IT Development

In its growth, the Bank places a heavy emphasis on the information and technical support of its subdivisions. Work is performed on a continuous basis to develop the IT infrastructure and the automated information system to enhance its functional and technical capabilities, align them with the requirements of tariff programs, and expand its analytical capacity.

In terms of IT development, the Bank aims to create a dynamic digital bank with an optimal structure of automated business processes, ensuring the implementation of advanced technologies for banking service development and innovative banking systems.

Over its development period, the Bank has successfully and efficiently resolved the following objectives within its IT segment:

-     modernizing IT infrastructure and ensuring the fault tolerance of the Bank's information systems;

-     upgrading the computer fleet;

-     implementing a managed print services (MPS) system in the head office;

-     developing the Colvir CBS (Core Banking System), including "Online Archiving," 24/7 account processing, and internet banking for legal entities;

-     implementing robotic process automation (RPA) within the Bank's business processes, including the deployment of Computer Vision;

-     developing the Bank's endpoint management system;

-     achieving phased license coverage for databases;

-     conducting a pilot project to test ITSM systems to select and subsequently replace the current IT service management system;

-     archiving electronic archive files from previous years;

-     transitioning to alternative (open-source, etc.) DBMS.

The Bank continuously performs work to maintain its infrastructure at a modern technological level and ensure its information security in view of new challenges and threats.

 

Development of Remote and Alternative Service Channels

Over the past few years, alongside the development of the physical infrastructure of branches and the agent network, the Bank has worked on developing modern customer service methods. This includes expanding its own channels and tools for sales and customer service via the internet and mobile devices to shift simple, everyday operations online.

The Bank worked on developing the Baspana real estate portal to bridge client demand for improved housing conditions with offerings from partners for housing and related services, including home renovation. It also enhanced sales channels and tools to serve clients via the internet and mobile devices, which successfully reduced queues in branches and cut down customer service times.

 

Automation of Operations and Development of the Bank's Business Processes (IT Infrastructure Reorganization and Ensuring Continuous Operation of the Bank's Information Systems)

As part of efforts to improve the quality of services provided, labor productivity, and decision-making speed—as well as to mitigate operational risks—the Bank is actively working on automating its operations.

The Bank automates processes for credit and post-credit operations, deposit and post-deposit operations, citizen appeals, client-flow and payment monitoring, incoming calls, video services, HR processes, accounting processes, IT and IT security, reporting collection and preparation, and banking document management. These processes are continuously evaluated and analyzed to adapt to changing market conditions.

In the reporting year, in accordance with the Bank's Business Process Automation Action Plan for 2025, client operations in the Bank's digital channels, risk management processes, collateral management, HR, accounting, compliance control, and reporting processes were automated. At year-end, the Bank's Business Process Automation Action Plan for 2025 was 100% executed.

At the same time, the Bank continued to implement initiatives to develop its digital infrastructure and automate key business processes in 2025. Within the framework of the phased migration of the electronic document management system to the BPM 2.0 Business Process Management System (BPMS BPM 2.0), the automation of processes for the Bank's Authorized Bodies was secured. As part of the expansion of regional lending programs, process automation tasks were completed within the BPM system.

During the reporting year, integrations were implemented with the Open API Platform for client account data exchange, alongside ETL integration with the Analytical Center of JSC "NIH "Baiterek" for the transfer of regulatory reporting and the Bank's key performance indicators. The development of Open API continued, including the implementation of funds transfers between a client's own accounts (Me2Me) across different second-tier banks, carried out jointly with the National Payment Corporation of the National Bank of the Republic of Kazakhstan.

In 2025, the Bank took over the database of waitlist registrants from the "E-Kezekte" system. Data migration tasks into the Bank's own waitlist management system, "TsoZh," were completed, corresponding business processes were developed, and a specialized web resource, orken.baspana.kz, was launched to accept applications from waitlist registrants.

Furthermore, the development of the operational data store (ODS) continued, securing its integration with the CRM system and the Baspana system. To increase the sustainability, scalability, and technological reliability of the Bank's IT landscape, work is underway to develop the enterprise service bus (ESB) architecture using modern technological solutions.

As part of modernizing the IT infrastructure and ensuring the fault tolerance of the Bank's information systems, the following equipment was commissioned and the following activities were carried out during the reporting year:

1)   12 pieces of disks for the Netapp NVMe-SSD 15 TB array, 24 pieces for the Huawei NVMe-SSD 3.8TB array, as well as 1 piece of disk array were commissioned, which made it possible to ensure flexibility, reliability, cross-platform compatibility, and the availability of a high-performance enterprise-class system. The upgrade stands at 8%.

2)   Activities aimed at increasing the level of fault tolerance of the backup Data Center (DC) were carried out. In this regard, work was performed to relocate server and network equipment from the DC in Astana, 17 Kabanbay Batyr Ave. to the DC at the address Astana, 47A Abay Ave. The new backup Data Center complies with the TIER III fault tolerance level, which ensures increased reliability of the infrastructure, the possibility of conducting routine maintenance without stopping services, and compliance with international standards for engineering infrastructure availability.

