Unofficial translation
In accordance with subparagraph 42) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan" and subparagraph 12) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On payments and payment systems", the Board of the National Bank of the Republic of Kazakhstan DECIDES:
Footnote. The preamble as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).1. To approve the attached Rules for the issue, use and redemption of electronic money, as well as requirements for issuers of electronic money and electronic money systems in the Republic of Kazakhstan.
2. To recognize as invalid the resolution of the Board of the National Bank of the Republic of Kazakhstan, as well as the structural elements of certain resolutions of the Board of the National Bank of the Republic of Kazakhstan according to the list in accordance with the appendix to this resolution.
3. The Department of Payment Systems (Ashykbekov E.T.) in the manner prescribed by the legislation of the Republic of Kazakhstan, shall ensure:
1) together with the Legal Department ( Sarsenova N.V.) the state registration of this resolution in the Ministry of Justice of the Republic of Kazakhstan;
2) the direction of this resolution to the republican state enterprise on the right of economic management "Republican Center for Legal Information of the Ministry of Justice of the Republic of Kazakhstan":
to publication in the legal information system "Әdіlet" within ten calendar days after its state registration in the Ministry of Justice of the Republic of Kazakhstan;
etc. to be included in the State register of regulatory legal acts of the Republic of Kazakhstan, reference control bank of regulatory legal acts of the Republic of Kazakhstan, within ten calendar days from the date of its state registration in the Ministry of Justice and the Republic of Kazakhstan;
3) posting of this resolution on the official Internet resource of the National Bank of the Republic of Kazakhstan after its official publication.
4. The Office for the Protection of the Rights of Consumers of Financial Services and External Communications (Terentyev A.L.) to ensure the direction of this resolution for official publication in periodicals within ten calendar days after its state registration with the Ministry of Justice of the Republic of Kazakhstan.
5. Control over the execution of the present decision to assign to the Vice-Chairman of the National Bank of the Republic of Kazakhstan Pirmatov G.O.
6. This resolution becomes effective upon expiry of ten calendar days after the day of its first official publication.
| The chairman | |
| National Bank | D. Akishev |
| Approved by Board Resolution National Bank Republic of Kazakhstan dated August 31, 2016 № 202 |
Rules for the issue, use and redemption of electronic
money, as well as requirements for issuers of electronic money and
electronic money systems in the Republic of Kazakhstan
Chapter 1. General Provisions
1. These Rules for the issuance, use and repayment of electronic money, as well as requirements for issuers of electronic money and electronic money systems on the territory of the Republic of Kazakhstan (hereinafter – the Rules) are developed in accordance with subparagraph 42) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan" and subparagraph 12) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On payments and payment systems" (hereinafter – the Law on payments and payment systems) and determine the procedure for issuing, using and repaying electronic money on the territory of the Republic of Kazakhstan, as well as requirements for issuers of electronic money (hereinafter referred to as the issuer) and electronic money systems on the territory of the Republic of Kazakhstan.
Footnote. Paragraph 1 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).The procedure for issuing, using and redeeming electronic money in the territory of the Republic of Kazakhstan, as well as requirements for issuers and electronic money systems in the territory of the Republic of Kazakhstan, include issuing electronic money, conducting transactions using electronic money, redeeming electronic money, requirements for issuers and electronic money systems in the territory of the Republic of Kazakhstan.
1-1. The requirements of the Rules applicable to banks apply to branches of non-resident banks of the Republic of Kazakhstan established in the territory of the Republic of Kazakhstan.
