«КАЗАХСТАН
РЕСПУБЛИКАСЫНЫҢ
ҰЛТТЫҚ БАНКІ»
РЕСПУБЛИКАЛЫҚ
МЕМЛЕКЕТТІК МЕКЕМЕСІ
БАСҚАРМАСЫНЫҢ
ҚАУЛЫСЫ
31 August 2016
Almaty city

REPUBLICAN
STATE
INSTITUTION
«NATIONAL BANK
OF THE REPUBLIC OF KAZAKHSTAN»
RESOLUTION
OF THE BOARD
No. 212
Almaty city

On approval of the Rules for the provision by banks and organizations carrying out certain types of banking operations of electronic banking services

Registered by the Ministry of Justice of the Republic of Kazakhstan on 18 October 2016 under No. 14337

(as amended and supplemented as of 30.03.2019)

In accordance with the laws of the Republic of Kazakhstan dated 30 March 1995 «On the National Bank of the Republic of Kazakhstan», dated 26 July 2016 «On Payments and Payment Systems», for the purpose of establishing the procedure for the provision by banks and organizations carrying out certain types of banking operations of electronic banking services, the Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. To approve the attached Rules for the provision by banks and organizations carrying out certain types of banking operations of electronic banking services (hereinafter - the Rules).

2. To recognize as having lost force certain resolutions of the Board of the National Bank of the Republic of Kazakhstan, as well as structural elements of certain resolutions of the Board of the National Bank of the Republic of Kazakhstan, according to the list in accordance with the appendix to this resolution.

3. The Department of Payment Systems (Ashykbekov E.T.) shall, in the procedure established by the legislation of the Republic of Kazakhstan, ensure:

1) together with the Legal Department (Sarsenova N.V.), state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;

2) sending of this resolution to the republican state enterprise on the right of economic management «Republican Center for Legal Information of the Ministry of Justice of the Republic of Kazakhstan»: for official publication in the information-legal system «Әділет» within ten calendar days after its state registration with the Ministry of Justice of the Republic of Kazakhstan;

for inclusion in the State Register of Normative Legal Acts of the Republic of Kazakhstan, the Reference Control Bank of Normative Legal Acts of the Republic of Kazakhstan within ten calendar days from the day of its state registration with the Ministry of Justice of the Republic of Kazakhstan;

3) placement of this resolution on the official internet resource of the National Bank of the Republic of Kazakhstan after its official publication.

4. The Department for the Protection of the Rights of Consumers of Financial Services and External Communications (Terentyev A.L.) shall ensure the sending of this resolution for official publication in periodical printed publications within ten calendar days after its state registration with the Ministry of Justice of the Republic of Kazakhstan.

5. Control over the execution of this resolution shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan Pirmatov G.O.

6. This resolution shall enter into force upon the expiration of ten calendar days after the day of its first official publication, with the exception of part two of paragraph 6 and paragraph 21 of the Rules, which enter into force from 1 June 2017.

Chairman of the National Bank
D. Akishev

Approved by resolution of the Board of the National Bank of the Republic of Kazakhstan dated 31 August 2016 No. 212

Rules for the provision by banks and organizations carrying out certain types of banking operations of electronic banking services

Chapter 1. General provisions

1. These Rules for the provision by banks and organizations carrying out certain types of banking operations of electronic banking services (hereinafter - the Rules) have been developed in accordance with the laws of the Republic of Kazakhstan dated 30 March 1995 «On the National Bank of the Republic of Kazakhstan», dated 31 August 1995 «On Banks and Banking Activity in the Republic of Kazakhstan» (hereinafter - the Law on Banks and Banking Activity), dated 7 January 2003 «On Electronic Document and Electronic Digital Signature» (hereinafter - the Law on Electronic Document), dated 24 November 2015 «On Informatization» (hereinafter - the Law on Informatization), dated 26 July 2016 «On Payments and Payment Systems» (hereinafter - the Law on Payments and Payment Systems) and determine the procedure for the provision by banks and organizations carrying out certain types of banking operations (hereinafter - banks) of electronic banking services.

The procedure for the provision by banks of electronic banking services includes the provision of electronic banking services, security procedures, measures against unauthorized access, suspension and termination of the provision of electronic banking services, storage of electronic documents in the provision of electronic banking services.

The effect of the Rules does not extend to services related to the acceptance of payments using payment cards in favor of persons selling goods and services on the Internet (internet acquiring).

