Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 188 of 12 November 2019 on Approval of the Rules for Forming the Risk Management and Internal Control System for Second-Tier Banks


"NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN" REPUBLICAN STATE INSTITUTION		REPUBLICAN STATE INSTITUTION "NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN"
BOARD RESOLUTION		RESOLUTION OF THE BOARD
12 November 2019, Almaty city		No. 188, Almaty city


On approval of the Rules for forming the risk management and internal control system for second-tier banks

In accordance with the Law of the Republic of Kazakhstan of 31 August 1995 "On banks and banking activity in the Republic of Kazakhstan", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:

To approve the attached Rules for forming the risk management and internal control system for second-tier banks.
To recognize as no longer in force the normative legal acts of the Republic of Kazakhstan, as well as structural elements of certain normative legal acts of the Republic of Kazakhstan, according to the list in the annex to this resolution.
The Department of Methodology and Regulation of Financial Organizations shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1) together with the Legal Department, state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on the official internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after state registration of this resolution, submission to the Legal Department of information on the implementation of the measures provided for by subparagraph 2) of this paragraph and paragraph 4 of this resolution.

The Department of External Communications – Press Service of the National Bank of the Republic of Kazakhstan shall ensure, within ten calendar days after state registration of this resolution, that a copy of it is sent for official publication to periodical print publications.
Control over the execution of this resolution shall be assigned to the Deputy Chairman of the National Bank of the Republic of Kazakhstan, O.A. Smolyakov.
This resolution enters into force upon the expiry of ten calendar days after the day of its first official publication.
Second-tier banks shall, by 1 July 2020, bring their activities into compliance with the requirements of this resolution.


Chairman of the National Bank	E. Dosayev

Approved

by resolution of the Board

of the National Bank

of the Republic of Kazakhstan

dated "12" November 2019 No. 188

Rules

for forming the risk management and internal control system for second-tier banks

Chapter 1. General provisions

These Rules for forming the risk management and internal control system for second-tier banks (hereinafter – the Rules) have been developed in accordance with the Law of the Republic of Kazakhstan of 31 August 1995 "On banks and banking activity in the Republic of Kazakhstan" (hereinafter – the Law on Banks) and establish the procedure for forming the risk management and internal control system of second-tier banks (hereinafter – the bank).
The following concepts are used in the Rules:
information technology risk – the probability of damage occurring as a result of failure (disruption of functioning) of information and communication technologies operated by the bank;
information security risk – the probable occurrence of damage as a result of violation of confidentiality, deliberate violation of integrity or availability of the bank's information assets;
authorized collegial body of the bank – the board of directors, a committee under the board of directors, the management board, a committee under the management board;
reputational risk – the probability of losses, failure to receive planned income as a result of narrowing of the client base, reduction of other development indicators due to the formation in society of a negative perception of the bank's reliability, the quality of services it provides or the nature of the bank's activity as a whole;
legal risk – the probability of losses occurring as a result of the bank or a counterparty failing to comply with the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, [on joint-stock companies](jl:1039594.0.1000001297_0" \o "Law of the Republic of Kazakhstan of 13 May 2003 No. 415-II "On joint-stock companies" (with amendments and additions as of 01.07.2019)), and in relations with non-residents of the Republic of Kazakhstan – the legislation of the country of their origin, as well as the terms of concluded contracts;
internal capital adequacy assessment process – a set of processes for managing material risks, taking into account the volume of assets, the nature and level of complexity of activity, the organizational structure, strategic plans, the bank's risk profile, the regulatory legal framework, assessment and aggregation of such risks in order to determine the target level of the bank's capital adequacy to maintain a stable financial position and solvency;
unsecured consumer loan – a bank loan without a collateral condition at the time of issuance, provided to an individual for purposes not related to entrepreneurial activity;
compliance risk – the probability of losses occurring as a result of the bank and its employees failing to comply with the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, the bank's internal documents regulating the procedure for the bank's provision of services and conduct of operations on the financial market, as well as the legislation of foreign states affecting the bank's activity;
corporate governance – the system of relationships between the bank's management board, board of directors, shareholders, executive employees and auditors, as well as relationships between the bank's authorized collegial bodies.

The corporate governance system allows organizing the distribution of powers and responsibilities, as well as building the process of making corporate decisions;

credit risk – the probability of losses occurring as a result of a borrower or counterparty failing to fulfill its obligations in accordance with the terms of a bank loan agreement;
creditworthiness – a comprehensive legal and financial characteristic of a borrower, represented by financial and non-financial indicators, allowing assessment of its ability in the future to fully and on time fulfill obligations under a bank loan agreement;
loan agreement – an agreement between the bank and a borrower on the provision of financing (including conditional financing), as a result of which the bank has (or will have in the future) claims against the borrower;
contingency financing plan – a set of procedures and an action plan for responding to a decrease in the bank's ability to timely meet its obligations;
unit-owner of protected information – a bank unit, the owner of information, violation of the confidentiality, integrity or availability of which will lead to losses for the bank;
critical information asset – an information asset determined in accordance with resolution of the Board of the National Bank of the Republic of Kazakhstan of 27 March 2018 No. 48 "On approval of Requirements for ensuring information security of banks and organizations carrying out certain types of banking operations, Rules and deadlines for providing information on information security incidents, including information on violations, failures in information systems", registered in the Register of state registration of normative legal acts under No. 16772;
material risk – a risk the realization of which will lead to deterioration of the bank's financial stability;
conflict of interest – a situation in which a contradiction arises between the personal interest of the bank's officials, its shareholders and (or) its employees and the proper performance by them of their official powers or the property and other interests of the bank and (or) its employees and (or) clients, which will entail adverse consequences for the bank and (or) its clients;
market risk – the probability of financial losses on balance sheet and off-balance sheet items caused by unfavorable changes in the market situation, expressed in changes in market interest rates, foreign currency exchange rates, market value of financial instruments, goods;
operational risk – the probability of losses occurring as a result of inadequate and insufficient internal processes, human resources and systems, or the influence of external events, with the exception of strategic risk and reputational risk;
internal liquidity adequacy assessment process – a set of liquidity risk management processes, in order for the bank to maintain an appropriate level of liquidity and introduce an appropriate liquidity risk management system in various time intervals depending on the types of activity, currency;
liquidity risk – the probability of financial losses occurring as a result of the bank's inability to fulfill its obligations within the established period without significant losses;
policy – an internal document approved by the bank's board of directors defining the main quantitative and qualitative parameters, principles, standards ensuring the effective functioning of the bank and compliance of its activity with the strategy, risk profile, risk appetite. Within the framework of the policy, the bank's board of directors ensures the availability of relevant internal documents describing individual procedures, processes, instructions;
strategic risk – the probability of losses occurring as a result of errors (shortcomings) made in making decisions determining the strategic development of the bank and expressed in insufficient consideration of possible dangers inherent in the bank's activity, incorrect or insufficiently justified determination of promising areas of activity in which the bank will achieve advantages over competitors, absence or provision in incomplete volume of necessary resources and organizational measures ensuring achievement of the bank's strategic goals;
stress testing – a method of assessing the potential impact of exceptional but possible events on the bank's financial condition;
risk – the probability that expected or unforeseen events will have a negative impact on the bank's financial stability, its capital and (or) income;
risk culture – processes, procedures, internal rules of the bank aimed at understanding, accepting, managing and controlling risks in order to minimize their impact on the bank's financial condition, as well as ethical norms and standards of professional activity of all participants in the organizational structure. Risk culture supplements the existing approved procedures, processes and mechanisms of the bank's activity and is an integral component of the risk management system;
risk profile – a set of types of risk and other information characterizing the degree of the bank's exposure to risks inherent in all types of the bank's activity for identifying weaknesses and determining the priority of subsequent actions within the framework of the risk management system;
risk appetite statement – a document approved by the bank's board of directors describing the aggregated level (levels) of material risks (limits of acceptable risk size) that the bank is ready to accept or intends to exclude when implementing the strategy. The risk appetite statement contains a statement of a qualitative nature, as well as a quantitative nature, including indicators in relation to profitability, capital, liquidity, risks, and other applicable indicators;
risk treatment – the process of selecting and implementing measures to change risks;
risk register – a structured list of risks containing criteria and causes of risks, the probability of their occurrence, impact (damage), priority and methods of risk treatment;
authorized body – a state body carrying out state regulation, control and supervision of the financial market and financial organizations;
organizational structure – an internal document and (or) a set of internal documents establishing the quantitative composition and system of management bodies, executive employees and structural units of the bank, reflecting the structure of subordination and accountability.
The purpose of the Rules is to define requirements for the bank's formation of risk management and internal control systems by ensuring:
effective management of the bank's risks through their timely identification, measurement, control and monitoring to ensure compliance of the bank's own capital with the level of risks it assumes and the availability of an appropriate level of liquidity;
proper corporate governance practice and an appropriate level of business ethics and risk culture;
compliance by the bank and its employees with the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, internal policies, procedures and other internal documents of the bank;
timely detection and elimination of shortcomings in the activity of the bank and its employees;
creation in the bank of adequate mechanisms for resolving unforeseen or emergency situations.
The bank's board of directors ensures the availability of a risk management system corresponding to the chosen business model, scale of activity, types and complexity of operations and ensures a proper process of identification, measurement and assessment, monitoring, control and procedures for minimizing the bank's material risks in order for the bank to determine the amount of own capital and liquidity necessary to cover material risks inherent in the bank's activity.

The risk management system is a set of components established by the Rules which provides a mechanism for interaction of internal procedures, processes, policies, structural units of the bank developed and regulated by the bank for the purpose of timely identification, measurement, control and monitoring of the bank's risks, as well as their minimization to ensure its financial stability and stable functioning.

The risk management system ensures:
an optimal balance between the profitability of the bank's main areas of activity and the level of risks assumed, based on the choice of a viable and sustainable business model, an effective process of planning strategy and budget taking into account the risk appetite strategy;
an objective assessment of the size of the bank's risks, completeness and documentation of risk management processes, their preventive identification, measurement and assessment, monitoring and control, minimization of material types of risk at each level of the organizational structure with optimal use of financial resources, personnel and information systems in order to maintain a sufficient volume of the bank's own capital and liquidity;
coverage of all types of the bank's activity exposed to material risks, at all levels of the organizational structure, completeness of assessment of individual material types of risk, their mutual influence in order to determine the bank's risk profile and build a risk appetite strategy;
the presence of risk appetite levels for all types of material risks and an algorithm of actions in cases of violation of the established levels, including responsibility for accepting risks the level of which is defined as high, procedures for informing the board of directors, committees under the board of directors and the bank's management board within the framework of the risk appetite strategy;
awareness of the bank's authorized collegial bodies making decisions carrying risks, through building an effective corporate governance system, the availability of complete, reliable and timely management information on material risks inherent in the bank's activity;
rational decision-making and acting in the interests of the bank on the basis of a comprehensive assessment of the information provided in good faith, with due care and diligence (duty of care). The duty to exercise care and diligence does not extend to errors in the process of making business decisions, unless the bank's employees and officials have shown gross negligence in doing so;
decision-making by the bank's employees and officials and acting in good faith in the interests of the bank, without taking into account personal benefits, the interests of persons connected with the bank by special relations, to the detriment of the bank's interests (duty of loyalty);
a clear distribution of functions, duties and powers of risk management between all structural units and employees of the bank, and their responsibility taking into account minimization of conflict of interest;
separation of the risk management and internal control function from the bank's operational activity through building a three lines of defense system, which includes:

the first line – at the level of the bank's structural units;

the second line – at the level of risk management units and those performing control functions;

the third line – at the level of the internal audit unit in terms of assessing the effectiveness of the functioning of the risk management system;

availability of documents developed to regulate the bank's activities, the creation and functioning of effective risk management and internal control systems in the bank that correspond to the strategy, organizational structure, risk profile of the bank and the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, as well as their periodic review and updating;
compliance with the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;
compliance with existing procedures, processes, policies and other internal documents of the bank on risk management through the construction of an effective internal control system.
The authorized body, within the framework of assessing the effectiveness of the bank's risk management system, is guided by the following principles:
ensuring the financial stability of banks, preventing the deterioration of the financial position of banks and an increase in risks associated with the activities of banks, protecting the legitimate interests of depositors, creditors, clients and correspondents of banks;
the predominance of substance over form, expressed in the assessment of the bank's risk management system as a mechanism for measuring and assessing, monitoring, controlling, and minimizing the bank's material risks, rather than formally regulated procedures of the bank and compliance with the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, internal documents of the bank;
proportionality in the exercise of control and supervision functions, as well as in the application of measures provided for by the laws of the Republic of Kazakhstan based on the results of control and supervision, based on the business model adopted by the bank, the scale of activity, types and complexity of operations and the materiality of the bank's risks;
application of a uniform approach to the assessment of the risk management system and supervisory response measures;
identification of material risks in the bank's activities.
The authorized body assesses:
the effectiveness of the corporate governance system;
material risks inherent in the bank's activities, taking into account the types and complexity of the bank's operations;
compliance of risk management systems with the chosen business model, scale of activity, types and complexity of the bank's operations;
the financial condition of major participants of the bank in order to determine the possibility of maintaining the bank's financial stability;
the impact of the financial condition of participants of the banking conglomerate on the financial stability of the bank;
the effectiveness of applying preventive measures to prevent deterioration of the bank's financial stability by adjusting risk management systems based on the scale of activity and level of risks taken;
the application of a system of quantitative and qualitative indicators within the framework of assessing the bank's activities and the effectiveness of modeling methods.

Chapter 2. Business model

The bank's business model is a combination of the chosen strategy, products, planning processes that ensure competitiveness and a sufficient level of profitability. The main principles in forming the bank's business model are:
viability, expressed in the bank's ability to ensure a sufficient level of profitability in the next 12 (twelve) months and based on budget planning and forecasting of financial indicators;
sustainability, expressed in the bank's ability to ensure a sufficient level of profitability for a period of at least 3 (three) years and based on strategic planning and forecasting of financial indicators.

The bank conducts a regular analysis of the business model in order to assess the impact of strategic risks and risks inherent in the bank's activities on it.

Banking activities are carried out within the framework of the chosen business model, taking into account the volume of assets, the nature and level of complexity of activities, organizational structure, and risk profile.

The bank's strategy is approved by the bank's board of directors for a period of at least 3 (three) years and contains:
missions and goals of the bank's development. The goals are measurable, achievable, realistic and have exact deadlines for implementation;
target market segments in the context of economic sectors and geographical distribution of the bank's development;
analysis of the strengths and weaknesses of the chosen bank strategy, taking into account key sources of income;
quantitative indicators of the loan portfolio, liquid assets, customer deposits and other attracted funds, taking into account the established risk appetite levels. At the same time, realistic assumptions are used that take into account available and accessible resources, current and potential economic conditions;
analysis of key sources of income;
key types of investments, their structure and planned changes, including the introduction and development of new products and services, taking into account the assessment of risks and processes associated with their introduction and development, as well as an assessment of the bank's current capabilities for the introduction and development of such products;
scenarios of strategic development of the bank's activities (negative, and the most probable variants of events).
The bank's budget is approved annually by the bank's board of directors and contains a monthly forecast of financial indicators (assets and liabilities, income and expenses, information on the loan portfolio, customer deposits and other attracted funds, in the context of currencies (national and foreign currencies in aggregate), customer categories).

The budget corresponds to the bank's strategy. At the same time, the assumptions used are realistic and take into account available and accessible resources, current and potential economic conditions and possible risks.

One of the components of effective budget planning is the tariff policy, which minimally includes the following components:

internal order and procedures for conducting market analysis of demand and prices for banking services;

internal order and procedures for forming the structure of interest rates and tariffs;

acceptable lower and upper limits of interest rates and tariffs for the bank, as well as requirements for the internal order of their approval, taking into account the requirements of civil, banking legislation of the Republic of Kazakhstan, on payments and payment systems, on compulsory deposit insurance, their application and periodic review;

criteria for choosing the method of determining prices for banking services, as well as requirements for methodologies based on assessing the nature and level of complexity of the bank's activities and the risks inherent in the bank;

participants in the pricing process and the order of interaction between them, including information exchange;

internal order and procedures for timely informing the bank's clients about the conditions for providing banking services, as well as informing about changes.

The bank conducts a monthly analysis of the budget for compliance of forecast indicators with actual values, the causes of identified deviations, followed by the development of corrective measures if necessary, and makes justified adjustments with their subsequent documentation.

In the process of strategic and budget planning, the bank analyzes key sources of profitability in order to identify potential risks.

In order to keep the bank's strategy and budget up to date, the bank annually analyzes the target markets in which it operates, assesses the competitive environment, the sufficiency of resources and the ability to generate short-term and long-term profitability.

Strategic and budget planning is carried out within the framework of the adopted and approved risk appetite levels.

Chapter 3. Risk appetite strategy

In order to build an effective risk management system, the bank's board of directors approves the risk appetite strategy as a separate document, or as an integral part of the bank's strategy. The risk appetite strategy defines clear boundaries of the volume of risks taken, within which the bank operates as part of the implementation of the overall bank strategy, and also defines the risk profile of the bank's activities in order to prevent the realization of risks or minimize their negative impact on the bank's financial position. The risk appetite strategy is taken into account:
in strategic and budget planning, defined by Chapter 2 of the Rules;
in internal processes for assessing capital and liquidity adequacy, defined by Chapters 5 and 6 of the Rules;
in forming the bank's organizational structure and remuneration policy, defined by Chapter 4 of the Rules.
An effective risk appetite strategy:
contains a description of the bank's risk profile;
contains a process for disseminating the strategy across all structural subdivisions and is brought to the attention of the bank's employees;
is aimed at introducing a risk culture at all levels of the bank's organizational structure, as well as disseminating the practice of complying with risk appetite levels within the risk culture;
provides protection against the bank taking excessive risks when making decisions;
is the basis for forming a risk appetite statement;
changes in the event of significant changes in market conditions and (or) the level of the bank's financial stability.
Within the framework of the risk appetite strategy, the bank's board of directors forms a risk appetite statement, which establishes the general direction in relation to the risks taken by the bank within the framework of budget planning and the bank's operational activities. An effective risk appetite statement:
is formed taking into account the bank's strategy;
determines for each material type of risk the aggregated level (levels) of risk appetite that the bank accepts in its activities, taking into account the risk profile;
includes quantitative indicators that are used to determine the aggregated level (levels) of risk appetite for each material type of risk;
includes a qualitative statement that describes the grounds for the bank accepting risks, or excluding them, including reputational and (or) other risks, the quantitative assessment of which is not feasible, and also establishes approaches that allow them to be controlled;
implies a forward-looking approach, takes into account the results of stress testing in order to identify potential events leading to a violation of risk appetite levels.
In order to determine risk appetite, the bank's board of directors establishes the aggregated level (levels) of risk appetite and risk appetite levels for each type of material risk.

