Resolution of the Board of the National Bank of the Kyrgyz Republic No. 2019-P-12/32-3-(NPA) of June 19, 2019 on Amendments to Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic

NATIONAL BANK OF THE KYRGYZ REPUBLIC

RESOLUTION

of June 19, 2019 No. 2019-P-12/32-3-(NPA)

On Amendments to Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic

In accordance with Articles 20 and 68 of the Law "On the National Bank of the Kyrgyz Republic, Banks and Banking Activities," the Board of the National Bank of the Kyrgyz Republic resolves:

1. Make amendments to the following regulatory legal acts of the National Bank of the Kyrgyz Republic (attached):

• resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic" dated April 15, 2015 No. 22/3;

• resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Instruction on Working with Bank Accounts, Bank Deposit (Deposit) Accounts" dated October 31, 2012 No. 41/12;

• resolution of the Board of the National Bank of the Kyrgyz Republic "On Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic" dated June 30, 2010 No. 52/4;

• resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation on Minimum Requirements for Managing Credit Risk in Operations in Accordance with Islamic Principles of Banking and Finance" dated September 25, 2013 No. 35/13.

2. This resolution enters into force after the expiration of fifteen days from the day of official publication.

3. The Legal Department:

• publish this resolution on the official website of the National Bank of the Kyrgyz Republic;

• after official publication, send this resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Regulatory Legal Acts of the Kyrgyz Republic.

4. The Department of Banking Supervision and Licensing Methodology shall bring this resolution to the attention of commercial banks, the Non-Commercial Legal Entity "Union of Banks of Kyrgyzstan," regional departments, and the branch office of the National Bank of the Kyrgyz Republic in the Batken region.

5. The Payment Systems Department shall bring this resolution to the attention of the Non-Commercial Legal Entity "Association of Payment System Operators of the Kyrgyz Republic" and payment system operators.

6. Control over the execution of this resolution is entrusted to the Member of the Board of the National Bank of the Kyrgyz Republic overseeing the Department of Banking Supervision and Licensing Methodology.

Chairman of the Board of the National Bank of the Kyrgyz Republic		T. Abdygulov

		Appendix to the Resolution of the Board of the National Bank of the Kyrgyz Republic dated June 19, 2019 No. 2019-P-12/32-3-(NPA)

On Amendments to Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic

1. Make the following amendments to the resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic" dated April 15, 2015 No. 22/3:

in the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic," approved by the aforementioned resolution:

• sub-item 1 of item 4 shall be worded as follows:

"1) Remote/distant services - services provided by the provider to the user based on the user's instructions, transmitted to the service provider remotely using information systems (internet banking, mobile banking, and others).";

• in item 5:

the fourth paragraph shall be worded as follows:

"- develop an information security policy determining the liability of service providers when interacting with users, taking into account the requirements of regulatory legal acts in the field of information security, as well as in the event of an emergency situation;";

the sixth paragraph shall be worded as follows:

"- comply with requirements for counteracting terrorist financing and legalization (money laundering) of criminal proceeds in accordance with the legislation of the Kyrgyz Republic;";

add paragraphs eighth, ninth, and tenth as follows:

"- develop and approve the procedure for recognizing and using electronic signatures when performing legally significant actions (expression of consent, submitting applications, concluding contracts and other transactions);

• maintain an electronic registry of documents signed with an electronic signature;

• ensure monitoring and maintenance of a log (logs) of user connections to the remote/distant service system.";

• supplement the regulation with item 6-1 as follows:

"6-1. The use of electronic signatures in remote/distant services must be carried out in accordance with the requirements of Appendix 2 to this Regulation.";

• in item 10:

in the seventh paragraph, exclude the words "periodicity (at least once a month) and";

add the sixteenth paragraph as follows:

"- a mechanism for determining the user on whose behalf the electronic signature is used, and the obligation to maintain the confidentiality of the electronic signature key.";

• recognize item 11 as having lost force;

• reword item 14 as follows:

"14. Requirements for services via internet banking.

1) When serving a user via internet banking, the service provider must, at a minimum:

• inform clients about possible risks and precautionary measures;

• inform clients about the necessity of observing security rules and procedures when making payments using internet banking (prohibition of transferring passwords, codes, keys to third parties);

• ensure confidentiality when transmitting financial messages and payments;

• use secure network protocols;

• apply mechanisms to prevent fraudulent spoofing of internet banking server web pages;

• use multi-factor authentication (for example, password/code/one-time code, and personal identification number, biometric means, and others);

• apply a policy providing for the use of complex passwords and their regular change;

• use mechanisms to prevent automatic password guessing;

• use mechanisms for blocking the connection session with the internet banking server if the user is inactive for more than the established time interval.";

• reword item 18 as follows:

"18. The service provider is obligated to familiarize/inform the user with the usage rules and tariffs for the services provided before signing the contract or before the start of remote/distant services.";

• in item 21:

the third paragraph shall be worded as follows:

"- determination of measures to reduce risks, including the application of appropriate client identification technologies and internal control norms (verification of authenticity and relevance of identification means);";

add the eighth paragraph as follows:

"- monitoring of internet banking user actions.";

• in item 27, replace the words "comply with the generally accepted 'Know Your Customer' rules established by the regulatory legal acts of the National Bank" with the words "comply with the requirements of the legislation of the Kyrgyz Republic regarding due diligence of clients";

• supplement the Regulation with Appendix 2 as follows:

		"Appendix 2 to the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic"

Requirements for the Use of Electronic Signatures in Remote/Distant Services

In order to recognize the legal significance of electronic documents in remote/distant services, the following conditions for the use of electronic signatures are established.

