In accordance with the Risk Management Policy of the Bank, the Board of Directors of the Bank ensures the presence of a risk management system corresponding to the chosen business model, scale of activity, types and complexity of operations, and ensures a proper process of identification, measurement and assessment, monitoring, control, and procedures of minimization of material risks to ensure financial stability and stable functioning of the Bank.

A key factor of a high culture of risk management of the Bank is regular informing of authorized collegial organs of the Bank, including the Board of Directors of the Bank, on issues related to risks, including policies and procedures of risk management. To the exclusive competence of the Board of Directors of the Bank in the part of risk management belong powers regulated by the Charter of the Bank, internal documents of the Bank, as well as the Regulation on the Board of Directors of the Bank. The Board of Directors of the Bank, for the purpose of effective performance of the assigned duties, exercises monitoring and control over risk management, internal audit, compliance with the requirements of the legislation of the Republic of Kazakhstan and internal documents of the Bank by means of interaction with authorized collegial organs under the Board of Directors of the Bank, the Management Board of the Bank, and the Head of Risk Management. The Risk and Internal Control Committee of the Board of Directors of the Bank exercises its activity in accordance with the Regulation defining its powers, competence, as well as principles of its work. This collegial organ regularly receives from units on risk management and other responsible units data and reports on the current level of risks of the Bank, on levels of risk appetite and mechanisms on reducing the level of risks, if necessary.

In the Bank, the Risk Appetite Strategy of the Bank is developed and approved by the Board of Directors of the Bank, which defines clear boundaries of the volume of accepted risks inherent to the activity of the Bank within the framework of implementation of the general strategy of the Bank, as well as defines the risk profile of the activity of the Bank with the purpose of preventing the materialization of risks or minimizing their negative influence on the financial position of the Bank.

In accordance with the Risk Appetite Strategy, the Risk Appetite Statement of the Bank is approved by the Board of Directors of the Bank. Within the framework of the Risk Appetite Statement, a set of quantitative and qualitative indicators of risk appetite levels is approved for each material risk of the Bank, taking into account the adopted business model of the Bank. Monitoring of compliance with risk appetite levels in accordance with the Risk Appetite Statement of the Bank is carried out on a periodic basis, information on the results of which is sent for consideration of authorized organs of the Bank, including the Board of Directors of the Bank within the framework of management reporting on risks.

The main financial risks inherent to the activity of the Bank include market risk (currency risk, interest rate risk), liquidity risk, credit risk, and operational risk.

 Information on compliance with aggregated levels of risk appetite as of 01.01.2026 (million tenge)

The current aggregate risk level of credit, market, liquidity risk, and operational risk as of 01.01.2026 constitutes 44 billion tenge and is within the limits of the approved risk appetite level, which constitutes 23% of the approved risk appetite level for 2025.

For the purposes of capital adequacy assessment, the Regulation on the Internal Capital Adequacy Assessment Process (ICAAP), approved by the Board of Directors of the Bank, has been developed and implemented in the Bank. Within the framework of ICAAP, the identification, assessment, and control of material types of risk inherent to the activity of the Bank, as well as capital planning based on the strategy of the Bank, results of a comprehensive assessment of material risks, and stress testing of the financial stability of the Bank in relation to internal and external risk factors, as well as requirements for the equity capital adequacy of the Bank, are carried out in the Bank.

Assessment of the influence of current risks* of the Bank on the level of equity capital adequacy

The sufficiency of the capital level taking into account the current aggregate risk level will decrease by -0.016 across all coefficients; nevertheless, its value will be higher than the minimum requirements established by the regulatory organ due to a significant volume of equity capital (758 billion tenge).

Currency risk. The exposure of the Bank to currency risk is minimal taking into account the specifics of the business model of the Bank. The Bank does not conduct operations with foreign currency, with the exception of operations related to administrative and economic activity, as well as the conversion of client funds within the framework of implementation of the Project "National Fund for Children". In addition, there are coupon international bonds denominated in US dollars in the portfolio of financial instruments of the Bank.

Interest rate risk. The interest rate risk of the Bank represents a risk of occurrence of losses due to an unfavorable change in remuneration rates.

Within the framework of interest rate risk management, the Bank conducts an analysis of sensitive assets and liabilities, the yield and cost of which are determined by means of an interest rate. For the control of exposure to interest rate risk, the Bank uses the instrument of interest rate GAP analysis, the purpose of which is the determination of on which time interval the exposure to interest rate risk is formed due to a change in the interest rate.