The applied risk appetite levels meet the following requirements:

have a clear definition;

are relevant;

are measurable;

are calculated on a periodic basis;

information on the actual values of risk appetite levels and their fulfillment is provided to the board of directors and the bank's risk management committee;

are developed taking into account a forward-looking approach.

Effective risk appetite levels:
are set at a level that contributes to the bank's compliance with the aggregated level (levels) of risk appetite;
take into account available capital, liquidity, profitability, development strategy;
take into account all material concentration risks (concentration on a client, on a currency, on country risk, on market segments and other types of concentration);
are based not only on the application of best practices and (or) requirements of the authorized body, but also take into account the material risks inherent in the bank;
are developed using objective and understandable assessments, are unambiguous;
are regularly reviewed for relevance;
take into account reasonable assumptions supported by stress testing results.
The procedure for determining risk appetite levels contains, but is not limited to, the following components:
internal order for calculating and determining quantitative and qualitative parameters characterizing the bank's risk appetite levels;
information and materials, methods and tools used for calculating and determining risk appetite levels;
responsible persons and (or) bank subdivisions involved in calculating and determining the bank's risk appetite levels and responsible for control and monitoring of the established risk appetite levels;
conditions under which adjustments are made to the approved risk appetite levels.

The quantitative methods used in establishing risk appetite levels ensure a high degree of reliability in assessing the level of risks.

Risk appetite levels include the following limits of the risk level:
a level that does not require corrective measures;
a level defined as acceptable, but requiring separate corrective measures in the existing procedures of the risk management system in order to reduce the risk level;
a level defined as high, requiring the application of appropriate measures in order to prevent deterioration of the bank's financial stability and its solvency.

When determining risk appetite, the bank assesses the acceptability of the established risk appetite in the current period of time and how acceptable it will be in the future through stress testing (scenario analysis and sensitivity analysis).

If material risks are identified, the description of which is absent in the risk profile, the bank assesses the risk level, refines the relevant procedures to include such risks in the risk profile, determines the risk appetite level and develops measures to prevent and (or) minimize the identified risk.

The aggregated level (levels) of risk appetite is (are) established and reviewed (reviewed) on a periodic basis. Risk appetite levels for certain types of risk are reviewed during the year when the market situation changes and (or) the requirements of the authorized body change, but within the framework of the aggregated risk appetite level.

Chapter 4. Corporate governance

The main elements of an effective corporate governance system are:
organizational structure;
corporate values;
the bank's activity strategy;
distribution of duties and powers in terms of decision-making between the authorized bodies of the bank;
mechanisms of interaction and cooperation between members of the board of directors, the management board, external and internal auditors of the bank;
risk management procedures and methodologies;
internal control system;
remuneration system;
availability of an adequate management reporting system;
transparency of corporate governance.
The bank's organizational structure corresponds to the chosen business model, scale of activity, types and complexity of operations, minimizes conflicts of interest and distributes risk management powers between collegial bodies and structural subdivisions, including, but not limited to:
the bank's board of directors;
committees under the bank's board of directors;
the bank's management board;
risk management subdivision(s);
compliance control subdivision;
internal audit subdivision.
The main principles and duties of the bank's board of directors include:
- - 1. rational decision-making and acting in the interests of the bank based on a comprehensive assessment of the information provided in good faith, with due care and diligence (duty of care). The duty to exercise care and diligence does not extend to errors in the process of making business decisions, unless the members of the board of directors have shown gross negligence;
    2. making decisions and acting in good faith in the interests of the bank, not taking into account personal benefits, the interests of persons related to the bank by special relations, to the detriment of the bank's interests (duty of loyalty);
    3. active involvement in the bank's activities and awareness of significant changes in the bank's activities and external conditions, as well as making timely decisions aimed at protecting the bank's interests in the long term;
    4. preliminary consideration of the draft corporate governance code and (or) amendments thereto.

Within the framework of the corporate governance code, a procedure for managing conflicts of interest and mechanisms for its implementation, as well as control over execution, are developed. The procedure contains the following components:

mechanism of the procedure for minimizing conflicts of interest in the bank's activities;

approval process that a member of the board of directors undergoes before starting to perform the functions of an official in another organization in order to prevent a conflict of interest;

obligation of members of the board of directors to immediately provide information on any issue that has created a conflict of interest or is a potential cause of its occurrence;

obligation of members of the board of directors to abstain from voting on issues in which a member of the board of directors has a conflict of interest;

mechanism of the board of directors' response to violations of the provisions of the procedure.

Within the framework of the corporate governance code, procedures are developed through which the bank's employees confidentially report violations related to the bank's activities;

- - 1. ensuring compliance of the bank's corporate governance system with the following principles:

compliance with the scale and nature of the bank's activities, its structure, risk profile, business model of the bank;

protection of shareholders' rights, provided for in accordance with civil, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on joint-stock companies and support for the implementation of these rights;

ensuring timely and reliable disclosure of information in accordance with banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan, on currency regulation and currency control, on payments and payment systems, on the securities market, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;

to perform their duties, members of the board of directors have access to complete, up-to-date and timely information;

- - 1. approval of the following internal documents and control over their execution:

the bank's organizational structure;

the bank's development strategy;

the bank's profitability management policy;

stress testing procedures and scenarios;

contingency financing plan;

business continuity management policy;

internal procedure for paying remuneration to the bank's executive employees and bank employees directly subordinate to the bank's board of directors;

HR policy;

remuneration policy;

accounting policy;

tariff policy;

credit policy;

problem assets policy;

the document regulating the main approaches and principles of the internal capital adequacy assessment process (hereinafter – ICAAP);

the document regulating the main approaches and principles of the internal liquidity adequacy assessment process (hereinafter – ILAAP);

policy (policies) for managing information technology risks and information security of the bank;

internal control policy;

credit risk management policy;

market risk management policy;

operational risk management policy;

compliance risk management policy;

policy for managing the risk of legalization (laundering) of proceeds from crime and financing of terrorism (hereinafter – ML/FT);

collateral policy;

liquidity management policy;

internal audit policy, internal auditor's code of ethics, regulation on the internal audit subdivision, internal audit procedures, annual internal audit plan;

policy (procedures) for engaging an external auditor;

approval of the bank's risk appetite strategy and risk appetite levels;
exercising control over compliance with the risk appetite strategy, risk appetite levels and risk management policies;
ensuring the existence of a financial service responsible for accounting and high-quality preparation of financial statements;
preliminary approval of the annual financial statements certified by an audit organization, as well as sending a request for periodic independent audits as necessary;
electing members of the bank's management board, appointing the head of risk management, the head of internal audit and the chief compliance controller;
reviewing reports sent by the audit committee, with subsequent control over the elimination of identified violations;
control over the effective compliance with the bank's procedures through which bank employees confidentially report violations concerning the bank's activities and the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, as well as on abuses;
formation in the bank of three lines of defence:

the first line of defence is provided by the bank's structural subdivisions responsible for the timely identification and assessment of risks, communicating information about them to the subdivisions of the second line of defence, as well as risk management. The first line of defence performs operations within the approved risk appetite levels of the bank and functions within the framework of the adopted risk management policies;

the second line of defence is provided by independent subdivisions for risk management, compliance control and other subdivisions performing control functions (including, within their competence, subdivisions performing security functions, financial control, human resources, legal risk management, operational risk management). The risk management subdivision(s) conducts a comprehensive analysis of risks in the bank's activities, forms the necessary reports to the bank's board of directors and the risk management committee, promotes critical assessment and identification of risks by members of the management board and business subdivisions.

The compliance control subdivision organizes procedures for compliance with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, the legislation of foreign states affecting the bank's activities, as well as the bank's internal documents regulating the procedure for the bank's provision of services and conduct of operations in the financial market, and provides complete and reliable information to the board of directors on the presence of compliance risks;

the third line of defence is provided by an independent internal audit subdivision responsible for assessing the quality and effectiveness of the risk management and internal control system, the first and second lines of defence;

exercising control over the activities of the bank's management board by:

monitoring the implementation by the bank's management board of the strategy and policies approved by the board of directors, decisions of the general meeting of shareholders;

approving internal documents regulating the activities of the bank's management board in accordance with the Rules;

ensuring the implementation of the internal control system;

holding regular meetings with members of the bank's management board;

conducting analysis and critical assessment of information submitted by the management board;

establishing the necessary performance standards and remuneration system for members of the management board that correspond to the long-term goals defined by the bank's strategy and are aimed at financial stability;

1. interaction with and control over the work of the head of risk management;
2. periodic (at least once a year) assessment of the activities of each member of the bank's board of directors;
3. ensuring that records of decisions taken are kept (minutes of meetings, brief information on the issues considered, recommendations, if any, as well as special opinions of members of the bank's board of directors). Such documents and (or) materials are provided to the authorized body upon request in accordance with the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations;
4. ensuring a developed information technology infrastructure for the collection and analysis of complete, reliable, timely information for risk management purposes. Awareness of the existence of information technology infrastructure limitations in determining risk appetite levels;
5. making a decision on granting a loan the amount of which exceeds 5 (five) percent of the bank's own capital based on analysis and assessment of the expediency of granting the loan;
6. making a decision on granting an unsecured consumer loan the amount of which exceeds 20,000,000 (twenty million) tenge based on analysis and assessment of the expediency of granting the bank loan. This paragraph does not apply to cases of granting an unsecured consumer loan when refinancing mortgage loans.

1. The composition of the bank's board of directors and the qualification requirements for its members meet the following requirements:
2. the composition of the bank's board of directors and its powers are sufficient to exercise effective control;
3. the bank's board of directors consists of persons possessing the necessary qualifications, impeccable business reputation and experience, collectively sufficient for the general management of the bank, in accordance with the chosen business model, scale of activity, type and complexity of operations;
4. members of the bank's board of directors are focused on interaction, cooperation and critical discussion in the decision-making process;
5. members of the bank's board of directors conscientiously perform their duties and make decisions, minimize conflicts of interest.
6. In order to improve efficiency and conduct more detailed work on certain areas of the bank's activities and based on the chosen business model, scale of activity, types and complexity of operations, risk profile, the bank's board of directors creates special committees under the bank's board of directors.

Each committee carries out its activities within the framework of a document defining its powers, competence, as well as principles of work, internal procedure for submitting reports to the bank's board of directors, tasks facing committee members and restrictions on the terms of work of members of the bank's board of directors in the committee. The bank's board of directors provides for periodic rotation of members (except experts) of such committees in order to avoid concentration of powers and promote the advancement of new views.

Committees keep records of decisions taken (minutes of meetings, brief information on the issues considered, recommendations, if any, as well as special opinions of committee members). The chairman of a committee under the board of directors is a member of the board of directors who is not the head or a member of the executive body.

Within the framework of the risk management system, the bank's board of directors committees consider the following issues:
strategic planning;
personnel and remuneration;
audit;
risk management;
other issues provided for by the bank's internal documents.

Consideration of the listed issues is carried out by one or several committees of the bank's board of directors, except for audit issues considered by a separate committee of the board of directors.

Main requirements for the composition of the audit committee:
the audit committee consists exclusively of members of the bank's board of directors;
the chairman of the audit committee is an independent director of the bank;
the audit committee includes at least one member of the bank's board of directors with work experience in the field of audit and (or) accounting and financial reporting and (or) risk management.
The audit committee is responsible for:
ensuring the development of the internal audit policy, the code of ethics of the internal auditor, the regulation on the internal audit subdivision, procedures for conducting internal audit and the management information system in accordance with the requirements established by Chapter 12 of the Rules for further submission for approval to the bank's board of directors;
interaction with the external auditor on the quality of information provided on the bank's activities, consideration of recommendations of external auditors, control over the elimination of identified comments, as well as consideration of the annual financial statements certified by the audit organization for further submission for preliminary approval by the bank's board of directors;
ensuring the development of a policy (procedures) for engaging an external auditor for further submission for approval to the bank's board of directors, including determination of:

criteria and conditions for selecting an external auditor;

system of payment for financial statement audit services, as well as for the provision of consulting services to the bank on audit issues;

consideration of the amount of payment for external auditor services;
preliminary consideration of the annual internal audit plan;
preliminary consideration of reports on the results of internal and external audit, control over the timely implementation by the bank's management board of actions to eliminate violations and implement recommendations of internal and external audit, inconsistencies of activities with the bank's policies, requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, and international financial reporting standards;
consideration of inspection acts of the authorized body and conclusions of other experts regarding the structure and effectiveness of the overall risk management and internal control system in the bank;

8) consideration of the results of assessing the effectiveness of internal audit activities.

Main requirements for the composition of the risk management committee:
the chairman of the risk management committee is an independent director of the bank, or the chairman of the board of directors;
the composition includes at least one member of the bank's committee with work experience in the field of risk management or internal control.
The risk management committee is responsible for:
ensuring the development of the risk appetite strategy, determination of the bank's risk profile;
determining the sizes of the aggregated risk appetite level(s) of the bank and the bank's risk appetite levels for each significant type of risk for further submission for approval to the bank's board of directors;
ensuring the development of a document regulating the main approaches and principles of ICAAP taking into account the requirements established by Chapter 5 of the Rules, for further submission for approval to the bank's board of directors and for monitoring the bank's compliance with the approved document;
ensuring the development of a document regulating the main approaches and principles of ILAAP taking into account the requirements established by Chapter 6 of the Rules, for further submission for approval to the bank's board of directors and for monitoring the bank's compliance with the approved document;
ensuring the development of stress testing procedures and stress testing scenarios for further submission for approval to the bank's board of directors;
ensuring the development of the bank's business continuity management policy taking into account the requirements established by Chapter 7 of the Rules, for further submission for approval to the bank's board of directors and for monitoring the bank's compliance with the policy specified in this subparagraph;
ensuring the development of a contingency financing plan for further submission for approval to the bank's board of directors;
ensuring the development of the bank's information technology and information security risk management policy (policies) taking into account the requirements established by Chapter 8 of the Rules, for further submission for approval to the bank's board of directors and for monitoring the bank's compliance with the policy (policies) specified in this subparagraph;
ensuring the development of the compliance risk management policy taking into account the requirements established by Chapter 9 of the Rules, for further submission for approval to the bank's board of directors and for monitoring the bank's compliance with the policy specified in this subparagraph;
ensuring the development of an internal procedure defining the functioning of the management information system that ensures the provision on a regular basis to the bank's board of directors of complete, reliable and timely information on the level of risks taken. The procedure specified in this subparagraph includes criteria, composition, frequency of formation and forms of providing to the bank's board of directors management information on the level of risks taken by the bank and subsidiary organizations, indicating the structural subdivisions and bank bodies responsible for the timely preparation and communication of information to the bank's board of directors. The management reporting forms contain information taking into account the requirements established by Chapters 5, 6, 7, 8 and 9 of the Rules, as well as information:

on the results of stress testing and other tools for assessing and identifying the interconnectedness of banking risks among themselves;

on assessing the impact of risks on the bank's financial condition, including assessing changes in the bank's income and expenses, assessing the size and sufficiency of own capital, identifying the main factors and causes that caused changes and affect the main performance indicators;

exercising control over the bank's management board's compliance with risk appetite levels;
the availability of internal models and information systems for managing the bank's risks, as well as for the purpose of ensuring complete, reliable and timely financial, regulatory and management information;
consideration of the results of assessing the quality and effectiveness of the functioning of the risk management and internal control system, corporate governance as a whole, aimed at ensuring the protection of the bank and its reputation for further submission for approval to the bank's board of directors.

The risk management committee regularly receives from the risk management subdivision(s) and other responsible subdivisions data and reports on the current level of the bank's risks, violations of risk appetite levels and mechanisms for reducing the level of risks.

Main requirements for the composition of the personnel and remuneration committee:
the chairman of the personnel and remuneration committee is an independent member of the bank's board of directors;
the personnel and remuneration committee includes at least one committee member with work experience in the field of personnel management.
The personnel and remuneration committee is responsible for ensuring the development of:
taking into account the minimization of conflicts of interest, a draft organizational structure of the bank for further approval by the bank's board of directors;
procedures for managing conflicts of interest and mechanisms for its implementation for further approval by the relevant bank body;
a policy on remuneration, accrual of monetary remuneration, as well as other types of material incentives for the bank's managerial employees for further submission for approval to the bank's board of directors in accordance with Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 24 February 2012 No. 74 "On Establishing Requirements for the Internal Policy on Remuneration, Accrual of Monetary Remuneration, as well as Other Types of Material Incentives for Managerial Employees of Second-Tier Banks, Insurance (Reinsurance) Organizations and the Form of Reporting on Income Paid to All Managerial Employees of Second-Tier Banks and Insurance (Reinsurance) Organizations", registered in the Register of State Registration of Normative Legal Acts under No. 7525.

The amount of remuneration directly depends on the ratio of risk to result. Methods of paying remuneration against future income, the term and probability of receipt of which are uncertain, are carefully weighed on the basis of adopted qualitative and quantitative indicators. The remuneration system provides for the possibility of changing the amount of non-fixed remuneration taking into account all risks, including violations of risk appetite limits, internal procedures or requirements of the authorized body.

Main requirements for the composition of the strategic planning committee:
the chairman of the strategic planning committee is an independent member of the bank's board of directors;
the strategic planning committee includes at least one committee member with work experience in one of the following fields:

information technology development;

development and provision of banking services;

risk management;

budget planning.