Footnote. The Rules were amended with paragraph 1-1 in accordance with the resolution of the Board of the National Bank dated 30.11.2020 № 139 (shall be enforced since 16.12.2020).2. The Rules use the concepts provided for in Article 1 of the Law on payments and payment systems, as well as the following concepts:
1) an information security incident, including violations, failures in information systems (hereinafter referred to as an information security incident) – separately or serially occurring failures in the operation of the information and communication infrastructure or its individual objects that pose a threat to their proper functioning and (or) conditions for illegal receipt, copying, distribution, modification, destruction or blocking electronic information resources of the operator of the electronic money system;
2) information about information security incidents, including information about violations, failures in information systems – information about separately or serially occurring failures in the operation of the information and communication infrastructure or its individual objects that pose a threat to their proper functioning and (or) conditions for illegal receipt, copying, distribution, modification, destruction or blocking of electronic information resources of the operator of the electronic money system;
3) perimeter protection of information and communication infrastructure - a set of software and hardware that separates the information and communication infrastructure of the operator of the electronic money system from external information networks and provides protection against threats to information security;
4) information security – the state of security of electronic information resources, information systems and information and communication infrastructure from external and internal threats;
5) threat to information security – a set of conditions and factors that create prerequisites for the occurrence of an information security incident;
6) ensuring information security is a process aimed at maintaining the state of confidentiality, integrity and availability of information assets of the operator of the electronic money system;
7) security procedure – a set of organizational measures and software and hardware means of information protection designed to certify the rights of the owner of electronic money to use electronic money and to detect errors and (or) changes in the content of messages transmitted and received electronically (hereinafter referred to as an electronic message) when using electronic money;
8) information asset of the operator of the electronic money system – a set of information and an object of information and communication infrastructure used for its storage and (or) processing;
9) information and communication infrastructure of the operator of the electronic money system (hereinafter referred to as information infrastructure) – a set of information and communication infrastructure facilities designed to ensure the functioning of the technological environment in order to form electronic information resources and provide access to them;
10) internal rules of the electronic money system – the rules according to which the issue, sale, acquisition, repayment of electronic money are made, as well as operations with their use in the electronic money system are carried out;
11) personal account of the owner of electronic money – a personal section of the owner of electronic money on the Internet resource of the electronic money system, through which the owner of electronic money has access to his electronic wallet to obtain the necessary information about the balance of electronic money, transactions carried out on it, payments and other transactions using electronic money in the manner provided for the internal rules of the electronic money system and contracts concluded between the operator of the electronic money system (hereinafter – operator) or the issuer and owner of electronic money. The list of services provided through the personal account of the owner of electronic money is set by the operator;
12) exchange operations with electronic money – operations for the exchange of electronic money issued by one issuer for electronic money of another issuer that is a participant in another electronic money system;
13) compulsory repayment of electronic money – an operation for the repayment of electronic money, providing for the transfer of an equal nominal value to the bank account of the owner of electronic money or to the consolidated account of the issuer before their demand by an individual;
14) termination of the issue of electronic money – termination of the issuer's activity in rendering a payment service providing for the issuance of electronic money to an individual or an agent of the electronic money system (hereinafter referred to as the agent) by exchanging for an equal amount of money at their nominal value;
15) blocking of an electronic wallet - a complete or partial ban on the use of electronic money stored in the electronic wallet of the owner of electronic money.
Footnote. Paragraph 2 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).Chapter 2. The procedure for issuing electronic money
3. Issuance of electronic money is carried out by the issuer within the amount of money received from individuals or agents in accordance with the agreements concluded with them and internal rules from the electronic money system.
Electronic money system operates with a single issuer (hereinafter - odnoemitentnaya electronic money system) or multiple (two or more) of the Issuer (hereinafter - the Multi-issuer electronic money system).
4. The issuer within ten calendar days from the date of commencement of the activity on the issue of electronic money notifies the National Bank of the Republic of Kazakhstan in the form according to Appendix 1 to the Rules and submits the following documents and information:
1) internal rules of the electronic money system approved by the issuer's governing body or operator (if the operator acts as the owner of the trademark of the electronic money system and (or) administers the electronic money system);
2) documents confirming the status of the issuer in the electronic money system (if the issuer is not an operator and does not own the trademark right for the electronic money system);
3) samples of contracts concluded with the owners of electronic money;
4) confirmation of the existence of approved security procedures and protection of information from unauthorized access in the electronic money system;
5) a description of the main characteristics and information about the electronic money system, including:
name of the electronic money system;
name of operator;
type of electronic wallet;
a scheme of contractual relationships between participants in the electronic money system;
a scheme of cash and information flows during operations using electronic money;
scheme of interaction with the operator (if the issuer is not an operator);
risk management methods used in the electronic money system;
6) a certificate on the characteristics of software and hardware, containing:
a description of the composition of the hardware and software for information processing, telecommunications, and communication channels used;
internal documents containing information about organizational, hardware, software, and other ways of protecting software and information from unauthorized access in an electronic money system.
Footnote. Paragraph 4 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).5. If the trademark name of the electronic money system or of the issuer or operator changes (if the issuer is not an operator and does not own the right to the trademark of the electronic money system), the issuer shall notify the National Bank of the Republic of Kazakhstan in any written form about this within ten calendar days from the date of change of the trademark of the electronic money system or of the issuer or operator.
Footnote. Paragraph 5 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 № 139 (shall be enforced since 16.12.2020).6. The purchase of electronic money by individuals and agents is carried out by depositing cash or transferring money by bank transfer to the issuer's corresponding account.