3)   In order to increase the level of fault tolerance and improve monitoring of the state of the Bank's IT infrastructure, work was conducted to integrate the VMware vCenter system into the Grafana monitoring system (monitor.otbasybank.kz) to monitor the state of physical and virtual servers, as well as LUNs (logical data storage devices). Prompt retrieval of data on the state of servers and LUNs was ensured, which allows for the timely elimination of potential failures and minimizes the risks of downtime for critical services.

4)   Work was completed in order to develop the VDI environment (virtual desktops) in Proxmox. A Windows 11 template was deployed for the VDI infrastructure, which allows for solving the following tasks:

-     standardization of virtual desktop configurations;

-     reduction of VDI deployment time for employees;

-     centralized management of OS updates and settings;

-     increasing the level of information security through a unified configuration policy;

-     reduction of operational costs for desktop maintenance;

-     increasing the fault tolerance and manageability of the VDI infrastructure.

5)   Within the framework of the development and modernization of the Bank's network infrastructure in 2025, the following activities were carried out:

-   switches were acquired and commissioned in accordance with the procurement plan for 2025, including within the framework of the relocation of the Bank's Central Office to the city of Astana, which made it possible to ensure the necessary bandwidth, scalability, and fault tolerance of the network infrastructure at the new site;

-   work was completed on the design and organization of a structured cabling system (SCS) at the new location in the city of Astana, including laying cable lines, organizing telecommunications cabinets and cross-connect nodes, which ensured compliance of the infrastructure with the requirements of reliability and further expansion;

-   the migration of the Bank's services to the Cisco ACI fabric was carried out, which made it possible to centralize the management of the data center network infrastructure, increase the level of automation, configuration flexibility, and fault tolerance of services;

-   software updates for Cisco firewalls were completed, which ensured an increase in the level of information security, elimination of identified vulnerabilities, and support for up-to-date versions of security policies;

-   software updates for the Cisco SD-WAN network were completed, which made it possible to increase the stability of the branch network, expand the functional capabilities of the solution, and ensure compliance with current requirements for security and manageability.

6)   Within the framework of modernizing the computer fleet, a planned update was carried out in 2025, in particular of laptops - by 40%, all-in-one PCs - by 9%, and uninterruptible power supplies - by 19%. Within the framework of the roadmap of the IT strategy, a phased annual update of the Bank's computer fleet and office equipment is planned.

7)   During the period of relocation of the Bank's central office from the city of Almaty to the city of Astana, activities were carried out to organize workstations (issuing laptops and ensuring the operation of users in a remote mode during the move period, connecting workstations and office equipment, installing the relevant programs and services).

8)   With the aim of increasing efficiency, optimizing expenses/costs, and improving the quality of provided printing services in the Bank, a service (under outsourcing) – "Print Service" – was introduced in the central office of the Bank by means of leasing 19 high-performance multi-functional devices with full technical support, which made it possible to decommission 285 units of obsolete printing equipment, 123 operated units of which were sent to the regional branches of the Bank. The decision on the Print Service in the central office of the Bank demonstrated its high efficiency, optimization, benefit, and scale potential. The transparency and manageability of the document printing process on paper media increased, the total volume of printed products decreased due to centralized control and regulation, and cases of inappropriate use of both printing equipment and printing paper were minimized. The decision made it possible to abandon capital expenditures for updating printing equipment, as well as to exclude procedures for amortization, write-off, and disposal of the obsolete printing fleet. The high-performance multi-functional devices used by the Bank are new-generation equipment with optimized energy consumption, which is an important element of the sustainable development policy (ESG).

 

Implementation and Development of Information Systems

In 2025, within the framework of IT development, the Bank initiated and implemented the following projects:

-     development of the "SDFO" system (Financial Transactions Data Collection System);

-     development of the "Electronic Archive" system;

-     development of the "Situational Monitoring" system;

-     development of the "RPM" system (Non-Financial Risk Management System);

-     development of the analytical system of the "Oracle BI" data warehouse;

-     development of the system of the "Account of External Service Providers' Activities – Appraiser's Account";

-     launch and development of the system "TsoZh Waitlist Database" and the web resource orken.baspana.kz;

-     development and optimization of modules of the Colvir CBS: "Online Archiving", 24/7 Account Processing, internet banking for legal entities;

-     robotic process automation of the Bank's business processes, including the implementation of Computer Vision;

-     licensing of the MS SQL Server database management system;

-     licensing of the Oracle database management system;

-     modernization of server and network equipment;

-     conducting a pilot project to test ITSM systems with the aim of selecting and subsequently replacing the current IT service management system;

-     transition to alternative (open source, etc.) DBMS:

-     1) Migration of the error log database from Microsoft SQL Server DBMS to PostgreSQL DBMS;

-     2) Migration of the BPM deposit operations user action log database from Microsoft SQL Server DBMS to PostgreSQL DBMS;

-     3) Migration of the Bank's Integration Bus knowledge base from Microsoft SQL Server DBMS to PostgreSQL;

-     4) Migration of the Biometrics Database (KCDI) from Microsoft SQL Server DBMS to PostgreSQL DBMS;

-     5) Migration of the Genesys database (GCTI8) from Oracle DBMS to PostgreSQL DBMS;

-     development of the UEM system;

-     archiving of last year's electronic archive files;

-     modernization of the computer fleet;

-     implementation of managed print services in the central office.