Paragraph 2 is set out in the wording of the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 27.08.18 No. 182 (see old wording)

2. The Rules use the concepts provided for by the laws on banks and banking activity, on electronic document, on informatization, on payments and payment systems, as well as the following concepts:

1) authentication - confirmation of the authenticity and correctness of the compilation of an electronic document in accordance with the requirements of the security procedure;

2) biometric identification - the procedure for establishing the identity of the client for the purpose of unambiguous confirmation of his rights to receive electronic banking services on the basis of his physiological and biological characteristics;

3) one-time (single) code - a unique sequence of electronic digital symbols created by software and technical means at the request of the client and intended for one-time use when providing the client with access to electronic banking services;

4) security procedure - a set of organizational measures and software and hardware means of information protection intended for identifying the client during the preparation, transmission and receipt of electronic documents in order to establish his rights

4 to receive electronic banking services and detect errors and (or) changes in the content of transmitted and received electronic documents; 5) unique user identifier - a digital, alphabetic or other character code assigned by the bank to the client for logging into the bank's system, in which access to electronic banking services is provided; 6) password - a combination of digital, alphabetic and other symbols created to confirm the rights to log into the bank's system for receiving electronic banking services; 7) identification data exchange center (IDEC) - the operations center of the interbank money transfer system, which ensures interaction with banks on the exchange of client data from available sources for carrying out client identification procedures; 8) dynamic identification - the procedure for establishing the client's identity in order to unambiguously confirm his rights to receive electronic banking services by using a one-time (single-use) code; 9) electronic document - a document in which information is presented in electronic-digital form and certified by identification means, drawn up by the sender and containing no distortions and (or) changes made to it after drawing up, in the manner provided for by the Rules; 10) electronic payment services - electronic banking services related to making payments and (or) money transfers, exchange operations with foreign currency using a bank account and carrying out other types of banking operations not related to information banking services. Chapter 2. Provision of electronic banking services 3. Electronic banking services are provided through remote access systems. 4. When opening an internet resource for the provision of electronic banking services, the bank, within ten working days after the day of opening the internet resource, notifies the National Bank of the Republic of Kazakhstan (hereinafter - the National Bank) in free written form. The notification contains: 1) the domain name and electronic address of the internet resource; 2) a list of electronic banking services provided via the Internet; 3) confirmation that the bank has approved security procedures and procedures for protecting information from unauthorized access when providing electronic banking services. 5. When the domain name or electronic address of the internet resource changes, the bank, within ten working days from the day of the changes, notifies the National Bank in free written form. Paragraph 6 is set out in the wording of the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 22.12.17 No. 248 (see old wording) 6. The bank provides electronic banking services only for banking operations that are provided for by the license issued by the authorized state body. Before providing electronic banking services, the bank ensures that the client is provided with information on the amount of the commission charged in monetary terms for the electronic banking services provided. When providing
payment services through an electronic terminal, it is permitted to indicate the amount of the commission charged in monetary terms after the client deposits cash into the terminal.

7. The bank develops and approves procedures and takes measures to prevent the use of existing or newly introduced methods and technologies for providing electronic banking services in schemes for the legalization (laundering) of proceeds obtained by criminal means and the financing of terrorism.

When providing electronic banking services, the bank applies the necessary measures provided for by the Law of the Republic of Kazakhstan dated 28 August 2009 "On Counteracting the Legalization (Laundering) of Proceeds Obtained by Criminal Means and the Financing of Terrorism" (hereinafter - the Law on AML/CFT), as well as for complying with the functions of a currency control agent in accordance with the currency legislation of the Republic of Kazakhstan.

8. Electronic banking services are provided through the use of identification means provided for by the Law on Payments and Payment Systems, in compliance with the procedure established by the Rules. The provision by the bank of electronic banking services to the client using an electronic digital signature is carried out if the client has a registration certificate issued by an accredited certification center of the Republic of Kazakhstan or a foreign certification center registered with a trusted third party of the Republic of Kazakhstan.

9. Electronic banking services are provided to the client on the basis of an agreement on the provision of electronic banking services or a bank servicing agreement containing a condition on the provision of electronic banking services (hereinafter - the agreement).

