Unofficial translation
Pursuant to subparagraph 52-1) of part two of article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the laws of the Republic of Kazakhstan "On State Services", "On Permits and Notifications", and subparagraph 1) of paragraph 1 of article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" The Board of the National Bank of the Republic of Kazakhstan RESOLVES:
Footnote. Preamble - as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).1. To approve the attached Rules for the organization of the activities of payment organizations.
2. The Department of payment systems (E.T. Ashykbekov) in accordance with the procedure established by the legislation of the Republic of Kazakhstan shall:
1) jointly with the Legal Department (N.V. Sarsenova) ensure the state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;
2) send this resolution to the Republican State Enterprise on the Right of Economic Management "Republican Center of Legal Information of the Ministry of Justice of the Republic of Kazakhstan":
for official publication in the information and legal system “Adilet” within ten calendar days after the state registration with the Ministry of Justice of the Republic of Kazakhstan;
for inclusion in the State Register of Regulatory Legal Acts of the Republic of Kazakhstan, Reference Control Bank of Regulatory Legal Acts of the Republic of Kazakhstan within ten calendar days from the date of the state registration with the Ministry of Justice of the Republic of Kazakhstan;
3) place this resolution on the official Internet resource of the National Bank of the Republic of Kazakhstan after its official publication.
3. The Directorate for the Protection of the Rights of Consumers of Financial Services and External Communications (A.L. Terentyev) shall, within ten calendar days after the state registration with the Ministry of Justice of the Republic of Kazakhstan, send this resolution for official publication in periodicals.
4. Control over the execution of this resolution shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan G.O. Pirmatov
5. This resolution shall be enforced upon expiry of ten calendar days after the date of its first official publication.
|
Chairman of the National Bank |
D. Akishev |
"AGREED"
Ministry of Information and Communications
of the Republic of Kazakhstan
Minister _______________ D. Abayev
September 14, 2016
"AGREED"
Minister of National Economy
of the Republic of Kazakhstan
_________________ K. Bishimbayev
September 23, 2016
| Approved by resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 № 215 |
Rules for the organization of the activities of payment organizations Chapter 1. General provisions
1. These Rules for organizing the payment organizations’ operation (hereinafter referred to as the Rules) have been developed pursuant to subparagraph 52-1) of part two of Article 15 of the Law of the Republic of Kazakhstan "On the National Bank of the Republic of Kazakhstan", the laws of the Republic of Kazakhstan "On State Services", "On Permits and Notifications", subparagraph 1) of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems" (hereinafter referred to as the Law on Payments and Payment Systems) and establish the procedure for organizing the payment organizations’ operation.
The procedure for organizing the payment organizations’ operation includes record registration of payment organizations with the National Bank of the Republic of Kazakhstan (hereinafter referred to as the National Bank), maintenance by the National Bank of the register of payment organizations (hereinafter referred to as the register), provision of payment services by payment organizations, notification by payment organizations of the opening of branches, requirements for software and hardware tools of payment organizations and information security management system.
Footnote. Paragraph 1 - as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).2. The following concepts shall be used in the Rules prescribed by the Law on Payments and Payment Systems:
1) an information security incident, including violations and failures in information systems (hereinafter - an information security incident) – individual or serial failures in the operation of the information and communications infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the illegal receipt, copying, distribution, modification, destruction or blocking of electronic information resources of the payment organization;
2) information on incidents of information security, including data on violations and failures in information systems - information on individual or serial failures in the operation of the information and communications infrastructure or its individual objects, creating a threat to their proper functioning and (or) conditions for the illegal receipt, copying, distribution, modification, destruction or blocking of electronic information resources of the payment organization;
3) cyber-security - the condition of protection of electronic information resources, information systems and information and communication infrastructure against external and internal threats;
4) threat to cyber-security - a set of conditions and factors that lead to a cyber security incident;
5) cyber-security assurance - a process aimed at maintaining the state of confidentiality, integrity and availability of information assets of a payment institution;
6) information and communication infrastructure protection perimeter - a set of software and hardware tools that separate the information and communication infrastructure of a payment institution from external information networks and provide protection against cyber security threats;
7) information and communication infrastructure of a payment institution (hereinafter - information infrastructure) - a set of information and communication infrastructure facilities intended to assure the technological environment functioning in order to form electronic information resources and provide access to them;
8) information asset of a payment institution - a set of information and of information and communication infrastructure used for its storage and (or) processing.
Footnote. Paragraph 2 - as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022); as amended by the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).3. The payment organization shall provide the following types of payment services if the registration number of the payment organization assigned by the National Bank (hereinafter referred to as the registration number) is available:
1) cash receiving services for payment without opening the bank account of the transmitter;
2) services for sale (distribution) of electronic money and payment cards;
3) services for receiving and processing payments made using electronic money;
4) services on processing payments initiated by the client in electronic form and transfer of the necessary information to a bank, a branch of a non-resident bank of the Republic of Kazakhstan, an organization engaged in certain types of banking operations, to make a payment and (or) transfer or accept money on these payments.
Footnote. Paragraph 3 - as amended by Resolution № 139 of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 (effective from December 16, 2020).Chapter 2. Accounting of payment organizations in the National Bank
4. For record registration with the National Bank, the payment organization shall submit an application to the National Bank on paper or through the "electronic government" web portal according to the form of Annex 1 to the Rules, which contains, in addition, information about the head (members) of the payment organization’s executive body (with attachment of copies of the diploma (diplomas) and document confirming the employment activity of the head (member) of the executive body of the payment organization in accordance with the Labor Code of the Republic of Kazakhstan.