7. The issuer or the operator of the issuance of electronic money familiarize Vlad dace electronic money information on the procedure for transactions with electronic money and the risks arising from the use of electronic money, the methods of filing and on the procedure for their consideration, as well as the types and amounts of commission voznagra REPRESENTATIONS, levied upon transactions using electronic money.
8. When electronic money is issued, the electronic money holder shall be issued a receipt or other document confirming the fact of the acquisition by the individual or agent of electronic money (hereinafter referred to as the receipt). The form and methods for issuing receipts when issuing electronic money are established by the relevant agreements and (or) internal rules of the electronic money system, taking into account the requirements established by paragraph 9 of the Rules.
9. The receipt issued upon the issue of electronic money contains the following details:
1) the name and details of the issuer, including its business identification number ;
2) the time and date of the transaction;
3) serial number of the receipt;
4) the amount of received money or received payments from the owner of electronic money;
5) the amount of issued electronic money;
6) the identification code of the electronic wallet of the owner of electronic money-individual;
7) the amount of the commission (in case of collection).
Reflection in the receipt of additional details established by the issuer is allowed.
10. Electronic money shall be deemed issued by the issuer from the moment the information on the available amount of electronic money is reflected in the electronic wallet, which is transferred to or is in use by the owner of the electronic money.
11. The Issuer ensures that the total amount of electronic money issued by it is consistent with the total amount of money received from the owners of electronic money.
12. It is allowed to sell electronic money issued by the issuer outside the Republic of Kazakhstan on the basis of agreements concluded with non-resident agents of the Republic of Kazakhstan, subject to the requirements established by article 43 of the Law on Payments and Payment Systems and the Rules.
13. Confirmation of the acquisition of electronic money from an agent for an individual is a document issued by the agent, confirming that he received an appropriate amount of money in exchange for electronic money being sold or another confirmation (information message) that clearly indicates the fact of electronic money being sold to an individual.
The issuer ensures that the agent issues the appropriate document to the owner of electronic money confirming that the money has been deposited or issued to the individual when the agent sells or purchases electronic money in the manner prescribed by the agreement between the agent and the issuer.
14. Payments and (or) money transfers between agents that are not banks, and their client, by mi-residents of the Republic of Kazakhstan, related to the acquisition or sale of electronic money, are made in the national currency of the Republic of Kazakhstan.
15. The agreement concluded between the issuer and the agent contains:
1) the procedure and conditions for the acquisition by an agent of electronic money;
2) the procedure and conditions for the sale of electronic money by an agent;
3) the regime and procedure for the exchange of information in the sale and acquisition of electronic money;
4) the conditions for ensuring the confidentiality of information and establishing liability for its non-compliance;
5) the procedure and conditions for transferring cash accepted by the agent from individuals to his bank accounts;
6) the responsibility of the parties for non-performance or improper performance of their obligations;
7) the procedure for resolving disputes between the issuer and the agent.
16. The issuer establishes requirements for the financial position of the agent and for the hardware and software used by him when conducting transactions with electronic money, if these requirements are established by the internal rules of the electronic money system.
17. It is allowed for agents to sell electronic money through electronic terminals that allow cash and non-cash payments to be received, cash and non-cash payment points, electronic remote access systems and Internet resources.
18. Cash accepted by non-bank agents when they sell electronic money to individuals shall be credited to their bank accounts in the manner and terms provided for by the agreement concluded between the issuer and the agent.
19. Upon the purchase of electronic money by an individual from the issuer or agent, it is allowed to increase the amount of money transferred by an individual to the issuer or agent by an appropriate amount to pay the cost of the electronic wallet and additional services provided by the issuer or agent when issuing or selling electronic money, respectively.
20. Second-tier banks and Kazpost joint-stock company sell electronic money denominated in foreign currency issued by non-residents of the Republic of Kazakhstan on the territory of the Republic of Kazakhstan on the basis of agreements concluded with non-resident issuers of the Republic of Kazakhstan.
21. It is allowed for the issuer to carry out exchange operations with electronic money issued by him by electronic money issued by another issuer, as well as enter into agreements with agents for the execution of electronic money exchange operations by them.
Chapter 3. The procedure for using electronic money
22. The use of electronic money is carried out by the participant of the electronic money system in accordance with the internal rules of the electronic money system and the terms of the concluded agreements between the operator of the electronic money system or the issuer and the participant in the electronic money system.
22-1. The issuer and (or) the operator, prior to making a payment and (or) transfer by an individual using electronic money, shall notify the individual about opening an electronic wallet in the electronic money system, indicating the identification code of the electronic wallet.