Liquidity risk. For the purposes of liquidity adequacy assessment, the Regulation on the Internal Liquidity Adequacy Assessment Process (ILAAP), approved by the Board of Directors of the Bank, has been developed and implemented in the Bank. Within the framework of ILAAP, an effective process on the identification, assessment, monitoring, and control of liquidity risk is carried out in the Bank, which includes forecasting cash flows on assets, liabilities, and off-balance sheet instruments at different time intervals. The Bank assesses all balance sheet and off-balance sheet items influencing the level of liquidity risk, as well as the level of liquidity in the market to cover the need of the Bank in attracting funding for the purpose of regulating liquidity risk, if necessary.

Considering the specifics of the business model of the Bank, the stable funding base of the Bank consists predominantly of budgetary funds within the framework of implementation of state programs on providing the population with affordable housing and housing construction savings.

Within the framework of ILAAP, an assessment of the exposure of the Bank to liquidity risk in case of mismatch of maturity dates of obligations on assets and liabilities, as well as an insufficient volume of liquid assets and sources of funding, including taking into account the situation in the financial market, is carried out.

The main purpose of liquidity risk management of the Bank is the determination of assessment methods and procedures for maintaining a sufficient level of liquidity. Management of liquidity risk of the Bank is carried out by means of analysis of the level of liquid assets necessary for the settlement of obligations upon occurrence of their maturity date; ensuring access to various sources of financing, the presence of plans in case of occurrence of problems with financing, and exercising control over the compliance of liquidity normatives in accordance with the level of risk appetite for liquidity risk and requirements of the regulator in the part of prudential normatives on liquidity.

The main measures on minimization of liquidity risk taking into account the specifics of the business model of the Bank are:

- monitoring of compliance with the limits established by the regulator and internal limits of the Bank on liquidity risk;

- control of the daily (intraday) liquidity position of the Bank;

- conducting a GAP analysis of assets and liabilities of the Bank by maturity, the purpose of which is the determination of on which time interval the exposure to liquidity risk is formed, and assessment of the influence of the magnitude of the formed liquidity imbalance in a certain time interval on the capability of the Bank to respond to its obligations;

- regular conducting of stress testing on liquidity risk under various scenarios.

The table below presents the liquidity GAP as of 01.01.2026 (million tenge): 

Upon compilation of the liquidity GAP, the following assumptions were used:

-     all assets and liabilities are distributed by time intervals depending on maturity dates;

-     contingent liabilities are distributed based on the calculation of disbursement of housing loans per month (without taking into account previously disbursed preliminary and intermediate loans).

The resulting negative gap in the net GAP is driven by an increase in accumulated funds of individuals in deposits within the "over 3 years" maturity bucket in the amount of 2,263 billion tenge, as well as the redemption of issued securities in the amount of 760 billion tenge.

At the same time, the cumulative liquidity GAP across all time horizons is positive. The minimum value of the cumulative GAP-to-total assets ratio falls within the "up to 7 days" bucket and stands at 6.7%. The Bank complies with the approved internal limits on the cumulative GAP of no less than -2% of the Bank's assets.

 

Credit Risks

Within the framework of the "Decision-Making System", new scoring cards for intermediate and preliminary loans were developed and implemented.

At the end of 2025, the share of provisions created in accordance with IFRS amounted to 0.27% of the loan portfolio, and the share of the Bank's 20 largest loans stood at 0.06% of the Bank's loan portfolio, which indicates the absence of concentration risk in the loan portfolio. In the structure of collateral, the share of real estate accounted for 85.20% of total collateral. The overall weighted average LTV (loan-to-value) ratio equals 43.61%, reflecting a conservative collateral policy.

For comparison, at the end of 2024, the share of provisions created in accordance with IFRS amounted to 0.22% of the loan portfolio, and the share of the Bank's 20 largest loans stood at 0.06% of the Bank's loan portfolio, which indicates the absence of concentration risk in the loan portfolio. In the structure of collateral, the share of real estate accounted for 87.1% of total collateral. The overall weighted average LTV (loan-to-value) ratio was equal to 43.24%, reflecting a conservative collateral policy.