Documents provided for by subparagraphs 1-1), 2), 3) and 7) of paragraph 2 of Article 16 of the Law on Payments and Payment Systems shall be attached to the application.
Footnote. Paragraph 4 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication); as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).5. Excluded by the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
6. Excluded by the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
7. The rules for performing the payment institution’s activities contain the following mandatory conditions:
1) description of the payment services provided by the payment institution;
2) the procedure and terms for the provision of payment services to customers of the payment institution;
3) the cost of payment services (tariffs) provided by the payment institution;
4) the procedure for interaction with third parties providing technological support for payment services rendered by the payment institution;
5) information about the risk management system used by the payment institution;
6) the procedure for settling disputable situations and resolving disputes with clients;
7) the procedure for compliance with cyber-security measures;
8) description of the software and hardware and equipment required for the payment services implementation.
Footnote. Paragraph 7 - as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).8. Excluded by the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
9. Excluded by the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
10. The National Bank shall examine the application of the payment organization and make a decision on it within ten working days from the date of submitting the full package of documents provided for in paragraph 2 of Article 16 of the Law on Payments and Payment Systems.
If the payment organization resubmits the application in the case provided for in paragraph 2 of Article 17 of the Law on Payments and Payment Systems, the application shall be considered by the National Bank within the period provided for in part one of this paragraph.
Footnote. Paragraph 10 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).11. Upon consideration of the application, the National Bank shall make a decision on the account registration of the payment organization or on refusal of the account registration of the payment organization.
12. In the event of changes and (or) additions to the documents provided for by paragraph 2 of Article 16 of the Law on Payments and Payment Systems, the payment organization shall submit the amended and (or) supplemented documents to the National Bank within ten calendar days from the date of entering such changes and (or) additions.
Footnote. Paragraph 12 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).12-1. The payment organization that underwent accounting registration with the National Bank, if it is necessary to include additional payment services in the list of rendered payment services, shall submit to the National Bank the documents provided for by subparagraphs 1-1), 3) and 7) of paragraph 2 of Article 16 of the Law on Payments and Payment Systems, with the changes and (or) additions made, taking into account the payment services planned for rendering within ten calendar days from the date of such changes and (or) additions.
Footnote. Rules as added by paragraph 12-1 in accordance with the resolution of the Board of the National Bank of the RK dated 28.11.2019 № 221 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication); as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).13. Excluded by the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
14. Accounting registration of the payment organization formed as a result of voluntary reorganization of the payment organization (payment organizations) in accordance with Article 20 of the Law on Payments and Payment Systems shall be performed by the National Bank in accordance with the procedure provided for in this chapter.
15. The exception of the register of the reorganized (reorganized) payment organization (the payment organizations) shall be carried out by the National Bank in day of inclusion formed (formed) as a result of voluntary reorganization of the payment organization (the payment organizations) in the register.
Chapter 2-1. Procedure for providing the state service "Inclusion in the register
of payment organizations registered with the National Bank of the Republic of Kazakhstan"
(hereinafter referred to as the state service on account registration)
Footnote. Rules as added by chapter 2-1 in accordance with the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
15-1. The list of main requirements for the provision of the state service in accounting registration, including characteristics of the process, the form, content and result of the provision, as well as other information, taking into account the specifics of the state service rendering in accounting registration, is established in Appendix 2 to the Rules.
Footnote. Paragraph 15-1 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).15-2. The employee of the National Bank, authorized to receive and register correspondence, on the date of receipt of the application, shall receive, register and send it for execution to the subdivision responsible for providing the state service on the account registration (hereinafter referred to as the responsible subdivision). Upon receipt of an application after the end of working hours, on weekends and holidays, according to the labour legislation of the Republic of Kazakhstan, applications shall be received during the next working day.
When the payment organization sends an application through the web portal "electronic government," the personal office automatically shall display the status of acceptance of the request for the provision of the state service, indicating the date and time of receipt of the result.
The National Bank shall receive information on the identity documents of the head of the payment organization and on the state registration (re-registration) of the legal entity from the relevant state information systems through the “electronic government” gateway.
15-3. The employee of the responsible subdivision within five working days from the date of registration of the application shall verify the completeness of the submitted documents.
If it is established that the submitted documents are incomplete, the responsible subdivision shall prepare and send a written reasoned refusal to further consider the application within five working days from the date of registration of the application.
15-4. Upon establishing the fact of completeness of the submitted documents, the responsible department, within eight working days from the date of the application registration, shall review the documents for their compliance with the requirements of the legislation of the Republic of Kazakhstan, prepare a draft notification of completion of the registration for the granting of permission (right) for the provision of payment services by the payment organization (hereinafter - the notification) in accordance with Appendix 3 to the Rules or a draft of reasoned refusal.
The National Bank, represented by the head of the responsible department, shall approve and sign the notification or reasoned refusal within two working days.
After the notification or reasoned refusal has been approved and signed by the head of the responsible department, the employee of the responsible department, on the day the decision is made, shall include the payment organization in the register of payment organizations (upon signing the notification) and send the payment organization the result of rendering the public service for accounting registration.
On the “e-government” web portal, the result of rendering the public service for accounting registration shall be sent to the payment organization's personal account in the form of an electronic document certified by an electronic digital signature (hereinafter - EDS) of an authorized person.