Footnote. The Rules were amended with paragraph 22-1 in accordance with the resolution of the Board of the National Bank dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).23. Payments and other operations using electronic money shall be carried out by transferring electronic money by its owner from his/her electronic wallet to the electronic wallet of the identified owner of electronic money, subject to the security procedures from unauthorized access established by the internal rules of the electronic money system or by agreements concluded between participants in the electronic money system.
Footnote. Paragraph 23 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).24. After making a payment using electronic money, their owner is issued a sales receipt confirming the fact of the transaction using electronic money, in the form of an electronic message or on paper (hereinafter referred to as the sales receipt).
A sales receipt contains the following details:
1) amount of payment;
2) time and date of payment;
3) the serial number of the sales receipt;
4) the name (code) and individual identification number, business identification number of an individual entrepreneur or legal entity;
5) a transaction code or other code identifying a payment in an electronic money system;
6) the identification code of the wallet of the owner of electronic money-individual.
7) contact phone numbers of the operator, including cellular communication.
Additional details may be reflected in the sales receipt.
Footnote. Paragraph 24 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).24-1. After transferring electronic money, their owner is issued a document confirming the fact of the fact of a transaction using electronic money, in the form of an electronic message or on paper.
Footnote. The Rules were amended with paragraph 24-1 in accordance with the resolution of the Board of the National Bank dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).25. It is allowed to transfer electronic money between the participants of the electronic money system where the owners of electronic money are identified owners of electronic money of one or several issuers within the framework of one electronic money system.
Footnote. Paragraph 25 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).26. The issuer or operator informs the owner of electronic money about the completion of each transaction using electronic money by sending him a corresponding notice in the manner established by the agreement with the owner of electronic money.
27. The issuer provides the ability to determine the owners of electronic money-individuals as identified and unidentified when they carry out transactions with electronic money.
28. The issuer ensures compliance with the restrictions established by paragraph 5 of article 42 and paragraph 4 of article 44 of the Law on Payments and Payment Systems on the amount of electronic money purchased for unidentified owners of electronic money, the amount of storage of electronic money in an electronic wallet and the total amount of used electronic money through an electronic wallet.
Footnote. Paragraph 28 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).29. The issuer may establish requirements for the types and amounts of operations carried out using the electronic money issued by it that do not contradict the Law on Payments and Payment Systems.
30. In case of refusal of the owner of electronic money from the subject of a civil transaction purchased using electronic money, and acceptance of such refusal by an individual entrepreneur or legal entity, electronic money is refunded to the owner-individual of the electronic money – the payer individual in his/her electronic wallet or a refund of the amount of money equivalent to the amount electronic money. The methods, procedure and terms for making such a payment are established by the internal rules of the electronic money system.
Footnote. Paragraph 30 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).31. At the request of the owner of electronic money, the issuer submits to him an extract containing information on operations carried out using electronic money in the form and terms stipulated by the agreement concluded between them.
32. The Issuer blocks the electronic wallet of the owner of electronic money in the following cases:
1) receiving a notification from the owner of electronic money, including in case of loss, theft or unauthorized use of an electronic wallet;
2) non-fulfillment by the owner of electronic money of its obligations stipulated by the agreement concluded between the issuer and the owner of electronic money;
3) transactions in violation of established requirements and conditions and the use of electronic money;
4) seizure of electronic money of the owner of electronic money on the grounds provided for by legislative acts of the Republic of Kazakhstan ;
5) for other reasons stipulated by the contract between the issuer and the owner of electronic money.
The conditions and terms for blocking the electronic wallet of the owner of electronic money are provided for by the agreement concluded between the issuer and the owner of electronic money.
33. In the case of blocking the electronic wallet of the owner of electronic money, the issuer's obligations and obligations of the owner of electronic money that arose before the blocking of the electronic wallet are subject to execution.
34. If an erroneous transfer of electronic money is detected, loss, theft and unauthorized use of the electronic wallet, the owner of electronic money shall immediately notify the issuer thereof in the manner established by the agreement between the issuer and the owner of electronic money and (or) internal rules of the electronic money system.
Chapter 4. The procedure for the repayment of electronic money
35. When the electronic money is presented by an individual-physical person for repayment, the issuer shall repay electronic money by issuing cash to him or by transferring money to the bank account of the owner of electronic money-individual. Methods for presenting electronic money for redemption, with the exception of the forced redemption of electronic money, are established by an agreement concluded between the owner of electronic money, an individual and the issuer, and (or) internal rules of the electronic money system.
36. Electronic money shall be deemed repaid by its issuer from the moment of crediting the corresponding amount of money to be transferred to the owner of electronic money to an individual to the bank account of the owner of electronic money to an individual or to issue cash to him.
