/or money transfer in the System is considered completed (final) after the Beneficiary Participant receives an information message from the Operator regarding the crediting of money to their position in the System.

25. The terms for receiving, processing, and sending electronic messages between Participants and the Operator are determined by the operational documentation and the Agreement.

26. The Beneficiary Participant ensures the availability of money to the Client for disposal in an instant mode. Crediting of money to the Client's bank account is carried out by the Beneficiary Participant in the manner and terms determined by the Agreement and the legislation of the Republic of Kazakhstan.

27. Tariffs between Participants of the System are established by the National Bank in coordination with the Participants of the System.

28. Participants establish tariffs for Clients for carrying out operations in the System at a level not exceeding the tariffs for similar interbank payment services provided by such Participants in other payment systems ensuring payments and/or money transfers using electronic payment means, mobile applications, and/or barcodes.

Paragraph 2. Procedure for Carrying Out Transfers in the System

Using a Simplified Identifier

29. Upon receiving a Client's instruction to transfer money using a simplified identifier, the Sender Participant carries out the following actions:

1. checks the sufficiency of money in the Client's bank account to carry out the money transfer;

2. checks the operation for compliance with the requirements of the legislation of the Republic of Kazakhstan on payments and payment systems;

3. forms and sends an information message to the Beneficiary Participant via the Operator.

30. Upon receiving the information message, the Beneficiary Participant searches for the Client using the simplified identifier and sends an information message to the Operator with the search result.

31. In case of a negative result of searching for the Client using the simplified identifier, the Beneficiary Participant refuses the operation.

32. After receiving the information message from the Beneficiary Participant, the Operator sends an information message to the Sender Participant regarding the money transfer or its refusal, indicating the reason for refusal.

33. After receiving the information message from the Operator regarding the money transfer, the Sender Participant forms a payment message and sends it to the Operator.

34. The Operator checks the integrity and format of the payment message, as well as compliance with the maximum amount of the payment message in the System, and sends the payment message to the Beneficiary Participant.

35. Based on the payment message for the money transfer, the Beneficiary Participant ensures the availability of money to the Client in accordance with the requirements of the Rules, and Participants send Clients notifications on the results of the operation.

Paragraph 3. Procedure for Carrying Out Payments in the System

Using a QR Code

36. To carry out payments using a QR code, Participants ensure:

1. Clients – individuals in the remote access system have the ability to read the QR code in the format determined by the operational documentation;

2. in equipment (device) intended for receiving payments using payment cards and/or mobile payments – the formation of a QR code in the format determined by the operational documentation.

37. Payments using a QR code are carried out by scanning the QR code formed by the Beneficiary Participant in the equipment (device) intended for receiving payments using payment cards and/or mobile payments.

38. Upon initiation of a payment using a QR code by a Client, the Sender Participant checks the operation for compliance with the requirements of the legislation of the Republic of Kazakhstan on payments and payment systems, checks the sufficiency of money in the Client's bank account, identifies the Beneficiary Participant using the information in the QR code, and carries out the exchange of information and payment messages with the Operator in accordance with the operational documentation for crediting money to the Client's bank account.

39. The exchange of information and payment messages between Participants and the Operator for carrying out a payment using a QR code, completion of the payment, and crediting of money to the Client are carried out in accordance with paragraphs 25 and 26 of the Rules.

Paragraph 4. Procedure for Carrying Out Refunds of Transfers

Using a Simplified Identifier

40. Refund of a transfer using a simplified identifier is carried out by initiating a reverse money transfer by the Client-Beneficiary using a unique code previously assigned by the Operator to the transfer using a simplified identifier carried out in the System.

41. Upon initiation of a refund of a transfer using a simplified identifier by the Client-Beneficiary, the Beneficiary Participant sends a payment message to the Operator in accordance with the operational documentation.

42. Refund of a transfer using a simplified identifier at the initiative of the Sender Client is carried out by sending a request to cancel the transfer using a simplified identifier through the servicing Sender Participant.

43. The Sender Participant sends an information message to the Operator regarding the request to cancel the transfer using a simplified identifier.

44. After receiving the information message from the Sender Participant, the Operator carries out the exchange of information and payment messages with the Beneficiary Participant in accordance with the operational documentation.

45. A request for refund of a transfer using a simplified identifier at the initiative of the Sender Client is carried out based on the consent of the Beneficiary provided to the Beneficiary Participant.

46. The full amount of the previously received transfer using a simplified identifier is subject to refund. Refund of a partial amount of a transfer using a simplified identifier is not permitted.

47. Initiation of a refund of a transfer using a simplified identifier at the initiative of Clients is permitted within the time period established by the operational documentation.

48. Participants ensure the possibility of confirming the refund operation to Clients before its sending, as well as informing Clients about the result of the refund execution.

Requirements for reflecting the results of the operation to Clients in the mobile application are established by the operational documentation.

49. The Participant ensures the crediting of money to the Client in accordance with paragraph 26 of the Rules.

Paragraph 5. Procedure for Carrying Out Clearing

50. After the completion of the Operating Day of the System, the Operator fixes the net position of each Participant.

51. Final settlement and transfer of money on the positions of Participants in the IBMTS are carried out in accordance with the Rules for the Operation of the Interbank Money Transfer System, approved by the Decision of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 No. 201 "On Approval of the Rules for the Operation of the Interbank Money Transfer System" (registered in the Registry of State Registration of Normative Legal Acts under No. 14310) and according to the Operating Day schedule in accordance with the Appendix to the Rules.