 

Operational Risks

The operational risk management system (hereinafter – the ORMS) in the Bank is established in accordance with the requirements of the legislation of the Republic of Kazakhstan, the recommendations of the Basel Committee on Banking Supervision, generally accepted risk management principles and banking practices, as well as generally accepted international practice.

 

The ORMS infrastructure of the Bank includes:

1)      identification of operational risks: conducting analysis of both existing and newly implemented internal procedures, systems, products, and services provided by the Bank;

2)      assessment of operational risks: measurement of operational risks to identify trends in their changing levels;

3)      strategic management of operational risks: development of principles for continuous operational risk management in the Bank;

4)      continuous management of operational risks: carried out by all structural subdivisions of the Bank and includes reducing the level of exposure to operational risk and eliminating the negative impacts of operational risk events across all structural subdivisions of the Bank;

5)      monitoring and reporting on operational risks: monitoring of the operational risk level and its compliance with the operational risk appetite level is performed by the Bank on a regular basis. For operational risk monitoring purposes, the Bank utilizes a management reporting system for senior management and collegial bodies involved in risk management processes; regular assessments of risks impacting the achievement of set goals, changing circumstances, and conditions are conducted, along with the formulation of risk management recommendations. Management reporting information is provided to the Board of Directors / Management Board of the Bank on a quarterly/monthly basis;

6)      prevention/mitigation (control): conducting a set of measures aimed at preventing/reducing the probability of occurrence of events or circumstances that lead to operational losses, or at minimizing the size of potential losses.

In 2025, measures were taken to improve the database for collecting and analyzing internal data on operational risk events.

 

Information Security Risk and Information Technology Risk Management

To ensure the effective functioning of risk management systems for information security and information technology (hereinafter – IS and IT), and in accordance with the requirements of the legislation of the Republic of Kazakhstan, the following documents have been developed and are maintained in an up-to-date state:

1)      IT and IS Risk Management Policies;

2)      IT Risk Management Rules;

3)      IS Risk Assessment Methodology;

4)      Methodology for Determining Potential Losses from Information Security Risks;

5)      Methodology for Determining Risk Appetite Key Indicators for Information Security and Information Technology Risks of JSC "Otbasy Bank".

In 2025, a working group on forming a list of critical information assets, led by the internal control subdivision, carried out measures to classify the Bank's information assets and approved the Bank's list of critical information assets.

In 2025, the responsible subdivisions of the Bank performed an assessment of the level of IS and IT risks. The risk assessment results were presented to the Bank's senior management as part of the IS and IT risk report.

The internal control subdivision provides IT and IS risk reports on a periodic basis to the Information Security Committee, the Management Board, and the Board of Directors of the Bank.

 

Business Continuity Management

The Bank's business continuity management aims to ensure the Bank's resilience to any incidents by eliminating or maximizing the reduction of downtime, rapidly recovering key business processes, and minimizing losses. To this end, the following documents have been developed, approved, and are maintained in an up-to-date state:

-     The Bank's Business Continuity Management Policy;

-     The Bank's Business Continuity Management Rules;

-     The Bank's Business Continuity Plans by lines of business.

Annually, the following activities are conducted in this area:

-     training of the Bank's personnel on business continuity issues;

-     business impact analysis for critical processes and lines of business of the Bank;

-     testing and analysis of the Bank's business continuity plans;

-     risk analysis of unforeseen circumstances, for which a risk response action plan has been drawn up.

 

Compliance Risk

Compliance control is a management and control system within the organization related to the risks of non-compliance with statutory requirements, regulatory documents, rules and standards of supervisory authorities, and other regulatory documentation of the organization.

Compliance control is an integral part of the internal control function, the purpose of which is to protect the interests of investors, banks, and their clients by monitoring compliance by the Bank's employees with statutory provisions, supervisory requirements, and internal documents of the Bank regulating the procedure for the Bank's provision of services and execution of transactions in the financial market.

To date, compliance is an essential part of the functioning of the Bank and its organizational structure.

An effective compliance risk management system and its maintenance in an appropriate state allow senior management to timely identify all material risks of incomplete realization of the Bank's business goals.

Responsibility for compliance with established norms is based on the Bank's compliance culture, which is reflected in the established system of three lines of defense:

1)      The first line of defense manages compliance risk within its competence and in accordance with the Bank's internal documents on compliance risk management issues (first-level control). The participants are employees of the Bank and heads of the Bank's structural subdivisions;

2)      The second line of defense performs compliance risk management and compliance control (second-level control). Participants: Chief Compliance Controller, compliance control subdivision;

3)      The third line of defense performs an independent assessment of the effectiveness of the compliance risk management system (third-level control). The participant is the internal audit subdivision.