In general, a relatively high level of support for the development of digital technologies and innovations is noted in the Bank, which provides a good basis for further productive development.

Cybersecurity

Ensuring the security of information assets and protecting their confidentiality remain vital tasks within the framework of the Bank's activities. The relevance of these tasks is highlighted by the need to comply with the Resolution of the Government of the Republic of Kazakhstan dated December 20, 2016, No. 832 "On Approval of Unified Requirements in the Field of Information and Communication Technologies and Ensuring Information Security", the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated March 27, 2018, No. 48 "On Approval of Requirements for Ensuring Information Security of Banks, Branches of Non-Resident Banks of the Republic of Kazakhstan, and Organizations Engaging in Certain Types of Banking Operations, Rules and Deadlines for Submitting Information on Information Security Incidents, Including Data on Breaches and Failures in Information Systems", as well as compliance with the requirements of other regulatory legal acts of the Republic of Kazakhstan and internal regulatory documents of the Holding.

The primary conceptual directions for strengthening information security are:

·      maintaining the database of internal regulatory documents on information security up to date;

·      increasing the level of awareness of the Bank's information technology infrastructure users in the field of information security;

·      ensuring compliance with the regulations of the external regulator;

·      technical support and development of software and hardware measures to ensure the Bank's information security, including the following areas:

1)   monitoring of information security events;

2)   registration and resolution of information security incidents, as well as the development of a knowledge base for them;

3)   control over the circulation of critical information subject to protection (personal data and banking secrecy);

4)   control over access management in the application information systems of the Bank;

5)   vulnerability management in the information technology infrastructure of the Bank;

6)   protection of information in databases;

7)   control over privileged access;

8)   protection of e-mail and users during work with the Internet;

9)   protection of web applications and mobile applications of the Bank;

10)                  multi-layered antivirus protection of the information technology infrastructure of the Bank;

11)                  control of changes on critical hosts of the Bank and application control.

·      conducting penetration tests, social engineering, and source code analysis of critical applications of the Bank to obtain a third-party view of the actual security of the Bank's assets;

·      executing continuous searches for potential malicious threats through automated anomaly detection tools, and investigating identified suspicious actions for a possible incident;

·      conducting continuous analysis of the Bank's digital assets to identify vulnerabilities according to international CVE standards using the relevant specialized systems operated in the Bank;

·      conducting proactive searches and data analysis to identify potential threats that are not covered by current security tools;

·      implementing measures to prevent/localize information security threats;

·      generating and assigning tasks for the localization and prevention of threats to the relevant responsible subdivisions of the Bank;

·      conducting analysis of alerts on new threats to determine the initial area of impact and degree of severity.

To ensure information security, protection systems against data leaks, cyberattacks, virus activity, unauthorized entry to the Bank's resources, copying, unauthorized changes, and others are used.

The Bank monitors all critical information systems of the Bank that contain, process, and (or) transmit data classified as protected information security data on a continuous basis, with the aim of identifying information security incidents and responding to them in a timely manner. In the reporting year, the number of data leak cases was 0. The total amount of fines paid in connection with breaches in the field of information security was 0.

In the future, to ensure information security, the Bank will carry out activities to update and configure systems, as well as keep rules, policies, and protection systems in the field of information security up to date.

The Anti-Fraud Department operates as an independent structural subdivision in the Bank, the primary task of which is to protect the Bank and its clients from fraud events related to scams.

In order to detect transactions with signs of fraud and illegal incidents, an Anti-Fraud system functions in the Bank on a continuous basis, ensuring daily monitoring and analysis of client transactions in the remote banking service system. Employees of the Anti-Fraud Department, in accordance with the requirements of internal documents, conduct analysis of alerts on operations with signs of fraud.

In the reporting year of 2025, planned improvements and updates to the Anti-Fraud system were implemented, including:

1)      updating and reconfiguring system components due to changes in external integrations;

2)      expanding the functional capabilities of the system for viewing legal entities;

3)      updating and developing internal categories and signs;

4)      improving mechanisms for restrictions and control over client accounts.

In parallel, the Bank continued interaction with the Anti-Fraud Center of the National Bank of the Republic of Kazakhstan, which allows for taking into account up-to-date information on incidents and improving the quality of transaction monitoring.

Additionally, for the proactive identification of fraudulent phishing websites, pilot testing of "Brand Protection" class systems was conducted, as well as "Database Protection" class systems to identify leaks of clients' personal data. In order to reduce fraud risks, the Anti-Fraud Department, jointly with the Department for Development and Support of Information Systems, developed a service to check client transactions (excluding transactions created in the mobile application) for data matches with the databases of the Anti-Fraud Center of the NBRK (trustworthiness assessment).

The Anti-Fraud Department continues to take all necessary measures to ensure the secure functioning of the Bank, prevent internal and external security threats, protect the legitimate interests of the Bank and its clients from illegal encroachments, and strengthen the security of the Bank's personnel and property.