Electronic money is deemed paid off by its issuer from the moment of crediting the corresponding amount of money to be transferred to the owner of electronic money, an individual entrepreneur or legal entity, to the bank account of the owner of electronic money, an individual entrepreneur or legal entity.
37. In case of acceptance by an individual entrepreneur and (or) legal entity of electronic money from the owner of electronic money as payment for civil transactions, the issuer shall repay it in accordance with the procedure and terms established by paragraph 8 of article 44 In case of acceptance by an individual entrepreneur and (or) legal entity of electronic money from the owner of electronic money as payment for civil transactions, the issuer shall repay it in accordance with the procedure and terms established by paragraph .
Footnote. Paragraph 37 as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).38. The issuer notifies the National Bank of the Republic of Kazakhstan about it thirty calendar days before the termination of the issue of electronic money in accordance with Appendix 1 to the Rules.
Footnote. Paragraph 38 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).39. Electronic money systems are divided into single-issue and multi- issue .
40. The issuer, upon termination of the issue of electronic money within the framework of a single - issue electronic money system, performs the following:
1) thirty calendar days before the termination of the issue of electronic money informs the owners of electronic money about it through the Internet resource of the electronic money system (if any) and the personal account of the owner of electronic money, the media, sending it to the email address and (or) to a cellular device indicated by the owner of electronic money, short text and (or) multimedia messages. The message sent by the issuer contains information on the need to repay electronic money in circulation no later than the deadline set by the issuer from the date of termination of electronic money issuing activities;
2) after the expiration of the period established by the issuer for the repayment of outstanding electronic money in electronic money in electronic wallets:
individual entrepreneurs and legal entities - are forcibly repaid to their bank accounts;
identified owners of electronic money — individuals with bank accounts — are forcibly repaid to their bank accounts;
unidentified owners of electronic money-individuals - are forcibly repaid to the appropriate balance sheet account of the issuing bank until claimed by the owner of electronic money;
3) for receiving forcibly repaid electronic money of individuals:
Identified owners of electronic money present an identity document to the issuer;
unidentified owners of electronic money provide the issuer with information containing a code value that is preliminarily sent by the issuer to each unidentified electronic wallet by sending short text and (or) multimedia messages to the email address and (or) to the cellular communication device indicated by the owner of the electronic money . At the same time, when issuing money, the issuer fixes its recipient according to his document proving his identity;
4) the issuer, within three working days after the expiration of the deadline set by him for the repayment of electronic money in circulation, submits in arbitrary written form to the National Bank of the Republic of Kazakhstan information containing information on the number of owners of electronic money, electronic money that are forcibly redeemed for the corresponding bank Issuer's account, indicating the amount.
The issuer quarterly until the tenth day (inclusive) of the month following the next quarter, informs in arbitrary written form the National Bank of the Republic of Kazakhstan about the unfulfilled amount (remaining with the ummah) and the number of owners of electronic money up to the full fulfillment of their obligations (issuing money).
41. The issuer, upon termination of the issue of electronic money within the framework of a multi - issue electronic money system, performs the following:
1) on the basis of an agreement concluded with one of the issuers of the electronic money system, assigns obligations to it on issued electronic money;
2) in the absence of the issuer that made the decision to discontinue the activity of issuing electronic money, a contract with one of the issuers regarding the assignment of its obligations, the procedure for the issuer to fulfill previously assumed obligations to the owners of electronic money for issued electronic money and repay them is similar to the procedure established for odnoemitentnoy si tem of electronic money;
3) the issuer informs the owners of electronic money via the Internet resource of the electronic money system (if available) and a personal account about the decision to terminate the activity on issuing electronic money and the bank that has taken obligations from the issuer (if there is such an agreement with one of the issuers) owner of electronic money, mass media, sending to an email address and (or) to a cellular communication device specified by the owner of electronic money, short text and (or) multimedia messages puppies. The message sent by the issuer contains information about the need to repay the electronic money in circulation no later than the deadline set by the issuer, from the date of termination of activity and the issue of electronic money.
It is allowed for the issuer, having accepted obligations from the issuer, which has ceased operations, to present other working conditions to individual entrepreneurs or legal entities and agents within the framework of the electronic money system.
Chapter 4-1. Termination of operations using electronic money issued by the issuing bank deprived of the license and (or) appendix to the license, or the validity of the license of which is suspended
Footnote. The Rules are as amended by Chapter 4-1 in accordance with the resolution of the Board of the National Bank dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).