All participants in the compliance risk management system, within their competence and responsibility, manage compliance risks in strict and mandatory compliance with the requirements of the legislation of the Republic of Kazakhstan, the legislation of foreign states that influences the Bank's activities and is recognized by the Republic of Kazakhstan, internal rules and procedures of the Bank, and generally accepted norms of conduct.

The main objective of compliance risk management is to minimize and/or maintain at an acceptable level compliance risks, such as financial losses incurred by the Bank and the application of legal sanctions against it due to non-compliance with the requirements of the legislation of the Republic of Kazakhstan, regulatory legal acts of the authorized body, internal documents and procedures of the Bank, as well as the legislation of foreign states that influences the Bank's activities and is recognized by the Republic of Kazakhstan.

In order to effectively manage compliance risk, the compliance control subdivision carries out work to identify and assess the causes of compliance risk:

– on a regular basis, the collection and analysis of compliance risk materialization events are carried out. For this purpose, audit results and a unified internal database of operational losses and events are used, and client complaints are reviewed;

– the compliance control subdivision participates in the implementation of new products and services;

– on a regular basis, internal reviews of internal documents and processes of the Bank are conducted for compliance with the requirements of the legislation of the Republic of Kazakhstan (in 2025, the compliance control subdivision conducted 6 reviews);

– the "Know Your Customer" principle has been implemented;

– a register of compliance risks is maintained alongside the compilation of a compliance risk map;

– training seminars are conducted within the framework of strengthening the compliance culture in the Bank.

In order to ensure that the Bank's activities comply with the legislation of the Republic of Kazakhstan, the compliance control subdivision constantly monitors changes and amendments to the legislation of the Republic of Kazakhstan, with the subsequent provision of recommendations on the development of new internal documents and making appropriate changes/amendments to the Bank's internal documents and procedures.

Within the framework of executing statutory requirements on anti-money laundering, combating the financing of terrorism, and proliferation financing (hereinafter – AML/CFT/CPF), a financial monitoring system functions in the Bank.

The main objective of the financial monitoring system is to minimize the risks arising during the execution of banking operations subject to financial monitoring, and other transactions with money or property related to money laundering, the financing of terrorism, and proliferation financing, by ensuring compliance with the requirements of the legislation of the Republic of Kazakhstan in the field of AML/CFT/CPF, preventing the Bank's involvement in money laundering, the financing of terrorism, and proliferation financing, and maintaining the effectiveness of the Bank's internal control system at a level sufficient for risk management.

The Bank has implemented the "Know Your Customer" principle; when establishing business relations, customer due diligence procedures are conducted, and the completeness and timeliness of submitting information on operations subject to financial monitoring to the authorized body for financial monitoring are ensured.

The Bank adheres to sanction regimes, namely:

-        does not enter into business relations with persons under sanctions;

-        does not provide services (directly/indirectly), the provision of which is prohibited/restricted by international economic sanctions, including services provided for the purpose of violating/circumventing international economic sanctions;

-        does not process payments through the Bank in favor of (directly or indirectly) persons and (or) organizations included in sanction lists, and does not perform transactions, payments, or transfers prohibited by international economic sanctions.

According to the approved Compliance Program (Plan) for 2025, all planned activities were completed within the established timeframes. Thus, the following main activities were executed:

-        within the framework of monitoring changes/amendments to the legislation of the Republic of Kazakhstan regulating the Bank's activities, 37 brief reviews of legislative changes were prepared, and 7 Plans/amendments to the Action Plan to bring the Bank's internal documents and activities into compliance with statutory requirements were developed and approved;

-        work was carried out on sending notifications to the SAM (Financial Monitoring Agency), automating AML/CFT/CPF procedures, including scenario automation, methodological work due to changes in legislation, as well as other work according to the requirements of the Internal Control Rules for AML/CFT purposes in the Bank;

-        within the framework of the ongoing work on compliance by the Bank's subdivisions with the compliance risk management policy, taking into account statutory requirements, 6 compliance reviews were conducted, based on the results of which Reports were prepared and Plans of corrective and/or preventive actions were approved;