The Committee on Strategic Planning Issues is responsible for the preliminary review of:
the draft bank strategy for its further submission for approval to the bank's board of directors, as well as for monitoring the implementation of the strategy and assessing the compliance of the bank's strategy with the current market and economic situation, the risk profile and financial potential, as well as the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;
the draft bank budget for the corresponding year for its further submission for approval to the bank's board of directors, as well as for exercising control over its implementation;
the draft bank profitability management policy for its further submission for approval to the bank's board of directors, as well as for monitoring and controlling the bank's and its employees' compliance with said policy;
documents submitted for consideration to the bank's board of directors containing information on the progress of implementation of the strategy, development plans, achievement of target values of strategic key performance indicators of the bank.
The bank's management board manages the current activities of the bank in accordance with the chosen business model, scale of activity, types and complexity of operations, risk profile, and internal documents approved by the bank's board of directors. The bank's management board is responsible for:
ensuring the implementation of the bank's strategy, compliance with the procedures, processes and policies approved by the bank's board of directors;
developing the draft bank strategy for its further submission for approval to the bank's board of directors, as well as for monitoring the implementation of the strategy and assessing the compliance of the bank's strategy with the current market and economic situation, the risk profile and financial potential, as well as the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;
developing the draft bank budget for the corresponding year for its further submission for approval to the bank's board of directors;
developing the draft bank profitability management policy for its further submission for approval to the bank's board of directors, as well as for monitoring the bank's and its employees' compliance with said policy;
developing an internal procedure defining the communication of the strategy, policies and other internal documents of the bank within 10 (ten) working days from the day of approval and (or) introduction of amendments and additions thereto to the bank's employees in the areas of activity assigned to them, and for monitoring the bank's and its employees' compliance with the requirements of the Rules;
developing the bank's HR policy for its further approval by the board of directors, as well as for monitoring its compliance with the strategy, organizational structure, risk profile of the bank, achieved results and the requirements of the labor, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on joint-stock companies. The HR policy establishes standards, conditions and mechanisms ensuring the involvement of competent managerial employees in banking activities and ensures:

the availability of personnel possessing the necessary experience, qualifications and impeccable business reputation, capable of managing the processes and risks associated with the bank's activities;

maintaining a sufficient amount of resources for the effective performance of functions and duties;

minimizing conflicts of interest in the performance of their duties;

minimizing the risk of concentration of powers in one employee;

internal procedure for remuneration of employees, including the procedure for payment of remuneration, as well as other types of material incentives;

conducting an assessment of the performance of the bank's employees;

developing the tariff policy for its further submission for approval to the board of directors, as well as for monitoring the bank's and its employees' compliance with the tariff policy;
developing the bank's credit policy for its further submission for consideration to the risk management committee and for approval to the bank's board of directors;
approving the plan(s) for ensuring continuity and (or) recovery of activities;
providing the bank's board of directors with the necessary information for monitoring and assessing the quality of the management board's work in accordance with the internal documents of the bank and the Rules, which includes:

the management board's achievement of the goals set in the bank's strategy, indicating, if any, the reasons preventing their achievement;

the compliance of the bank's activities with the strategy and policies approved by the bank's board of directors;

the results of the bank's activities and its financial position, including the stability (volatility) of the bank's profitability;

the non-compliance of the bank's decisions with the procedures, processes and policies approved by the bank's board of directors;

exceeding the approved risk appetite levels and the reasons for their violation;

information on the timeliness, completeness and quality of the management board's elimination of violations and deficiencies identified by compliance control, risk management, internal control, internal audit units, and external audit and the authorized body, as well as the implementation of their recommendations;

information on the state of internal control, in terms of timely identification of incorrect, incomplete or unauthorized operations, deficiencies in activities to ensure the safety of assets, errors in the formation of financial and regulatory reporting, violations of the bank's internal documents, requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, as well as the exclusion of conflicts of interest and internal abuses and fraud, including in relation to persons connected with the bank by special relations;

developing an internal procedure for considering client appeals arising in the process of providing banking services, as well as for monitoring the bank's compliance with the requirements specified in this subparagraph. The internal procedure for considering client appeals takes into account the requirements of the legislation of the Republic of Kazakhstan on the procedure for considering appeals of individuals and legal entities, the banking legislation of the Republic of Kazakhstan and determines:

procedures for record-keeping on complaints (applications) of clients, including the receipt, initial processing, registration of appeals received by the bank, and responses to client appeals;

the bank's structural unit responsible for record-keeping on client appeals;

procedures for communicating (transferring) received appeals to the responsible structural units or employees who will be tasked with processing and preparing a response to the client's appeal;

the timeframes for timely processing of client appeals and preparation of responses to client appeals;

the internal procedure for interaction of the bank's structural units when considering client appeals and preparing responses to client appeals;

the internal procedure and procedures for maintaining a classifier of received client appeals of the bank;

developing the procedure and (or) internal order for refusing to conduct high-risk operations, including operations with values created and accounted for in a decentralized information system using cryptography and (or) computer calculations, which, in accordance with the civil legislation of the Republic of Kazakhstan, are not financial instruments or financial assets and do not contain a right of claim against anyone, as well as terminating business relations with a client, are developed taking into account the inherent risk factors.

The bank's management board is responsible for the proper performance of duties delegated to collegial bodies or employees of the bank within the framework of the approved organizational structure of the bank.

The bank's board of directors ensures the presence of a risk management unit(s), supervised and (or) headed by the head of risk management, possessing sufficient powers, independence and resources, interacting with the board of directors. The risk management unit(s) performs (perform), but is not limited to, the following functions:
development of a risk management system, including risk management policies and procedures, risk appetite strategy and determination of risk appetite levels;
identification of material current and potential risks inherent in the bank's activities;
risk assessment and determination of the aggregated risk appetite level(s);
development, for subsequent submission for consideration to the risk management committee and approval by the bank's board of directors, of risk appetite levels, monitoring of compliance with risk appetite levels;
development of early warning systems and triggers aimed at identifying violations of risk appetite levels;
provision of management reporting to the management board, the risk management committee and the bank's board of directors.
The qualifications and professional experience of the head of risk management correspond to the chosen business model, scale of activity, types and complexity of operations, risk profile. The independence of the head of risk management is determined by:
regardless of subordination, the head of risk management is appointed and dismissed by the bank's board of directors;
has unhindered access to the bank's board of directors, without the participation of the management board;
has access to any information necessary for the performance of his duties;
does not combine the position of chief operating officer, financial director, other similar functions of the bank's operational activities (except for underwriting, collateral service), head of the internal audit unit.

Interaction between the head of risk management and the board of directors and (or) the risk management committee is carried out on a regular basis. Information on the decision taken to dismiss the head of risk management is communicated to the authorized body. At the request of the authorized body, the bank's board of directors provides the rationale for the reasons for such a decision.

Identification, measurement, monitoring and control of risks are carried out on an ongoing basis at all levels of the bank's management. Improvement of the risk management and internal control system is carried out in accordance with changes in the bank's risk profile, as well as taking into account changes in the external environment.

The bank identifies all material risks inherent in the bank's activities (including risks on balance sheet and off-balance sheet operations, by groups, portfolios and certain types of activities of business units). In order to effectively manage material risks, the bank's board of directors, the risk management committee and the head of risk management carry out regular assessment of the risks inherent in the bank's activities, as well as maintaining the relevance of the bank's risk profile. The risk assessment procedure includes continuous analysis of current risks, as well as identification of new and potential risks. When assessing risks, the bank takes into account the degree of concentration of material risks.

When identifying and measuring risks, both quantitative and qualitative parameters are taken into account. The bank also takes into account risks that are difficult to assess, for example, reputational and legal risks.

In addition to identifying and measuring risk exposure, the risk management unit assesses possible ways to mitigate risks and indicates the need to reduce the risk level. In cases where a decision is made to accept a risk exceeding the established risk appetite levels, the head of risk management submits a report on such exception to the board of directors with a proper analysis of the reasons for the excess and subsequently monitors the reduction of the accepted risk level within the framework of the risk management system and the established level for it.

The head of risk management informs the bank's board of directors of the existence of material discrepancies between the opinion of the risk management unit and the decision of the bank's management board regarding the level of risks accepted by the bank.

Regular communication on risk-related issues, including risk management policies and procedures, within the bank is a key factor of a high risk management culture. The risk management culture promotes a full exchange of information on risks and encourages open discussion and critical assessment of issues related to risk-taking by employees, the management board and the bank's board of directors.

Significant information on risk-related issues requiring immediate decision-making or urgent measures is promptly communicated to the bank's board of directors, the risk management committee and, if necessary, the bank's management board, responsible officials and heads of control units, for taking preventive measures.

The bank excludes the creation of closed groups within individual units that impede the effective exchange of information on risks and lead to decisions by the bank's authorized bodies without taking into account the opinion (expertise) of the bank's involved units. To overcome problems related to information exchange, the board of directors, management board and control units of the bank ensure the effectiveness of the internal communication system and, if necessary, make appropriate changes.

The bank ensures the presence of an internal control system that corresponds to the current market situation, strategy, volume of assets, level of complexity of the bank's operations. The internal control system is aimed at achieving the following goals:
ensuring the efficiency of the bank's activities, including the efficiency of risk, asset and liability management, ensuring the safety of assets;
ensuring the completeness, reliability and timeliness of financial, regulatory and other reporting for internal and external users;
ensuring information security;
ensuring the bank's compliance with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, the bank's internal documents.

Within the framework of internal control, checks are carried out of the bank's processes for carrying out activities for compliance with internal policies and procedures, as well as the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on compulsory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies. The bank has reliable internal and external information for the purposes of risk management, making strategic business decisions and determining the sufficiency of its own capital and liquidity. The bank's board of directors and the relevant committees of the bank's board of directors make decisions related to risk-taking on the basis of qualitative, up-to-date and reliable data.

Risk measurement and modeling methods are used in addition to qualitative analysis and risk monitoring. The head of risk management informs the bank's board of directors and the risk management committee about the methods used and potential shortcomings of risk management models and analytical approaches in the bank.

Chapter 5. Internal Capital Adequacy Assessment Process

The bank's board of directors approves the bank's internal document regulating the main approaches and principles of the ICAAP and containing the following sections:
1. description of the organizational structure of the ICAAP;
2. description of the risk appetite strategy;
3. organization of management of credit, market, operational risks within the framework of the ICAAP;
4. organization of stress testing procedures;
5. organization of risk management procedures within the framework of new products and types of activities;
6. organization of self-assessment procedures for the internal capital adequacy assessment process.
The ICAAP is an integral part of the bank's management and is created for the purposes of:
1. identifying, assessing, aggregating and controlling material types of risk inherent in the bank's activities, in order to determine the necessary level of capital sufficient to cover them, including:

credit risk;

market risk;

operational risk;

as well as other risks to which the bank is exposed;

1. capital planning based on the bank's strategy, the results of a comprehensive assessment of material risks, stress testing of the bank's financial stability in relation to internal and external risk factors, as well as the requirements for the sufficiency of the bank's own capital established by Article 42 of the Law on Banks.

The description of the organizational structure of the ICAAP contains a list of ICAAP participants indicating the responsibility of the bank's collegial bodies and units involved in the implementation of capital adequacy management processes, including:
the bank's board of directors is responsible for managing capital adequacy for risk management purposes and determining the risk appetite level(s). The bank's board of directors approves the ICAAP compliance report, including information on maintaining the necessary level of capital adequacy;
the risk management committee is responsible for developing risk management policies and procedures in the field of capital management within the risk appetite level established by the bank's board of directors. The risk management committee periodically notifies the bank's board of directors of material changes in the capital level;
the unit(s) of the person(s) entrusted with internal control functions carries out (carry out) verification of compliance with the ICAAP procedures and communicates (communicate) the results to the bank's board of directors;
the unit(s) involved in the risk management process is (are) responsible for the implementation of the capital adequacy management process and is (are) responsible for preparing the ICAAP compliance report and conducting stress testing;
the unit responsible for budget development and planning carries out investment planning and budget development in all areas of the bank's activities;
the capital management unit(s) develops (develop) and implements (implement) measures to increase the capitalization level and develops (develop), jointly with interested units, a contingency financing plan;
the internal audit unit assesses the effectiveness of the ICAAP.

Within the framework of the ICAAP, the bank's board of directors is responsible for compliance with the approved risk appetite strategy developed in accordance with Chapter 3 of the Rules.

The bank ensures the presence of an effective credit risk management system that corresponds to the current market situation, strategy, volume of assets, level of complexity of the bank's operations and ensures effective identification, measurement, monitoring and control of the bank's credit risk in order to ensure the sufficiency of its own capital to cover it, and including, but not limited to, the following components:
internal procedure for carrying out operations inherent in credit risk and making appropriate decisions;
credit administration procedures;
credit risk assessment procedures;
credit monitoring;
collateral management;
management of problem loans;
assessment of the effectiveness of the credit risk management system.
Within the framework of the credit risk management system, the bank is guided by the following principles and requirements:
the board of directors and the bank's risk management committee ensure:

maintaining a sufficient level of provisions;

exercising control over the credit risk assessment process, which is ensured by the following:

taking necessary measures to ensure the completeness and reliability of information for the purpose of making decisions;

compliance with the requirements of the civil, tax, and banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on accounting and financial reporting, on credit bureaus and the formation of credit histories, internal policies and procedures for credit risk management;

taking measures to ensure complete and reliable management, regulatory, and financial reporting;

the existence of a procedure for assessing loans that is independent of business units;

approval of an adequate system for classifying assets by credit risk level, based on the use of all available information in the loan assessment process;

the existence of interaction procedures between participants in the credit risk management process that are regulated in detail and in full;

building an effective internal control system, including assessment of the conformity of the level of provisions with expected losses within the framework of the approved provisioning methodology and the internal capital adequacy assessment process;

the bank carries out credit activity and credit risk management within the framework of the approved credit policy, which includes, but is not limited to, the following:

the main directions of the bank's credit activity;

participants in the credit process and their areas of responsibility;

the internal procedure for making credit decisions, including the procedure for reviewing and approving loans, including with respect to lending to persons related to the bank by special relationships, and lending limits for the purpose of limiting credit risk concentration;

the procedure for analyzing the borrower's creditworthiness.

If the aggregate amount of loans granted and contingent obligations assumed to an individual exceeds 0.01 (zero point zero one) percent of the bank's equity, the size of which is above 100 (one hundred) billion tenge, or exceeds 0.02 (zero point zero two) percent of the bank's equity, the size of which is up to 100 (one hundred) billion tenge, the bank performs a creditworthiness analysis on the basis of the following information and taking into account the following factors (but not limited to them):

the borrower's possession of a permanent and sufficient income;

the possession of real estate and other property;

the existence of loan indebtedness, including to other creditors;

debt burden;

payment discipline (credit history) on loans;

the borrower's rating in the bank's scoring systems (if any);

the existence of other indebtedness;

the existence of other sources of repayment of indebtedness to the bank;

balances and transactions on bank accounts;

information on education and employment (field of activity);

socio-demographic characteristics;

information on the intended use of money;

additional information on the borrower's income.

If the aggregate amount of loans granted and contingent obligations assumed to an individual does not exceed 0.01 (zero point zero one) percent of the bank's equity, the size of which is above 100 (one hundred) billion tenge, or exceeds 0.02 (zero point zero two) percent of the bank's equity, the size of which is up to 100 (one hundred) billion tenge, the bank performs a creditworthiness analysis on the basis of the following information and taking into account the following factors (but not limited to them):

the borrower's possession of a permanent and sufficient income;

the existence of loan indebtedness, including to other creditors;

debt burden;

payment discipline (credit history) on loans;

the borrower's rating in the bank's scoring systems (if any);

the existence of other sources of repayment of indebtedness to the bank;

balances and transactions on bank accounts;

information on education and employment;

socio-demographic characteristics;

information on the intended use of money (if any).

If the aggregate amount of loans granted and contingent obligations to a legal entity exceeds 0.1 (zero point one) percent of the bank's equity, the size of which is above 100 (one hundred) billion tenge, or exceeds 0.2 (zero point one) of the bank's equity, the size of which is up to 100 (one hundred) billion tenge, the bank performs a creditworthiness analysis on the basis of the following information and taking into account the following factors (but not limited to them):

analysis of financial statements and main financial ratios of borrower legal entities (profitability, ratio of own and borrowed funds, cash inflow plan) and income level;

the existence of loan indebtedness, including to other creditors;

payment discipline (credit history) on loans;

the level of liquid assets;

debt burden;

the existence of other sources of repayment of indebtedness to the bank;

projected free cash flows;

assessment of the borrower's external environment (state of the economy, industry, development prospects, diversification of production and sales markets, and characteristics of the borrower's operating activity, such as the borrower's market share in the relevant market, positioning of the borrower's product, geography of operations, cyclicality of the business, changes in consumer preferences, changes in technology, barriers to entry into the economic sector, and other factors affecting the company's ability to generate income and maintain prices);

assessment of the quality of management (experience, competence, business reputation);

assessment of the borrower's owners;

the existence of facts of involvement in court proceedings;

inclusion in the list of unreliable taxpayers.

If the aggregate amount of loans granted and contingent obligations to a legal entity does not exceed 0.1 (zero point one) percent of the bank's equity, the size of which is above 100 (one hundred) billion tenge, or exceeds 0.2 (zero point one) of the bank's equity, the size of which is up to 100 (one hundred) billion tenge, the bank performs a creditworthiness analysis on the basis of the following information and taking into account the following factors (but not limited to them):

the borrower's possession of a permanent and sufficient income;

the existence of loan indebtedness, including to other creditors;

payment discipline (credit history) on loans;

debt burden;

the existence of other sources of repayment of indebtedness to the bank;

the development prospects of the relevant industry.

Depending on the lending industry and the type of borrower, the set of quantitative and qualitative indicators changes.

With respect to individuals and legal entities, the credit policy determines the cases (issuance of bank guarantees, letters of credit, bank guarantees issued under a bank counter-guarantee, as well as loans secured by highly liquid assets) in which the borrower's creditworthiness analysis is not applied. For banks that are subsidiary organizations of non-resident banks of the Republic of Kazakhstan having a long-term foreign currency credit rating of not lower than "A-" on the international scale of Standard & Poor's agency or a rating of an equivalent level from one of the other rating agencies, it is permitted to use a creditworthiness analysis at the level of the borrower's parent organization or the organization that includes the borrower in consolidated financial statements, conducted by the parent bank or a person affiliated with the bank, provided that the analysis was carried out no later than 12 months from the date of the borrower's application;

the internal procedure for making credit decisions with respect to loan restructuring in connection with the borrower's financial difficulties, which is based on the principles of justification, expediency, and independence when making a decision to carry out restructuring and includes a description of the cases and conditions for loan restructuring. At the same time, the bank defines the following cases of changing the terms of a bank loan agreement in connection with the borrower's financial difficulties as restructuring:

change in the loan payment schedule, including the subsequent granting or extension of a grace period for loan payments for repayment of principal and (or) remuneration;

subsequent extension of the loan term;

deferral of one or more loan payments in aggregate for a period of more than 30 (thirty) calendar days;

forgiveness of part of the principal and (or) remuneration on the loan;

capitalization of payments on remuneration overdue in aggregate for more than 30 (thirty) calendar days;

change (conversion) of the loan currency from one currency to another with capitalization of overdue indebtedness on remuneration and (or) fixing the exchange rate on loans in foreign currency;

granting a new loan to pay overdue indebtedness on a loan at the bank, including at other financial organizations;

increase in the credit limit in the case of indebtedness on the loan overdue in aggregate for more than 30 (thirty) calendar days;

reduction of the remuneration rate on the loan, except for a change in the size of the base indicator on a loan with a floating remuneration rate;

reduction of indebtedness on the loan as a result of repayment of the amount of indebtedness at the expense of the borrower's collateral property transferred to the financial organization.