41-1. From the date of suspension or revocation of the license and (or) appendix to the license of the issuing bank, the operator terminates operations using electronic money issued by this issuer, as well as informs the owners of electronic money about this through the Internet resource of the electronic money system (if any) and the personal account of the owner of electronic money, mass media, sending to an e-mail address and (or) to a cellular device specified by the owner of electronic money, short text and (or) multimedia messages.
41-2. It is allowed for the operator to redeem electronic money issued by the issuing bank, deprived of a license and (or) an appendix to the license, or whose license is suspended, from the owners of electronic money - individuals. The operator is reimbursed the total amount of redeemed electronic money held in his electronic wallet, according to the order of satisfaction of creditors' claims of the liquidated bank, established by paragraph 3 of Article 74-2 of the Law of the Republic of Kazakhstan "On banks and banking activities in the Republic of Kazakhstan";
Footnote. Paragraph 41-2 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 17.09.2022 № 84 (shall be enforced ten calendar days after the date of its first official publication). Chapter 5. Requirements for electronic money issuers and electronic money systems
in the Republic of Kazakhstan
42. The issuer takes measures to ensure and implement organizational and procedural measures in the electronic money system in order to identify, as well as prevent fraud and counteract the legalization (laundering) of proceeds from crime and the financing of terrorism in accordance with the requirements of the Law of the Republic of Kazakhstan "On countering the legalization (laundering) of proceeds from crime, and financing of terrorism."
Footnote. Paragraph 42 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 17.09.2022 № 84 (shall be enforced ten calendar days after the date of its first official publication).43. The Issuer ensures that agents comply with the requirements established by the Law on Payments and Payments of Monthly Systems and the Rules.
44. The issuer ensures that the operator complies with the functions assigned to it, including those delegated on its own behalf, on the basis of an agreement concluded with the operator.
45. The functioning of the electronic money system is provided by the issuer or operator.
46. Means and measures to prevent unauthorized access to software and hardware used in the electronic money system, including organizational measures and software and hardware security measures, provide a sufficient level of information protection and preservation of its confidentiality.
47. The procedures for the security and protection of information used in the electronic money system provide continuous protection of information at all stages of the issue, use and redemption of electronic money, including:
1) reliable establishment of the right of the owner of electronic money to use electronic money in transactions;
2) detecting the presence of distortions and (or) changes in the content of electronic messages compiled when using electronic money;
3) ensuring protection against unauthorized access to information and ensuring the integrity of this information;
4) providing evidence in the investigation of incidents involving the use of electronic money.
48. Emit nt or the operator records information about the balances of electronic money in electronic wallets of electronic money holders and their transactions with electronic money.
49. The issuer ensures the recording of all operations performed using electronic money between participants in the electronic money system, as well as the storage of information for at least five years generated by using electronic money in the format in which it was generated, sent or received in compliance with it c of integrity and immutability.
Chapter 6. Remote and simplified identification of the owner of electronic money - individual
Footnote. The Rules are as amended by Chapter 6 in accordance with the resolution of the Board of the National Bank dated 21.09.2020 № 112 (shall be enforced upon expiration of ten calendar days after the day of its first official publication).
50. Remote identification of the owner of electronic money - an individual is carried out by the issuer and (or) the operator on the basis of information from available sources received from the operating center of the interbank money transfer system, in accordance with the procedure and on the grounds provided for by the Rules for provision of electronic banking services by banks, branches of non-resident banks of the Republic of Kazakhstan and organizations engaged in certain types of banking operations, approved by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 № 212 (registered in the Register of state registration of regulatory legal acts under № 14337).
Footnote. Paragraph 50 - as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).51. Identification of the owner of electronic money – an individual by a simplified method shall be carried out by the issuer and (or) the operator by conducting a videoconference session or by capturing the client's image using a specialized application that implements the technology for detecting the movement of the interviewee in the identification process.
Simplified identification shall be carried out by the issuer and (or) operator through its official Internet resource and (or) mobile application.
It is allowed using by the issuer and (or) the operator of devices of other individual entrepreneurs and legal entities to carry out a simplified identification of the owner of electronic money - an individual on the basis of the concluded agreement, subject to compliance with the requirements of paragraphs 52, 53 and 54 of these Rules.
52. In the course of conducting the simplified identification, the issuer and (or) the operator shall ensure:
1) complete fixing of the face of the owner of electronic money – an individual and his/her identity document;
2) receipt from open sources of confirmation of the individual identification number of the owner of electronic money - an individual.
It is allowed for the issuer and (or) operator to establish additional requirements or control questions during simplified identification, if these requirements and questions are provided for by the internal rules of the electronic money system.
