Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 9 of 28 February 2022 on Amendments and Additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 34 of 28 January 2016 on Approval of Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations

"NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN" REPUBLICAN STATE INSTITUTION		REPUBLICAN STATE INSTITUTION "NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN"
RESOLUTION OF THE BOARD 28 February 2022 Nur-Sultan city		RESOLUTION OF THE BOARD No. 9 Nur-Sultan city

On Amendments and Additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 34 of 28 January 2016

"On Approval of Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations"

The Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. To introduce into Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 34 of 28 January 2016 "On Approval of Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations" (registered in the Register of State Registration of Normative Legal Acts under No. 13256) the following amendments and additions:

in the Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations, approved by the said resolution:

paragraph one of point 2 shall be stated in the following wording:

"2. The Requirements use the concepts provided for by Article 1 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", Article 1 of the Law of the Republic of Kazakhstan "On Informatization", the Rules for the Provision by Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations of Electronic Banking Services, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 212 of 31 August 2016, registered in the Register of State Registration of Normative Legal Acts under No. 14337 (hereinafter – Rules No. 212), as well as the following concepts:";

points 5 and 6 shall be stated in the following wording:

"5. To ensure the protection of data from unauthorized access, the internal documents of the bank shall establish the procedure for the storage and use of technical means, passwords or other information providing access to the workplace.

6. The internal documents of the bank shall approve the procedure for access to resources (disk space, directories, network resources, databases) allocated for the accumulation of information therein for transmission to the information system, receipt of information from the information system, storage, archiving or other processing of information.";

chapter 3 shall be stated in the following wording:

"Chapter 3. Requirements for the Internal Documents of the Bank on the Structure and Functioning of the Information System

11. The internal documents of the bank on the structure and functioning of information systems shall approve:

1) the list of information systems and their objects, their purpose and main characteristics, requirements for the number of hierarchy levels and the degree of centralization of systems, including the list of functions and tasks for each object of the information system;

2) requirements for methods and means of communication for information exchange between components of information systems;

3) plans for the restoration of the operation of information systems (hereinafter – restoration plan);

4) requirements for the modes of functioning of information systems;

5) requirements for monitoring the functioning of information systems;

6) requirements for the classification, number and mode of work of responsible employees of the restoration team.

12. The internal documents of the bank on the structure and functioning of information systems shall be subject to review for updating on a periodic basis determined by the bank, but not less than once a year.";

shall be supplemented with points 18-1 and 18-2 of the following content:

"18-1. The bank shall ensure the presence of at least one backup center located in a different populated area (capital, city of republican significance, city of regional significance, city of district significance) than the main center, guaranteeing the resumption of the provision of payment services by the bank within the period established by part three of point 23 of the Requirements.

The increase of the periods established by part three of point 23 of the Requirements shall be carried out in the presence of sufficient grounds affecting the periods of resumption of the provision of payment services, with simultaneous notification of the National Bank.

The main and backup centers of the bank shall be located on the territory of the Republic of Kazakhstan.

18-2. The bank shall provide each center (main and backup) with two dedicated communication channels from different communication service suppliers (providers).";

point 22 shall be stated in the following wording:

"22. Based on the results of testing the Plan, the bank shall prepare a document on the test results (protocol) indicating:

1) the list of information systems and their objects for which testing was conducted, as well as the location of the main and backup centers;

2) the time spent on restoring the operation of information systems and their objects;

3) identified vulnerabilities and proposals for their elimination.

Information on the test results shall be submitted by the bank to the National Bank of the Republic of Kazakhstan (hereinafter – the National Bank) within fifteen working days after approval of the document on the test results by the authorized body of the bank.";

shall be supplemented with point 26 of the following content:

"26. In order to organize the resumption of clients' access to payment services, the bank shall provide to the National Bank through secure communication channels a list of current unique numeric identifiers (IP addresses) of information systems located in both the main and backup centers. In case of change of the unique numeric identifiers (IP addresses) of information systems located in both the main and backup centers, the bank shall immediately inform the National Bank through secure communication channels.

The National Bank together with banks shall carry out the necessary measures related to the resumption of clients' access to payment services, including during a state of emergency.".

2. Banks, branches of non-resident banks of the Republic of Kazakhstan and organizations carrying out certain types of banking operations shall ensure compliance with the requirements for the placement of the main and backup centers of information systems on the territory of the Republic of Kazakhstan within three years from the day of entry into force of this resolution.

3. The Department of Payment Systems (Ashykbekov Ye.T.) shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:

1) together with the Legal Department (Kasenov A.S.) state registration of this resolution[1] with the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on the official internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this resolution, submission to the Legal Department of information on the implementation of the measure provided for by subparagraph 2) of this point.

4. Control over the execution of this resolution[2] shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan Sholpankulov B.Sh.

5. This resolution shall enter into force upon the expiration of ten calendar days after the day of its first official publication.

Chairman	G. Pirmatov

Correct:

Chief Specialist-Secretary of the Board Zh. Mukhambetova

1. On Amendments and Additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 34 of 28 January 2016 "On Approval of Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations" ↑
2. On Amendments and Additions to Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 34 of 28 January 2016 "On Approval of Requirements for the Security and Continuity of Operation of Information Systems of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan and Organizations Carrying Out Certain Types of Banking Operations" ↑