10. The agreement contains the following conditions:

1) a list of electronic banking services;

2) the procedure and maximum term for the provision of electronic banking services;

3) the method(s) of providing electronic banking services and obtaining access to them (via the Internet, telecommunications means, digital and information technologies, software and equipment or other devices);

4) the amounts of commissions charged or an indication of the internet resource containing information about them, and the procedure for charging them;

5) the procedure and time limits for the bank to provide confirmation of the sending and (or) receipt of electronic documents on the basis of which electronic banking services were provided to the client;

6) the rights and obligations of the parties;

7) security procedures, as well as the procedure for authentication and confirmation of the client's rights to receive electronic banking services;

8) the liability of the parties for non-performance or improper performance of their obligations under the agreement;

9) the grounds for suspension or termination of the provision of electronic banking services, indicating the procedure and form of notifying the client;

10) the procedure for submitting claims and methods for resolving disputed situations arising during the provision by the bank of electronic banking services;

11) contact telephone numbers and addresses, including for contacting the bank on issues related to the provision of electronic banking services;

12) a condition on non-disclosure by the bank of information received from the client during the provision of electronic banking services;

13) the client's right to terminate the agreement;

14) the procedure for determining the currency exchange rate applied when providing electronic banking services in foreign currency.

The inclusion in the agreement of other conditions not contained in this paragraph is permitted.

11. When concluding the agreement, the bank provides the client with information about electronic banking services.

12. If the agreement contains a reference to an electronic document posted on the bank's internet resource and containing additional terms to the agreement, the bank ensures that the client has the possibility of unhindered access to the specified electronic document during the term of the agreement.

13. If the bank provides an electronic banking service via the Internet, the procedure and conditions for the provision of electronic banking services are determined by the bank's internal documents, which are posted on the bank's internet resource.

14. Electronic payment services are provided to legal entities using an electronic digital signature, dynamic identification or biometric identification of their authorized persons.

15. When using dynamic identification for legal entities to receive electronic payment services, devices generating a one-time (single-use) code and personal identification numbers for the codes thereto are used. The device generating a one-time (single-use) code has a unique number and is assigned to each specific authorized person of the legal entity for performing the operations determined by them within the scope of their powers. The use of the device generating a one-time (single-use) code is carried out by entering into it a personal identification number and, when accessing the services, specifying a set of other identification means (unique user identifier, password). An authorized person of a legal entity is not permitted to use a device generating a one-time (single-use) code that belongs to another authorized person.

16. Electronic payment services are provided to individuals using one of the following identification methods: electronic digital signature, dynamic identification, biometric identification or a unique user identifier and password.

17. When using dynamic identification for individuals to receive electronic payment services, a one-time (single-use) code is created by the bank and sent to the client - an individual in accordance with the terms of the agreement concluded between them. An individual is permitted to use a device generating a one-time (single-use) code to receive electronic payment services.

18. When using dynamic identification, for each access to electronic payment services, the creation of a new one-time (single-use) code is required.

When the client re-accesses electronic payment services, the creation and use of a new one-time (single-use) code is required.

19. Information banking services are provided using one of the following identification methods: electronic digital signature, dynamic identification, biometric identification or a unique identifier and password. The password is used on a multiple-use basis or is changed at the client's discretion.

20. The use of a unique user identifier and password specified in the bank's system for access to electronic payment services is not recognized as dynamic identification.

Paragraph 21 was put into effect from 1 June 2017

21. The client is permitted to receive electronic banking services through a remote access system of a third-party payment service provider.

For the client to receive electronic banking services from a third-party payment service provider, the bank servicing the client's bank account provides the third-party payment service provider with access to the bank account and the client's information.

The third-party payment service provider, when providing electronic banking services, ensures compliance with the requirements established by the Law on Payments and Payment Systems and the Rules.

22. The bank is permitted to transfer to third parties, on the basis of a contract for the provision of services for consideration, the performance of information technology functions necessary for the provision of electronic banking services (hereinafter - the outsourcing contract). The procedure for outsourcing for the provision of electronic banking services is determined by the bank's internal documents and the outsourcing contract and is carried out in accordance with the requirements of paragraphs 16, 17 of Article 13 of the Law on Payments and Payment Systems.

The Rules are supplemented by Chapter 2-1 in accordance with the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 27.08.18 No. 182

Chapter 2-1. Specifics of using the services of the CIID in the provision of services by remote means

22-1. When providing electronic banking services, business relations with the client by remote means are established in accordance with the Requirements for proper verification of clients in the case of remote establishment of business relations by subjects of financial monitoring, approved by resolution of the Board of the National Bank of the Republic of Kazakhstan dated 29 June 2018, No. 140, registered in the Register of state registration of normative legal acts under No. 17250.

