RESOLUTION OF BOARD OF NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN

of April 29, 2026 No. 45

About approval of rules of implementation of activities of operators of exchange of unsecured digital assets

According to the subitem 1) "About digital assets in the Republic of Kazakhstan" the Board of National Bank of the Republic of Kazakhstan DECIDES: parts two of Item 1 of article 4 of the Law of the Republic of Kazakhstan

1. Approve the enclosed Rules of implementation of activities of operators of exchange of unsecured digital assets (further – Rules).

2. To provide to department of payment systems and digital financial technologies of National Bank of the Republic of Kazakhstan in the procedure established by the legislation of the Republic of Kazakhstan:

1) together with Legal department of National Bank of the Republic of Kazakhstan state registration of this resolution in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on official Internet resource of National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after state registration of this resolution of submission to Legal department of National Bank of the Republic of Kazakhstan of data on execution of the action provided by the subitem 2) of this Item.

3. To impose control of execution of this resolution on the supervising vice-chairman of National Bank of the Republic of Kazakhstan.

4. This resolution becomes effective since May 1, 2026 and is subject to official publication.

Suspend till July 12, 2026:

the subitem 6) of Item 1 of Rules, having determined that during suspension this subitem is effective in the following edition:

"6) requirements to information security;";

Item 6 of Rules, having determined that during suspension this Item is effective in the following edition:

"6. The employee of National Bank authorized on acceptance and registration of correspondence in day of receipt of the statement performs its acceptance, registration and the direction on execution in the division responsible for rendering the state service (further – responsible division). In case of receipt of the statement after the termination of working hours, in days off and holidays according to the labor law of the Republic of Kazakhstan reception of applications is performed the next working afternoon.

In case of the direction uslugopoluchately statements through the web portal of "the electronic government" in personal account the status about adoption of the statement on rendering the state service with indication of date and time of receipt of result is automatically displayed.

The National Bank receives from the corresponding state information systems through lock of "the electronic government" of data on identity documents of the head of uslugopoluchatel, and on state registration (re-registration) of the legal entity.";

parts seven of Item 8 of Rules, having determined that during suspension this part is effective in the following edition:

"On the web portal of "the electronic government" the result of rendering the state service goes to uslugopoluchatel to personal account in electronic form, certified by the digital signature (further – the EDS) the authorized person.";

Item 9 of Rules, having determined that during suspension this Item is effective in the following edition:

"9. Information on stage of rendering the state service is updated in the automatic mode in information system of monitoring of rendering the state services.";

the paragraph of the twelfth Item 23 of Rules, having determined that during suspension this paragraph is effective in the following edition:

"procedures of ensuring information security;";

parts two of Item 36 of Rules, having determined that during suspension this part is effective in the following edition:

"The operator of exchange of unsecured digital assets provides continuity of functioning of Internet resource, mobile application, information infrastructure, confidentiality, integrity and availability of these information systems of the operator of exchange of unsecured digital assets.";

Chapter 5 of Rules, having determined that during suspension this head acts in the following edition:

"Chapter 5. Requirements to information security

43. The storage duration of information on incidents of information security constitutes at least 5 (five) years.

44. The operator of exchange of unsecured digital assets determines procedure for acceptance of urgent measures to elimination of incident of information security, its reasons and effects.

45. The operator of exchange of unsecured digital assets conducts register of incidents of information security with reflection of all information on incident of information security, the taken measures and the proposed adjusting measures.

46. On each incident of information security the separate map of incident of information security which includes data by description of incident, date and time of origin, detection and elimination of incident, the arisen effects, damage and the taken measures is filled in.

47. The operator of exchange of unsecured digital assets manages risks of information security with indication of the name, the description, origin, acceptable risk level and the actions plan on its minimization in relation to objects of informatization of the operator of exchange of unsecured digital assets.

48. Information on incidents of information security obtained during monitoring of activities for ensuring information security is subject to consolidation, systematization and storage.

49. The operator of exchange of unsecured digital assets sends to National Bank in any form the notification on the occurred incidents of information security within 24 (twenty four) hours from the moment of their detection with appendix of the card of incident of information security.

50. The operator of exchange of unsecured digital assets provides:

1) identification, authentication and authorization of users;

2) registration and storage of events of information security;

3) information security from unauthorized access, leakage, modification, destruction and blocking.

4) backup and recovery of information;

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info