The bank makes a decision on restructuring loans for borrowers having financial difficulties taking into account the existence of prospects for loan repayment after restructuring.

The decision to carry out loan restructuring (for borrowers and (or) a group of interrelated borrowers having financial difficulties, whose total indebtedness, including contingent obligations, exceeds 1 (one) percent of the bank's equity, the size of which is above 100 (one hundred) billion tenge, or 2 (two) percent of the bank's equity, the size of which is up to 100 (one hundred) billion tenge) is made by the bank's management board or an authorized collegial body of the bank, which includes the chairman of the bank's management board. Information on decisions made is sent on a quarterly basis to members of the bank's board of directors;

acceptable credit risk management methods, taking into account (but not limited to) the following factors:

one's own knowledge and experience in using the method;

economic efficiency;

the type of borrower and (or) counterparties, their financial condition;

the complexity and degree of risk inherent in a particular type of lending;

the bank carries out credit activity in accordance with internal documents regulating the performance of operations inherent in credit risk, which includes, but is not limited to, the following:

the conditions for granting loans to individuals and legal entities (including persons related to the bank by special relationships and bank employees) for each type of lending, including requirements for potential borrowers and (or) counterparties;

requirements for information of the borrower and (or) counterparty, including financial and other information necessary for making a decision on granting a loan;

the internal procedure for corporate lending, providing for analysis of the lending sector, the borrower's credit history, as well as a rating system based on quantitative and qualitative factors enabling a detailed assessment of loan quality;

the methodology of credit scoring or analysis of the borrower's solvency and creditworthiness, based on quantitative and qualitative characteristics, and the internal procedure for its use;

establishment of the minimum acceptable rating level (if any) at which a loan is granted;

the internal procedure and procedures for approval, authorization, analysis, and monitoring of deviations from the credit policy, standards, procedures, and limits;

establishment of lending limits and (or) remuneration rates on loans taking into account analysis of borrowers, including taking into account, if any, ratings and (or) scoring assessment of borrowers. Lending limits, including on unsecured loans, are established by currencies, industries, categories of borrowers (counterparties) (financial organizations, corporate, retail lending), products, groups of related parties, and per borrower;

the internal procedure for reviewing and approving applications for loans, making decisions on granting (refusing to grant), including with respect to lending to persons related to the bank by special relationships;

the internal procedure with respect to collateral, defining:

types of collateral and criteria for their acceptability;

requirements for the collateral structure;

limits by types of collateral;

the share of highly liquid collateral in the overall structure of security, the coefficient characterizing the ratio of the loan amount to the collateral value;

procedures ensuring the legal validity of collateral;

prompt assessment of the sufficiency of collateral, taking into account changes in the borrower's production activity indicators, the value and preservation of the collateral, including its exposure to other circumstances materially affecting its valuation;

procedures for the sale of collateral, including maximum sale periods;

the objectivity (adequacy) of the collateral valuation by appraisers.

When making a decision to grant a loan secured by immovable property, the bank considers the results of the appraisal. In the case where the market value determined as of the date of the last appraisal by the appraiser amounts to more than 100,000 (one hundred thousand) monthly calculation indices, the bank ensures (at least once a year) an appraisal of the collateral by an appraiser.

Assessment of decisions made for compliance with the established internal procedure is carried out in accordance with the requirements of Chapter 11 of the Rules. In the event of detection of deviations from the established internal procedure, the interested units bring information on the detected deviations to the bank's board of directors. In order to exclude material deviations in the bank's activity, the board of directors establishes restrictions on the volume (loan amount) and (or) on the number of deviations and exercises control over compliance with the established restrictions;

the existence of an adequate rating model and (or) scoring system.

The bank's board of directors determines the units responsible for the development of the rating model and (or) scoring system, their implementation, application, and control over their functioning. The rating model and (or) scoring system contain a description of each credit risk level and the conditions for their assignment. In the process of assigning a borrower's credit rating and (or) scoring score, the bank takes into account the financial condition of the borrower(s) and other available information on the borrower.

When assigning a borrower's credit rating and (or) scoring score, the bank is guided by current available information on factors affecting the borrower's future creditworthiness and solvency.

The credit rating assigned to legal entities is subject to periodic monitoring for relevance. The frequency of review increases in the case of negative information carrying the risk of deterioration of the borrower's financial condition and (or) impossibility of repaying obligations to the bank and other available information;

the existence of an adequate system for classifying assets by credit risk level.

Within the framework of the asset classification system by credit risk level, the bank implements and uses comprehensive procedures and information systems (in their absence, software) for monitoring the quality of the credit portfolio. The procedures and information systems include criteria that identify and detect problem loans and ensure proper control.

The asset classification system by credit risk level ensures the provision of information to the board of directors, committees under the board of directors, the management board, and other bank units participating in the credit risk management process and allows assessing the bank's credit risk level both for the balance sheet as a whole and in the context of each asset.

The asset classification system by credit risk level is based on a detailed analysis of all assets (except receivables from non-core activities in an amount not exceeding 2 (two) percent of the bank's equity) inherent in credit risk.

The detailed analysis of assets includes assessment of:

the probability of default on the obligations of the borrower and (or) counterparty (PD);

the amount of losses in the event of default of the borrower and (or) counterparty (LGD);

the amount of obligations exposed to default (EAD);

the term during which the risk position is maintained;

the value of collateral and the possibility of its sale;

the business environment and economic conditions.

Classification of assets (except receivables from non-core activities in an amount not exceeding 2 (two) percent of the bank's equity) inherent in credit risk is carried out on the basis of at least 5 (five) categories and ensures:

reliable assessment of capital adequacy within the framework of ICAAP;

the necessary level of provisions to cover expected losses.

Assets for which there is overdue indebtedness on principal and (or) accrued remuneration for a period of more than 90 (ninety) calendar days are classified into the worst categories, unless there are strong and justified grounds for classification into a higher category.

Assets for which there is overdue indebtedness on principal and (or) accrued remuneration for a period of less than 90 (ninety) calendar days are classified into the worst category if there are other factors of the borrower's insolvency determined by internal documents;

the existence of a problem asset management policy.

The bank's board of directors approves the problem asset management policy, which contains:

the definition of problem assets;

methods of problem asset management (restructuring, sale, write-off, seizure of collateral, bankruptcy, and others);

limits with respect to problem assets (by portfolios) and deadlines for implementing the approved problem asset management methods to bring them into compliance with the established limits when they are breached;

quantitative and qualitative parameters for early response to the risk of an increase in the volume of problem assets;

a list of interested units and the internal procedure for their interaction when working with problem assets;

the internal procedure for providing management reporting to the board of directors on the level of problem assets;

procedures for assessing the problem asset management methods used by the bank;

the existence of a reliable provisioning methodology.

In order to ensure the sufficiency of provisions formed to cover expected losses, the bank annually (or more often if necessary) conducts an analysis of the provisioning methodology by:

determining the conformity of provisions calculated according to the requirements of the provisioning methodology with actual amounts of losses;

analyzing current market conditions and changes in macroeconomic indicators;

validating the provisioning methodology.

When forming provisions for collective loans, the bank analyzes historical data covering the necessary period of time and most correctly reflecting the bank's credit losses. At the same time, historical data are supplemented by analysis of the current market and economic situation.

If the provisioning methodology indicates the absence of signs of increased credit risk on loans for which provisions are formed on an individual basis, such loans are subject to assessment of the credit risk level on a collective basis;

the existence of a procedure for validating credit risk assessment models.

In order to ensure the adequacy of credit risk assessment using models, the bank regulates the processes of their validation, back-testing, and permissible levels of deviation from the planned risk level. In the event of deviation from the planned risk level, the bank develops a corrective action plan.

Validation is carried out through one or more of the following methods:

checking the discriminatory power of the model;

assessing the predictive accuracy of the model;

analyzing rating migration;

comparative analysis of ratings.

Validation is carried out at least once every 4 (four) years. The frequency of validation depends on the current market situation, strategy, volume of assets, and level of complexity of the bank's operations, and increases in the event of significant changes in the economy or in the bank's internal lending processes. The validation results are provided to the risk management committee;

application of adequate and justified expert judgments in carrying out credit risk assessment.

In situations where the use of expert judgments is necessary, the bank ensures:

a regulated process for the use of expert judgments, indicating the limits for the use of such judgments;

a sufficient level of competence of employees conducting the expert judgment;

a uniform approach in the application of expert judgments. Under identical conditions, expert judgments do not have significant deviations;

expert judgment is carried out on the basis of justified and documented assumptions, with the application of due prudence.

The bank's application of expert judgments taking into account historical data is supplemented by analysis of the current market and economic situation, in particular (as applicable):

changes in lending processes, standards, and practices of decision-making, repayments, and write-offs;

changes in external and internal economic factors and the business environment, taking into account dynamics;

changes in the level of non-performing and restructured loans;

the emergence of new market segments and products;

changes in credit risk concentration;

the existence of the necessary tools, including a set of data storage tools ensuring complete and reliable information on loans (including receivables and contingent obligations), as well as other operations inherent in credit risk, which allow correctly assessing the credit risk level.

The bank carries out credit administration in accordance with procedures that include, but are not limited to, the following:

verification of the conformity of the submitted credit documents with the terms of granting loans;

verification of the conformity of loan agreements with the decisions made;

formation and maintenance of the credit file.

Formation of the credit file (part of the credit file) in electronic form is permitted. The credit file contains (including, but not limited to):

borrower identification documents:

this group includes documents proving the identity of an individual, documents related to the formation of a legal entity (with disclosure of ultimate individual owners owning directly or indirectly ten or more percent of shares or participation interests, except in cases established by paragraph 3 of Article 8-1 of the Law on Banks), confirmation of its legal personality, as well as documents confirming the powers of persons acting on behalf of the borrower and authorized to sign credit and collateral documentation on behalf of the borrower.

Documentation relating to the determination of intended use (except for overdrafts, consumer loans without confirmation of intended use with an aggregate amount of less than 0.2 (zero point two) percent of the bank's equity, and loans for the purpose of replenishing working capital with an aggregate amount of less than 0.2 (zero point two) percent of the bank's equity, syndicated loans with the participation of non-resident banks of the Republic of Kazakhstan):

This group includes documents and information on the transaction for the purpose of which financing is requested (including the initial financing purposes in the case of restructuring and (or) refinancing), including for large borrowers:

documents confirming the purpose of the loan, including for legal entities – supply contracts, purchase and sale contracts, foreign trade contracts;

for a legal entity whose amount of loans and contingent liabilities exceeds, for banks whose own capital exceeds 100 (one hundred) billion tenge – 0.1 (zero point one tenth) percent of the bank's own capital, for banks whose own capital does not exceed 100 (one hundred) billion tenge – 0.2 (zero point two tenths) percent of the bank's own capital – a feasibility study for the loan characterizing the payback periods and profitability level of the financed transaction, or the borrower's business plan which reflects information on the description of activities indicating the purposes of the loan, sales markets and the borrower's marketing strategy, risk assessment and management, a financial plan detailed by year (financial indicators of the business plan implementation by year, sources and volume of financing of the business plan and loan repayment), an estimate of income (expenses) (for loans related to investment purposes, start-up projects or loans whose main source of repayment is planned to be proceeds from the sale of goods and (or) services acquired through credit funds).

For the purposes of this paragraph:

a working capital replenishment loan means a loan granted to finance current production processes;

a consumer loan means a loan granted to an individual or an individual entrepreneur without forming a legal entity and meeting the following criteria:

the granting of the loan is not related to the purpose of financing entrepreneurial activity and it is assumed that the loan will not be used by the borrower for carrying out entrepreneurial activity;

the loan is planned to be directed to the acquisition of durable goods (residential real estate, automobiles, household appliances, furniture and other) and (or) payment for various services (educational, tourist, medical, repair and construction and other) and (or) other purchases and purposes (refinancing of a loan in another bank (if the previously obtained loan is related to consumer purposes), mobile phones, food products and other);

the loan recipient has a permanent source of income (wages, pension, benefits, dividends from securities, income from leasing real estate and other income) objectively allowing it to service obligations to the bank under the loan received, confirmed in the manner determined by the bank's internal documents.

Documents necessary for analyzing the client's financial condition and the quality of collateral:

this group of documents includes all documents on the basis of which the analysis of the borrower's financial condition is carried out and which reflect the main economic indicators of the borrower's activity, as well as documents confirming the existence, quality and size of the collateral accepted.

Documentation necessary for conducting credit monitoring. This group includes documentation formed by the bank's divisions in the course of administering the loan or necessary to confirm periodic credit monitoring, as well as procedures for updating information about borrowers (counterparties) for the purposes of credit risk management;

the existence and functioning of a management information system.

The bank develops management reporting forms which include, but are not limited to, the following information:

on the credit portfolio and its quality, presented, including in the dynamics of its changes;

on the size (level) of exposure to credit risk, including an assessment of the approach of aggregate exposure to the limits established in the bank for various types of loans (pre-limit approach);

on exposure to credit risk in relation to a group of related borrowers and the dynamics of its change;

on the concentration of credit risk of the largest borrowers (counterparties) and borrowers (counterparties) related to the bank by special relationships, including with the bank's shareholders, and the dynamics of its change;

on internal ratings of borrowers (counterparties) and the dynamics of their change, on monitoring the quality of loans by borrower (counterparty) ratings and its frequency;

on the size of provisions and assessment of the adequacy level of provisions;

on restructured, refinanced and problem loans;

on monitoring and control over compliance with limits;

on deviations from policy and limits.

The board of directors ensures the existence of a market risk management system which corresponds to the current market situation, development strategy, volume of assets and level of complexity of the bank's operations and ensures effective identification, measurement, monitoring and control of the bank's market risk, and also determines the market risk hedging strategy in order to ensure the sufficiency of own capital to cover it.

The market risk management system is integrated into the bank's internal risk management processes, and its results constitute an integral part of the process of monitoring and controlling the level and profile of its market risk, as well as the decision-making process in carrying out the bank's current activities. The results of the market risk assessment are taken into account in the process of developing the bank's development strategy.

Market risk management is carried out on the basis of managing the position of assets and liabilities, forming the value of financial instruments with ensuring a positive interest margin and expected return, managing the open currency position, constant monitoring of market risks and control of established risk appetite levels for the relevant operations.

The market risk management system includes management of securities portfolios and control over open positions by currencies, interest rates and derivative financial instruments.

In the process of managing market risk the bank determines:
the bank's organizational structure involved in the market risk management process, including the internal order of subordination and reporting;
the structure of the trading and banking book, as well as procedures for separating instruments into trading and banking book instruments.

The trading book is the part of the bank's financial portfolio in which financial instruments are presented that are acquired and sold to maintain trading operations, generate income in the form of the difference between the purchase and sale price, and hedge the bank's operations against various types of risk. Trading book positions are regularly revalued. All other operations relate to the banking book;

assets (liabilities) sensitive to changes in interest rates;
methods, techniques and models for assessing market risk;
risk orientation, the bank's approaches to establishing and monitoring risk appetite levels and methods for minimizing risk.
The functioning of the market risk management system is carried out on the basis of the following main components, but is not limited to them:
approval and periodic analysis of the bank's investment activity strategy, formation of the optimal structure of assets and liabilities taking into account the bank's defined risk profile, the level of sufficiency of the bank's own capital and the level of liquidity to cover significant market risk.

The investment activity strategy complies with the following main principles:

the content corresponds to the bank's overall strategy in terms of goals, directions and implementation timelines;

the existence of a relationship between the tactical and strategic processes of managing the bank's investment activity;

maximum profit generation, ensuring growth of a quality investment portfolio, maintaining a sufficient level of liquid assets in the overall structure of the bank's assets;

formation of the structure of assets and liabilities taking into account compliance with the requirements, methods and procedures for managing market risk;

approval of the procedure for identifying, assessing, monitoring and controlling market risks, taking into account all areas of the bank's activity to which market risk is inherent (banking and trading books, on-balance-sheet and off-balance-sheet operations), as well as methods for hedging the said risks.

The bank develops a market risk management process which includes, but is not limited to, the following:

the participants in the market risk management process, their powers and responsibilities with a clear definition of the reporting structure, as well as the internal order of information exchange;

the list of foreign currencies and financial instruments with which operations are permitted, indicating the purposes of their use, as well as internal requirements and criteria for financial instruments, including as to volume, composition and conditions;

the internal order and procedures for identifying, measuring, monitoring and controlling the level of market risk.

The procedures for identifying, measuring, monitoring and controlling market risk:

cover all types of assets, liabilities and off-balance-sheet positions;

cover all types of market risk and their sources;

allow, on a regular basis, assessment and monitoring of changes in factors affecting the level of market risk, including rates, prices and other market conditions;

allow timely identification of market risk and taking measures in response to adverse changes in market conditions.

In order to assess the accepted level of market risk, the bank uses models corresponding to the development strategy, volume of assets and level of complexity of the bank's operations.

In relation to financial instruments denominated in foreign currency and sensitive to changes in interest rates, the aggregate volume of which exceeds 5 (five) percent of the volume of assets (liabilities), the bank measures interest rate risk separately for each of the foreign currencies. The assumptions adopted within the interest rate risk assessment methodology are documented in the relevant internal documents of the bank.

The bank, on a periodic basis, conducts sensitivity analysis for each type of market risk inherent in the bank's activity. Sensitivity analysis shows the impact on the bank's profit (losses) and own capital of possible changes in risk variable factors.

The bank, on a periodic basis, carries out back-testing of market risk assessment models. The bank conducts back-testing to verify the reliability and effectiveness of market risk assessment models and, where necessary, improves them. The results of back-testing with proposals, where necessary, for improving market risk management procedures are sent to the risk management committee and the bank's board of directors.

The bank conducts regular monitoring of the level of market risk in order to prevent the possibility of exceeding the established risk appetite levels. The frequency of market risk monitoring is determined by the bank based on the degree of its materiality for the relevant area of the bank's activity.

Information obtained in the process of market risk monitoring about a significant change in the level of risk is promptly brought to the attention of the board of directors and the bank's risk management committee for making the necessary decisions.

In order to minimize market risk the bank establishes:

risk appetite levels for currency, price and interest rate risks in accordance with Chapter 3 of the Rules;

constant control over compliance with the established risk appetite levels;

procedures for immediately informing the board of directors, the risk management committee, the bank's management board and other interested structural divisions about the achievement of limit values and (or) violations of the established risk appetite levels;

measures to reduce market risk taken upon achievement of the risk appetite levels;

market risk management procedures in the case of:

changes in the structure of financial instruments, their quantitative and value indicators;

development and introduction of new technologies and conditions for carrying out banking operations and other transactions, other financial innovations and technologies;

entry into new markets;

methods and criteria for hedging risks, including establishment of criteria for the effectiveness (optimality) and cost of hedging.

