Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 116 of 20 December 2021 on Amendments and Additions to Resolutions of the Board of the National Bank of the Republic of Kazakhstan No. 202 of 31 August 2016 and No. 215 of 31 August 2016

"NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN" REPUBLICAN STATE INSTITUTION		REPUBLICAN STATE INSTITUTION "NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN"
RESOLUTION OF THE BOARD 20 December 2021 Nur-Sultan city		RESOLUTION OF THE BOARD No. 116 Nur-Sultan city

On Amendments and Additions to Resolutions of the Board of the National Bank of the Republic of Kazakhstan No. 202 of 31 August 2016 "On Approval of the Rules for the Issuance, Use and Redemption of Electronic Money, as well as Requirements for Electronic Money Issuers and Electronic Money Systems in the Territory of the Republic of Kazakhstan" and No. 215 of 31 August 2016 "On Approval of the Rules for Organizing the Activities of Payment Organizations"

In accordance with subparagraphs 42) and 52-1) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan" and subparagraphs 1) and 12) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. To introduce the following amendments and additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 202 of 31 August 2016 "On Approval of the Rules for the Issuance, Use and Redemption of Electronic Money, as well as Requirements for Electronic Money Issuers and Electronic Money Systems in the Territory of the Republic of Kazakhstan" (registered in the State Register of Registration of Normative Legal Acts under No. 14298):

the preamble shall be restated as follows:

"In accordance with subparagraph 42) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan" and subparagraph 12) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:";

in the Rules for the Issuance, Use and Redemption of Electronic Money, as well as Requirements for Electronic Money Issuers and Electronic Money Systems in the Territory of the Republic of Kazakhstan, approved by the said resolution:

part one of paragraph 1 shall be restated as follows:

"1. These Rules for the Issuance, Use and Redemption of Electronic Money, as well as Requirements for Electronic Money Issuers and Electronic Money Systems in the Territory of the Republic of Kazakhstan (hereinafter – the Rules) are developed in accordance with subparagraph 42) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan" and subparagraph 12) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law on Payments and Payment Systems) and determine the procedure for the issuance, use and redemption of electronic money in the territory of the Republic of Kazakhstan, as well as requirements for electronic money issuers (hereinafter – the issuer) and electronic money systems in the territory of the Republic of Kazakhstan.";

paragraph 2 shall be restated as follows:

"2. The Rules use the concepts provided for by Article 1 of the Law on Payments and Payment Systems, as well as the following concepts:

1) information security incident, including violations, failures in information systems (hereinafter – information security incident) – separately or serially occurring failures in the operation of information and communication infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of electronic information resources of the electronic money system operator;

2) information about information security incidents, including information about violations, failures in information systems – information about separately or serially occurring failures in the operation of information and communication infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of electronic information resources of the electronic money system operator;

3) perimeter of protection of information and communication infrastructure – a set of software and hardware means separating the information and communication infrastructure of the electronic money system operator from external information networks and providing protection against information security threats;

4) information security – the state of protection of electronic information resources, information systems and information and communication infrastructure from external and internal threats;

5) information security threat – a set of conditions and factors creating prerequisites for the occurrence of an information security incident;

6) ensuring information security – a process aimed at maintaining the state of confidentiality, integrity and availability of information assets of the electronic money system operator;

7) security procedure – a set of organizational measures and software and technical means of information protection intended to verify the rights of the electronic money holder to use electronic money and to detect errors and (or) changes in the content of messages transmitted and received electronically (hereinafter – electronic message) when using electronic money;

8) information asset of the electronic money system operator – a set of information and an object of information and communication infrastructure used for its storage and (or) processing;

9) information and communication infrastructure of the electronic money system operator (hereinafter – information infrastructure) – a set of objects of information and communication infrastructure intended to ensure the functioning of the technological environment for the purpose of forming electronic information resources and providing access to them;

10) internal rules of the electronic money system – the rules in accordance with which the issuance, sale, acquisition, redemption of electronic money are carried out, as well as operations using them in the electronic money system are performed;

11) personal account of the electronic money holder – a personal section of the electronic money holder on the Internet resource of the electronic money system, through which the electronic money holder has access to his electronic wallet to obtain necessary information about the balance of electronic money, operations conducted on it, making payments and other operations using electronic money in the manner provided for by the internal rules of the electronic money system and agreements concluded between the electronic money system operator (hereinafter – the operator) or the issuer and the electronic money holder. The list of services provided through the personal account of the electronic money holder is established by the operator;

12) exchange operations with electronic money – operations for the exchange of electronic money issued by one issuer for electronic money of another issuer that is a participant in another electronic money system;

13) forced redemption of electronic money – an operation for the redemption of electronic money, providing for the transfer of an amount equal to their nominal value to the bank account of the electronic money holder or to the consolidated account of the issuer until they are claimed by an individual;