If grounds for refusing accounting registration of a payment organization and inclusion in the register of payment organizations are identified, the National Bank, represented by the head of the responsible division, shall send the service recipient a preliminary decision on refusing accounting registration of the payment organization and inclusion in the register of payment organizations with notification of the time and place of the hearing to provide the service recipient with the opportunity to express a position on the preliminary decision.
A preliminary decision shall be sent no less than 3 (three) working days before the expiration of the application review period.
A participant in an administrative procedure shall have the right to submit or express an objection to a preliminary decision on an administrative case no later than two working days from the date of its receipt.
Footnote. Paragraph 15-4 is in the wording of the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).15-5. Information on the stage of provision of state service on registration shall be updated automatically in the information system for monitoring the provision of state services.
Chapter 3. Maintaining the register
16. The register shall contain information on payment organizations registered with the National Bank.
The register shall be maintained by the National Bank in order to monitor the payment services market and shall be posted on the official Internet resource of the National Bank.
17. The National Bank, when making a decision on the registration of a payment organization within ten working days from the date of submission of the full package of documents provided for in paragraph 2 of Article 16 of the Law on Payments and Payment Systems shall:
1) assign a registration number to the payment organization and make an entry in the register according to the form according to Annex 4 to the Rules;
2) in writing send a notification to the payment organization on passing the account registration of the payment organization with indication of the registration number.
Footnote. Paragraph 17 in the wording of the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication); № 119 dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).18. When making a decision on rejecting the record registration of a payment organization, the National Bank, within ten working days from the date of receiving a full package of documents provided for in paragraph 2 of Article 16 of the Law on Payments and Payment Systems, shall send to the payment organization a motivated refusal to register with indication of the reason for refusal.
Footnote. Paragraph 18 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).19. The National Bank shall maintain a file for each payment organization registered with the National Bank on paper or in electronic form.
20. The National Bank shall exclude the payment organization from the register on the grounds provided for in paragraph 1 of Article 18 of the Law on Payments and Payment Systems.
21. The payment organization within three working days from the date of entry into force of the court decision to terminate the activity of the payment organization or to make a decision on voluntary termination of activity by reorganization (accession, merger, division, allocation, transformation) or liquidation shall send to the National Bank in arbitrary written form a notification with the Annex of supporting documents.
22. The National Bank, within five working days from the date of exclusion by the National Bank of the payment institution from the register, shall notify the payment institution in writing at the actual location of the payment institution or the address specified in the application, and publish information on it on the National Bank’s official Internet resource.
Footnote. Paragraph 22 as amended by Resolution № 119 of the Board of the National Bank of the Republic of Kazakhstan dated 21.09.2020 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).23. If the payment organization is excluded from the register within thirty calendar days from the date of notification by the National Bank of the exclusion from the register, the payment organization shall decide to change the name if the words "payment organization" or reorganization or liquidation of the payment organization is present in it.
23-1. Consent to carry out a voluntary reorganization of a payment organization shall be issued upon submission of a decision on voluntary reorganization by the payment organization to the National Bank through the “e-government” web portal.
The list of basic requirements for the provision of the public service on voluntary reorganization, including the characteristics of the process, form, content and result of service provision, as well as other information taking into account the specifics of the provision of the public service on voluntary reorganization, is established in Appendix 5 to the Rules.
The resolution shall be accompanied by the documents specified in subparagraphs 2), 4), 5), and 7) of paragraph 2 of Article 20 of the Law on payments and payment systems.
Footnote. The Rules were supplemented with paragraph 23-1 in accordance with the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication); is in the wording of the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025). Chapter 3-1. Procedure for providing state service "Issue of consent for voluntary
reorganization (accession, merger, separation, allocation, transformation) of payment
organizations" (hereinafter referred to as the state service on voluntary reorganization)
Footnote. Rules as added by chapter 3-1 in accordance with the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
23-1. The issue of consent for voluntary reorganization of the payment organization shall be carried out when the payment organization submits a decision on voluntary reorganization to the National Bank on paper or through the web portal "electronic government."
The list of the main requirements for the provision of state service on voluntary reorganization, including the characteristics of the process, the form, content and result of the provision, as well as other information taking into account the peculiarities of the provision of state service on voluntary reorganization, shall be set out in Annex 5 to the Rules.
To the decision shall be attached the documents provided for in subparagraph 2), 4), 5) and 7) of paragraph 2 of Article 20 of the Law on Payments and Payment Systems.
23-2. The employee of the National Bank, authorized to receive and register correspondence, on the day of receipt of documents, shall receive, register and send for execution to the subdivision responsible for providing the state service on voluntary reorganization (hereinafter referred to as the responsible subdivision). Upon receipt of documents after the end of working hours, on weekends and holidays, according to the labour legislation of the Republic of Kazakhstan, the receipt of documents shall be carried out during the next working day.
When the payment organization sends an application through the portal, the personal office automatically displays the status of acceptance of the request for the provision of the state service, indicating the date and time of receipt of the result.
23-3. The employee of the responsible subdivision within five working days from the date of the registration of documents shall check their completeness.
If it is established that the submitted documents are incomplete, the responsible unit shall prepare and send a written reasoned refusal to further consider the application within five working days from the date of the registration of the application.
23-4. Upon establishing the fact of completeness of the submitted documents, the responsible unit, within eight working days from the date of registration of the documents, shall review the documents for their compliance with the requirements of the legislation of the Republic of Kazakhstan, prepare a draft notification on the issuance of consent to conduct a voluntary reorganization (hereinafter - the notification) or a reasoned refusal.
