In addition, amendments were made to the list of regulatory acts of the NBKR concerning the operations of banks, microfinance organizations, credit unions, and exchange offices.
A new document was approved, establishing minimum requirements for internal control in exchange offices in the context of AML/CFT.
The old regulation on internal control from 2019 was recognized as having lost its validity.
As part of the update of the regulatory acts of the NBKR, the terminology was revised to shift the focus from "financing terrorist activities" to a broader context — financing criminal activities and money laundering.
The procedures for identifying and verifying clients were clarified, including remote methods, as well as the procedure for detecting and temporarily suspending suspicious transactions, freezing funds, and working with sanction lists.
The document enshrines a risk-oriented approach and tightens the requirements for risk management, internal control, compliance, and reporting.
Requirements for correspondent relationships and dealings with high-risk countries, public officials, and beneficial owners have also been updated.
The resolution will come into effect 15 days after its official publication and will be posted on the NBKR website, as well as sent to the Ministry of Justice for registration in the State Register of NPA.
text of the regulation
REGULATION
on minimum requirements for organizing internal control in exchange offices in the Kyrgyz Republic to combat the financing of criminal activities and the legalization (laundering) of criminal proceeds
Chapter 1. General Provisions
1. This Regulation defines the minimum requirements for internal control in exchange offices licensed by the National Bank of the Kyrgyz Republic to combat the financing of criminal activities and the legalization (laundering) of income.
2. The National Bank supervises internal control in exchange offices for the purposes of AML/CFT.
3. The following definitions are used in this Regulation:
1) Close relatives - parents, adoptive parents, children, siblings, grandparents, grandchildren, on whom a public official has financial obligations.
2) Internal control - a set of measures to identify and control operations related to the financing of criminal activities and the legalization of income.
3) Identification - the process of establishing the identification data of a client or beneficial owner.
4) Verification - the verification of the identification data of a client or beneficial owner.
5) Beneficial owner - an individual who ultimately owns the rights of ownership or controls the client.
6) Internal control program - activities and procedures applied by the exchange office to comply with legislation in the field of AML/CFT.
7) Detection of operations subject to control - a stage of internal control that includes identifying operations that are subject to control.
8) Source of origin of funds - information about the origin of specific funds or assets that are the subject of business relations between the client and the exchange office.
9) Operations subject to control and reporting - operations specified in the Law of the Kyrgyz Republic "On Combating the Financing of Criminal Activities and the Legalization (Laundering) of Criminal Proceeds".
10) High-risk countries - states that do not sufficiently apply international standards for combating money laundering and financing terrorism.
11) Public officials - individuals performing significant governmental or political functions.
12) Financial intelligence unit - the authorized state body for combating the financing of criminal activities.
13) One-time operation - a transaction carried out once without ongoing business relations between the client and the exchange office.
14) Risk-oriented approach - the application of measures depending on the level of risk.
15) Sanction lists - the Consolidated Sanction List of the Kyrgyz Republic and the Consolidated Sanction List of the UN Security Council.
16) Suspicious operation - an operation in which there are grounds to suspect that the funds were obtained through criminal means.
Chapter 2. Internal Control Program for AML/CFT
4. The internal control program must ensure the implementation of the following activities:
1) Organization of internal control to define the powers and responsibilities of officials.
2) Assessment and monitoring of risks related to the financing of criminal activities.
3) Maintaining the relevance of the risk assessment and providing information about it to the National Bank.
4) Availability of internal regulatory documents for managing risk reduction.
5) Monitoring the application of control measures.
6) Proper client verification, including identification and verification.
7) Detection of suspicious operations and their documentation.
8) Application of targeted financial sanctions against individuals from sanction lists.
9) Implementation of measures regarding high-risk countries.
10) Establishing a procedure for refusing service to potential clients.
11) Timely provision of information to the financial intelligence unit.
12) Ensuring the confidentiality of information.
13) Continuous monitoring of compliance with legislation.
14) Monitoring the effectiveness of the internal control program.
15) Duties provided by legislation in the field of AML/CFT.
5. Exchange offices must assess the risks associated with new products and services before implementing them.
6. The internal control program must comply with the requirements of legislation and take into account the specifics of the exchange office's operations.
Chapter 3. Implementation and Assessment of the Internal Control Program
7. An official responsible for the implementation of the internal control program is appointed in the exchange office, who must undergo training at least once every three years.
8. The adequacy of the program must be assessed regularly, at least once every three years.
Chapter 4. Proper Client Verification Considering the Risk-Oriented Approach
9. The exchange office must identify and verify clients and beneficial owners before conducting an operation.
10. The identification procedure includes checking the identity document.
11. When working with legal entities, it is necessary to verify the authenticity of the documents confirming their registration.
12. The exchange office is obliged to identify beneficial owners and apply measures for their verification.
13. In the absence of beneficial owners, the exchange office must identify the controlling person.
14. Additional verification measures are applied when servicing public officials.
15. The exchange office must apply proper verification measures throughout the entire period of business relations.
16. Information about clients and beneficial owners must be updated at least once a year.
17. Employees of the exchange office must record information about cash currency operations.
18. For operations amounting to 1 million soms or more, proper client verification is conducted.
19. The exchange office must use a risk-oriented approach when conducting verifications.
20. In cases of high risk, enhanced verification measures are applied.
21. In cases of low risk, simplified measures may be applied.
22. The exchange office is obliged to store information about clients for at least five years.
23. The exchange office must understand the nature of the client's activities.
24. The exchange office conducts an analysis of clients' operations for compliance.
25. The exchange office applies enhanced or simplified verification measures depending on the level of risk.
26. The exchange office must not conduct operations if it cannot apply proper verification measures.
27. In the case of a suspicious operation, the exchange office suspends it and reports to the financial intelligence unit.
Chapter 5. Detection of Operations Subject to Control and Reporting
30. The exchange office is obliged to report suspicious operations to the financial intelligence unit.
31. Deadlines for reporting various operations are established depending on their nature.
Chapter 6. Information Storage During Internal Control
32. Information about operations must be documented.
33. The exchange office is not entitled to inform clients about the transfer of information to the financial intelligence unit.
34. The exchange office must ensure the confidentiality of client information.
35. Liability is provided for violations of legislation in the field of AML/CFT.
36. All documents and information must be stored for at least five years.
Information must be sufficient to reconstruct operations and used as evidence.
The exchange office is obliged to provide information to authorized bodies in accordance with the legislation of the Kyrgyz Republic.