The bank develops and implements a hedging strategy for each type of market risk, which contains:

hedged items;

a description of the hedging instruments used (use of exchange-traded and over-the-counter market instruments taking into account assessment of counterparty reliability and the terms of the hedging instruments);

the internal order for determining the necessary level of liquidity to cover hedging instruments;

a description of the procedure and methods for assessing hedging effectiveness.

Hedging is considered effective if the change in the fair value or cash flow of the hedged item is fully offset by the change in the fair value or cash flow of the hedging instrument. Hedging is carried out in relation to a specific identifiable risk, and not the bank's general risks;

the internal order and procedures for monitoring the bank's profitability from the use of financial instruments;
procedures for carrying out stress testing in order to assess market risk, including the internal order for using their results within the framework of the risk management process.

The bank conducts stress testing of market risks on a periodic basis in order to identify the level of potential market risks inherent in the bank's activity and assess the bank's ability to withstand changes.

The frequency of stress testing, procedures and methods of conducting it are established in the relevant internal documents of the bank. The frequency of stress testing is determined based on the level of the bank's exposure to market risk, the volatility of capital markets and other external factors. The frequency of stress testing increases in cases of significant changes in external factors.

The following scenarios are used in conducting stress testing:

historical;

providing for changes in exchange rates of foreign currencies and (or) precious metals on the bank's open positions;

providing for changes in the market value of financial instruments;

providing for changes in the general level of interest rates, scenarios of growth or decline in the yield of financial instruments sensitive to changes in interest rates;

providing for changes in yield;

providing for changes in the ratios between interest rates on resources attracted and placed by the bank;

providing for changes in the degree of volatility of market interest rates;

providing for sharp deteriorations in key market, financial and (or) other factors and conditions of the bank's activity.

The bank uses a stress testing methodology and scenarios corresponding to its business structure and risk profile.

The results of stress testing are presented to the bank's board of directors, risk management committee and management board and other interested structural divisions of the bank on a periodic basis. If the results of stress testing indicate the bank's vulnerability to individual risk factors, the bank applies measures to reduce the level of accepted risk;

a system of early detection indicators of exposure to market risk, including one based on the pre-limit approach;
procedures for making changes to the bank's internal documents and procedures in cases of changes in market conditions affecting the level of the bank's exposure to market risk;
approval of the internal order of the system of qualitative, detailed, periodic management information allowing timely and full assessment of the level of exposure to market risk, the approach to the established risk appetite levels and timely response to changes.

The bank ensures the existence of an effective management information system intended to provide the bank's board of directors, risk management committee and other interested structural divisions of the bank with information about the bank's exposure to market risk.

Management information contains, but is not limited to, the following:

information on the current state of interest rates, exchange rates, market quotations and their dynamics;

information on significant open positions by currency and financial instruments;

information on the level of interest rate risk on aggregated positions in financial instruments sensitive to changes in interest rates;

information on compliance of positions in financial instruments sensitive to changes in interest rates with established limits;

on early warning indicators of market risk;

expert assessments of changes in interest rates, exchange rates and price indices in the future;

results of market risk measurement;

the existence of an internal order for taking measures to reduce market risk;
the existence of procedures for assessing the fair value of financial instruments based on market information.
The board of directors ensures the existence of an operational risk management system fully integrated into the bank's overall risk management process at all levels of the bank's organizational structure and into newly created products, activities, processes and systems, and ensures effective identification, measurement, monitoring and control of the bank's operational risk in order to ensure the sufficiency of own capital to cover it. The operational risk management system includes, but is not limited to, the following:
a detailed description of the interaction between all participants involved in the operational risk management process, including the internal order of reporting.

The bank determines the participants in the operational risk management process on the basis of 3 (three) lines of defence.

The first line of defence is provided by the bank's structural divisions themselves. This means that the heads of structural divisions are responsible for identifying, measuring, monitoring and controlling the operational risk inherent in their activities, including that related to personnel, products, processes and systems. Based on the current market situation, strategy, volume of assets and level of complexity of the bank's operations, in order to ensure the effective functioning of the operational risk management system in the first line of defence, operational risk coordinators are appointed in the bank's structural divisions and the internal order of their interaction with the operational risk management and internal audit divisions is determined.

The second line of defence is provided by an independent operational risk management division.

The third line of defence is provided by the internal audit division through an independent assessment of the effectiveness of the bank's operational risk management system;

a description of operational risk measurement tools;
the internal order for establishing the operational risk appetite level;
the internal order of information exchange and the database of internal operational risk events;
a system for classifying operational risk events to ensure accuracy in identifying risk;
carrying out operational risk analysis and the corresponding revision of the operational risk management policy in the case of a significant change in the level and types of the bank's operational risk.
In order to build an effective operational risk management system, the board of directors is responsible for:
approving the operational risk management policy, which includes, but is not limited to, the following components:

the goals and objectives of operational risk management;

the main principles of operational risk management;

the classification of operational risk event types;

the level of the bank's operational risk appetite;

determination of the participants in the operational risk management process on the basis of 3 (three) lines of defence, their powers, responsibilities with a clear definition of the reporting structure;

determination of the internal order and procedures for identifying, measuring, monitoring and controlling operational risk, including:

determination of key operational risk indicators;

determination of procedures and mechanisms for managing operational risk;

the internal order of information exchange between the participants in the operational risk management process along the 3 (three) lines of defence, including the types, forms and timeframes for submitting information;

procedures for approving, authorizing, analyzing and monitoring deviations from policy, procedures and limits;

the internal order and procedures for approving new products, activities, processes and systems and (or) making significant changes to existing products, activities, processes and systems;

requirements for making changes to internal documents and procedures in cases of detecting deficiencies in operational risk management and (or) the occurrence of conditions affecting the level of the bank's exposure to operational risk;

forming a risk culture of operational risk management;
regular analysis of the operational risk management system in order to ensure timely identification and management of operational risk caused by changes in external factors, as well as operational risks related to new products, activities, processes or systems, including changes in the level and types of risk;
ensuring appropriate conditions for applying the best practice of operational risk management;
approval and control over risk appetite levels in relation to operational risk with regular review. In the process of analyzing the relevance of risk appetite levels, account is taken of changes in external factors, a significant increase in the volume of the bank's operations, including in individual types of activity, the results of audits of the internal control system (if any), the effectiveness of the operational risk management or risk reduction system, the volume of losses incurred, as well as the frequency, scale and nature of violations of the established risk appetite levels.
The bank identifies, measures, monitors and controls operational risk through the following (but not limited to them):
use of audit results.

Audit results are an additional source of information in the bank's operational risk management process;

collection and analysis of internal data on operational risk events.

Collection and analysis of internal data on operational risk events (maintaining a database of operational risk events) is a process allowing assessment of exposure to operational risk and the effectiveness of internal control on the basis of information on operational losses.

Analysis of loss cases gives an idea of the causes of large losses and information on whether control system failures are episodic or systemic;

conducting analysis of external operational risk events.

The composition of external data on operational risk events includes (if available) aggregate operational losses, timeframes, data on loss coverage, as well as relevant episodic information on loss cases in other banks;

conducting operational risk self-assessment.

An instrument through which the bank identifies and assesses the operational risks inherent in the bank's processes and assesses their impact on the processes and the effectiveness of the existing procedures for controlling the identified operational risks;

description (regulation) of business processes.

Description (regulation) of business processes – a process within which structural units constituting the first line of defense determine the main stages of business processes, types of activity, organizational functions, facilitating the identification of operational risks, interdependencies between risks, deficiencies in control and risk management;

application of key operational risk indicators.

Key operational risk indicators represent values (magnitudes) and (or) statistical data giving an idea of the operational risk profile to which the bank is exposed. Key operational risk indicators are used to monitor changes in the level of operational risk in the bank, which, in turn, ensures the identification of deficiencies in processes, organization, failures and potential losses;

scenario analysis of operational risk.

Scenario analysis of operational risk is a process of comparing external loss events with the bank's internal processes and obtaining an expert opinion from heads of structural units and the risk management unit on deficiencies in the control system or risks not previously identified in order to identify potential cases of operational risk and assess possible consequences.

The risk management committee ensures the existence of a process for regular monitoring of the level of operational risk.

The bank ensures the existence of a management information system, including the establishment of internal procedures defining the composition and frequency of operational risk management reporting submitted to various recipients, and the responsible persons (units) of the bank for preparing and communicating information to the relevant recipients. The established internal reporting procedure allows for preventive management of operational risk. Management reporting on operational risk contains:
information on violations of the established levels of the bank's risk appetite for operational risk;
information on significant internal operational risk events and losses broken down by operational risk classification, the amount of damage, indicating causes, types of events, consequences;
information on significant external operational risk events for decision-making;
information on corrective measures taken for significant operational risk events and (or) analysis of the effectiveness of measures taken;
results of operational risk self-assessment;
results of monitoring key risk indicators;
results of scenario analysis;
information on the operational risk map.

Management reporting contains complete, reliable, timely information. The frequency of reporting reflects the degree of the bank's exposure to risks, as well as the pace and nature of changes in its activities.

The processes of forming management reporting on operational risk are periodically reviewed for the purpose of continuous improvement of operational risk management and further development of the principles, procedures and processes of operational risk management.

In order to identify potential risks arising in stress situations, the bank, on a periodic basis (but not less than once every 6 (six) months), conducts stress testing to identify sources of potential threat to capital adequacy. Stress testing is conducted by the bank using the following methods (but not limited to them):
scenario analysis;
sensitivity analysis.

The stress testing process includes the following:

stress testing allows the bank to analyze the impact of stress scenarios on the level of capital adequacy, assess the level of risk occurrence when the internal and external environment changes;

the degree and frequency of stress testing corresponds to the chosen business model, scale of activity, types and complexity of operations, as well as the bank's role in the financial system. The bank has the ability to increase the frequency of stress testing in deteriorating market conditions or at the request of senior management;

the bank's board of directors actively participates in the stress testing process in terms of approving stress testing procedures, scenarios (including considering conservative scenarios also during periods of economic growth), evaluating results and, as a result, taking measures to minimize the capital risk identified during stress testing.

When conducting stress testing, the bank uses, but is not limited to, the following stress testing scenarios:

general economic scenario, which is based on assessing the impact of a decline in the country's economic conditions, including a decline in economic growth in general and in individual sectors of the economy;

a scenario specific to the bank's business, which is based on assessing the impact of local stress factors, including those related to the specifics of the bank's lending activity and the structure of its loan portfolio.

The bank develops stress testing scenarios based on conservative but potentially realizable negative changes in external and internal indicators affecting the reduction of the capital adequacy level.

The bank's board of directors approves the stress testing scenarios and adopted assumptions, as well as the stress testing results. The validity of the choice of scenarios and corresponding assumptions of the bank is documented and reviewed together with the stress test results.

When determining stress scenarios and sensitivity, the bank uses a wide range of information, including historical and hypothetical stress situations.

In addition to the possibility of applying stress scenarios used by the regulator, the bank strives to use the most applicable stress situations that correspond to its individual characteristics.

The bank's board of directors regularly reviews stress testing scenarios for significant changes. If necessary, changes to stress testing scenarios are subject to an interim assessment.

When developing stress testing scenarios and assumptions, the bank is guided by the following:

scenarios include all significant risks to which the bank is potentially exposed;

during stress testing, the bank considers the interrelationship of various types of risks;

the bank adheres to a conservative approach when determining stress testing assumptions. Based on the type and severity of the scenario, the bank considers the appropriateness of a number of assumptions in relation to its activities;

the bank considers short-term and prolonged, as well as idiosyncratic and market scenarios, regardless of how high the level of capital adequacy is at the current moment, including:

lack of availability of capital markets;

decline in energy prices;

weakening of the national currency exchange rate;

real estate market crisis;

changes in interest rates;

agricultural sector crisis;

growth of inflationary expectations;

increase in unemployment and decline in household incomes;

decline in the market value of assets.

The stress test results and projected risks, as well as subsequent actions to minimize negative impact, are communicated and discussed with the bank's board of directors and the units participating in the liquidity risk management process. The bank's board of directors integrates the results of the stress testing process into the bank's strategic and budget planning process. Stress testing results are used in setting internal limits.

The bank's board of directors takes into account stress testing results in the process of maintaining capital adequacy in case of unforeseen circumstances, including for the purpose of eliminating deficiencies in the process.

The bank ensures the existence of procedures for the development, approval and implementation of new products, types of activity, processes and systems or making significant changes to existing products, types of activity, processes and systems, ensuring:
assessment of risks inherent in new products, types of activity, processes and systems or in the case of making significant changes to existing products, types of activity, processes and systems;
implementation of cost-benefit analysis of implementation;
assessment of changes in the bank's risk appetite levels and making corresponding changes;
availability of necessary control mechanisms, risk management process;
availability of information on the level of residual risks;
availability of procedures and methods for identifying, measuring, monitoring and controlling risks inherent in new products, types of activity, processes and systems or in the case of making significant changes to existing products, types of activity, processes and systems;
assessment of the bank's capabilities to make investments in human resources and the bank's technological infrastructure before implementing new products, types of activity, processes and systems or in the case of making significant changes to existing products, types of activity, processes and systems.
Annually, the bank's board of directors conducts an assessment of capital adequacy based on the results identified within the internal capital adequacy assessment process and other information available to the bank's board of directors.

The internal capital adequacy assessment process is subject to continuous review of both quantitative and qualitative indicators, including the application of its results, stress testing approaches, risk identification and the information collection process, and validation of risk assessment models. The review is conducted within the framework of the 3 (three) lines of defense, based on their role in ICAAP. The review facilitates timely changes when internal and external factors change.

Chapter 6. Internal Liquidity Adequacy Assessment Process

The board of directors approves the bank's internal document regulating the main approaches and principles of ILAAP and containing the following sections:
1. description of the organizational structure of ILAAP;
2. description of the risk appetite strategy;
3. organization of liquidity risk and funding management, including daily liquidity risk and liquidity gaps;
4. description of the process of integrating liquidity risk management into the process of approving new products and types of activity;
5. review of the funding strategy and the contingency funding plan for liquidity;
6. organization of management of liquidity buffers and collateral;
7. organization of stress testing procedures;
8. organization of self-assessment procedures for the internal liquidity adequacy assessment process.
The description of the organizational structure of ILAAP contains a list of ILAAP participants indicating the responsibilities of the bank's collegial bodies and units participating in the implementation of liquidity and liquidity risk management processes, including:
the bank's board of directors is responsible for liquidity risk management and determining the level of risk appetite;
the risk management committee is responsible for developing policies and procedures in the area of liquidity management within the risk appetite level established by the board of directors. In addition, the risk management committee periodically notifies the bank's board of directors of compliance with risk appetite and significant changes in the liquidity level;
the unit(s) of the person(s) entrusted with internal control functions carries out (carry out) verification of compliance with ILAAP procedures and communicates (communicate) the results to the bank's board of directors;
the unit(s) participating in the risk management process is (are) responsible for the implementation of the liquidity risk management process and is (are) responsible for preparing the report on compliance with ILAAP and conducting stress testing;
the liquidity management unit(s) develops (develop) and implements (implement) measures for operational liquidity management and, jointly with the risk management unit, develops a contingency funding plan;
the internal audit unit conducts an assessment of the effectiveness of ILAAP.
Within the framework of ILAAP, the bank's board of directors is responsible for compliance with the approved risk appetite strategy.
The bank develops an effective process for identifying, assessing, monitoring and controlling liquidity risk, which includes detailed forecasting of cash flows by assets, liabilities and off-balance sheet instruments at different time intervals.

The bank assesses all balance sheet and off-balance sheet items affecting the level of liquidity risk. The bank assesses the level of liquidity in the market to cover the bank's need for attracting funding for the purpose of regulating liquidity risk.

When managing liquidity risk, the bank takes into account the decline in the value of assets and the impact of their sale during stress on the level of liquidity, profitability and capital.

The bank takes into account the interaction between liquidity risk and other types of risks to which it is exposed.

Liquidity measurement includes an assessment of the bank's cash inflows and outflows to determine the potential deficit of liquid assets in the future. The bank measures and forecasts expected cash flows by assets and liabilities, including off-balance sheet claims and liabilities, at different time horizons under normal conditions and in a number of scenarios, with varying degrees of stress.

Such time horizons include:

the need for liquidity and funding opportunities on an intraday basis;

the need for liquidity and funding opportunities for short and medium-term horizons up to 1 (one) year;

long-term liquidity of more than 1 (one) year.

The bank develops early warning indicators that identify increased liquidity risk and risks of limited funding. The developed indicators identify a negative trend in the level of liquidity, the bank's funding and reflect a real assessment for the purpose of taking immediate measures to mitigate the impact of emerging risks on the bank's financial position.

The bank determines triggers of qualitative and quantitative early warning indicators.

Qualitative or quantitative early warning indicators by their nature include, but are not limited to, the following:

rapid growth of assets, especially those financed by liabilities with the possibility of early withdrawal, or for which no maturity date is established;

increase in concentration in individual assets or liabilities;

increase in gaps in currencies;

decrease in the weighted average maturity of liabilities;

approaching the values of the bank's internal limits and (or) prudential standards defined as acceptable but requiring separate corrective measures in the existing risk management system procedures in order to reduce the level of risk;

negative trends or increased risk associated with the bank's activities;

significant decline in the bank's income, deterioration in asset quality and the bank's overall financial condition;

negative information, including in the media, related to the bank;

downgrade of the bank's credit rating;

decline in share quotations or increase in the cost of the bank's debt;

increase in the cost of corporate or retail funding;

increase in counterparty demands for additional collateral and (or) refusals on new unsecured transactions and on prolongation of terms;

closure or reduction of the established size of credit lines provided for the bank;

increase in outflow of retail deposits;

increase in outflow of term corporate deposits;

difficulties in attracting long-term financing.

The bank actively manages its intraday liquidity position and associated risks in order to timely fulfill payment and settlement obligations, both in normal and stress situations, thereby contributing to the uninterrupted functioning of payment and settlement systems.