14) termination of issuance of electronic money – termination of the issuer's activity in providing a payment service involving the issuance of electronic money to an individual or an agent of the electronic money system (hereinafter – the agent) by exchange for an amount of money equal to their nominal value;

15) blocking of an electronic wallet – full or partial prohibition on the use of electronic money stored in the electronic wallet of the electronic money holder.";

paragraph one of paragraph 4 shall be restated as follows:

"4. The issuer, within ten calendar days from the date of commencement of activities for the issuance of electronic money, notifies the National Bank of the Republic of Kazakhstan thereof in the form according to Appendix 1 to the Rules and submits the following documents and information:";

paragraph 38 shall be restated as follows:

"38. The issuer, thirty calendar days before the termination of the issuance of electronic money, notifies the National Bank of the Republic of Kazakhstan thereof in the form according to Appendix 1 to the Rules.";

paragraph 50 shall be restated as follows:

"50. Remote identification of the electronic money holder – an individual is carried out by the issuer and (or) the operator on the basis of information from available sources obtained from the operational center of the interbank money transfer system, in the manner and on the grounds provided for by the Rules for the Provision by Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations of Electronic Banking Services, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 212 of 31 August 2016 (registered in the State Register of Registration of Normative Legal Acts under No. 14337).";

supplement with Chapter 7 as follows:

"Chapter 7. Requirements for Software and Hardware and Information Security Management Systems of Electronic Money System Operators That Are Payment Organizations

55. Software ensures:

1) reliable storage of information, protection from unauthorized access, integrity of databases and complete preservation of information in electronic archives and databases during full or partial power outage at any time at any part of the equipment;

2) multi-level access to input data, functions, operations, reports implemented in the software, providing for at least two levels of access: administrator and user;

3) control of completeness of entered data of mandatory fields necessary for conducting and registering operations (when performing functions or operations without fully filling in all fields, the program provides an appropriate notification);

4) search for information by criteria and parameters defined for this information system, with saving the query, as well as sorting information by any parameters (defined for this information system) and the ability to view information for previous dates, if such information is subject to storage in the information system;

5) processing of information and its storage by date and time;

6) automated generation of report forms submitted by electronic money system operators to the National Bank of the Republic of Kazakhstan, as well as reports on conducted operations;

7) maintenance and automated generation of internal accounting system journals. The software generates the journal in full, as well as partially (for a specified date range, a specific date);

8) possibility of backup and recovery of data stored in accounting systems;

9) possibility of outputting output documents to the screen, printer or file;

10) possibility of exchanging electronic documents;

11) registration and identification of events occurring in the information system with preservation of the following attributes: date and time of the beginning of the event, name of the event, user who performed the action, record identifier, date and time of the end of the event, result of the event.

56. Electronic money system operators ensure the creation and functioning of an information security management system, which is part of the overall management system of electronic money system operators, intended for managing the process of ensuring information security.

57. The information security management system ensures the protection of information assets of electronic money system operators, allowing for a minimum level of potential damage to the business processes of electronic money system operators.

58. The electronic money system operator ensures an appropriate level of the information security management system, its development and improvement.

59. The electronic money system operator, in order to ensure confidentiality, integrity and availability of information, performs the following functions:

1) organizes the information security management system, coordinates and controls activities for ensuring information security and measures for identifying and analyzing threats, countering attacks and investigating information security incidents;

2) provides methodological support for the process of ensuring information security;

3) selects, implements and applies methods, means and mechanisms for managing, ensuring and controlling information security within its powers;

4) collects, consolidates, stores and processes information about information security incidents;

5) analyzes information about information security incidents;

6) ensures the implementation, proper functioning of software and hardware that automate the process of ensuring information security, as well as providing access to them;

7) determines restrictions on the use of privileged accounts;

8) organizes and conducts measures to ensure awareness of employees of electronic money system operators in matters of information security;

9) monitors the state of the information security management system of the electronic money system operator;

10) periodically (but not less than once a year) informs the management of the electronic money system operator about the state of the information security management system.

60. The electronic money system operator manages information security risks, indicating criteria for an acceptable level in relation to information assets.

When information security risks materialize, an action plan is developed aimed at minimizing the occurrence of such risks.

61. Information about information security incidents obtained during monitoring of activities to ensure information security is subject to consolidation, systematization and storage.

62. The storage period for information about information security incidents is at least 5 (five) years.

63. The electronic money system operator determines the procedure for taking urgent measures to eliminate an information security incident, its causes and consequences.

64. The electronic money system operator maintains a log of information security incidents, reflecting all information about the information security incident, measures taken and proposed corrective measures.

