THE RESOLUTION OF BOARD OF THE AGENCY OF THE REPUBLIC OF KAZAKHSTAN ON REGULATION AND DEVELOPMENT OF THE FINANCIAL MARKET

of October 30, 2026 No. 153

About introduction of amendments to the resolution of Board of the Agency of the Republic of Kazakhstan on regulation and development of the financial market of April 3, 2026 No. 53 "About approval of Requirements to ensuring information security of the banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types of banking activities"

Board of the Agency of the Republic of Kazakhstan on regulation and development of the DECIDES: financial market

1. Bring in the resolution of Board of the Agency of the Republic of Kazakhstan on regulation and development of the financial market of April 3, 2026 No. 53 "About approval of Requirements to ensuring information security of the banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types of banking activities" (it is registered in the Register of state registration of regulatory legal acts at No. 38336) the following changes:

state heading in the following edition:

"About approval of Requirements to ensuring information security in the financial sphere, including the cyber security of banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types of banking activities";

state Item 1 in the following edition:

"1. Approve the enclosed Requirements to ensuring information security in the financial sphere, including the cyber security of banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types of banking activities.";

Requirements to ensuring information security of banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing the separate types of banking activities approved by the specified resolution to state in edition according to appendix to this resolution.

2. To provide to department of information and cyber security in the procedure established by the legislation of the Republic of Kazakhstan:

1) together with Legal department state registration of this resolution in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this resolution on official Internet resource of the Agency of the Republic of Kazakhstan on regulation and development of the financial market after its official publication;

3) within ten working days after state registration of this resolution submission to Legal department of data on execution of the action provided by the subitem 2) of this Item.

3. To impose control of execution of this resolution on the supervising vice-chairman of the Agency of the Republic of Kazakhstan on regulation and development of the financial market.

4. This resolution becomes effective after ten calendar days after day of its first official publication.

Appendix

to the Resolution of Board of the Agency of the Republic of Kazakhstan on regulation and development of the financial market of October 30, 2026 No. 153

Approved by the Resolution of Board of the Agency of the Republic of Kazakhstan on regulation and development of the financial market of April 3, 2026 No. 53

Requirements to ensuring information security in the financial sphere, including the cyber security of banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types of banking activities

Chapter 1. General provisions

1. These Requirements to ensuring information security in the financial sphere, including the cyber security of banks, branches of nonresident banks of the Republic of Kazakhstan and the organizations performing separate types bank transactions (further - Requirements), are developed according to Items 2 and 10 of article 55 of the Law of the Republic of Kazakhstan "About banks and banking activity in the Republic of Kazakhstan" and establish requirements to ensuring information security in the financial sphere, including cyber security (further - information security) banks, branches of nonresident banks of the Republic of Kazakhstan (further - bank) and the organizations performing separate types of banking activities (further - the organization).

2. In Requirements the concepts provided by the Digital Code of the Republic of Kazakhstan, the Laws of the Republic of Kazakhstan "About state regulation, control and supervision of the financial market and the financial organizations" and "About cyber security" and also the following concepts are used:

1) the regular data carrier - the data carrier which is component of object of digital infrastructure and connected to it on permanent basis;

2) data asset - set of information and the object of digital infrastructure used for its storage and (or) processing. The data asset is subdivided on critical and not critical and determined by bank based on the level of losses from violation of their confidentiality, integrity, availability;

3) threat of information security - set of the conditions and factors creating premises to emergence of incident of information security;

4) risk of information security - probable emergence of damage owing to violation of confidentiality, deliberate violation of integrity or availability of data assets of bank, the organization;

5) ensuring information security - the process directed to maintenance of condition of confidentiality, integrity and availability of data assets of bank, organization;

6) incident of information security - event or several events of information security owing to which damage was caused to confidentiality, integrity or availability of digital resources;

7) the preset accounting records - the accounting records of digital systems established by their producers;

8) exclusive accounting record - the accounting record in digital system having privileges of creation, removal and change of access rights of accounting records;

9) the console of administration and monitoring - the workstation allowing to exercise remote control of digital system;

10) data-processing center of bank, the organization - specially allocated room in which the servers ensuring functioning of digital systems of bank, organization are placed;

11) business process - set of the interconnected actions or tasks directed to creation of certain product or service for the external or internal consumer;

12) the owner of business process - the division (worker) of bank, the organization which is responsible (answering) for lifecycle of business process and coordination of activities of the divisions of bank, organization involved in business process;

13) the virtual circle - computing resources or their logical consolidation abstracted from hardware realization, and providing at the same time logical isolation from each other of the computation processes which are carried out on one physical resource;

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info