Internal control system

The internal control system in the Bank is formed in accordance with the requirements of the legislation of the RK, the Basel Committee on Banking Supervision, and best world practices. The Bank applies the 2013 concept of the "COSO Integrated Model" in building the internal control system. The internal control system of the Bank (hereinafter – the ICS) represents a process embedded into day-to-day activity, carried out by the Board of Directors, collegial bodies, structural units, and all workers of the Bank upon execution of their duties.

The Board of Directors exercises control over the activity of the Management Board by means of ensuring the implementation of the ICS, as well as oversight over the state of the ICS. The Risk and Internal Control Committee of the Board of Directors exercises control over the functioning of the ICS and reviews the results of the evaluation of the quality and efficiency of the functioning of the ICS.

The Management Board ensures the presence and functioning of all components and principles of the ICS.

Quarterly, the authorized collegial bodies of the Bank review reports on operational risks, risks of information technologies and information security, and internal control, on which they adopt corresponding decisions. In addition, the Board of Directors reviews and approves the main internal documents regulating the ICS in the Bank.

Procedures on risk management ensure a rapid response to new risks, their identification, and the determination of risk owners. For a holistic understanding of inherent risks, the identification and assessment of risks are conducted in the Bank on an annual basis, which are reflected in the risk register, risk map, list of material risks, and the Risk Appetite Statement for the upcoming year, approved by the Board of Directors.

Approaches to the definition of risks, the order of identification and assessment of risks, the determination of response methods, and monitoring are provided for by internal documents within the framework of the risk management system.

The ICS of the Bank consists of three lines of defense and includes all units of the Bank.

The first line of defense is ensured by all structural units of the Bank, represents a system of controls developed to ensure the correct performance of day-to-day operations in processes. Controls are developed by business owners of processes and are an integral part of business processes to minimize identified and assessed risks of processes to an acceptable level. Management of controls and their monitoring are carried out by the units themselves, which implies the ability of business owners of processes to detect risks, weak sides of business processes, possible unforeseen events, and timely respond to them.

The second line of defense is ensured by the internal control unit, exercising monitoring, coordination, and documentation of the ICS, and by units ensuring the identification and assessment of risks by separate directions of the Bank's activity.

The third line of defense is ensured by the internal audit unit in the form of an independent evaluation of the efficiency of the Bank's ICS using the results of audit checks or in the form of a separate evaluation of the efficiency of the ICS.

The internal control unit renders consulting assistance to workers of the Bank on issues of internal control in accordance with the requirements of the legislation of the RK and internal regulatory documents of the Bank.

Annually, the internal control unit conducts internal training of all workers of the Bank on the ICS, with subsequent testing.

Within the framework of works on monitoring and documentation of the ICS, the internal control unit conducts selective checks of business processes of the Bank in accordance with the work plan / by order of the management, including those containing diagnostics of the adequacy of the design of internal controls preventing or detecting identified risks in processes, as well as testing of the operational efficiency of controls.

In 2025, the unit conducted a check of the following processes:

-                 "Asset and Liability Management of the Bank";

-                 "Realization of Housing under the Nauryz Program";

-                 "Lending" (processes of post-credit servicing, in which actions on removal of encumbrance from collateral real estate are performed upon written notification of the Bank);

-                 "Disbursement to recipients of payments of target savings from the National Fund of the RK".

By the results of the diagnostics/testing of controls in processes, there were such findings as: the necessity of regulation of control procedures, the presence of controls with a partially effective design, the presence of a material share of manual controls entailing the necessity of automation of controls/processes. In order to complement controls in processes, recommendations were developed on the refinement of regulation/automation/optimization of processes. Reports on the conducted checks were reviewed by the Risk Committee of the Bank, and plans of corrective actions on elimination of the revealed deficiencies were approved. Works on elimination of violations and execution of measures of the plans of corrective actions are being conducted by the responsible structural units of the Bank.

Identification and assessment of risks in their processes and self-assessment of the adequacy of the design of internal controls mitigating identified risks are conducted on an annual basis by structural units – participants of all lines of defense – owners of business processes. The results of the self-assessment are reflected in the Matrix of Business Processes, Risks, and Controls of the Bank (hereinafter – the Matrix). The Matrix for the upcoming reporting year, containing the self-assessment of business owners, is updated by process owners with the coordination and methodological support of the internal control unit and is approved by the Management Board. If necessary, action plans on elimination of deficiencies of internal control in processes are developed by business process owners and approved by authorized organs of the Bank.

Monitoring of the Bank's ICS on a constant basis is carried out by the first and second line of defense, as well as by the Management Board of the Bank. Material deficiencies of internal control are brought to the attention of the Board of Directors of the Bank.