65. The electronic money system operator provides to the National Bank information about the following identified information security incidents:

1) exploitation of vulnerabilities in application and system software;

2) unauthorized access to the information system;

3) "denial of service" attack on the information system or data transmission network;

4) infection of the server with malicious software or code;

5) commission of an unauthorized transfer of electronic money due to violation of information security controls;

6) information security incidents that pose a threat to the stability of the electronic money system operator's activities.

Information about the information security incidents specified in this paragraph is provided by the electronic money system operator as soon as possible, but no later than 48 hours from the moment of detection, in the form of an information security incident card according to Appendix 2 to the Rules.

Information on processed information security incidents is submitted in electronic format using the National Bank's platform for the exchange of information security events and incidents.

A separate information security incident card is filled out for each information security incident.";

in the appendix, the text in the upper right corner shall be restated as follows:

"Appendix 1

to the Rules for the Issuance, Use

and Redemption of Electronic Money,

as well as Requirements for Electronic Money

Issuers and Electronic Money Systems

in the Territory of the Republic of Kazakhstan";

supplement with Appendix 2 in the wording according to Appendix 1 to this resolution.

2. To introduce the following amendments and additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 215 of 31 August 2016 "On Approval of the Rules for Organizing the Activities of Payment Organizations" (registered in the State Register of Registration of Normative Legal Acts under No. 14347):

the preamble shall be restated as follows:

"In accordance with subparagraph 52-1) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the Laws of the Republic of Kazakhstan "On State Services", "On Permits and Notifications", and subparagraph 1) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:";

in the Rules for Organizing the Activities of Payment Organizations, approved by the said resolution:

paragraphs 1 and 2 shall be restated as follows:

"1. These Rules for Organizing the Activities of Payment Organizations (hereinafter – the Rules) are developed in accordance with subparagraph 52-1) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the Laws of the Republic of Kazakhstan "On State Services", "On Permits and Notifications", subparagraph 1) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter – the Law on Payments and Payment Systems) and determine the procedure for organizing the activities of payment organizations.

The procedure for organizing the activities of payment organizations includes registration of payment organizations with the National Bank of the Republic of Kazakhstan (hereinafter – the National Bank), maintenance by the National Bank of the register of payment organizations (hereinafter – the register), provision of payment services by payment organizations, notification by payment organizations of the opening of branches, requirements for software and hardware of payment organizations and the information security management system.

2. The Rules use the concepts provided for by the Law on Payments and Payment Systems, and the following concepts:

1) information about information security incidents, including information about violations, failures in information systems – information about separately or serially occurring failures in the operation of information and communication infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of electronic information resources of the payment organization;

2) information security incident, including violations, failures in information systems (hereinafter – information security incident) – separately or serially occurring failures in the operation of information and communication infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of electronic information resources of the payment organization;

3) information security – the state of protection of electronic information resources, information systems and information and communication infrastructure from external and internal threats;

4) information security threat – a set of conditions and factors creating prerequisites for the occurrence of an information security incident;

5) ensuring information security – a process aimed at maintaining the state of confidentiality, integrity and availability of information assets of the payment organization;

6) perimeter of protection of information and communication infrastructure – a set of software and hardware means separating the information and communication infrastructure of the payment organization from external information networks and providing protection against information security threats;

7) information and communication infrastructure of the payment organization (hereinafter – information infrastructure) – a set of objects of information and communication infrastructure intended to ensure the functioning of the technological environment for the purpose of forming electronic information resources and providing access to them.";

8) information asset of the payment organization – a set of information and an object of information and communication infrastructure used for its storage and (or) processing.";

paragraph 7 shall be restated as follows:

"7. The Rules for carrying out the activities of a payment organization contain the following mandatory conditions:

1) description of payment services provided by the payment organization;

2) procedure and terms for providing payment services to clients of the payment organization;

3) cost of payment services (tariffs) provided by the payment organization;

4) procedure for interaction with third parties providing technological support for payment services provided by the payment organization;

5) information about the risk management system used by the payment organization;

6) procedure for settling disputed situations and resolving disputes with clients;

7) procedure for complying with information security measures;

8) description of software and hardware and equipment necessary for the provision of payment services.";

supplement with Chapter 6 as follows:

"Chapter 6. Requirements for Software and Hardware of Payment Organizations and the Information Security Management System

34. Software ensures:

1) reliable storage of information, protection from unauthorized access, integrity of databases and complete preservation of information in electronic archives and databases during full or partial power outage at any time at any part of the equipment;

2) multi-level access to input data, functions, operations, reports implemented in the software, providing for at least two levels of access: administrator and user;

3) control of completeness of entered data of mandatory fields necessary for conducting and registering operations (when performing functions or operations without fully filling in all fields, the program provides an appropriate notification);

4) search for information by criteria and parameters defined for this information system, with saving the query, as well as sorting information by any parameters (defined for this information system) and the ability to view information for previous dates, if such information is subject to storage in the information system;

5) processing of information and its storage by date and time;

6) automated generation of report forms submitted by payment organizations to the National Bank, as well as reports on conducted operations;

7) maintenance and automated generation of internal accounting system journals. The software generates the journal in full, as well as partially (for a specified date range, a specific date);

8) possibility of backup and recovery of data stored in accounting systems;

9) possibility of outputting output documents to the screen, printer or file;

10) possibility of exchanging electronic documents;

11) registration and identification of events occurring in the information system with preservation of the following attributes: date and time of the event start, event name, user who performed the action, record identifier, date and time of the event end, result of the event execution.