The bank manages intraday liquidity risk through procedures that include, but are not limited to, the following:

tracking daily liquidity positions taking into account expected cash inflows and outflows, forecasting the size of potential funding deficit arising at different periods of the operating day;

identifying key clients acting as main sources of incoming or outgoing liquidity flows, forecasting inflows and outflows through establishing constant communication and awareness of upcoming large receipts and withdrawals;

identifying key periods, dates and circumstances in which liquidity flows and possible credit needs are especially high;

understanding the needs of business units;

controlling the intraday liquidity position in relation to expected payments in order to determine the size of necessary additional intraday liquidity or the need to limit liquidity outflow to cover priority payments;

having reliable sources of funding in order to obtain a sufficient level of required intraday liquidity in a short time;

managing the bank's assets that are used as collateral in case of need to obtain daily borrowed funds;

having a sufficient size of such assets, operational mechanisms for collateral;

monitoring outflows of key clients' funds in accordance with intraday needs;

the bank's response measures in case of unforeseen gaps in daily liquidity flows, including measures to ensure business continuity.

The bank ensures the existence of an effective management information system designed to provide the bank's board of directors, the risk management committee and other interested structural units of the bank with information on the bank's exposure to liquidity risk and the state of the bank's liquidity.

The bank develops a management reporting system that:

covers all sources of liquidity risk, including risks on contingent liabilities, as well as risks associated with the occurrence of events that entail early repayment of liabilities and the need for a certain amount of liquidity from the corresponding sources;

ensures the presentation of information on liquidity positions broken down by various time horizons;

ensures risk measurement for monitoring liquidity positions, both in normal and stress conditions, by types of currencies in which the bank has significant positions, both on an individual and aggregated basis;

allows monitoring and analysis of the dynamics of unencumbered highly liquid assets, for the purpose of their sale or use as collateral to attract funds upon the occurrence of stress situations;

allows monitoring and analysis of information on factors affecting the level of the stock of liquid assets;

ensures assessment and forecasting of future cash flows broken down by various time horizons, including taking into account stress testing results under various scenarios;

provides for the provision of more detailed and up-to-date information on a more frequent basis during periods of stress.

The management reporting system includes, but is not limited to, the establishment of internal procedures defining:

criteria, composition, internal procedure and frequency of liquidity risk management reporting submitted to various recipients (for example, daily reporting is provided to persons responsible for liquidity risk management, regular – to the management board, risk management committee and board of directors, with increased frequency – during periods of stress situations);

comparison of the current level of liquidity risk with established limits, identification of negative factors leading to negative trends in the liquidity level, as well as ways to limit violations;

messages on violations of liquidity risk limits indicating threshold values, causes of violations and proposals for leveling the current situation;

responsible persons (units) for preparing and communicating information to the relevant recipients.

Information systems ensure the functioning of the liquidity risk management system, including control over compliance with established limits. Information systems correspond to the complexity of the bank's business, risk profile, areas of activity, volume of assets and the bank's role in the financial system.

Description of the process of integrating liquidity risk management into the process of approving new products and types of activity.

The bank takes into account costs, benefits and liquidity risks in the process of approving new products for all important types of activity.

The bank's ILAAP takes into account the measurement of costs, benefits and liquidity risks inherent in all areas of the bank's activity (including activity related to contingent risks that do not have a direct effect at the moment but have the possibility of materializing in the future). This allocation of costs, benefits and liquidity risks includes factors related to the expected maturities of assets and liabilities, their liquidity risk characteristics in the market and any other relevant factors, including benefits from access to relatively stable sources of funding.

Review of the funding strategy and the contingency funding plan for liquidity (hereinafter – the funding plan). The bank diversifies funding sources and establishes internal limits on concentration, taking into account the following factors (but not limited to them):
types of funding sources broken down by products, instruments, markets;
maturity of funding;
characteristics of the issuer, counterparty or creditor, including sector of the economy, geographic location;
currency of funding sources.

The diversification goals are part of the funding plans (up to and more than one year) and are taken into account in the process of strategic and budget planning.

The board of directors, the risk management committee and the bank's management board are informed about the characteristics and diversification of funding sources and periodically review the funding strategy in order to immediately respond to changes in the internal and external environment.

An important component of ensuring funding diversification is ensuring access to financial markets, which is of decisive importance in the effectiveness and possibility of attracting funds from depositors and counterparties. Ensuring access to relevant markets takes into account, but is not limited to, the following:

maintaining presence in financial markets selected for funding;

the possibility of strengthening presence in selected funding markets;

identifying, establishing, maintaining relationships with current and potential creditors providing funds;

increasing the bank's capitalization in order to ensure the readiness of creditors to maintain relations with the bank.

The bank determines alternative sources of funding that increase the bank's ability to withstand stress situations and liquidity crises. Depending on the nature, severity and duration of the liquidity crisis, potential sources of financing include, but are not limited to, the following:

growth of deposits;

prolongation of maturity of liabilities;

issuance of short-term and long-term debt instruments;

intra-group transfers of funds, sale of subsidiaries or business lines;

securitization of assets;

sale of available highly liquid assets or conclusion of repo transactions;

containment of growth in volumes in main areas of activity (for example, slowing down lending).

The bank's board of directors, risk management committee and management board periodically assess and monitor the ability to promptly raise funds from each funding source in order to assess effectiveness in ensuring liquidity in the future.

The bank's board of directors approves a funding plan that clearly defines the process for addressing liquidity shortfalls in emergency situations. The funding plan corresponds to the scale of the bank's activities, risk profile, types and complexity of operations, volume of assets and the bank's role in the financial system. The funding plan includes a clear description of a diversified set of adequate, available, feasible potential measures to provide for unforeseen expenses to preserve liquidity and reduce cash shortfalls in various adverse situations.

The funding plan contains:

clearly defined and available sources of financing for unforeseen circumstances, with an assessment of the possible amount of funds raised from these sources;

the time required to raise additional funds from each source of financing for unforeseen circumstances;

clear operational procedures regulating:

the formation of the composition of persons (bodies, divisions) of the bank responsible for developing and implementing the funding plan, indicating powers and areas of responsibility in order to ensure internal coordination and communication;

a detailed algorithm of actions and their prioritization regarding what actions must be taken, who is responsible for taking them, when and how these actions are implemented;

several options for implementing different stress situations.

In order to ensure operational reliability, the funding plan is subject to regular testing and updating.

The bank has a permanent stock of unencumbered highly liquid assets that can be used in the shortest possible time without significant losses and discounts under various stress scenarios, including events entailing loss of access or reduction in volumes of liquid funds provided by creditors, including under collateral, as well as placed by depositors.

The necessary liquidity stock is comparable to the bank's established risk appetite for liquidity risk. This requires determining the necessary size of the stock of unencumbered highly liquid assets against estimates of liquidity needs under stress. Assessment of liquidity needs in current conditions and during stress periods includes:

both contractual and non-contractual cash outflows (inflows);

unconditional requirement of depositors to withdraw funds;

and takes into account the inability to obtain unsecured financing, as well as loss or reduction of access to liquid funds.

The necessary liquidity stock is mainly formed from the highest quality liquid assets, such as:

cash;

liquid government securities;

financial instruments that can be sold during the most adverse stress scenarios and less adverse ones in the form of unencumbered liquid assets sold or used as collateral without significant losses or discount.

General characteristics of the definition of highly liquid assets include:

transparency of its structure and risk characteristics;

ease and certainty of valuation;

the existence of a liquid market for this asset in all stress scenarios;

available market volumes for the asset, including the bank's stocks relative to normal market turnover;

absence of legal, regulatory or operational obstacles to the use of these assets for obtaining financing at any time to meet liquidity needs.

Effective collateral management is carried out through the following, but not limited to, procedures that determine:

assessment of the bank's needs for assets to be used as collateral, including assets currently pledged, taking into account the timing of their release;

assessment of the suitability of each type of asset for use as collateral in relation to each type of main counterparty and secured financing markets;

diversification of assets to be used as collateral by issuer, volume relative to financial market capabilities and counterparties, price sensitivity to avoid excessive concentration, and taking into account various market stress scenarios;

monitoring of collateral by issuers, geographic location, currencies, in order to assess how promptly assets are mobilized if necessary.

The stress testing system includes analysis of the types of stress testing used, stress testing scenarios, applicable assumptions, methodological basis for testing the resilience of the liquidity adequacy indicator in the event of changes in market conditions and management measures.

The bank periodically conducts stress testing on various factors of short-term and long-term scenarios focused both on the bank's specifics and on large-scale market stresses and a combination of both scenarios in order to analyze and quantify their impact on the level of liquidity, on the bank's cash flows, profitability and solvency.

The results of stress tests conducted are reviewed by the bank's board of directors. Based on the results of the review, measures are taken to eliminate or mitigate consequences to limit impacts on the bank, create the necessary liquidity stock and adjust the liquidity level.

The results of stress tests play a key role in forming the bank's funding plan and in determining the strategy and ILRMF.

The stress testing process includes the following:

the bank analyzes the impact of stress scenarios on the liquidity position, assesses the level of liquidity risk occurrence when the internal and external environment changes, at different time periods (short-term, long-term), including on an intraday basis;

the bank's board of directors participates in the stress testing process in terms of approving stress testing procedures, scenarios (including considering conservative stress scenarios even during periods of liquidity surplus), evaluating results and, as a result, taking measures to minimize the liquidity risk identified during stress testing;

the bank takes into account in stress testing the likely behavioral reaction of other market participants to market stress events and the extent to which the overall result amplifies market movement and exacerbates market strain.

When developing stress testing scenarios and assumptions, the bank is guided by the following:

scenarios include all main funding and liquidity risks in the market to which the bank is potentially exposed;

the bank considers short-term and protracted, as well as idiosyncratic and market scenarios, regardless of how high the current liquidity level is, including:

simultaneous absence of liquidity in several previously highly liquid markets;

serious difficulties in access to secured and unsecured funding;

currency convertibility restrictions;

serious operational or settlement failures affecting one or more main payment or settlement systems;

the bank takes into account the relationship between the reduction of liquidity in the market and funding restrictions;

during stress testing, the bank considers the relationship of various types of risks;

the bank takes into account liquidity needs in many currencies and several main payment and settlement systems;

the bank adheres to a conservative approach in determining stress testing assumptions. Based on the type and severity of the scenario, the bank considers the appropriateness of a number of assumptions in relation to its activities, which include, but are not limited to, the following:

narrowing of liquidity across the entire market;

outflow of retail and corporate funding;

lack of access to new secured and unsecured funding sources;

emergence of a need for significant discounts to sell assets and (or) conduct repo;

default of counterparties, including in the interbank market;

likelihood of additional margin and collateral calls;

likelihood of changes in financing terms;

liquidity directed to fulfill contingent liabilities on off-balance sheet instruments and operations, including credit lines;

planned change in asset volume;

non-renewability of interbank deposits;

inability to use credit lines provided to the bank;

impact of triggers of a significant credit rating downgrade;

conversion of the bank's client funds;

reduction in the ability to sell liquid assets taking into account legal, regulatory, operational and time restrictions;

limited access to funds of the authorized body, quasi-state sector companies;

limited operational ability of the bank to sell assets;

significant downgrade of the bank's credit rating;

appearance of negative information about the bank affecting the level of confidence in the bank.

Stress scenarios are analyzed by the bank on a regular basis in order to confirm their relevance. The analyses take into account changes in market conditions, changes in the nature, volume of assets or complexity of the business model and activities of the bank, actual experience in stress situations.

The bank's board of directors approves stress testing scenarios and adopted assumptions, as well as stress testing results. The validity of the choice of scenarios and corresponding assumptions of the bank is documented and reviewed together with the stress test results.

The stress test results and projected risks, as well as subsequent actions to minimize negative impact are communicated to and discussed with the bank's board of directors and divisions involved in the liquidity risk management process. The bank's board of directors integrates the results of the stress testing process into the bank's strategic and budget planning process. Stress testing results are used in setting internal limits.

The bank's board of directors includes stress testing results in the assessment and planning of the funding plan, including for the purpose of correcting deficiencies in the plan.

The bank annually conducts a self-assessment of the ILRMF to identify weaknesses in the process in terms of the following:
liquidity management policies;
organization of the process;
procedures, systems and control actions;
liquidity level and availability of funding.

Based on the self-assessment results and upon identification of inconsistencies and (or) weaknesses in the process, the bank draws up an action plan containing information on corrective actions to be implemented, including information on responsible parties, expected deadlines, and necessary resources.

Chapter 7. Business Continuity Management

The bank's board of directors ensures the existence of a business continuity management system of the bank that corresponds to the current market situation, strategy, volume of assets, level of complexity of the bank's operations.

The bank manages business continuity through procedures, but not limited to, listed in paragraphs 63-71 of the Rules.

The bank carries out, using the method defined in the bank's internal document, a business impact analysis, through which an assessment is made of:
impacts, damages or losses to the bank's personnel, premises, technology or information;
violations of the requirements of civil, tax, banking legislation of the Republic of Kazakhstan, legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit guarantee, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;
loss of reputation.

The business impact analysis of the bank is conducted to determine the time frames for recovery of critical activities, as well as to identify the resources necessary for the resumption and continuation of key activities in the event of unforeseen circumstances (critical resources).

To conduct the business impact analysis, the bank:

evaluates the volume of possible losses due to downtime in the provision of critical products and services over time;

establishes the maximum acceptable downtime period for each type of activity by identifying:

the maximum period of time within which the activity is resumed;

the period of time within which the normal level of activity is resumed;

identifies the types and levels of performance of activities, assets or other resources that must be continuously maintained in a minimum operable state and (or) restored within established time frames to provide critical products and services;

determines the volume of resources minimally necessary for the restoration and further implementation of critical activities in emergency mode;

establishes the target recovery time for each critical activity. The target recovery time is less than the maximum allowable downtime of the corresponding product or service;

establishes the target recovery point between the last data backup and the start of downtime of the critical activity;

ranks critical activities by target recovery time, highlighting priority ones;

identifies suppliers, counterparties, other interested parties on which the bank's critical activities depend and how these persons assist the bank in the event of unforeseen circumstances.

The bank identifies critical activities. Identified in the process of business impact analysis, the loss of which has the maximum negative impact on the bank in the short term and is subject to restoration in the shortest possible time, is a critical activity.
The bank determines the resources necessary to maintain critical activities, which include, but are not limited to, the following:
personnel.

When determining personnel as a resource necessary to maintain critical activities, the bank determines:

the required number of employees;

the necessary skills and competencies;

premises.

When determining premises as a resource necessary to maintain critical activities, the bank determines:

primary and alternative sites;

premises requiring enhanced protection;

technology.

When determining technology as a resource necessary to maintain critical activities, the bank determines:

information technology services supporting critical activities;

telecommunication services supporting critical activities;

other technologies supporting critical activities, including perimeter security, cash collection technologies;

information.

When determining information as a resource necessary to maintain critical activities, the bank determines:

information necessary for performing critical activities, including the bank's internal documents;

the volume of information requiring restoration (target recovery point);

methods of storage, protection and restoration of information;

suppliers, external services and supply.

The bank determines the suppliers, external services and supply on which the performance of critical activities depends;

financial resources.

The bank determines the volume of financial resources potentially available for the implementation of the plan(s) for ensuring continuity and restoration of the bank's activities in the event of unforeseen circumstances.

The bank carries out an analysis of unforeseen circumstance risks, which allows assessing threats and vulnerability in critical activities and the resources used by them. As threats that have a negative impact on resources, the bank considers, but is not limited to, the following:
unavailability of employees;
unavailability of technologies, including information and communication technologies (computer viruses, failure of computer hardware, loss of communication);
unavailability of supply (water, electricity);
lack of access to buildings (premises);
unavailability of key suppliers, counterparties;
unavailability of key information;
unavailability of financial resources.
The bank determines measures to manage unforeseen circumstance risks, which cover (but are not limited to) the following key resources:
personnel;
premises;
technology;
information;
suppliers, counterparties and supply channels.

When choosing measures to manage unforeseen circumstance risks, the bank takes into account the results of the business impact analysis and determines, among other things, the internal procedure for interaction with external suppliers involved in recovery work, with external counterparties (depositors, creditors), the bank's shareholders, with the authorized body and other authorities, as well as with the media and other interested parties.

When choosing measures to manage unforeseen circumstance risks, the bank takes into account, but is not limited to, the following factors:

the maximum acceptable downtime period for a critical activity;

the costs of implementing the plan(s) for ensuring continuity and restoration of activities;

the consequences of not taking measures;

the realism of risks and the magnitude of losses from their realization;

consistency with the established goals of the business continuity management system;

consistency with the bank's business continuity management policies and procedures.

The bank determines measures to maintain key knowledge and competencies to ensure the continuity of its activities. Measures include, but are not limited to, the following:

regulating the internal procedure for carrying out critical activities;

maintaining a list of additional personnel competencies not used in everyday activities for the redistribution of functions in conditions of staff shortage;

training personnel in professional skills, including conducting cross-functional training.

The bank determines measures to reduce the impact on the provision of critical products and services due to the absence of primary premises. These measures include, but are not limited to, the following:

provision of alternative premises;

relocation of personnel to other bank premises;

use of workplaces of employees performing non-critical work;

work from home or in remote premises.

When choosing an alternative premises, the bank takes into account, but is not limited to, the following features:

security of the premises;

access to the premises;

proximity to the main premises;

availability of necessary communications.

The bank determines measures to maintain the operability of information technology and communication services necessary to ensure business continuity.

The bank determines measures to ensure the integrity, availability and confidentiality of information necessary to ensure business continuity in the event of a critical event.

The bank determines the list of resources used (including material supply, financial resources) and measures to ensure their availability, including from external suppliers and counterparties and other interested parties in the event of a critical event, which includes:

storage of additional resources, including technological and telecommunication equipment, in warehouse premises;

agreements with the supplier on urgent delivery (replacement) of resources in the warehouse;

availability of alternative resource suppliers.

