Resolution of the Board of the National Bank of the Kyrgyz Republic No. 2026-P-14/44-1-(NPA) of 28 August 2026 on Amending the Resolution on Approval of the Regulation on Minimum Requirements for Internal Control in Commercial Banks for Countering Terrorist Financing and Money Laundering, the Regulation on the Procedure for Exchange Operations with Cash Foreign Currency, and on Amending Certain Regulatory Legal Acts on AML/CFT

RESOLUTION OF THE BOARD OF THE NATIONAL BANK OF THE KYRGYZ REPUBLIC

of 28 August 2026 No. 2026-P-14/44-1-(NPA)

On Amending the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for the Organization of Internal Control in Commercial Banks for the Purpose of Countering Terrorist Financing and Legalization (Laundering) of Criminal Proceeds", the Regulation "On the Procedure for Conducting Exchange Operations with Cash Foreign Currency in the Kyrgyz Republic" and on Amending and Supplementing Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic on Issues of Countering Terrorist Financing and Legalization (Laundering) of Criminal Proceeds" of 14 August 2019 No. 2019-P-12/42-1-(NPA)

In accordance with Articles 5, 9 and 64 of the Constitutional Law of the Kyrgyz Republic "On the National Bank of the Kyrgyz Republic", the Board of the National Bank of the Kyrgyz Republic resolves:

1. To introduce into the resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for the Organization of Internal Control in Commercial Banks for the Purpose of Countering Terrorist Financing and Legalization (Laundering) of Criminal Proceeds", the Regulation "On the Procedure for Conducting Exchange Operations with Cash Foreign Currency in the Kyrgyz Republic" and on Amending and Supplementing Certain Regulatory Legal Acts of the National Bank of the Kyrgyz Republic on Issues of Countering Terrorist Financing and Legalization (Laundering) of Criminal Proceeds" of 14 August 2019 No. 2019-P-12/42-1-(NPA) the following amendments:

in the Regulation "On Minimum Requirements for the Organization of Internal Control in Commercial Banks for the Purpose of Countering Terrorist Financing and Legalization (Laundering) of Criminal Proceeds", approved by the above-mentioned resolution:

1) Chapter 4 shall be supplemented with paragraphs 10-1, 10-2, 10-3, 10-4 as follows:

"10-1. The bank shall ensure the application of automated tools for monitoring and analyzing operations and (or) transactions with virtual assets, including blockchain analytics tools, to the extent corresponding to the specific type of services provided, the nature, scale and level of risks of the activity carried out, as well as taking into account the specifics of the technology used and the availability of data necessary for analysis.

The bank shall analyze available information on operations recorded in distributed ledger technology, addresses (wallets) of virtual assets, counterparties and other circumstances relevant to assessing the risk of TF/ML.

The bank shall take into account available and reliable information on the possible connection of virtual assets, addresses (wallets) or counterparties with persons included in Sanctions lists. Such information is grounds for additional analysis and application of measures provided for by the legislation of the Kyrgyz Republic in the field of CFT/AML.

10-2. The bank's internal measures, procedures and control systems shall provide for the identification of operations and (or) transactions with virtual assets that have signs of high risk.

Such signs may include:

• operations involving virtual asset service providers for which available and reliable information on the licensing or regulation of their activities is absent or insufficient;

• operations for which the bank cannot establish the addresses (wallets) of the sender and (or) recipient of virtual assets;

• operations with virtual assets using addresses (wallets) for which information necessary for conducting proper customer due diligence and risk assessment is absent or insufficient;

• operations that have signs of deliberate obstruction of the traceability of the origin and movement of virtual assets;

• operations related to the use of services, technologies or mechanisms aimed at concealing the origin of virtual assets or increasing the anonymity of operations;

• inconsistency of the operation with information on the client's activity, financial position, purpose and expected nature of business relations;

• other signs established by the bank's internal documents, as well as by the legislation of the Kyrgyz Republic in the field of CFT/AML.

10-3. The bank's internal documents shall provide for:

• the procedure for interaction with clients and (or) counterparties whose activity and (or) operations are related to virtual assets, including virtual asset service providers;

• the procedure for identifying, assessing, monitoring and managing risks associated with such business relations and operations;

• the procedure for applying additional control measures and proper customer due diligence upon identifying signs of increased risk related to virtual assets;

• other procedures provided for by the legislation of the Kyrgyz Republic in the field of CFT/AML.