52. After completing final settlements, the Operator sends an information message to the Participant in the form of a statement containing information on all payment messages processed in the System and information on the Participant's net position based on the results of clearing, as well as a list of unprocessed payment messages and all payment messages received in favor of this Participant and indicated in the final information message in the form of a statement.

53. If the information message in the form of a statement on the Participant's position in the System does not contain information on a payment message transferred by the Participant to the Operator, the Participant notifies the Operator about this and together with the Operator, no later than the next Operating Day, clarifies the reason for the loss of the payment message.

54. In case of untimely receipt of electronic messages or their absence, the Participant notifies the Operator in accordance with the Agreement.

Chapter 5. Cybersecurity Measures

55. The Operator establishes cybersecurity measures for work in the System, defines certified means of cryptographic information protection, an accredited certification center, and the procedure for using registration certificates.

56. The procedure for using registration certificates is established by the Operator's certification center.

57. Transmission and receipt of payment and information messages in the System are carried out electronically.

58. The Operator and System Participants ensure the storage of information and carry out monitoring of sent and received payments and money transfers for 5 (five) years.

All payments and money transfers processed by the Operator and Participant leave an audit trail in the internal digital systems of the Operator and Participant.

For the purposes of this paragraph, an audit trail is understood as a sequential registration of events on the processing of electronic messages in the System, information about which is stored in the System and by System Participants.

59. Changing payment messages during their processing by the Operator is not permitted.

60. When exchanging electronic messages, the Operator and Participants use means of cryptographic information protection and registration certificates defined and presented to Participants by the Operator.

61. The Operator and Participant apply means of cryptographic information protection to ensure confidentiality, integrity, confirmation of authorship, and authenticity of electronic messages.

62. To ensure the confidentiality of the System, guarantee protection against unauthorized access to information, and prevent compromise of information, the Operator and Participants encrypt stored or transmitted information via open channels.

63. Cybersecurity measures when working in the System are brought to the attention of Participants by the Operator within the terms established by the Agreement by publishing them on the Operator's official website.

Chapter 6. Risk Management System

64. The following measures are used to manage operational risk:

1. carrying out control over the performance by Participants of requirements for organizational measures and software and technical means ensuring work in the System;

2. conducting constant monitoring and maintaining uninterrupted operation of the Software and Technical Complex of the System in accordance with methods defined by the Operator's internal documents on operational risk management;

3. keeping the System business continuity plan up to date, taking into account possible scenarios of System stoppage;

4. ensuring the operability of the Backup Center;

5. transferring System work from the Main Center to the Backup Center in the presence of failures or downtime in the operation of the Software and Technical Complex of the System that cannot be restored in the Main Center;

6. taking control measures provided for by the Operator's internal control system.

For the purposes of this paragraph, operational risk is understood as the risk associated with deficiencies or failures in digital systems, internal processes, human errors, management deficiencies, non-compliance with legislation, including those arising from external events.

65. To manage cybersecurity risks in the system, organizational and technical measures are applied in accordance with legislative and regulatory requirements, international and national standards, as well as operational documentation requirements.

66. To manage liquidity risk, credit risk, and systemic risk in the system, a settlement guarantee system is applied.

For the purposes of this paragraph, liquidity risk is understood as the risk of a money sender participant associated with the possibility of untimely performance (non-performance) of its obligations to transfer money in full.

Credit risk – the risk of a participant associated with the possibility of untimely performance (non-performance) by the counterparty (payment participant and/or money transfer participant) of its obligations in full.

Systemic risk – the risk of non-performance of obligations by one or more participants for one or more money transfers, caused by the non-performance of obligations by one or more participants.

67. To prevent fraud in the system, a limit on the maximum amount of 1 (one) transaction between individuals is established in the amount of 1,000,000 (one million) tenge. Participants may establish additional limits on the frequency of such transactions in accordance with their internal documents.

There are no restrictions in the system for QR code payments.

Chapter 7. Procedure for Resolving Disputed Situations

68. A request regarding a disputed situation is initiated by a participant no later than 5 (five) working days from the date the client performed the operation, except for a request for a refund for goods sold and/or services rendered, the submission period for which is no later than 45 (forty-five) calendar days from the date the client performed the operation.

69. Participants independently resolve disputed situations related to clients contesting operations by interacting with each other on the Operator's portal specified in paragraph 5 of the Rules.

70. Categories of disputed situations and the conditions for their consideration are established by operational documentation.

71. The total period for considering a disputed situation, including the possibility of appeal, must not exceed 30 (thirty) calendar days.

72. In the event that a disputed situation between participants is not resolved, the participants refer to the Operator, indicating in the request the reason for the disputed situation and attaching supporting documents.

Appendix

to the Rules for the Operation

of the Interbank Mobile Payment System

Schedule of the System's Operational Day

No.	Name of Works	Time (time zone of Astana)
start	end
1	Closing of the current operational day. Fixing of participants' net positions. Transmission of a message with net positions to the interbank clearing system for settlement in the IMPS (payment messages with the highest possible priority in the interbank money transfer system)	17:59:59 (day T)
2	Opening of a new operational day	18:00:00
3	Reception and processing of payment and information messages, calculation of current net positions.	18:00	17:59:59 (day T+1)
4	Calculation of participants' net positions in the IMPS. Calculation of net positions in the IMPS for weekends or holidays is performed on the first working day after weekends or holidays	18:30	19:00
5	Formation and issuance of final statements and reports for participants.	After closing the current operational day and sending a message with net positions (para. 1)