1. The use of an electronic signature must be accompanied by informational messages about the legal significance of operations and transactions performed using it, and require the user's confirmation.

2. An electronic signature is applied to the entire document presented as an informational message, or to a document sent in accordance with an agreement between the parties of information exchange.

3. The use of an electronic signature must be carried out in accordance with the requirements of the legislation of the Kyrgyz Republic regarding due diligence of clients.

4. An electronic signature is used when:

• obtaining consent for standard operations (processing of personal data, loan applications, issuance of cards, etc.);

• signing contracts for opening additional accounts (deposits);

• signing loan contracts in accordance with established limits;

• updating identification data, excluding the client's full name and personal identification number. Updating is permitted if verification is possible.

5. A simple electronic signature must be used for operations with a low level of risk in accordance with internal risk management policies.

6. Operations with a medium level of risk and above, in accordance with internal risk management policies, must be conducted using an enhanced signature.".

2. Make the following amendments and additions to the resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Instruction on Working with Bank Accounts, Bank Deposit (Deposit) Accounts" dated October 31, 2012 No. 41/12:

in the Instruction on Working with Bank Accounts, Bank Deposit (Deposit) Accounts, approved by the aforementioned resolution:

• the third sentence of item 8 shall be worded as follows:

"Documents submitted upon opening an account in accordance with the requirements of this Instruction must be bound and stored in the bank in a specially established file for each client together with the original contract, or kept and stored electronically in a database for at least the storage periods of documents on paper carriers. In this case, access to electronic document databases must be provided in accordance with the legislation.";

• in the second paragraph of item 17:

in the second sentence, after the words "money transfers," add the words "(including those carried out through money transfer systems without opening an account)";

in the third sentence, after the words "loan repayment," add the words "money transfers (including those carried out through money transfer systems without opening an account),";

• reword the twelfth paragraph of item 37 as follows:

"The contract must be drawn up in the state or official language, at the client's choice, and concluded in written form in at least two copies, one for each party, or in the form of an electronic document signed with an electronic signature that reliably establishes that the document originates from the contracting party. Failure to comply with the written form of a bank deposit (deposit) contract or the requirements for recognizing an electronic signature renders the contract invalid. In this case, for the written form, one copy is stored in the bank, and the other is provided to the client; for the electronic form, the bank stores the document in an electronic database, and the client is provided access to the electronic form of the contract with the ability to download it for storage and verification of content uniqueness. The bank is obligated to provide the contract to the client before accepting the bank deposit (deposit).";

• reword item 39 as follows:

"39. Opening accounts under a bank deposit (deposit) agreement upon the first visit must be carried out with identification in the presence of the depositor themselves (if the depositor is an individual) or a person having duly documented powers confirming their authority to open an account (if the depositor is an individual or legal entity), or a person opening an account on behalf of a third party (for example, parents or legal representatives of a minor or third parties), for the purpose of their identification.";

• in sub-item 1 of item 40, after the words "application for opening an account, signed by the client," add the words "on paper, or in the form of an electronic document signed by means of an electronic signature";

• in item 48:

in the seventh paragraph, after the words "under a bank account agreement," add the words "upon the first visit".

3. Make the following additions and amendments to the resolution of the Board of the National Bank of the Kyrgyz Republic "On Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic" dated June 30, 2010 No. 52/4:

in the Regulation "On Minimum Requirements for Managing Credit Risk in Commercial Banks and Other Financial-Credit Organizations Licensed by the National Bank of the Kyrgyz Republic," approved by the aforementioned resolution:

• supplement the Regulation with item 34-3 as follows:

"34-3. The bank has the right to issue loans through remote/distant service channels, provided that the requirements specified in the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic," approved by the resolution of the Board of the National Bank of the Kyrgyz Republic dated April 15, 2015 No. 22/3, other regulatory legal acts of the National Bank, and the bank's internal policies and procedures are observed.