The National Bank, represented by the head of the responsible department, shall approve and sign the notification or reasoned refusal within two working days.
After the notification or reasoned refusal has been approved and signed by the head of the responsible department, the employee of the responsible department shall send the result of rendering the public service for voluntary reorganization to the payment organization on the day the decision is made.
On the “e-government” web portal, the result of rendering the public service for voluntary reorganization shall be sent to the payment organization's personal account in the form of an electronic document certified by the digital signature of an authorized person.
If grounds for refusing to grant consent for voluntary reorganization are identified, the National Bank, represented by the head of the responsible division, shall send the service recipient a preliminary decision on refusing to grant consent for voluntary reorganization with notification of the time and place of the hearing to provide the service recipient with the opportunity to express a position on the preliminary decision.
A preliminary decision shall be sent no less than 3 (three) working days before the expiration of the application review period.
A participant in an administrative procedure shall have the right to submit or express an objection to a preliminary decision on an administrative case no later than two working days from the date of its receipt.
Footnote. Paragraph 23-4 is in the wording of the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).23-5. Information on the stage of provision of state service on voluntary reorganization shall be updated automatically in the information system for monitoring the provision of state services.
Chapter 3-2. Procedure for appeal against decisions, actions (omissions)
of the National Bank and (or) its officials regarding state services
Footnote. Rules as added by chapter 3-2 in accordance with the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
23-6. Appeal of decisions, actions (omissions) of the National Bank and (or) its officials regarding state services shall be made in writing to the head of the National Bank.
The complaint of the payment organization shall indicate its name, postal address, outgoing number and date of submission of the complaint.
The complaint shall be signed by the payment organization.
Confirmation of acceptance of the complaint shall be its registration (stamp, incoming number and date) in the Office of the National Bank, specifying the name and initials of the person who accepted the complaint, the date and place of receipt of the response to the complaint.
The complaint of the payment organization on the provision of public services received by the National Bank is considered within five working days from the date of the registration.
In case of disagreement with the results of the provided state service, the payment organization shall file a complaint with the authorized body for evaluation and control over the quality of the provision of state services.
The complaint of the payment organization received by the authorized body for evaluation and control over the quality of state services shall be considered within fifteen working days from the date of the registration.
23-7. In the event of disagreement with the results of the state service rendered, the payment organization shall apply to the court in accordance with the procedure established by the legislation of the Republic of Kazakhstan.
Chapter 4. Provision of payment services by payment organizations
24. The payment organization, after providing the payment service, shall issue to the client a document confirming the fact of providing the payment service, on paper or by means of a telecommunication network.
25. In the case of payment services by the payment organization provided for in subparagraphs 1) and 4) of paragraph 3 of the Rules, the document confirming the fact of payment service provision shall contain the following details:
1) document number, date, month, year of its extract;
2) the name of the payment organization;
3) operation sum;
4) operation currency;
5) amount of the commission fee;
6) purpose of payment;
7) the name of the service provider (in case of payment service provided by subparagraph 1) of paragraph 3 of the Rules);
8) the name or bank identification code of a bank, a branch of a non-resident bank of the Republic of Kazakhstan or an organization engaged in certain types of banking operations, to which the payment organization provides information for making a payment and (or) transferring or accepting money for these payments in accordance with subparagraph 9) paragraph 1, Article 12 of the Law on Payments and Payment Systems (in the case of rendering of a payment service provided for in subparagraph 4) of paragraph 3 of the Rules).
It shall be allowed for the payment organization to provide additional bank details on the payment service provided in the document confirming the fact of providing the payment service.
Footnote. Paragraph 25 as amended by Resolution № 139 of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 (shall be enforced on 16.12.2020).26. In case of payment services provided by the payment organization under subparagraphs 2) and 3) of paragraph 3 of the Rules, the document confirming the payment service is issued by the payment organization in accordance with the Rules of issue, use and repayment of electronic money, as well as requirements to issuers of electronic money and electronic money systems in the territory of the Republic of Kazakhstan, approved by resolution № 202 of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 "On approval of the Rules of issue, use and repayment of electronic money, as well as requirements to issuers of electronic money and electronic money systems in the territory of the Republic of Kazakhstan", registered in the Register of State Registration of Regulatory Legal Acts under № 14298, Rules for issuing payment cards, as well as requirements for transactions servicing with their use in the territory of the Republic of Kazakhstan, approved by resolution № 205 of the Board of the National Bank of the Republic of Kazakhstan dated August 31, 2016 "On approval of the Rules for issuing payment cards, as well as requirements for operations with their use in the territory of the Republic of Kazakhstan", registered in the Register of the State Registration of Regulatory Legal Acts under № 14299.
27. The payment organization when providing payment services provided for in subparagraphs 1) and 2) of paragraph 3 of the Rules, through the payment agent and/or the payment subagent, shall:
1) ensure maintenance of the register of payment agents and (or) payment subagents in accordance with the internal document of the payment organization;
2) monitor compliance of the payment agent with the requirements of the Law on Payments and Payment Systems, as well as the terms of payment services provided for by the contract between the payment agent and the payment organization.
The control provided for in subparagraph 2) of part one of this paragraph shall be carried out in accordance with the agreement between the payment organization and the payment agent and (or) internal documents of the payment organization.
Footnote. Paragraph 27 as amended by the resolution of the Board of the National Bank of the RK dated 28.11.2019 № 221 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).28. The payment organization shall render payment services provided for in subparagraph 1) of paragraph 3 of the Rules, in accordance with the agreement between the payment organization and the service provider.
