The Bank strives to ensure a balance of business and public interests, and also ensures the consistency of its economic, environmental, and social goals for long-term sustainable development. The Bank integrates the principles of sustainable development, established by international standards in the field of sustainable development, into its management system, development strategy, and key processes.

The Bank operates an effective risk management system that complies with current legislation and also takes into account international standards in the field of risk management.

In order to formulate a unified approach to risk management and build an integrated risk management system for the Bank, the Risk Management Policy was developed. It covers the basic concepts and types of risks, the principles and organizational structure of the risk management system and also includes the definition of risk appetite and the procedure for forming a list of material risks.

The risk management system provides coverage for all material types of risks in accordance with regulatory requirements and the Bank's internal documents, including credit, market, liquidity risk, strategic, operational, information security and information technology risks, compliance, and ESG risks. Risk management functions are distributed among the Board of Directors, the Risk Committee, and specialized units, which ensure independent control, an appropriate level of management, and decision-making.

The main regulatory documents in the risk management and internal control system that define the processes and methods for assessing risk responses and evaluating controls are:

In the process of risk management, the Bank utilizes various approaches, taking into account the requirements of the regulatory body as a participant in the country's financial system, such as:

-     a three lines of defense system;

-     formation of the Bank's risk appetite strategy;

-     capital adequacy assessment;

-     liquidity adequacy assessment;

-     conducting stress testing on the Bank's main financial indicators;

-     ensuring the availability of a management reporting system.

For successful strategy implementation, the Bank analyzes on a regular basis the key risks that may affect the achievement of strategic goals and the financial stability of the Bank and develops appropriate measures to minimize them. In the reporting year, as in previous periods, the Bank continues to maintain a high level of liquidity and capital adequacy, which significantly exceeds the requirements of the regulatory body.

Risk Management Organizational Structure

The organization of the Bank's risk management involves the performance of functions by the Bank's Board of Directors, the Risks and Internal Control Committee under the Bank's Board of Directors, the Management Board, other authorized bodies of the Bank, as well as risk management units responsible for risk assessment, control, and monitoring, with the distribution of powers and responsibilities among them.

The Bank's Board of Directors is responsible for the proper functioning of the risk management system, taking into account the business model, scale of activities, types, and complexity of operations, and ensures an effective process of identifying, measuring, assessing, monitoring, controlling, and mitigating material risks in order to determine the required level of equity capital and liquidity to cover these risks. Operating under the Bank's Board of Directors is the Risks and Internal Control Committee, which ensures the coordination of the risk management process within the Bank, including the development of internal regulatory documents, as well as the determination of the Bank's risk profile. The Management Board, in turn, is responsible for monitoring the risk management process and implementing risk mitigation measures, and bears responsibility for providing the Bank's Board of Directors with the necessary information on approved risk appetite levels and the reasons for their breach (if any).

The Head of Risk Management is appointed and dismissed by decision of the Bank's Board of Directors. The Head of Risk Management possesses sufficient authority, independence, and resources for regular interaction with the Risks and Internal Control Committee under the Bank's Board of Directors and the Bank's Board of Directors. They organize and coordinate activities in the areas of internal control, underwriting and collateral management, as well as financial and credit risks.

The responsibilities of the risk management units include general risk management and control over the application of generally accepted methods/approaches for the detection, assessment, management, and reporting of both financial and non-financial risks. At the same time, the responsibility for managing specific types of risks is borne by the relevant structural units of the Bank that are the owners of these risks.

 

Setting Risk Appetite

The Risk Appetite Strategy approved by the Bank's Board of Directors is aimed at maintaining an optimal balance between the fulfillment of the Bank's strategic tasks, the profitability of the Bank's main lines of business, and the level of risks assumed by the Bank, at embedding a risk culture at all levels of the Bank's organizational structure, as well as at promoting the practice of compliance with risk appetite levels within the framework of the risk culture.

Within the framework of the Risk Appetite Strategy, risk appetite levels and the aggregated risk appetite level(s) for material types of risks are approved by decision of the Board of Directors. These are expressed through quantitative and qualitative indicators, where quantitative data are applied to assess manageable risks, and qualitative data are used for non-financial risks. These levels define clear boundaries for the volume of accepted risks within which the Bank's activities are carried out as part of the implementation of the Bank's general strategy, taking into account the risk profile of the Bank's activities in order to prevent the realization of risks or minimize their negative impact on the Bank's financial position.

The main types of risk that determine the aggregate risks to which the Bank is exposed and form its risk profile, including the material types of risk identified for 2025, are:

The aggregated risk appetite level is expressed quantitatively and includes credit, market, operational, and liquidity risks.

The structure of the Bank's aggregated risk appetite level approved for 2025 is as follows: credit risk – 73%, liquidity risk – 9%, market risk – 16%, operational risk – 3,540 million tenge.

Monitoring of compliance with risk appetite levels in accordance with the approved Risk Appetite Statement of the Bank is carried out on a quarterly basis, and the information on its results is submitted for review to the authorized bodies of the Bank, including the Bank's Board of Directors.

 

Risk Identification and Monitoring Process

The Bank's risk management system is a combination of components that provides a mechanism for interaction between internal procedures, processes, policies, and structural units developed and regulated by the Bank, with the aim of timely identification, measurement, control, and monitoring of the Bank's risks, as well as their mitigation to ensure its financial stability and stable functioning.

The Bank pays high attention to risk management, placing special emphasis on the identification and assessment of material risks that can significantly affect the financial stability, reputation, or liquidity of the Bank.

The Bank identifies material risks by:

-     conducting an analysis and assessment of operations planned by the Bank, and all balance sheet and off-balance sheet items exposed to risk;

-     analyzing the current market situation and analyzing the impact of changes in external and internal factors on risks;

-     developing a set of tools and indicators for risk analysis and assessment.

Based on the results of the identification, a monthly quantitative assessment of the Bank's material risks is carried out using methods that allow for a reliable evaluation of the Bank's level of risk exposure, taking into account the assumptions used in these methods.

Risk assessment consists in determining the magnitude and probability of potential losses over a given period of time and their impact on the financial condition of the Bank. Quantitative assessment makes it possible to determine the amount that the Bank may lose at a given level of risk.

Methods for assessing material risks include, but are not limited to:

1)  Assessment of expected credit losses in accordance with the requirements of IFRS and the regulatory body;

2) Value-at-Risk (VaR) and Expected Shortfall (ES) for assessing the Bank's market risk;

3) Gap analysis method (GAP analysis) for assessing the Bank's interest rate risk and liquidity risk;

4) Duration for assessing the Bank's interest rate and price risks;

5) Ratio analysis for assessing liquidity risk (the method of liquidity ratios, including LCR, NSFR);

6) Stress testing: scenario analysis and sensitivity analysis for assessing the Bank's market, credit, and liquidity risks;

7) Forecasting and modeling, including forecasting future cash flows to assess market risk and liquidity risk.

The Bank uses methods of regulating material risks in order to limit the risk level, such as: setting limits, diversification, and provisioning.

The risk management system ensures the awareness of the authorized bodies of the Bank making risk-related decisions by creating an effective corporate governance system and providing complete, reliable, and timely information on material risks inherent in the Bank's activities.