10-4. Before establishing business relations with clients or counterparties whose activity and (or) operations are related to virtual assets, the bank shall assess the sufficiency of its own internal measures, procedures and control systems, staffing, technical and organizational resources for identifying, assessing, monitoring, managing and reducing the relevant risks.

The decision to establish or continue business relations shall be made by an authorized official or collegial body of the bank in accordance with the bank's internal documents on the basis of a risk assessment and the results of proper customer due diligence.";

2) Chapter 7 shall be supplemented with paragraphs 28-1, 28-2, 28-3 as follows:

"28-1. When establishing business relations with clients/counterparties whose activity is related to virtual assets, as well as when carrying out operations related to virtual assets, the bank shall apply a risk-based approach taking into account the nature of the activity of the client and (or) the client's counterparty, the type and purpose of the business relations, the channels used for conducting operations, the jurisdiction, the degree of transparency of operations, the availability to the bank of information on the operation and its participants, as well as other circumstances relevant to assessing the risk of TF/ML.

28-2. The bank shall obtain and verify information and documents that are necessary for conducting proper customer due diligence and assessing risks associated with the business relations and operations specified in paragraph 10-1 of this Regulation, in accordance with the legislation of the Kyrgyz Republic in the field of CFT/AML and the bank's internal documents.

When assessing risk, the bank shall take into account information on the nature of the client's activity, the purpose and expected nature of the business relations, the source of origin of funds and other property, the expected volumes and types of operations, the countries (territories) of activity, the payment and other channels used, as well as other information available to the bank that is relevant to assessing the risk of TF/ML.

28-3. When establishing business relations with a client and (or) counterparty carrying out activity in the field of virtual assets, the bank shall take reasonable measures proportionate to the level of risk to establish its status, including verification of the existence of a license, registration or other permission in accordance with the legislation of the Kyrgyz Republic in the field of CFT/AML.

The absence or insufficiency of information on the status of the counterparty shall be taken into account by the bank when assessing the level of risk and is grounds for requesting additional information and documents, applying additional control measures or other measures provided for by the legislation of the Kyrgyz Republic in the field of CFT/AML.

The bank shall take into account the origin of virtual assets and the sources of the client's funds when assessing risks associated with operations with virtual assets.";

3) paragraph 39 shall be supplemented with paragraphs as follows:

"The bank shall take into account risks associated with virtual assets, the use of distributed ledger technologies, as well as the possible use of banking services and products for settlements for operations with virtual assets, including operations between users in which a virtual asset service provider or other obligated entity does not participate in the transfer of virtual assets (P2P operations).

The bank shall take reasonable measures proportionate to the level of risk to identify operations that have signs of possible use of banking services and products for settlements for operations with virtual assets, within the information available to the bank when conducting proper customer due diligence, monitoring business relations and carrying out banking operations.";

4) shall be supplemented with paragraph 39-4 as follows:

"39-4. In the event of absence or insufficiency of information and documents, the bank shall request additional information and documents, apply additional measures of proper customer due diligence and other measures provided for by the legislation of the Kyrgyz Republic in the field of CFT/AML and the bank's internal documents. In the event of impossibility of conducting proper customer due diligence, the bank shall act in accordance with paragraph 39-2 of this Regulation.".

2. This resolution shall enter into force upon the expiry of 15 (fifteen) days from the day of official publication.

3. The Legal Department shall:

• from the day of receipt of the relevant documents, within 3 (three) working days, publish this resolution on the official website of the National Bank of the Kyrgyz Republic;

• after official publication, send this resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Regulatory Legal Acts of the Kyrgyz Republic.

4. The Digital Financial Technologies Department shall, after official publication, within 3 (three) working days, bring this resolution to the attention of the Legal Entity Association "Union of Banks of Kyrgyzstan", commercial banks, the Legal Entity Association "Association of Microfinance Organizations", microfinance companies attracting deposits, and OJSC "Financial Company of Credit Unions".

5. The "Secretariat of the Board" Division shall, within 3 (three) working days from the day of adoption of this resolution, bring it to the attention of structural subdivisions, regional departments and the Representative Office of the National Bank of the Kyrgyz Republic in Batken Oblast.

6. Control over the execution of this resolution shall be assigned to the member of the Board of the National Bank of the Kyrgyz Republic supervising the Digital Financial Technologies Department.

Chairman		A. Beketaev