The payment organization shall render payment services for accepting payments to the budget without opening a client's bank account in accordance with an agency agreement for the provision of payment services between the payment organization and a bank, a branch of a non-resident bank of the Republic of Kazakhstan and (or) an organization engaged in certain types of banking operations.
Footnote. Paragraph 28 as amended by Resolution № 139 of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 (shall be enforced on 16.12.2020).29. The payment organization shall render payment services as a payment agent of a bank, a branch of a non-resident bank of the Republic of Kazakhstan and (or) an organization performing certain types of banking operations or a payment subagent in accordance with the agency agreement for the provision of payment services between a payment organization and a bank, a branch of a non-resident bank of the Republic and (or) an organization carrying out certain types of banking operations or a paying agent.
Footnote. Paragraph 29 as amended by Resolution № 139 of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 (shall be enforced on 16.12.2020).30. The contract with the service provider and the agency agreement for the provision of payment services shall contain the conditions provided for in part four of paragraph 3 of Article 13 of the Law on Payments and Payment Systems.
31. When carrying out paying agent activities, the payment organization shall submit to the bank, a branch of a non-resident bank of the Republic of Kazakhstan, or an organization carrying out certain types of banking operations with which an agency agreement for the provision of payment services has been concluded, information on attracted payment subagents in accordance with the agreement between them.
Footnote. Paragraph 31 as amended by Resolution № 139 of the Board of the National Bank of the Republic of Kazakhstan dated 30.11.2020 (shall be enforced on 16.12.2020).Chapter 5. Notification of payment organizations on opening of branches
32. The payment organization shall, within ten working days from the date of opening of a branch of the payment organization in the territory of the Republic of Kazakhstan and outside the Republic of Kazakhstan, shall submit to the National Bank a notification on opening of the branch according to the form according to Annex 6 to the Rules on paper or in electronic form through the financial automated information transport system.
To the notification of the opening of the branch shall be attached:
1) a copy of the decision of the management body of the payment organization on the opening of the branch and the election (appointment) of the first head of the branch of the payment organization;
2) notarized copy of the regulation on the branch;
3) business plan of the branch;
4) a copy of the power of attorney issued to the first head of the branch.
33. Documents provided for in paragraph 32 of the Rules shall be stored in the file of the payment organization on paper and in electronic form.
Chapter 6. Requirements for the software and hardware of payment institutions and the cyber-security management system
Footnote. The rules shall be supplemented by chapter 6 pursuant to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).
34. The software shall provide:
1) reliable storage of information, protection against unauthorized access, integrity of databases and complete safety of information in electronic archives and databases in the event of a complete or partial power outage at any time on any part of the equipment;
2) multi-level access to input data, functions, operations, reports implemented in the software, providing at least two levels of access: administrator and user;
3) control of completeness of the input data of the fields required to be filled in, necessary for conducting and registering operations (when performing functions or operations without complete filling of all the fields, the program provides the issuance of a corresponding notification);
4) information search according to the criteria and parameters defined for this information system, with saving of the request, as well as sorting of information according to any parameters (defined for this information system) and the ability to view information over previous dates, if such information is storable in the information system;
5) processing of information and its storage by date and time;
6) automated generation of the forms of reports filed by payment organizations to the National Bank, as well as reports on transactions performed;
7) maintenance and automated formation of logs of the internal accounting system. The software generates the log in full, also in part (for a specified date range, a specific date);
8) possibility of backing up and restoring data stored in accounting systems;
9) possibility of laying out the output documents on the screen, printer or file;
10) possibility of exchanging electronic documents;
11) registration and identification of events occurring in the information system with the preservation of the following attributes: the date and time of the start of the event, the name of the event, the user who performed the action, the record identifier, the date and time of the end of the event, the result of the event.
12) changing passwords of pre-installed accounts of perimeter security tools for information and communication infrastructure protection.
Footnote. Paragraph 34 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).35. Payment organizations shall ensure the creation and operation of an information security management system, which is part of the overall management system of the payment organization, designed to manage the process of ensuring information security.
The payment organization shall approve internal documents regulating the information security management process, including the information security policy.
The procedure and frequency of revision of the internal documents specified in part two of this paragraph shall be determined by the internal documents of the payment organization.
Footnote. Paragraph 35 is in the wording of the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).36. The cyber-security management system shall assure protection of the information assets of the payment organization, with a minimum level of potential damage to the business processes of the payment institution.
36-1. The information security department or the person responsible for information security shall conduct an information security assessment at least once a year. Based on the assessment results, the information security department or the person responsible for information security shall prepare a report, including the assessment materials, which shall be communicated to the head of the payment organization.
Footnote. Chapter 6 has been supplemented with paragraph 36-1 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).37. The payment organization shall ensure the appropriate level of the cyber-security management system, its development and improvement.
37-1. In order to delineate responsibilities and functions in the area of information security, a payment organization shall establish an information security division, which shall be a structural division separate from other structural divisions dealing with the creation, maintenance, and development of information technology facilities, or shall designate a person responsible for ensuring information security who is not on the staff of the structural divisions dealing with the creation, maintenance, and development of information technology facilities.
The information security division or the person responsible for ensuring information security shall coordinate the work to ensure information security and monitor compliance with information security requirements defined in the internal documents of the payment organization.
The payment organization shall provide advanced training for employees of the information security division or the person responsible for ensuring information security by conducting:
1) internal events (lectures, seminars);
2) external training (attending courses, seminars – at least once every two years for each employee).