22-2. The use of the services of the CIID is permitted when identifying the client using means of biometric identification.

Paragraph 22-3 was amended in accordance with resolution of the Board of the National Bank of the Republic of Kazakhstan dated 30.03.19 No. 44 (see old version)

22-3. In the case provided for by paragraph 22-2 of the Rules, on the basis of the client's consent received for the collection, processing, storage and provision, including, if necessary, to third parties, of his personal data, confirmed by means of an identification tool, the bank conducts a video conference session with the client using the devices available to the client and (or) other devices of the bank. The substantive part of the videoconference session (the list of control questions), as well as the list and scope of services provided by banks during remote identification of clients, are established by banks independently.

The bank transmits to the COID the individual or business identification number of the client and the video image of the client obtained from the videoconference session.

The COID, by means of software, determines the degree of correspondence between the biometric indicators of the photo image obtained from the videoconference session and the photo image of the client from available sources. Video recordings of client requests are stored at the bank.

For the purposes of this chapter, information from available sources means information from state databases that allows the identification of the client's identity.

The results of the degree of correspondence of the biometric indicators of the photo images and the identification data of the client obtained by the COID from available sources are transmitted to the bank. The results of the degree of correspondence are stored in the COID database.

The COID ensures the integrity and immutability of the information obtained from available sources.

The bank makes a decision on providing electronic banking services to the client on the basis of the results of the correspondence of the photo images received from the COID, applying, if necessary, additional methods of client identification.

The interaction of banks with the COID is carried out on the basis of a contract concluded between them, which contains the following conditions, but is not limited to:

1) the procedure and terms for the provision and receipt of the service;

2) security procedures;

3) the amount of the commission charged, the procedure for its collection;

4) the liability of the parties, including in terms of compliance with the confidentiality regime, preservation of banking secrecy and protection of clients' personal data;

5) the rights and obligations of the parties;

6) the procedure for filing claims and methods for resolving disputed situations.

Chapter 3. Security Procedures

23. The provision of electronic banking services by the bank is carried out in accordance with the security procedures established by the bank's internal documents and the contract.

24. Security procedures ensure:

1) reliable identification of the client and their right to receive the relevant electronic banking services;

2) the detection of distortions and (or) changes in the content of electronic documents on the basis of which electronic banking services are provided to the client;

3) protection against unauthorized access to information constituting banking secrecy and the integrity of such information.

25. The provision of electronic banking services is authorized if the client complies with the security procedures established by the bank's internal documents and the contract.

26. The bank ensures the storage of confirmation of the sending and (or) receipt of messages on the basis of which electronic banking services were provided to the client.

27. At the client's request, the bank provides them with confirmation of the sending and (or) receipt of electronic documents confirming the provision (receipt) of electronic banking services, in the manner and within the time limits provided for by the contract.

Paragraph 28 is set out in the wording of the resolution of the Board of the National Bank of the RK dated 27.08.18 No. 182 (see old version)

28. The provision of electronic banking services to a natural person, as well as information banking services to a legal entity, by means of telephone communication without the use of an identification tool is permitted on the basis of the application of security procedures established by the bank's internal documents and the contract.

When providing electronic payment services to a natural person by means of telephone communication, the bank retains confirmation of the initiation of the payment service by the client - a natural person, obtained in accordance with the security procedures established by the bank's internal documents and the contract.

Chapter 4. Measures against Unauthorized Access

29. Upon detection of unauthorized access to information constituting banking secrecy, its unauthorized modification, the commission of an unauthorized payment and (or) money transfer and other unauthorized actions, the bank notifies the client in respect of whom such actions were committed no later than the next working day after their detection.

30. In the event of unauthorized actions specified in paragraph 29 of the Rules, the bank immediately takes all necessary measures to eliminate their consequences and prevent their recurrence in the future.

Chapter 5. Suspension and Termination of the Provision of Electronic Banking Services

31. The bank suspends or terminates the provision of electronic banking services to the client in the following cases:

1) violation by the client of the procedure and conditions for receiving electronic banking services provided for by the contract;

2) malfunction of technical means ensuring the provision of electronic banking services;

3) on other grounds provided for by the laws on banks and banking activities, on payments and payment systems, on AML/CFT, the Civil Code of the Republic of Kazakhstan (Special Part) dated 27 December 1994, and the contract.