The amounts of loans issued through remote/distant service channels must not exceed 15,000 Kyrgyz som (equivalent in foreign currency) for contracts signed with a simple electronic signature, and 150,000 Kyrgyz som (equivalent in foreign currency) for contracts signed with an enhanced electronic signature.";

• supplement item 36 with the second paragraph as follows:

"For loans issued through remote/distant service channels, the borrower's credit file may be kept electronically in a database (on electronic carriers) for at least the storage periods of documents on paper carriers. In this case, access to electronic document databases must be provided in accordance with the legislation.";

• supplement item 39 with the second paragraph as follows:

"In this case, contracts for loans issued through remote/distant service channels in amounts established by the regulatory legal acts of the National Bank may be signed by means of an electronic signature that allows verifying its belonging to the contracting party.";

• reword item 46 as follows:

"46. Each page of the loan contract with all appendices must be signed by the client on paper, or in the form of a single electronic document signed by means of an electronic signature that allows verifying its belonging to the contracting party.

The bank must receive a receipt from the client, or the client must make an inscription on the loan contract stating that the client has familiarized themselves with all contract terms, the contract terms are clear, and the client agrees with them, or in the form of a single electronic document signed by means of an electronic signature. The receipt (if it was received) is bound/stored in the client's credit file.";

• reword item 47 as follows:

"47. The number of copies of the concluded contract must be no less than the number of parties concluding it. Each party concluding the contract must receive the original copy of the loan contract signed by all parties, or in the form of an electronic document signed by means of an electronic signature that allows verifying its belonging to the contracting party. The loan contract must not contradict the legislation of the Kyrgyz Republic, as well as the regulatory legal acts of the National Bank. The bank must receive a receipt from the client confirming the client's receipt of the original contract, or an electronic document signed by means of an electronic signature. The fact of the client receiving funds must be confirmed by the corresponding document.";

• reword the third paragraph of item 61 as follows:

"Exceptions to blank loans include loans issued for an amount less than or equal to 150,000 Kyrgyz som, with an annuity repayment schedule and a term of no more than 24 months, and loans issued through remote/distant service channels meeting the specified conditions. The amount of such loans must not exceed the borrower's annual net solvency (all income and expenses of the borrower).".

4. Make the following additions and amendments to the resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Managing Credit Risk in Operations in Accordance with Islamic Principles of Banking and Finance" dated September 25, 2013 No. 35/13:

in the Regulation "On Minimum Requirements for Managing Credit Risk in Operations in Accordance with Islamic Principles of Banking and Finance," approved by the aforementioned resolution:

• supplement item 38-3 as follows:

"38-3. The bank has the right to issue an asset carrying credit risk through remote/distant service channels, provided that the requirements specified in the Regulation "On Minimum Requirements for Providing Remote/Distant Services in the Kyrgyz Republic," approved by the resolution of the Board of the National Bank of the Kyrgyz Republic dated April 15, 2015 No. 22/3, other regulatory legal acts of the National Bank, and the bank's internal policies and procedures are observed.

The amounts of assets carrying credit risk issued through remote/distant service channels must not exceed 15,000 Kyrgyz som (equivalent in foreign currency) for contracts signed with a simple electronic signature, and 150,000 Kyrgyz som (equivalent in foreign currency) for contracts signed with an enhanced electronic signature.";

• supplement item 39 with the second paragraph as follows:

"For assets carrying credit risk issued through remote/distant service channels, the client/partner's file may be kept electronically in a database (on electronic carriers) for at least the storage periods of documents on paper carriers. In this case, access to electronic document databases must be provided in accordance with the legislation.";

• supplement item 42 with the second paragraph as follows:

"In this case, contracts for assets carrying credit risk issued through remote/distant service channels in amounts established by the regulatory legal acts of the National Bank may be signed by means of an electronic signature that allows verifying its belonging to the contracting party.";

• reword item 49 as follows:

"49. Each page of the contract with all appendices must be signed by the client/partner, or in the form of a single electronic document signed by means of an electronic signature that allows verifying its belonging to the contracting party.

The bank must receive a receipt from the client/partner, or the client/partner must make an inscription on the contract, or in the form of a single electronic document signed by means of an electronic signature, stating that the client/partner has familiarized themselves with all contract terms, the contract terms are clear to the client/partner, and the client/partner agrees with them. The receipt (if it was received) is bound/stored in the client/partner's file.";

• reword item 50 as follows:

"50. The number of copies of the concluded contract must be no less than the number of parties concluding it. Each party concluding the contract must receive the original copy of the contract signed by all parties, or in the form of an electronic document signed by means of an electronic signature that allows verifying its belonging to the contracting party. The contract must not contradict the legislation of the Kyrgyz Republic, including the regulatory legal acts of the National Bank. The bank must receive a receipt from the client/partner confirming the client/partner's receipt of the original contract, or an electronic document signed by means of an electronic signature. The fact of the client/partner receiving funds must be confirmed by the corresponding document.";

• reword the third paragraph of item 63 as follows:

"Exceptions to blank assets carrying credit risk include assets issued for an amount less than or equal to 150,000 Kyrgyz som, with an annuity repayment schedule and a term of no more than 24 months, and assets issued through remote/distant service channels meeting the specified conditions. The amount of such assets must not exceed the annual net solvency of the client/partner (all income and expenses of the client/partner). The maximum risk size for assets excluded from the calculation of blank assets must not exceed 20 (twenty) percent of the blank assets."."