The bank ensures the development and availability of a plan(s) for ensuring continuity and (or) restoration of activities. The plan(s) for ensuring continuity and (or) restoration of activities meets (meet) the following principles:
understandable to responsible persons;
accessible for use by responsible persons;
has goals and scope corresponding to the business continuity management policy, including:

the list of the bank's critical activities, as well as the maximum allowable downtime, including those requiring restoration;

the target recovery time for critical activities, including for information technology and telecommunications;

measures to minimize the risk of loss of reputation;

is coordinated with the actions of external organizations;
contains a description of the functions and responsibilities of personnel involved in ensuring continuity and restoration of activities;
has an activation scheme, including:

the decision-making procedure for activation, including a list of employees responsible for confirming activation and the conditions under which activation of the plan is required;

the list of employees informed about the activation of the plan;

contains a scheme of emergency external and internal communications, paying attention to:

communications within the team of employees involved in recovery and emergency provision of critical products and services;

communications with external organizations involved in ensuring business continuity;

communications with the authorized body;

communications with the media and clients;

communications with counterparties and other interested parties during recovery work;

communication methods;

contains requirements for the minimum volume of resources and suppliers necessary at various points in time for the restoration and emergency provision of critical activities;
contains the sequence of actions for the restoration and continuous provision of critical activities, including:

the scheme for involving third-party organizations in the recovery process;

the scheme for involving counterparties and interested parties of the bank in the process of restoring the bank's activities;

the sequence and locations of restoration of the bank's critical activities;

the timing and locations of restoration of critical information technology services, as well as the sequence of actions for their restoration, including restoration of network infrastructure in a new building, restoration of basic functionality, applications and databases, synchronization, backup, telecommunications;

the timing and locations of mobilization of necessary resources;

contains all necessary detail, including the location of backup premises, travel routes, contacts of the authorized body and other government bodies and organizations involved in restoring the bank's operations, as well as means of communication with them;
contains a method for documenting key information on the progress of work, decisions taken and measures taken;
has a scheme for:

cancelling the emergency mode of operation, including criteria allowing a decision to be made to end work in emergency mode;

transition to the normal day-to-day functioning mode;

restoration of disrupted internal banking processes after elimination of the consequences of unforeseen circumstances;

has a single owner of the plan responsible for maintenance and revision.
The bank tests the plan(s) for ensuring continuity and (or) restoration of activity in order to determine that:
critical activities are protected regardless of the severity of the critical event;
these plans ensure the bank's activity under unforeseen circumstances and the transition to the normal day-to-day functioning mode.
The bank:
carries out testing and in the event of significant changes in the bank's activity;
carries out testing of both individual elements of the business continuity management system and in aggregate, in order to verify the reliability of the system as a whole;
plans testing in such a way as to minimize the impact of critical events that arise during testing;
determines the goals and objectives of each testing;
determines a group of observers (testing controllers) from among the bank's employees responsible for developing the plan(s) for ensuring continuity and (or) restoration of activity, employees performing internal control, and, if necessary, independent specialists from organizations specializing in providing consulting services in the field of ensuring business continuity and information security of the bank. The group of observers (testing controllers) carries out:

control over the execution of each test;

evaluation of testing results;

preparation of a protocol on the testing, its results and feedback, including necessary corrective actions;

agreement of the protocol with the heads of the bank's divisions involved in testing the plan(s) for ensuring continuity and (or) restoration of activity;

prepares and agrees a report on the results of the testing based on the agreed inspection protocol, which includes, among other things, an analysis of the testing results, proposals for eliminating identified deficiencies and improving the plans and other elements of the bank's business continuity management system.

The report on the results of the testing with proposals, if necessary, for improving the plan(s) for ensuring continuity and (or) restoration of activity is sent to the risk management committee for review and to the bank's board of directors for approval.

The bank's board of directors ensures the existence of a management information system, including but not limited to information on the status of implementation of procedures and processes for business continuity management, identified facts of violations of internal procedures and policies, incidents, results of inspections and plans to improve the bank's resilience and ability to restore certain operations.

Chapter 8. Information Technology Risk Management

The bank's board of directors ensures the existence of an information technology risk management system that corresponds to the external operating environment, strategy, organizational structure, asset volume, nature and level of complexity of the bank's operations and ensures minimization of information technology risks.
The information technology risk management system includes, but is not limited to, the following:
information technology risk management policy;
information technology risk management procedures;
management information system;
assessment of the effectiveness of the information technology risk management system by the internal audit division.
The bank determines the following participants in the information technology risk management system (but is not limited to them):
the bank's risk management division;
the information technology division.
The bank creates a structural division for risk management, whose functions include information technology risk management, including:
development, implementation and enhancement of the information technology risk management system;
participation in the development and agreement of action plans for implementing the bank's strategy in terms of ensuring the availability of information and communication technologies;
participation in the assessment of information technology risks;
monitoring the level of information technology risks;
interaction and consulting with the bank's structural divisions on information technology risk management issues;
planning and analysis of the results of the information technology risk assessment conducted by the information technology division;
development and formation of a risk register including information technology risks;
provision of reporting on the realization of material information technology risks and monitoring of the implementation of measures to eliminate their consequences to the risk management committee;
provision of reporting or other information on information technology risk management to the board of directors;
use of internal audit results in terms of information technology risks.
The bank creates a structural division for information technology, whose functions include:
conducting an assessment of information technology risks;
development of measures to treat information technology risks and provision of reporting on their implementation to the risk management division;
preparation and provision of reporting on the realization of material information technology risks to the bank's risk division, as well as on the elimination of their consequences;
development of action plans for implementing the bank's strategy in terms of ensuring the availability of information and communication technologies for critical business processes.

The bank ensures the independence of the structural division for risk management from the structural division for information technology.

The risk management division develops an internal document defining the procedure for information technology risk management, which includes, but is not limited to, the following:
1. procedures for identifying information technology risks;
2. procedures for determining internal and (or) external factors influencing the realization of each of the information technology risks;
3. procedures for assessing the probability and consequences of all identified information technology risks, applying qualitative and (or) quantitative assessment methods, including on the basis of data on their realization;
4. procedures for collecting and storing information on the realization of material information technology risks;
5. procedures for forming a risk register including information technology risks;
6. procedures for developing measures to treat information technology risks;
7. procedures for monitoring the implementation of measures to treat information technology risks.
The information technology division develops an action plan for implementing the bank's strategy in terms of ensuring the availability of information and communication technologies for critical business processes, which discloses, but is not limited to, the following:
determination of resource needs, including determination of the budget related to the development of information and communication technologies;
description of the required measures in the field of information and communication technologies, indicating the deadlines and those responsible for their implementation.

The bank ensures the existence of a management information system, including but not limited to the establishment of an internal procedure defining the criteria, composition and frequency of reporting on the bank's information technology risk management, and the responsible persons (divisions) for preparing and communicating information to the relevant recipients.

Chapter 9. Information Security Risk Management

The bank's board of directors ensures the existence of an information security risk management system that corresponds to the external operating environment, the bank's strategy, organizational structure, asset volume, nature and level of complexity of the bank's operations and is aimed at minimizing information security risks.
The information security risk management system includes, but is not limited to, the following:
1. information security risk management policy;
2. information security risk management procedures;
3. management information system;
4. assessment of the effectiveness of the information security risk management system by the internal audit division.
The bank determines the following participants in the information security risk management system (but is not limited to them):
the bank's risk management division;
the information security division;
the information technology division;
divisions that own the protected information.
The bank creates a structural division for risk management, whose functions include information security risk management:
development, implementation and enhancement of the information security risk management system;
participation in the development and agreement of action plans for implementing the bank's strategy in terms of ensuring information security;
creation and leadership of a working group to form the list of critical information assets of the bank, including at least the divisions that own the protected information;
participation in the assessment of information security risks;
monitoring the level of information security risks;
interaction and consulting with the bank's structural divisions on information security risk management issues;
planning and analysis of the results of information security risk assessments conducted by the information security division;
development and formation of a risk register including information security risks;
provision of reporting on the realization of material information security risks and monitoring of the implementation of measures to eliminate their consequences to the risk management committee;
provision of reporting or other information on information security risk management to the bank's board of directors;
use of internal audit results in terms of information security risks.
The bank creates a structural division for information security, whose functions include:
conducting an assessment of information security risks;
development of measures to treat information security risks and provision of reporting on their implementation to the risk management division;
preparation and provision of reporting on the realization of material information security risks to the bank's risk division, as well as on the elimination of their consequences;
development of action plans for implementing the bank's strategy in terms of ensuring information security.

The bank ensures the independence of the structural division for risk management from the structural division for information security.

The risk management division develops an internal document defining the procedure for information security risk management, which includes, but is not limited to, the following:
procedures for identifying and classifying information assets in order to identify critical information assets;
procedures for identifying vulnerabilities of critical information assets;
procedures for identifying potential threats to critical information assets;
procedures for identifying existing information security risk management measures;
procedures for assessing the probability and consequences of breach of confidentiality, integrity and availability of information assets, applying qualitative and (or) quantitative assessment methods, including on the basis of data on their realization;
procedures for collecting and storing information on the realization of material information security risks;
procedures for forming a risk register including information security risks;
procedures for monitoring the implementation of measures to treat information security risks.
The information security division develops an action plan for implementing the bank's strategy in terms of ensuring information security, which discloses, but is not limited to, the following:
determination of resource needs, including determination of the budget related to the implementation of measures aimed at managing information security risks;
description of the required measures in the field of information security, indicating the deadlines and those responsible for their implementation.
The divisions that own the protected information, within the framework of information security risk management, carry out:
1. provision of a description of the protected information to the risk management division;
2. formation of the list of critical information assets of the bank as part of the working group for forming the list of critical information assets of the bank under the leadership of the risk management division.
The bank ensures the existence of a management information system, including but not limited to the establishment of an internal procedure defining the criteria, composition and frequency of reporting on the bank's information security risk management, and the responsible persons (divisions) for preparing and communicating information to the relevant recipients.

Chapter 10. Compliance Risk Management

The bank's board of directors controls the bank's compliance risk management procedure, creates a compliance control division in the bank, appoints and dismisses the chief compliance controller, and approves the compliance risk management policy.

The compliance control division organizes procedures for compliance with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, the legislation of foreign states affecting the bank's activities, as well as the bank's internal documents regulating the procedure for the bank's provision of services and conduct of operations on the financial market, and provides complete and reliable information to the board of directors on the existence of compliance risk.

The risk management committee is responsible for developing the compliance risk management policy, subject to approval by the board of directors and containing the main principles of compliance risk management, including the principles for creating a compliance culture in the bank, on the basis of which compliance risk is identified and managed at all levels of the bank's structure.

The compliance control division is responsible for developing the compliance risk management policy, ensuring compliance risk management and coordinating the bank's activities on compliance risk management.

The compliance control division is a structural division of the bank independent of any activity of the bank's structural divisions constituting the first line of defense.

The independence of the compliance control division is ensured by the following factors:

the compliance control division has the status of an independent structural division;

employees of the compliance control division do not hold positions on a part-time basis in other structural divisions of the bank;

the head and employees of the compliance control division are not placed in a situation where a conflict of interest is possible between their compliance risk management duties and any other duties assigned to them;

employees of the compliance control division, within their competence, have access to and, if necessary, require any information from the bank's structural divisions, the bank's subsidiaries, and also engage employees of the bank and its subsidiaries to assist in performing the compliance control function.

The compliance control division performs, but is not limited to, the following functions:
development of an internal procedure, methods and procedures for identifying, measuring, monitoring and controlling the bank's compliance risk on a consolidated basis;
development, implementation and maintenance of internal control rules for the purposes of countering ML/FT;
formation of a compliance program (plan), which includes, among other things:

verification of compliance by the bank's divisions with the compliance risk management policy taking into account the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies;

verification of compliance by the bank with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, regulating the issues of the bank's provision of services and conduct of operations on the financial market, as well as the legislation of foreign states affecting the bank's activities in order to determine the degree of the bank's exposure to compliance risk;

personnel training on compliance risk management issues;

assistance to the bank's management board in managing the bank's compliance risk;
consulting the bank's management and employees on the norms of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on countering the legalization (laundering) of proceeds from crime and the financing of terrorism, on joint-stock companies, rules and policies related to compliance risk management, including informing about changes, except in cases where such a function is performed by the bank's legal division;
control over the organization in the bank of work to familiarize the bank's employees with the requirements of the bank's internal documents regulating the procedure for the bank's provision of services and conduct of operations on the financial market;
coordination of the activities of the bank's subsidiaries on compliance risk management issues, including ML/FT risk;
mandatory participation in the process of introducing new banking products and services;
ensuring the organization in the bank of measures to identify, assess and control conflicts of interest;
development, independently or jointly with the bank's structural divisions and officials, of recommendations for eliminating identified violations and deficiencies in the bank's work related to compliance risk management and submission of relevant information to the bank's board of directors;
development and maintenance of a compliance risk reporting system and provision on a periodic basis of information on the bank's compliance risk management issues to the bank's board of directors;
development of an internal procedure for interaction and coordination of compliance risk management work with the bank's structural divisions, including with the internal audit division.

Certain compliance risk management functions, in accordance with the bank's internal documents, are delegated, if necessary, to other structural divisions of the bank, provided there is no conflict of interest.

The independence of the chief compliance controller is determined by:
1. regardless of subordination, the chief compliance controller is appointed and dismissed by the bank's board of directors;
2. has unhindered access to the bank's board of directors, without the participation of the bank's management board;
3. has access to any information necessary for the performance of his duties;
4. does not combine the position of chief operating officer, financial director, other similar functions of the bank's operational activities, or head of the internal audit division.

Combining the functions of the chief compliance controller and the head of the compliance control division is permitted.

Interaction between the chief compliance controller and the board of directors and (or) the risk management committee is carried out on a regular basis.

Information on the appointment and dismissal of the chief compliance controller is communicated to the authorized body.

At the request of the authorised body, the bank's board of directors shall provide justification for the reason for adopting such a decision.

The bank shall identify, measure, monitor and control compliance risk and shall develop compliance risk management procedures which include, but are not limited to, the following:
development of internal guidelines (instructions) for the bank's employees on compliance risk management matters, including AML/CFT risk, through the preparation of internal documents;
monitoring of compliance by the bank and its employees with compliance risk management policies and procedures;
collection of data on compliance risk events;
analysis of client complaints (applications) for the presence of compliance risk;
development and analysis of quantitative and qualitative indicators characterising the degree of the bank's exposure to compliance risk;
conducting investigations (reviews), independently or jointly with the bank's structural subdivisions and (or) officials, of facts of violations by the bank's employees of the legislation of the Republic of Kazakhstan regulating the provision of services by the bank and the conduct of operations on the financial market, as well as of the legislation of foreign states affecting the bank's activities, in accordance with the procedure determined by the bank's internal document;
provision of consultations upon requests regarding the compliance of a specific operation (transaction) of the bank or part thereof with the legislation of the Republic of Kazakhstan regulating the provision of services by the bank and the conduct of operations on the financial market, as well as with the legislation of foreign states affecting the bank's activities.
When developing procedures for identifying, measuring, monitoring and controlling compliance risk, the bank shall take into account, but not be limited to, the following factors:
the volume of the bank's assets, the nature and complexity of the bank's business;
the availability of data for use as source information;
the state of information systems and their capabilities;
the qualifications and experience of personnel involved in the compliance risk management process.
The bank shall ensure the existence of a compliance risk management system which takes into account:
1. the bank's strategy and types of activity;
2. the volume of the bank's assets, the nature and complexity of the bank's business;
3. the complexity of the bank's organisational structure;
4. the level and types of risks inherent in the bank's activities;
5. the effectiveness of the compliance risk management procedures applied by the bank in the past;
6. potential internal organisational changes and (or) changes in market conditions;
7. the legislation of the Republic of Kazakhstan regulating the provision of services by the bank and the conduct of operations on the financial market, as well as the legislation of foreign states affecting the bank's activities.
The compliance risk management system includes, but is not limited to, the following:
the compliance risk management policy and procedures;
the AML/CFT risk management policy and procedures, including a customer acceptance policy. When developing and implementing procedures for deciding whether to accept a client for servicing, the bank shall take into account the inherent risk factors;
assessment of the effectiveness of the compliance risk management system by the internal audit subdivision.

The compliance risk management system is based on 3 (three) lines of defence:

bank employees;

the compliance control subdivision;

the internal audit subdivision.

The compliance risk management policy and procedures include, but are not limited to, the following:
1. the goals and objectives of compliance risk management;
2. the principles of compliance risk management, including the principles of creating a compliance culture in the bank (a culture of compliance by the bank and its employees with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organisations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalisation (laundering) of proceeds of crime and the financing of terrorism, on joint-stock companies, the legislation of foreign states affecting the bank's activities, and the bank's internal documents regulating the procedures for the provision of services by the bank and the conduct of operations on the financial market);
3. the internal procedure, methods and procedures for compliance risk management, including those based on a risk-oriented approach;
4. the internal procedure, methods and procedures for managing the risks of intentional or unintentional involvement of the bank and (or) its subsidiary organisations in AML/CFT processes, or other criminal activity (AML/CFT risk);
5. the participants in the compliance risk management system based on 3 (three) lines of defence, their powers and responsibility with a clear definition of the reporting structure;
6. the powers and responsibility of the chief compliance controller and the head of the compliance control subdivision;
7. requirements for the professional qualities of employees of the compliance control subdivision;
8. procedures for controlling and coordinating the activities of the bank's subsidiary organisations on compliance risk management matters;
9. the internal procedure for interaction and exchange of information between participants in the compliance risk management system.
The AML/CFT risk management policy and procedures include, but are not limited to, the following:
development and implementation of internal documents regulating the procedure for AML/CFT risk management, the conduct of financial monitoring and internal control for the purposes of countering AML/CFT;
the methodology for assessing AML/CFT risks in accordance with the bank's rules on internal control for the purposes of countering AML/CFT;
the internal procedure for organising the management of the bank's risks in the context of its structural subdivisions and (or) employees in the AML/CFT part;
the existence of a customer acceptance policy;
when developing and implementing procedures for deciding whether to accept a client for servicing, the bank shall take into account risk factors, including those identified and posted on the internet resource of the authorised body.

Internal procedures and the procedure for refusing to establish and for terminating business relationships with a client shall be developed taking into account the risk factors posted on the internet resource of the authorised body. Information on instances of refusal to establish and of termination of business relationships shall be sent to the authorised body quarterly, no later than the 5th (fifth) day of the month following the reporting quarter;

the existence of an automated information system and procedures which make it possible to identify operations subject to financial monitoring, as well as to promptly send the relevant data and information to the Committee for Financial Monitoring of the Ministry of Finance of the Republic of Kazakhstan.

Chapter 11. Internal Control

The bank shall ensure the existence of an internal control system which corresponds to the current market situation, strategy, volume of assets and level of complexity of the bank's operations. Internal control is a process built into day-to-day activities carried out by the bank's authorised bodies, structural subdivisions and all employees of the bank in the performance of their duties, and aimed at achieving the following goals:
ensuring the effectiveness of the bank's activities, including the effectiveness of managing banking risks, assets and liabilities, and ensuring the safekeeping of assets;
ensuring the completeness, reliability and timeliness of financial, regulatory and other reporting for internal and external users, as well as information security;
ensuring the bank's compliance with the requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organisations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalisation (laundering) of proceeds of crime and the financing of terrorism, on joint-stock companies, and the bank's internal documents;
preventing the involvement of the bank and its employees in the conduct of unlawful activity, including fraud, errors, inaccuracies, deception, legalisation (laundering) of proceeds of crime and financing of terrorism, in the conduct of operations on the territory of the Republic of Kazakhstan connected with quantities created and recorded in a decentralised information system using cryptography and (or) computer computations which, in accordance with the civil legislation of the Republic of Kazakhstan, are not financial instruments or financial assets and do not contain a right of claim against anyone.

