Resolution of the National Bank of the Kyrgyz Republic No. 78/22 of December 23, 2015 on Amendments and Additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic No. 37/5 of December 15, 2005

NATIONAL BANK OF THE KYRGYZ REPUBLIC

RESOLUTION

of December 23, 2015 No. 78/22

On Amendments and Additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic" dated December 15, 2005 No. 37/5

On Amendments and Additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic" dated December 15, 2005 No. 37/5

In accordance with Articles 7 and 43 of the Law of the Kyrgyz Republic "On the National Bank of the Kyrgyz Republic",

The Board of the National Bank of the Kyrgyz Republic

RESOLVES:

1. Make the following amendments and additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic" dated December 15, 2005 No. 37/5 (attached).

2. The Legal Department:

• publish this Resolution on the official website of the National Bank of the Kyrgyz Republic;

• after official publication, send this Resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Legal Acts of the Kyrgyz Republic.

3. This Resolution shall enter into force upon the expiration of two months from the date of its official publication.

4. The Supervision and Licensing Methodology Department shall bring this Resolution to the attention of commercial banks, the State Development Bank of the Kyrgyz Republic, regional departments, and the representative office of the National Bank of the Kyrgyz Republic in the Batken region.

5. Control over the implementation of this Resolution shall be entrusted to the Deputy Chairman of the National Bank of the Kyrgyz Republic L.Dz. Orozbaeva.

Chairman	T. Abdygulov

Appendix

AMENDMENTS AND ADDITIONS in the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic" dated December 15, 2005 No. 37/5

Make the following amendments and additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On Approval of the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic" dated December 15, 2005 No. 37/5:

in the Regulation "On Minimum Requirements for Operational Risk Management in Commercial Banks of the Kyrgyz Republic", approved by the aforementioned Resolution:

• in paragraph 1.1, replace the abbreviation "NBKR" with the words "National Bank of the Kyrgyz Republic (hereinafter - the National Bank)";

• supplement paragraph 1.2 with the following paragraph:

"Commercial banks carrying out operations in accordance with the principles of Islamic banking and financing shall be guided by this Regulation in order to comply with the operational risk management standards established by the Regulation "On Minimum Requirements for Risk Management in Banks Carrying Out Operations in Accordance with the Principles of Islamic Banking and Financing", approved by the Resolution of the Board of the National Bank dated December 28, 2009 No. 51/5.";

• rephrase paragraph 2.1 as follows:

"2.1. The bank must develop and approve an operational risk management policy with the Board of Directors of the bank, corresponding to the scale, risk profile, systemic significance, and capital size of the bank.

The operational risk management policy may be presented as a separate document or may be part of a unified risk management policy and must at least include:

• goals and objectives of operational risk management;

• main principles of operational risk management;

• main types of operational risks taking into account all areas of the bank's activities and the causes of their occurrence;

• distribution of powers and responsibilities at all levels of management and monitoring of operational risk;

• methods for identifying, assessing, monitoring, controlling, and minimizing operational risk;

• procedures for reporting and exchanging information on operational risk management.";

• rephrase the sixth paragraph of paragraph 2.3 as follows:

"- for outsourcing. Outsourcing is understood as the bank's attraction of external service providers to perform on a continuous basis certain types of work and services that would normally be carried out by the bank itself. The bank cannot use outsourcing for operations related to lending, attracting deposits, or other banking operations for which a license is required;";

in the seventh paragraph, replace the word "including," with the word "including";

• rephrase paragraph 2.4 as follows:

"2.4. The operational risk management policy must be reviewed periodically, at least once a year, and the bank's procedures and other internal documents on operational risk management must be reviewed as necessary, but at least once every two years, taking into account the achieved level of operational risk management in the bank and international experience, fully integrated into the bank's overall risk management process, and also brought to the attention of all bank employees in a timely manner.";

• in paragraph 2.5, after the words "activities of the bank", supplement with the words ", and also carries out control over the effective implementation by the Board of the bank of policies and procedures for operational risk management";

• in paragraph 3.1:

in the second sentence of the second paragraph of sub-paragraph 3.1.7, replace the words "Moreover, if during the conduct of significant operations" with the words "If during the conduct of certain types of work and services", and replace the word "policy" with the words "internal regulatory documents";

supplement sub-paragraph 3.1.7-1 with the following content:

"3.1.7-1. Before using outsourcing, the bank must develop a decision-making procedure for attracting service providers, as well as prepare outsourcing contracts. An outsourcing contract is an important tool for reducing risks associated with non-performance or disputes between parties. The following key provisions must be included in the outsourcing contract:

• clear definition of the types of work and services transferred for execution to a third party;

• the bank's ability to access all accounting and other information of the service provider related to the object of outsourcing. In this regard, at the request of the National Bank and external auditors, the bank is obliged to provide such information related to the object of outsourcing;

• continuous monitoring and assessment by the bank of the service provider's activities in order to timely take corrective measures;

• conditions and minimum terms for terminating the contract in case of necessity, as well as obligations remaining in force after the termination of the contract;

• procedures for resolving significant issues specific only to the outsourcing contract (for example, if the service provider is located abroad, provisions on the legislation of the countries of the parties to the contract, to avoid collision of legal acts);

• conditions for transferring all or part of the outsourcing activity to a sub-contract in case of necessity (to ensure the possibility of maintaining a similar risk management regime in case of a change in the service provider);

• issues of ensuring the service provider's confidentiality of information concerning the bank and protection against intentional or accidental disclosure to third parties.

The decision-making procedure for attracting service providers must include criteria that allow for a preliminary assessment of the possibility and ability of the service provider to effectively, reliably, and at a high level carry out outsourcing activities, as well as to assess the factors of emerging risks associated with attracting a specific service provider.

When developing criteria, the bank should take into account that the service provider must:

• possess the necessary resources and have workers of appropriate qualification to perform the work and services transferred by the bank for outsourcing;

• understand the goals and objectives of the bank in this area of activity and act in accordance with them;

• be financially sound in order to timely and in full volume fulfill its obligations.";

• in paragraph 4.3, replace the word "year" with the words "two years".