53. The to perform the simplified identification, the issuer and (or) the operator shall ensure the use of licensed software aimed at maintaining the state of confidentiality, integrity and availability of information.
54. The issuer and (or) the operator shall decide on the identification of the electronic money owner - an individual in a simplified way based on the procedures provided for by the internal rules of the electronic money system and agreements concluded between the operator and (or) the issuer and the owner of electronic money.
Chapter 7. Requirements for software and hardware and
information security management systems of operators of electronic money systems
that are payment organizations
Footnote. The Rules are supplemented by Chapter 7 in accordance with the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).
55. The software shall provide:
1) reliable storage of information, protection against unauthorized access, integrity of databases and complete safety of information in electronic archives and databases in the event of a complete or partial power outage at any time on any part of the equipment;
2) multi-level access to input data, functions, operations, reports implemented in the software, providing at least two levels of access: administrator and user;
3) control of completeness of the input data of the fields required to be filled in, necessary for conducting and registering operations (when performing functions or operations without complete filling of all the fields, the program provides the issuance of a corresponding notification);
4) information search according to the criteria and parameters defined for this information system, with saving of the request, as well as sorting of information according to any parameters (defined for this information system) and the ability to view information over previous dates, if such information is storable in the information system;
5) processing of information and its storage by date and time;
6) automated generation of the forms of reports filed by payment organizations to the National Bank, as well as reports on transactions performed;
7) maintenance and automated formation of logs of the internal accounting system. The software generates the log in full, also in part (for a specified date range, a specific date);
8) possibility of backing up and restoring data stored in accounting systems;
9) possibility of laying out the output documents on the screen, printer or file;
10) possibility of exchanging electronic documents;
11) registration and identification of events occurring in the information system with the preservation of the following attributes: the date and time of the start of the event, the name of the event, the user who performed the action, the record identifier, the date and time of the end of the event, the result of the event.
12) changing passwords of pre-installed accounts of perimeter security tools for information and communication infrastructure protection.
Footnote. Paragraph 55 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).56. Operators of electronic money systems ensure the creation and operation of an information security management system, which is part of the general management system of operators of electronic money systems, designed to manage the process of ensuring information security.
57. The information security management system ensures the protection of information assets of operators of electronic money systems, allowing a minimum level of potential damage to the business processes of operators of electronic money systems.
58. The operator of the electronic money system ensures an appropriate level of information security management system, its development and improvement.
59. In order to ensure confidentiality, integrity and availability of information, the e-money system operator shall perform the following functions:
1) organize the information security management system, coordinate and control the information security activities and measures to identify and analyze threats, counter attacks and investigate information security incidents;
2) ensures methodological support of the information security process;
3) select, implement and apply methods, means and mechanisms of information security management, provision and control within the scope of its authority;
4) collect, consolidate, store and process information on information security incidents;
5) analyze information on information security incidents;
6) ensure the implementation, proper functioning of software and hardware tools that automate the information security process, as well as the provision of access to them;
7) determine restrictions on the use of privileged accounts;
8) organize and conduct activities to ensure awareness of the electronic money system operator's employees on information security issues;
9) monitor the state of the information security management system of the e-money system operator;
10) periodically (but at least once a year) inform the management of the e-money system operator about the state of the information security management system;
11) keep up-to-date the schemes of the information and communication infrastructure protection perimeter and the list of administrators of the means of ensuring its security;
12) install firewalls on the information and communication infrastructure protection perimeter;
13) ensure the security of user access to Internet resources from the perimeter of information and communication infrastructure protection.
Footnote. Paragraph 59 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).60. The operator of the electronic money system manages information security risks by specifying criteria of an acceptable level in relation to information assets.
When implementing information security risks, an action plan is developed aimed at minimizing the occurrence of such risks.
61. Information about information security incidents obtained during the monitoring of information security activities is subject to consolidation, systematization and storage.
62. The retention period of information on information security incidents is at least 5 (five) years.
63. The operator of the electronic money system determines the procedure for taking urgent measures to eliminate an information security incident, its causes and consequences.
64. The operator of electronic money systems keeps a log of information security incidents with a reflection of all information about the information security incident, the measures taken and the recommended corrective measures.
65. The operator of the electronic money system provides the National Bank with information on the following identified information security incidents:
1) exploiting vulnerabilities in application and system software;
2) unauthorized access to the information system;
3) “denial of service” attack on an information system or data transmission network;
4) server infection with malware or code;
5) making an unauthorized transfer of electronic money due to violation of information security controls;
6) information security incidents that threaten the stability of the operator of the electronic money system.