Effective internal control is ensured through the formation of proper management control and a control culture (control environment).

Management control and control culture (control environment) characterise the general attitude, awareness and practical actions of the bank's board of directors and the bank's management board aimed at creating and effectively operating the internal control system.

Management control and control culture (control environment) are formed by the board of directors and the management board of the bank on the basis of adherence to ethical principles, standards of professional activity and corporate governance, which, together with their legally established duties and responsibility, ensure adequate control on the part of the bank's management bodies, including control over:
the organisation of the bank's activities, including the development and implementation of the bank's strategy and the bank's internal documents;
the functioning of the banking risk management system and the assessment of banking risks;
the distribution of powers when performing banking operations and other transactions;
the management of information flows (receipt and transmission of information) and ensuring information security;
the creation and functioning of the internal control system.
The bank shall ensure the existence and functioning of the bank's internal control system, which includes, but is not limited to, the following:
the principles of organising the internal control system;
requirements for the professional qualities of employees;
the internal procedure and procedures for carrying out internal control;
determination of the participants in the internal control system based on three lines of defence, their powers and responsibility with a clear definition of the reporting structure;
the internal procedure for interaction and exchange of information between participants in the internal control system across the three lines of defence;
the internal procedure for making changes to the bank's internal documents in cases of detection of deficiencies in the course of carrying out internal control.

The bank's internal control system is based on the following principles:

participation in the internal control process of all structural subdivisions and employees of the bank and the organisation of internal control as a day-to-day activity at all levels of management;

coverage by internal control of all areas of activity and business processes and regulation of internal control procedures for all areas and business processes of the bank;

carrying out internal control on an ongoing basis (continuity).

The bank shall determine the participants in the internal control system based on three lines of defence:
the first line of defence is ensured by the bank's structural subdivisions themselves. Heads of structural subdivisions are responsible for the organisation and implementation of internal control in the structural subdivision;
the second line of defence is ensured by the risk management subdivisions, compliance control, the legal subdivision, the human resources subdivision, the subdivision (persons) performing the functions of financial control, and other structural subdivisions of the bank performing control functions;
the third line of defence is ensured by the internal audit subdivision through an independent assessment of the effectiveness of the internal control system.
The bank shall develop procedures for carrying out internal control based on the following interrelated elements:
control over risk management;
control actions and separation of powers;
information and interaction;
monitoring and correction of deficiencies.
The internal control system shall ensure control over the timely identification and ongoing assessment of risks inherent in the bank and the taking of timely measures to minimise material risks in accordance with the bank's internal documents. The internal control system shall ensure, but is not limited to, the following:
consideration and taking into account, during risk assessment, of internal factors (the complexity of the bank's organisational structure, the nature of its activities, the qualitative characteristics of personnel, organisational changes, staff turnover), as well as external factors (changes in economic conditions and the situation in the banking sector, technological innovations) which negatively affect the achievement of the bank's goals;
carrying out risk assessment for individual areas of the bank's activity;
the bank's conduct of new operations and services provided that they are regulated in the bank's internal documents;
ensuring timely notification of the persons (subdivisions, bodies of the bank) defined in the relevant internal documents of the bank about factors affecting the level of the bank's exposure to risks.

The internal control system shall be adjusted as any new or uncontrolled material risks are identified, including those related to the introduction of new services and products.

Control actions include, but are not limited to, the following:
control exercised by the bank's board of directors, board of directors' committees and the bank's management board in order to identify and eliminate internal control deficiencies, violations and errors;
control exercised by heads of structural subdivisions;
control of the physical presence of and access to material valuables, and ensuring the protection of premises for storing material valuables;
verification of compliance with established limits;
a system for approving and delegating rights and powers;
verification of the timely and correct recording of the bank's operations and transactions in accounting and reporting;
verification of compliance with the bank's policies and procedures when performing operations and transactions.

Control actions within the framework of separation of duties help minimise conflicts of interest and the conditions for their occurrence, the commission of unlawful actions, and also prevent giving one and the same structural subdivision and (or) employee the opportunity to:

perform banking operations and other transactions and simultaneously record them in accounting;

authorise the payment of money and carry out its actual payment, taking into account the limits established by the bank's internal documents;

conduct operations on the accounts of the bank's clients and on accounts reflecting the bank's own financial and economic activities;

assess the reliability and completeness of documents submitted when granting a loan and monitor loan repayment;

perform actions in any other areas of activity in which a conflict of interest arises.

Depending on the bank's operations, the following control methods are applied:

dual control (the "four eyes" and "joint access" principles).

The "four eyes" principle requires that the work of one employee be checked (approved) by another employee in order to involve the second employee in verifying the correctness of the calculation, authorisation and documentation of the operation.

The "joint access" principle presupposes a procedure under which 2 (two) or more employees are equally responsible for the physical protection of valuables and documents. Responsibility is established by the relevant internal document of the bank and is communicated to all employees;

analysis of operations.

Preliminary analysis of an operation for the purpose of preventing an incorrect or unauthorised operation.

Subsequent analysis after its completion for the purpose of uncovering the fact of an unauthorised operation.

To ensure the effectiveness of the subsequent analysis, it is necessary that the person carrying out the subsequent analysis be independent of the employees conducting that operation;

reports on the results of operations to provide the bank's management with information on the bank's performance indicators, financial conditions and deviations from the budget;

training of the bank's personnel in control techniques and error detection;

ensuring data protection;

ensuring protection against personnel errors;

checking for errors in order to detect them in a timely manner.

From the standpoint of internal control, the availability of reliable and detailed information of a financial and operational nature and data on compliance with the established requirements of the civil, tax, banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control and supervision of the financial market and financial organisations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activity, on compulsory deposit insurance, on countering the legalisation (laundering) of proceeds of crime and the financing of terrorism, on joint-stock companies, as well as incoming external market information on events and conditions relevant to decision-making, shall be ensured. The collection and analysis of information and its transmission to the intended recipients presupposes ensuring:
that the bank's board of directors, the bank's management board and the persons (subdivisions, bodies of the bank) defined in the relevant internal documents are provided with information for making decisions and performing their duties;
the existence of information flows ensuring the integrity, security and availability of information inside and outside the bank;
adequate control over the management of information flows and the bank's information security.

Internal control over the functioning of information systems and technical means provides for control of information technology systems carried out in order to ensure their security, uninterrupted and continuous operation.

From the standpoint of internal control, mandatory recording of all the bank's operations and transactions shall be ensured.

Control over ensuring the timeliness, reliability and sufficiency of the bank's financial information requires verification of the following (but is not limited to them):

information systems ensuring the maintenance of accounting in the bank for compliance with the legislation of the Republic of Kazakhstan in the field of accounting and financial reporting and IFRS;

the existence in the bank of internal documents on accounting matters;

ensuring chronological and timely registration of operations and events in accounting;

ensuring the possibility of generating financial statements as at the end of each operating day;

compliance of synthetic (summary) accounting with analytical (detailed) accounting;

conducting regular checks of accounting records by employees who are not involved in the process of authorising or recording operations in the financial statements;

making accounting entries on the basis of primary documents and ensuring the proper execution and safekeeping of primary documents.

Ongoing monitoring of the bank's internal control system is carried out by the first and second lines of defence, as well as by the bank's management board.

Material deficiencies in internal control shall be brought to the attention of the bank's board of directors.

The internal audit subdivision shall assess the effectiveness of internal control.

The Risk Management Committee shall exercise control over the functioning of the internal control system.

The bank's management reporting on internal control includes information on material violations and deficiencies identified in the course of carrying out internal control, as well as on the results of decisions or measures taken to eliminate them.

Chapter 12. Internal Audit

The bank shall ensure the functioning of internal audit taking into account the strategy, organisational structure, volume of assets, nature and level of complexity of the bank's operations. The internal audit subdivision has clearly defined powers, is independent in its activities, and reports to the bank's board of directors. The internal audit subdivision has sufficient resources and powers to perform its functions and duties objectively and with quality.

The head and employees of the internal audit subdivision shall not hold any other position, shall not be members of a collegial body of the bank, and shall not combine duties in the bank and (or) subsidiary organisations.

The internal audit subdivision shall be guided in its activities by international internal audit standards.

The bank's board of directors and the audit committee shall contribute to improving the efficiency of the internal audit unit's work by:
ensuring unrestricted access for employees of the internal audit unit to any documents, information and objects of the bank, including access to systems, records and minutes of meetings of the bank's collegial bodies;
establishing requirements for the internal audit unit to conduct an independent assessment of the effectiveness of the internal control system, the risk management system, and corporate governance in all areas of the bank's activity;
establishing a requirement for internal auditors to comply with the code of ethics and the requirements of the banking legislation of the Republic of Kazakhstan and the legislation of the Republic of Kazakhstan on joint-stock companies;
establishing requirements for employees of the internal audit unit to have sufficient knowledge of banking activity and internal audit methods, skills in collecting necessary and sufficient information, and the ability to conduct analysis and assessment to perform their job duties;
establishing a requirement for the bank's management board to timely and effectively implement the action plan to eliminate violations and deficiencies identified as a result of the audit;
the requirement to conduct periodic assessment of the effectiveness of the bank's risk management system, the internal accounting procedure, the preparation and ensuring of the integrity of financial and regulatory reporting, the compliance risk management system, and the internal control system.

The internal audit unit shall carry out an independent, comprehensive assessment of the effectiveness of the corporate governance, internal control, and risk management systems.

The internal audit unit shall use a risk-based approach when developing its plans and actions, form an independent, reasoned opinion regarding the risks inherent in the bank's activity, and conduct appropriate assessments of internal processes.

The effective operation of the internal audit unit is based on the following principles:
independence and objectivity, which are achieved through the following:

conducting audits in any of the bank's units and in any areas of activity on the basis of a risk-based approach;

the absence of involvement of the internal audit unit in the development, implementation and application of internal control measures;

the absence of a conflict of interest in the activities of employees of the internal audit unit;

rotation of duties performed among employees of the internal audit unit where this can be carried out without detriment to the competence and professionalism of the employees;

the absence of a link between the remuneration of employees of the internal audit unit and the financial results of the bank's structural units. The bonus portion of the remuneration of the head and employees of the internal audit unit shall be established in such a way as to exclude the occurrence of a conflict of interest and not to cast doubt on the independence and objectivity of the internal audit unit;

providing the internal audit unit's reports for consideration by the board of directors and the audit committee, and for familiarization without the right to adjust such reports – to the bank's management board;

the head of the internal audit unit shall report directly to the bank's board of directors, which appoints him to the position, monitors his activity and, if necessary, decides on his dismissal;

information on the adoption of a decision to dismiss the head of the internal audit unit shall be communicated to the authorized body. Upon receipt of a request from the authorized body, the bank shall provide an explanation of the reasons for adopting such a decision;

professional competence and professional due care, which meet the following characteristics:

the ability of employees of the internal audit unit to collect and perceive information, verify and evaluate identified facts and interact with employees of the internal audit unit;

the responsibility of the head of the internal audit unit for staffing the employees, and constant monitoring and assessment of the required level of skills;

the level of qualification and skills of employees of the internal audit unit and (or) engaged external experts that meets the requirements of professional competence, and the ability to carry out internal audit of the audited areas of the bank's activity at the proper level;

advanced training in order to keep up with changes in the internal and external environment;

professional ethics, which meets the following principles:

conscientious performance of job duties by employees of the internal audit unit, their responsibility, integrity and honesty;

maintaining the confidentiality of information obtained in the course of performing job duties;

exclusion of the occurrence of a conflict of interest. Employees of the internal audit unit hired from among the bank's employees shall not be allowed, for the subsequent 12 (twelve) months from the day of their transfer to the internal audit unit, to conduct an audit of the unit in which they worked;

employees of the internal audit unit shall comply with the requirements of internal documents, the banking legislation of the Republic of Kazakhstan, and the legislation of the Republic of Kazakhstan on joint-stock companies.

The bank shall approve a regulation on the internal audit unit in order to ensure the efficiency of its activity. The regulation includes, but is not limited to, the following:
the status of the internal audit unit in the bank, its powers, duties and the internal procedure for interaction with other units of the bank;
the tasks and scope of activity of the internal audit unit;
the duties of the internal audit unit to inform the board of directors, the management board and other interested units of the bank about the results of the work performed;
the conditions under which the internal audit unit provides consultations;
the responsibility and accountability of the head of the internal audit unit;
the requirement to be guided by international internal audit standards;
the procedures for interaction of the internal audit unit with the bank's external auditor;
the powers of the internal audit unit in the course of its activity (including checking any unit and type of activity of the bank and its subsidiary organizations, unrestricted access to the bank's documents, data, tangible objects, management reporting, records and minutes of all meetings and conferences, and decisions adopted).
The scope of activity of the internal audit unit includes assessment of:
the effectiveness of the risk management and internal control system;
the effectiveness of the bank's policies and procedures;
the reliability of the accounting and information system;
the reliability, effectiveness and integrity of management reporting systems (including the relevance, accuracy, completeness, accessibility, confidentiality and comprehensiveness of data);
the safekeeping of assets and capital.
The activity of the internal audit unit shall properly cover all issues of regulation of the bank's activity (on the basis of a risk-based approach), in particular:
risk management, including:

assessment of the organization of the risk management process, including the duties of structural units;

assessment of the bank's compliance with the risk appetite strategy and the procedures for determining risk appetite;

assessment of the effectiveness of the internal procedure for informing and disseminating issues and decisions adopted within the framework of risk management;

assessment of the effectiveness of risk management systems, including identification, assessment, monitoring and control, response, and reporting on risks arising in the bank's activity;

assessment of the process of generating data in information systems used within the framework of risk management for the purpose of ensuring accuracy, reliability and completeness;

assessment of the process of approval and application of risk assessment models, including verification of the consistency of approaches, the relevance, independence and reliability of data sources used in these models.

If, during audits by the internal audit unit, material facts are identified of decisions being adopted by the bank's management board in the presence of a negative opinion of the risk management unit(s), such facts shall be communicated by the internal audit unit to the bank's board of directors;

the internal control system, including:

verification of the organization of the internal control system;

assessment of internal control processes and procedures;

assessment of management information on internal control for reliability, completeness and timeliness;

capital and liquidity adequacy, including:

assessment of the effectiveness of internal processes for assessing capital and liquidity adequacy, the adequacy of the ratio of capital, liquidity and risks assumed by the bank, and compliance with mandatory ratios;

assessment of stress testing processes for the level of capital and liquidity, taking into account the frequency of stress tests, the objectives of testing, the realism of scenarios and assumptions made, and the reliability of the processes;

regulatory and management reporting.

The internal audit unit shall assess the effectiveness of risk management processes and the preparation of reporting for the bank's management and the authorized body;

compliance.

Assessment of the effectiveness of processes and procedures for managing compliance risk and ML/TF risk;

the activity of the financial block:

assessment of the process of generating initial financial data for the purpose of ensuring their adequacy, accuracy and completeness, and the subsequent transfer of key data, including financial results, valuation of financial instruments and their impairment;

assessment of the process of approval and application of pricing models, including verification of the consistency of approaches, the relevance, independence and reliability of data sources used in these models;

assessment of existing control mechanisms to prevent and detect violations of the rules for conducting operations;

assessment of the bank's procedures for measuring and monitoring banking positions in liquidity, currency and interest rate for compliance with the bank's risk profile, the external environment and minimum regulatory requirements;

sample testing of the bank's transactions for their compliance with policies and procedures during the audit and assessment of the effectiveness of internal control measures in relation to these transactions;

assessment of the effectiveness of accounting processes, including control procedures.

Based on the results of audits, an internal audit report shall be formed, which contains, but is not limited to, the following:
general information, including the objectives, scope, timing of the audit, and information on the composition of the audit team;
a list of violations and deficiencies identified during the audit, indicating the causes that gave rise to the violations and deficiencies, and their impact on the bank's activity;
recommendations for eliminating the identified violations and deficiencies;
a list of persons to whom the audit report is sent.

The internal audit report shall be sent to the bank's management board for familiarization, and the identified material facts and conclusions drawn shall be sent for consideration by the audit committee and the bank's board of directors.

The head of the internal audit unit shall be responsible for preparing an annual audit plan on the basis of a risk-based approach, which contains, but is not limited to, the following:
the objectives and scope of the audit;
the areas subject to audit;
the timing of the audit;
the necessary human and other resources.

The annual audit plan shall be based on a risk assessment and shall be revised during the year if necessary.

Chapter 13. Outsourcing

In the case of engaging external contractors for outsourcing to perform certain operations and (or) carry out business processes, the bank's board of directors shall ensure the existence of effective principles and practices for managing the risks arising as a result of engaging external contractors. Measures for engaging external contractors include:
procedures for determining which functions are transferred to outsourcing and in what manner;
processes for verifying the reliability of the financial condition of the company when selecting potential counterparties;
sound principles for concluding contracts with external contractors, taking into account their ownership structure, confidentiality conditions and providing for the right to terminate contracts;
programs for managing and monitoring the risks associated with concluding such contracts, taking into account the financial position of the service provider;
creating conditions for effective control in the bank and in the organization providing the services;
developing effective contingency plans;
performance of comprehensive contracts and (or) service agreements with a clear distribution of responsibilities between the organization providing the services and the bank.

Appendix

to the Resolution of the Board

of the National Bank

of the Republic of Kazakhstan

dated "12" November 2019 No. 188

List of normative legal acts of the Republic of Kazakhstan, as well as structural elements of certain normative legal acts of the Republic of Kazakhstan, recognized as no longer in force

Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 26 February 2014 No. 29 "On approval of the Rules for forming the risk management and internal control system for second-tier banks" (registered in the Register of state registration of normative legal acts under No. 9322, published on 17 April 2014 in the information and legal system "Adilet").
Paragraph 22 of the List of normative legal acts of the Republic of Kazakhstan to which amendments and additions are made, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 27 August 2014 No. 168 "On introducing amendments and additions to certain normative legal acts of the Republic of Kazakhstan" (registered in the Register of state registration of normative legal acts under No. 9796, published on 12 November 2014 in the information and legal system "Adilet").
Paragraph 4 of the List of certain normative legal acts of the Republic of Kazakhstan to which amendments and additions are made on issues of regulation of the financial market, payments and payment systems, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 29 October 2018 No. 267 "On introducing amendments and additions to certain normative legal acts of the Republic of Kazakhstan on issues of regulation of the financial market, payments and payment systems" (registered in the Register of state registration of normative legal acts under No. 18123, published on 11 January 2019 in the Reference Control Bank of normative legal acts of the Republic of Kazakhstan).

Lineage: No known changes

Timeline

What changed in the obligations

Similar documents from other regulators