The Internal Control System of the Bank (hereinafter – ICS) is formed in accordance with the requirements of the legislation of the Republic of Kazakhstan, the Basel Committee on Banking Supervision, and international best practices. In designing its internal control system, the Bank applies the 2013 COSO Integrated Framework. The ICS is a continuous process embedded into daily operations conducted by the Board of Directors, authorized collegial bodies, structural units, and all employees of the Bank in the performance of their duties, aimed at achieving the following objectives:

1) ensuring the efficiency of the Bank's activities, including the effectiveness of managing banking risks, assets, and liabilities, and ensuring the safety of assets;

2) ensuring the completeness, reliability, and timeliness of financial, regulatory, non-financial, and other reporting for internal and external users, as well as information security;

3) ensuring compliance by the Bank with the requirements of the civil, tax, and banking legislation of the Republic of Kazakhstan, the legislation of the Republic of Kazakhstan on state regulation, control, and supervision of the financial market and financial organizations, the legislation of the Republic of Kazakhstan on currency regulation and currency control, on payments and payment systems, on pension provision, on the securities market, on accounting and financial reporting, on credit bureaus and the formation of credit histories, on collection activities, on mandatory deposit insurance, on anti-money laundering and combating the financing of terrorism, on joint-stock companies, and internal documents of the Bank;

4) preventing the involvement of the Bank, its employees, and clients:

‒      in illegal activities, including fraud, deception, money laundering, and the financing of terrorism (hereinafter – ML/FT), the illegal production, trafficking, and/or transit of drugs, or organizing financial pyramids; making payments and/or money transfers in favor of electronic casinos, internet casinos, as well as foreign bookmakers and/or totalizers that do not hold licenses to operate in the gambling industry in the Republic of Kazakhstan;

‒      in operations carrying a high risk of ML/FT;

‒      in operations related to the subsequent acquisition of unsecured digital assets on digital asset exchanges that are not participants of the Astana International Financial Centre, the list of which is compiled by the authorized body;

‒      in payments and/or money transfers by individuals under twenty-one years of age in favor of a gambling business organizer;

‒      in any other actions provided for by the Rules on the Formation of Risk Management and Internal Control Systems for Second Tier Banks and Branches of Non-Resident Banks of the Republic of Kazakhstan, approved by Resolution of the Management Board of the National Bank of the Republic of Kazakhstan No. 188 dated November 12, 2019.  

The Board of Directors exercises control over the activities of the Management Board by ensuring the implementation of the ICS, as well as supervising its condition. The Risks and Internal Control Committee under the Board of Directors monitors the functioning of the ICS and reviews the results of the quality and efficiency assessments of the system. The Audit Committee under the Board of Directors reviews reports on the effectiveness of the ICS, assesses the results and quality of the corrective action plans developed for the ICS, and provides recommendations to the Board of Directors to enhance the system. The Management Board ensures the availability and functioning of all components and principles of the ICS.

The Bank develops internal control procedures based on the following interrelated elements:

1)   control over risk management;

2)   control activities and segregation of duties;

3)   information and communication;

4)   monitoring and remediation of deficiencies.

The Bank's ICS utilizes specific control mechanisms, including:

1)   oversight carried out by the Board of Directors, its committees, and the Management Board to identify and eliminate internal control deficiencies, violations, and errors;

2)   controls executed by the heads of structural units;

3)   physical verification and access controls for material assets, including securing storage premises;

4)   verification of compliance with established limits;

5)   a system for approvals and the delegation of rights and authority;

6)   verification of the timely and correct recording of the Bank's operations and transactions in accounting records and statements;

7)   verification of compliance with the Bank’s policies and procedures when executing operations and transactions.

From an internal control perspective, mandatory recording of all operations and transactions of the Bank is guaranteed. The controls applied to financial accounting and reporting include:

1)   reviewing information systems that support accounting to ensure compliance with the legislation of the Republic of Kazakhstan on accounting and financial reporting, and IFRS;

2)   maintaining internal documents governing accounting practices;

3)   ensuring chronological and timely registration of operations and events;

4)   maintaining the capability to generate financial statements as of the end of each business day;

5)   ensuring compliance of general accounting with analytical records;

6)   conducting regular reviews of accounting entries by employees who are not involved in the authorization or recording of operations in the financial statements;

7)   generating accounting entries solely based on primary documents, ensuring their proper execution and safekeeping.

Control activities in operations are distributed within a strict segregation of duties framework to minimize conflicts of interest, eliminate conditions for illicit actions, and prevent any single structural unit or employee from being granted the ability to:

1)   execute banking operations or other transactions while simultaneously recording them in the accounting system;

2)   authorize money disbursements and carry out the actual payment while managing the limits established by the Bank's internal documents;

3)   conduct operations on client accounts while simultaneously managing accounts that reflect the Bank's own financial and economic activities;

4)   evaluate the authenticity and completeness of documents submitted for loan issuance while simultaneously monitoring loan repayment;

5)   perform actions in any other operational area where a conflict of interest may arise.

Depending on the nature of the transaction, the Bank applies the following control methods:

1)   dual control (the "four-eyes principle" and "joint access");

2)   transaction analysis;

3)   performance reporting to provide management with operational reports regarding performance indicators, financial conditions, and budget variances;

4)   instructing personnel on control techniques and error detection methods;

5)   ensuring data protection;

6)   protecting processes against human error;

7)   checking for mistakes to ensure their timely detection.

From an internal control standpoint, the availability of reliable, detailed financial and operational data is ensured, along with comprehensive records regarding compliance with civil, tax, and banking regulations, and external market intelligence vital for strategic decision-making.