35. Payment organizations shall ensure the creation and functioning of an information security management system, which is part of the overall management system of the payment organization, intended for managing the process of ensuring information security.

36. The information security management system shall ensure the protection of the information assets of the payment organization, allowing a minimum level of potential damage to the business processes of the payment organization.

37. The payment organization shall ensure an appropriate level of the information security management system, its development and improvement.

38. The payment organization, in order to ensure the confidentiality, integrity and availability of the information of the payment organization, shall perform the following functions:

1) organize the information security management system, coordinate and control activities for ensuring information security and measures for identifying and analyzing threats, countering attacks and investigating information security incidents;

2) provide methodological support for the process of ensuring information security;

3) select, implement and apply methods, means and mechanisms of management, provision and control of information security within its powers;

4) collect, consolidate, store and process information about information security incidents;

5) analyze information about information security incidents;

6) ensure the implementation and proper functioning of software and hardware tools automating the process of ensuring information security, as well as the provision of access to them;

7) determine restrictions on the use of privileged accounts;

8) organize and conduct measures to ensure the awareness of employees of the payment organization in matters of information security;

9) monitor the state of the information security management system of the payment organization;

10) periodically (but not less than once a year) inform the management of the payment organization about the state of the information security management system of the payment organization.

39. The payment organization shall manage information security risks, specifying criteria for an acceptable level in relation to information assets.

When information security risks materialize, an action plan shall be developed aimed at minimizing the occurrence of such risks.

40. Information about information security incidents obtained during monitoring of activities for ensuring information security shall be subject to consolidation, systematization and storage.

41. The storage period for information about information security incidents shall be not less than 5 (five) years.

42. The payment organization shall determine the procedure for taking urgent measures to eliminate an information security incident, its causes and consequences.

43. The payment organization shall maintain a log of information security incidents reflecting all information about the information security incident, measures taken and proposed corrective measures.

44. The payment organization shall provide to the National Bank information about the following identified information security incidents:

1) exploitation of vulnerabilities in application and system software;

2) unauthorized access to the information system;

3) a "denial of service" attack on the information system or data transmission network;

4) infection of a server with a malicious program or code;

5) commission of an unauthorized transfer of funds as a result of a violation of information security controls;

6) information security incidents posing a threat to the stability of the payment organization's activities.

Information about the information security incidents specified in this paragraph shall be provided by the payment organization as soon as possible, but not later than 48 hours from the moment of detection, in the form of an information security incident card in the form according to Appendix 7 to the Rules.

Information on processed information security incidents shall be submitted in electronic format using the National Bank's platform for the exchange of information security events and incidents.

A separate information security incident card shall be filled out for each information security incident.";

supplement with Appendix 7 in the wording according to Appendix 2 to this resolution.

3. The Department of Payment Systems (Ashykbekov Ye.T.) shall, in the procedure established by the legislation of the Republic of Kazakhstan, ensure:

1) together with the Legal Department (Kasenov A.S.), the state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on the official
internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this resolution, submission to the Legal Department of information on the implementation of the measure provided for by subparagraph 2) of this paragraph.

4. Control over the execution of this resolution shall be assigned to the Deputy Chairman of the National Bank of the Republic of Kazakhstan Sholpankulov B.Sh.

5. This resolution[1] shall enter into force on 1 April 2022.

Chairman	Ye. Dosayev

AGREED

Ministry of National

Economy of the Republic of Kazakhstan

AGREED

Ministry of Digital Development,

Innovations and Aerospace

Industry of the Republic of Kazakhstan

True copy:

Chief Specialist-Secretary of the Board Zh. Mukhambetova

1. On Amendments and Additions to Resolutions of the Board of the National Bank of the Republic of Kazakhstan No. 202 of 31 August 2016 "On Approval of the Rules for the Issue, Use and Redemption of Electronic Money, as well as Requirements for Electronic Money Issuers and Electronic Money Systems on the Territory of the Republic of Kazakhstan" and No. 215 of 31 August 2016 "On Approval of the Rules for Organizing the Activities of Payment Organizations" ↑