Footnote. Chapter 6 has been supplemented with paragraph 37-1 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).When a new employee is hired, no later than five working days from the date of employment, the new employee shall be familiarized, against signature, with the basic requirements for ensuring information security (introductory briefing). The result of the briefing shall be recorded in the briefing log or in another document confirming that the briefing has been conducted.
Footnote. Chapter 6 has been supplemented with paragraph 37-2 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).37-3. An employment contract concluded with an employee of a payment organization shall contain the employee's obligation to comply with requirements for ensuring information security and non-disclosure of confidential information.
Footnote. Chapter 6 has been supplemented with paragraph 37-3 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).38. To ensure confidentiality, integrity and availability of information of the payment organization, the payment organization shall perform the following functions:
1) organize the information security management system, coordinates and controls information security activities and measures to identify and analyze threats, counter attacks and investigate information security incidents;
2) provide methodological support for the information security assurance process;
3) select, implement and apply methods, tools and mechanisms for managing, assuring and controlling information security within its powers;
4) collect, consolidate, store and process information about information security incidents;
5) analyze information about information security incidents;
6) ensure implementation, proper operation of software and hardware tools that automate the information security assurance process, also providing access to them;
7) define restrictions on the use of privileged accounts;
8) organize and conduct activities to ensure awareness of the payment organization employees of the information security issues;
9) monitor the state of the information security management system of the payment organization;
10) periodically (at least once a year) update the payment organization administration on the state of the information security management system of the payment organization;
11) keep up-to-date the schemes of information and communication infrastructure protection perimeter and the list of administrators of means of ensuring its security;
12) install firewalls on the perimeter of information and communication infrastructure protection;
13) ensure the security of user access to Internet resources from the perimeter of information and communication infrastructure protection;
14) in the event of connecting laptops or other devices to the information assets of a payment organization from outside the payment organization’s security perimeter, licensed software shall be installed on these devices to organize secure access (encryption of the communication channel, provision of two-factor authentication).
Footnote. Paragraph 38 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication); as amended by the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).39. The payment organization shall manage cyber security risks, indicating the criteria for an acceptable level in relation to information assets.
During realization of the cyber-security risks, an action plan shall be developed to minimize the occurrence of such risks.
40. Information about cyber-security incidents obtained when monitoring the activities of cyber-security assurance is subject to consolidation, systematization and storage.
41. The storage term of information about cyber-security incidents shall be at least 5 (five) years.
42. The payment institution shall establish the procedure of urgent measures to eliminate a cyber-security incident, its causes and consequences.
43. The payment organization shall maintain cyber-security incidents log reflecting all the information about the cyber-security incident, the measures taken and the proposed corrective measures.
44. The payment organization shall provide the National Bank with information on the following identified cyber-security incidents:
1) exploitation of vulnerabilities in application and system software;
2) unauthorized access to the information system;
3) "denied service" attack on the information system or data network;
4) infection of the server with malware or code;
5) unauthorized transfer of funds due to a violation of cyber-security controls;
6) cyber-security incidents that imperil the payment organization’s stability.
Information about the cyber security incidents specified in this paragraph shall be provided by the payment organization as soon as possible, but no later than 48 hours from the moment of detection, by way of cyber-security incident card in accordance with the form of Appendix 7 to the Rules.
Information on processed cyber-security incidents shall be filed in electronic format using the platform of the National Bank for the exchange of cyber-security events and incidents.
For each cyber-security incident, a separate cyber- security incident card shall be filled out.
45. The payment organization uses a static IP address to connect to the National Bank platform for the exchange of information security events and incidents and provides information about it within ten working days from the date of registration with the National Bank.
In the event of a change in the static IP address, the payment organization shall notify the National Bank of this within five working days from the date of the change in the static IP address.
Footnote. Chapter 6 has been supplemented with paragraph 45 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).46. Payment organizations shall provide payment services and ensure the processing of payments made when rendering payment services using software and hardware that are located and operated on the territory of the Republic of Kazakhstan.
Footnote. Chapter 6 has been supplemented with paragraph 46 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).47. The server room (data processing centre) of the payment organization, whether owned or rented, shall be equipped with the following systems:
1) access control and management system;
2) security alarm;
3) fire alarm;
4) automatic fire extinguishing system;
5) video surveillance system.
Server and communication equipment shall be connected to the power supply system via uninterruptible power supplies.
In the absence of a server room (data processing centre) in the payment organization, the requirements of this clause shall apply to rented premises or premises in which the payment organization’s information technology facilities are located.
Footnote. Chapter 6 has been supplemented with paragraph 47 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).48. Access to the server room (data processing centre) of a payment organization, whether owned or rented, shall be granted to persons whose list is approved by the head of the payment organization or the person replacing him/her.
The payment organization shall ensure the maintenance and storage of the log of the access control and management system to the server room (data processing centre) for at least one year.
Footnote. Chapter 6 has been supplemented with paragraph 48 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).49. The payment organization's own or rented server room (data centre) video surveillance system shall ensure monitoring of all passages and entrances to the server room (data centre). The placement of video cameras in the server room (data centre) eliminates any areas within the server room (data centre) or in front of its entrance that are not covered by video surveillance.
The video surveillance system of the server room (data centre) shall record events continuously or using a motion detector.
The archive of video surveillance recordings from the server room (data centre) shall be stored for at least three months.