-        23 registers of persons connected to the Bank by special relations, as well as lists of the Bank's insiders, were formed;

-        identification of compliance risks and assessment of compliance risks were carried out, the results of which were approved by the Management Board of the Bank;

-        compliance risk control reporting was prepared and submitted for approval to the Board of Directors of the Bank on a quarterly basis;

-        within the framework of ongoing anti-corruption work, anti-corruption monitoring and an internal analysis of corruption risks were conducted;

-        training seminars were conducted on the topics of:

"Risk Management System for Money Laundering and Financing of Terrorism";

"Banking Secrecy and Consequences of Non-Compliance";

"On Combating Corruption in the Bank."

 

ESG Risks

ESG risk management is part of the integrated risk management system of the Bank and is carried out within the framework of the general risk management architecture. ESG risks are considered as a combination of environmental, social, and corporate governance risks capable of influencing the financial stability, business reputation, and achievement of the strategic goals of the Bank.

ESG risks are included in the Risk Register of the Bank as a separate group and are taken into account alongside credit, market, strategic, operational, compliance, and liquidity risks, as well as information security and information technology risks.

Identification of ESG risks is carried out taking into account:

-     expectations of investors, clients, workers, and other stakeholders;

-     analysis of external and internal factors of impact;

-     assessment of potential conflicts and risks arising at various stages of implementation of the Bank's projects.

Based on the results of the analysis, a list of ESG risks is formed, approved by the Board of Directors as part of the Risk Register.

The structure of ESG risks includes:

Environmental risks – risks of non-compliance with the requirements of the legislation of the Republic of Kazakhstan in the field of environmental protection and other environmental obligations.

Social risks – risks related to compliance with labor legislation, ensuring safety and labor protection, protecting the rights of workers, the level of personnel engagement, and the development of human capital.

Corporate governance risks – risks related to the efficiency of the internal control system, the quality of oversight by the Board of Directors, and compliance with corporate governance principles.

Assessment of ESG risks is carried out according to the criteria of probability of occurrence and degree of potential consequences. By the results of the conducted assessment, social risks and corporate governance risks are assigned to a low level, environmental ones – to a medium level.

Monitoring of ESG risks is carried out on a regular basis with the submission of information to the authorized organs of the Bank. The Risk Register is used as an instrument of systematic tracking, analysis, and minimization of ESG risks, which contributes to the sustainable development of the Bank and the reduction of potential negative impact on clients and society.

 

Climate Risks

The Bank consistently develops the integration of climate risks into the general risk management system, orienting toward international standards, including IFRS S2, as well as methodological guidelines of the Agency for Regulation and Development of the Financial Market. The understanding that climate factors can directly or indirectly amplify traditional categories of banking risks − from credit to operational and strategic − formed the basis of the systemic approach of the Bank to the management of these risks.

The Bank, together with international consultants, developed its own methodology for climate risk assessment, including the classification of physical and transition risks. Within the framework of the methodology, an initial diagnostics of the exposure of the loan portfolio was conducted using geographical data, information on collateral, and types of real estate, which allowed identifying the zones of greatest vulnerability of the mortgage portfolio to floods, temperature anomalies, and other climate phenomena. Stress tests and scenario analysis of the impact of climate factors on the portfolio are implemented into the regular risk assessment practice of the Bank.

Management of climate risks is carried out within the framework of the existing risk process: identification, assessment, monitoring, and response. Physical risks, such as the probability of damage to collateral property from extreme weather conditions (floods and landslides) − are assessed alongside transition risks related to the tightening of energy efficiency norms, growth of demand for energy-efficient housing, and changes in funding policy.

In the reporting year, the Bank developed and implemented internal procedures for the inclusion of climate factors into the risk appetite, the Risk Register, and reporting, as well as approved key performance indicators (KPIs). Climate risks are integrated into the processes of risk assessment and management; the Sustainable Development Strategy establishes key performance indicators in the field of climate impact management and greenhouse gas emissions reduction. In addition, the Bank implemented the practice of climate stress testing and scenario analysis to assess the resilience of capital and liquidity to systemic climate shocks over short-term, medium-term, and long-term horizons.

The Bank forms a comprehensive, quantitatively justified, and strategically embedded mechanism for climate risk management, ensuring adaptability, transparency, and reliability under conditions of intensifying environmental and regulatory challenges.