32. In the event of suspension or termination of the provision of electronic banking services on the grounds provided for in paragraph 31 of the Rules, the bank notifies the client in the manner and within the time limits established by the contract, except in cases of suspension or termination of the provision of electronic payment services provided for in subparagraph 3) of paragraph 31 of the Rules.

33. Upon elimination of the causes that led to the suspension of the client's right to receive electronic banking services, the bank resumes the provision of electronic banking services to the client with subsequent written or electronic notification thereof, except in cases of suspension or termination of the provision of electronic payment services provided for in subparagraph 3) of paragraph 31 of the Rules.

Chapter 6. Storage of Electronic Documents in the Provision of Electronic Banking Services

34. Electronic documents are stored in the format in which they were generated, sent or received, with their integrity and immutability ensured, and do not require printing or other display of the content of the electronic document on a paper medium for the purpose of storage.

35. The procedure and terms of storage of electronic documents are determined by the internal documents of the bank, developed in accordance with the Law on Payments and Payment Systems and the Law on AML/CFT.

Appendix
to the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 31 August 2016 No. 212

List of certain resolutions of the Board of the National Bank of the Republic of Kazakhstan, as well as structural elements of certain resolutions of the Board of the National Bank of the Republic of Kazakhstan, recognized as having lost force

1. Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21 April 2000 No. 146 "On Approval of the Rules for the Exchange of Electronic Documents in the Conduct of Payments and Money Transfers in the Republic of Kazakhstan" (registered in the Register of State Registration of Regulatory Legal Acts under No. 1148, published on 14 July 2000 in the newspaper "Legal Gazette" No. 31).

2. Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 4 July 2003 No. 228 "On Amendments and Additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21 April 2000 No. 146 'On Approval of the Rules for the Exchange of Electronic Documents in the Conduct of Payments and Money Transfers in the Republic of Kazakhstan', registered in the Ministry of Justice of the Republic of Kazakhstan under No. 1148" (registered in the Register of State Registration of Regulatory Legal Acts under No. 2434).

3. Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 28 March 2008 No. 18 "On Approval of the Rules for the Provision of Electronic Banking Services by Second-Tier Banks and Organizations Carrying Out Certain Types of Banking Operations" (registered in the Register of State Registration of Regulatory Legal Acts under No. 5189, published on 23 May 2008 in the newspaper "Legal Gazette" No. 77 (1477).

4. Item 3 of the List of Resolutions of the Board of the National Bank of the Republic of Kazakhstan to which Amendments and Additions are Made, which is an appendix to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 24 August 2009 No. 85 "On Amendments and Additions to Certain Resolutions of the Board of the National Bank of the Republic of Kazakhstan" (registered in the Register of State Registration of Regulatory Legal Acts under No. 5806, published on 30 October 2009 in the newspaper "Legal Gazette" No. 166 (1763).

5. Paragraph 3 of the List of amendments and additions that are made to certain resolutions of the Board of the National Bank of the Republic of Kazakhstan on issues of making payments and money transfers, being an annex to the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 30 May 2011 No. 52 "On introducing amendments and additions to certain resolutions of the Board of the National Bank of the Republic of Kazakhstan on issues of making payments and money transfers" (registered in the Register of state registration of normative legal acts under No. 7080, published on 3 August 2011 in the newspaper "Yuridicheskaya Gazeta" No. 110 (2100).

6. Paragraphs 1 and 7 of the List of normative legal acts on issues of making payments and money transfers to which amendments and additions are made, being an annex to the resolution of the Board of the National Bank of the Republic of Kazakhstan dated

26 April 2013 No. 117 "On introducing amendments and additions to certain normative legal acts on issues of making payments and money transfers" (registered in the Register of state registration of normative legal acts under No. 8513, published on 23 July 2013 in the newspaper "Yuridicheskaya Gazeta" No. 107 (2482).

7. Paragraphs 1 and 7 of the List of normative legal acts of the Republic of Kazakhstan to which amendments and additions are made, approved by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 27 August 2014 No. 168 "On introducing amendments and additions to certain normative legal acts of the Republic of Kazakhstan" (registered in the Register of state registration of normative legal acts under No. 9796, published on 12 November 2014 in the information and legal system "Adilet" of the republican state enterprise with the right of economic management "Republican Center for Legal Information of the Ministry of Justice of the Republic of Kazakhstan").