Footnote. Chapter 6 has been supplemented with paragraph 49 in accordance with the Resolution of the National Bank of the Republic of Kazakhstan dated 20.02.2025 № 6 (shall be enforced from 01.06.2025).| Annex 1 to Rules for the organization of activities of payment organizations |
|
| Form | |
| National Bank | |
| of the Republic | |
| of Kazakhstan |
Application
Footnote. Annex 1 in the wording of the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
___________________________________________________________________
(name and business identification number of the payment organization) hereby
requests to register the payment organization and include the payment organization
to the register of payment organizations
1. Payment organization location:
__________________________________________________________________________
________________________________________________________________________
(index, city (region), district, street, house (office) number
__________________________________________________________________________
__________________________________________________________________
(phone, fax, e-mail address, internet resource (if any)
2. Information on the state registration (re-registration) of payment organization:
__________________________________________________________________________
_____________________________________________________________________
(document name, number and date of issue, by whom)
3. List of planned payment services in accordance with paragraph 3 of the Rules of the organization
activity of the payment organizations:
1) ____________________________________________________________;
2) ____________________________________________________________;
3) ___________________________________________________________
4. List of documents submitted in accordance with paragraph 2 of Article 16 of the Law
of the Republic of Kazakhstan dated July 26, 2016 "On payments and payment systems":
1) ___________________________;
2) ___________________________;
5. Information on the head (members) of the executive body of the payment organization:
General information:
Surname, first name, patronymic name (if any) |
__________________________________________________ |
Individual Identification number | |
Information on identity document | (document name, number, series (if any) and date of issue, by whom) |
Place of residence | (place of residence, including home, office telephone numbers and e-mail address) |
Citizenship |
Full list of places of work and positions:
№ | Period of work (month/year) | Name of organization, of the occupied position | Position duties |
1. | |||
Other information:
Presence of unexpunged conviction or outstanding conviction |
Yes/no |
If previously positioned the head, member of the management body, head, member of the executive body, chief accountant of the financial organization, during the period not more than one year before the decision on preservation of the financial organization or forced redemption of its shares, deprivation of the license of the financial organization, resulting in its liquidation and (or) termination of activities on the financial market, or entry into force of the court decision on forced liquidation of the financial organization or recognition of it as bankrupt in the procedure defined by the Law of the Republic of Kazakhstan dated March 7, 2014 "On Rehabilitation and Bankruptcy" |
Yes/no |
Other information (if any) |
I hereby confirm that the attached information has been verified and is accurate and complete.
I hereby agree to the use of information constituting a legally protected secret contained in information systems.
First head of the payment organization
or person authorized to sign
____________________________________________
surname, first name, patronymic name (if any) signature
| Annex 2 to the Rules for organization of the activities of payment organizations |
|
| Form |
List of basic requirements to the provision of state service "Inclusion in the register of payment organizations passed record registration with the National Bank of the Republic of Kazakhstan"
Footnote. Annex 2 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated, 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
1. | Name of the service provider | National Bank of the Republic of Kazakhstan |
2. | Methods of provision of state service |
Web portal of "electronic government" |
3. | Term of provision of state service | Within ten working days from the date of registratio of application and complete list of documents. |
4. | Form of provision of state service | Electronic (automated). |
5. | Result of provision of state service |
Notification on passing the registration for granting permission (right) to provide by the payment organization of payment services established by the Law of the Republic of Kazakhstan “On Payments and Payment Systems” (hereinafter - the Law) or motivated refusal. |
6. | The amount of the payment charged from the service recipient when rendering state service and the ways of its collection in cases provided for by the legislation of the Republic of Kazakhstan | The service is provided free of charge. |
7. | Work schedule of the service provider, the State Corporation and information objects |
1) service provider - from Monday to Friday from 9.00 to 18.30 hours with a break for lunch from 13.00 to 14.30 hours, except for weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. |
8. | List of documents, required for provision of state service |
1) application in the form according to Annex 1 to the Rules for Organization of Payment Organizations' Activities approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan № 215 dated August 31, 2016 (hereinafter - the Rules). |
9. | Grounds for refusal to provide state service, established by the laws of the Republic of Kazakhstan |
1) submission of incomplete and (or) unreliable information to be reflected in the documents specified in paragraph 2 of Article 16 of the Law; |
10. | Other requirements, subject to the particularities of provision of state service, including those provided in electronic form and via the State Corporation |
The addresses of the places where the state service is provided are posted on the portal and on the official Internet resource of the service provider: www.nationalbank.kz, section “State Services”. |
| Annex 3 to Rules for the organization of activities of payment organizations |
Footnote. Annex 3 in the wording of the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
| Form |
"ҚАЗАҚСТАН РЕСПУБЛИКАСЫНЫҢ |
|
REPUBLICAN STATE INSTITUTION |
[Bank details |
| |
|
|
National Bank of the Republic of Kazakhstan on the results of consideration of the application
_______________________________________________________
name of the service recipient
attached documents in accordance with paragraph 4, of Article 16 of the Law of the
Republic of Kazakhstan dated July 26, 2016 "On Payments and Payment Systems"
shall notify of passing ________________________________
name of the service recipient
account registration as payment organization, of assignment of registration numbers
№ _____________ and shall entry in the register of payment organizations.
In accordance with subparagraph 4) of paragraph 2 of Article 13 of the Law of the
Republic of Kazakhstan dated July 26, 2016 "On Payments and Payment Systems" payment organization
________________________________________________________________
name of the service recipient
shall provide the following payment services:
____________________________________________________________;
____________________________________________________________;
___________________________________________________________
[position of the signing person] [Full name of the signing person]
| Annex 4 to Rules for the organization of activities of payment organizations |
|
| Form |
Register of the payment organizations
Footnote. Annex 4 in the wording of the resolution of the Board of the National Bank of the RK dated 19.03.2020 № 35 (shall be enforced upon expiry of twenty one calendar days after the date of its first official publication).