Information about information security incidents specified in this paragraph is provided by the operator of the electronic money system as soon as possible, but no later than 48 hours from the moment of detection, in the form of an information security incident card in accordance with Appendix 2 to the Rules.
Information on processed information security incidents is provided in electronic format using the platform of the National Bank for the exchange of information security events and incidents.
A separate information security incident card is filled in for each information security incident.
| Appendix 1 to the Rules for the issuance, use and repayment of electronic money, as well as requirements for issuers of electronic money and electronic money systems in the territory of the Republic of Kazakhstan |
Footnote. The text in the upper right corner is in the wording of the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).
Form
Notification on commencement (termination) of the issue of electronic money
Footnote. Appendix is as amended by the resolution of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 № 139 (shall be enforced since 16.12.2020).
_______________________________________________________________________________
(name of the issuer)
hereby notifies about the commencement (termination) of the issue of electronic money from "____" ______ 20 ___
_______________________________________________________________________________.
(name of the system)
Authorized person of the notifier
_________________ _____________________________________________ ______________
(position) (Surname, name, patronymic (if any) (signature)
| Appendix 2 to the Rules for the issuance, use and repayment of electronic money, as well as requirements for issuers of electronic money and electronic money systems in the territory of the Republic of Kazakhstan |
Form
Information security incident card
Footnote. The Rules are supplemented by Appendix 2 in accordance with the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).
№ | General information | |
Characteristics of an information security incident | Information about information security incident | |
1 | Name of the information security incident | |
2 | Date and time of detection (dd.mm.yyyy and hh:mm indicating the UTC+X time zone) | |
3 | Place of detection (organization, branch, segment of information infrastructure) | |
4 | Source of information about an information security incident (user, administrator, information security administrator, employee of an information security unit or technical device) | |
5 | The methods used in the implementation of an information security incident (social engineering, introduction of malicious code) | |
Content of the information security incident | ||
6 | Symptoms, signs of an information security incident | |
7 |
Main events (exploitation of vulnerabilities in application and system software; | |
8 | Affected assets (the physical level of information infrastructure, the level of network equipment, the level of network applications and services, the level of operating systems, the level of technological processes and applications and the level of business processes of the operator of the electronic money system) | |
9 | The status of an information security incident (an accomplished information security incident, an attempt to implement an information security incident, a suspicion of an information security incident) | |
10 | Damage | |
11 | Threat source (revealed identifiers) | |
12 | Premeditation (intentional, erroneous) | |
Measures taken on the information security incident | ||
13 | Measures taken (vulnerability identification, blocking, recovery) | |
14 | Planned actions aimed at minimizing the occurrence of information security risks | |
15 | Notified persons (surname, first name, patronymic (if any) of officials, name of state bodies, organizations) | |
16 |
Involved specialists | |
Responsible information security officer_______________________ _________________
(surname, first name, patronymic (if any) (signature)
Date "____" ______ 20 ___
| Appendix to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 № 202 |
The list of resolutions of the Board of the National Bank of the
Republic of Kazakhstan, as well as the structural elements of certain
resolutions of the Board of the National Bank of the
Republic of Kazakhstan, which are recognized as invalid
1. Decree of the National Bank of the Republic of Kazakhstan dated August 26, 2011 № 102 "On approval of the Rules for the issue, use and redemption of electronic money, as well as requirements for issuers of electronic money and electronic money systems in the Republic of Kazakhstan" (registered in the Register of State Registration of Regulatory legal acts under № 7241, published on October 27, 2011 in the newspaper Yuridicheskaya Gazeta № 157 (2147)).
2. Clause 10 of the Amendments to certain regulatory legal acts of the National Bank of the Republic of Kazakhstan on identification numbers, which are Appendix 1 to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated March 26, 2012 № 108 "On amendments to some regulatory legal acts of the National Bank of the Republic Kazakhstan on Identification Numbers "(for the one registered in the Register of State Registration of Normative Legal Acts under № 7625, published on September 6, 2012 in the newspaper "Kazakhstanskaya Pravda" № 299-300 (27118-27119)).
3. Clause 14 of the List of Normative Legal Acts of the Republic of Kazakhstan, which are amended and supplemented, approved by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 27, 2014 № 168 "On Amendments and Additions to Some Normative and Equal Acts of the Republic of Kazakhstan" (registered in the register of state registration of normative legal acts under № 9796, published November 12, 2014 in the legal information system "Әdіlet" republican state enterprise of Mr.and rights economic management "Republican Center of Legal Information of the Ministry of Justice of the Republic of Kazakhstan").