№ r/n | Date of registration of the payment organization | Registration number of payment organization | Name of payment organization | Surname and initials of the head | Business Identification Number of the payment organization | Payment organization location, telephone, fax, e-mail address, internet resource (if any) | List of payment services provided | Notes |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
| Annex 5 to the Rules for organization of the activities of payment organizations |
List of basic requirements to the provision of state service
" Issuance of consent for voluntary reorganization (accession, merger, division, separation, spin-off, transformation) of payment organizations"
Footnote. Annex 5 as amended by the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 19.02.2024 № 10 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
1. | Name of the service provider | National Bank of the Republic of Kazakhstan |
2. | Methods of provision of state service | Web portal of "electronic government" www.egov.kz, www.elicense.kz (hereinafter - the portal). |
3. | Term of provision of state service | Within ten working days from the date of registratio of application and complete list of documents. |
4. | Form of provision of state service | Electronic (automated). |
5. | Result of provision of state service |
Notification of the decision on the results of the approval or a motivated response on refusal to provide state service. |
6. | The amount of the payment charged from the service recipient when rendering state service and the ways of its collection in cases provided for by the legislation of the Republic of Kazakhstan | The service is provided free of charge. |
7. | Work schedule of the service provider, the State Corporation and information objects |
1) service provider - from Monday to Friday from 9.00 to 18.30 hours with a break for lunch from 13.00 to 14.30 hours, except for weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. |
8. | List of documents, required for provision of state service |
1) decision on voluntary reorganization of the payment organization; |
9. | Grounds for refusal to provide state service, established by the laws of the Republic of Kazakhstan |
1) establishment of unreliability of the documents submitted by the service recipient to receive a state service and (or) data (information) contained in them; |
10. | Other requirements, subject to the particularities of provision of state service, including those provided in electronic form and via the State Corporation |
The addresses of the places where the state service is provided are posted on the portal and on the official Internet resource of the service provider: www.nationalbank.kz, section “State Services”. |
| Annex 6 to Rules for the organization of activities of payment organizations |
|
| Form | |
| National Bank of the Republic of Kazakhstan |
Notification of opening of the branch office
_________________________________________________________________________
(name, location and business identification number
of the payment organization)
Footnote. Annex 6 in the wording of the resolution of the Board of the National Bank of the RK dated 28.11.2019 № 221 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
Hereby announces of opening of the branch:
in the territory of the Republic of Kazakhstan (in case of opening):
_______________________________________________________________
(name, location and business identification number of the payment organization branch)
Details of the head: _________________________
(position, surname, first name, patronymic name (if any)
List of payment services provided by the branch of the payment organization in accordance
with paragraph 3 of the Rules for the organization of the activities of payment organizations:
1) ______________________________________________________________;
2) ______________________________________________________________;
3) ______________________________________________________________.
□ outside the Republic of Kazakhstan (in case of opening):
_______________________________________________________________
(name, location of payment organization branch)
Details of the head: _________________________
(position, surname, first name, patronymic name (if any)
List of payment services provided by the branch of the payment organization in accordance with
paragraph 3 of the Rules for the organization of the activities of payment organizations:
1) __________________________________________________________;
2) __________________________________________________________;
3) __________________________________________________________.
I hereby confirm that the attached information has been verified and is accurate and complete.
I hereby agree to the use of information constituting a legally protected secret contained in information systems.
First head of the payment organization or the person authorized to sign
_____________________________________ _____
surname, first name, patronymic name (if any) signature
| Annex 7 to Rules for the organization of activities of payment organizations |
Form
Card of cyber-security incident
Footnote. The Rules have been supplemented by Appendix 7 pursuant to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.12.2021 № 116 (shall be enforced from 01.04.2022).
№ | Overview | |
Characteristics of the cyber-security incident | Information on the cyber security incident | |
1 | Name of the cyber-security incident | |
2 | Date and time of detection (date, place, year and hour with indication of the time zone UTC+X) | |
3 | Place of detection (organization, branch, segment of the information infrastructure) | |
4 | Source of information on the cyber-security incident (user, administrator, cybersecurity official, a cybersecurity unit employee or a hardware) | |
5 | Methods used in realization of a cyber-security breach(social engineering, malware code) | |
Content of the cyber-security incident | ||
6 | Symptoms, signs of the cyber-security incident | |
7 |
Main events (exploitation of vulnerabilities in application and system software; | |
8 | Affected assets (physical level of information infrastructure, level of network equipment, level of network applications and services, level of operating systems, level of technological processes and applications, and level of business processes of the payment organization) | |
9 | Status of the cyber-security incident (completed cyber-security incident, attempted cyber-security incident, suspected cyber-security incident) | |
10 | Damage | |
11 | Source of the threat (identifiers detected) | |
12 | Intentionality (intended, erroneous) | |
Actions taken on the cyber-security incident | ||
13 | Actions taken (identification of vulnerability, blocking , recovery) | |
14 | Planned actions to minimize occurrence of cyber-security risks | |
15 | Notification of the person (full name), officials, name of state bodies, organizations) | |
16 |
Specialists involved | |
Responsible cyber-security officer
____________________________________________ __________________
(full name) (signature)
Date "____" ______ 20 ___
