Ria Payment System Rules for the Republic of Kazakhstan

Continental Exchange Solutions, Inc. dba Ria Financial Services, acting as the Payment System Operator

August 1, 2020

1. INTRODUCTION AND DESCRIPTION OF THE PAYMENT SYSTEM

Continental Exchange Solutions, Inc. dba Ria Financial Services ("Ria") is part of the Ria money transfer division of Euronet Worldwide, Inc. ("Euronet"). Euronet provides secure electronic payment solutions for financial institutions, retailers, service providers, as well as individual consumers, both locally and internationally. RIA is one of the international money transfer operators ("IMTO"), offering its customers worldwide services related to both sending and receiving money transfers. RIA has an extensive network of its own money transfer branches located in North America, Europe, Asia, and Australia.

The RIA Payment System is a money transfer system managed by RIA, which is considered the Payment System Operator in accordance with the Law of the Republic of Kazakhstan "On Payments and Payment Systems" dated July 26, 2016, No. 11-VI, as amended and supplemented ("Payment Systems Law"). These Rules, established in respect of the activities of the Ria Payment System Operator, and any amendments made to them from time to time ("Rules"), as well as the terms used herein, are intended exclusively to fulfill the requirements of Article 5 of the Payment Systems Law in Kazakhstan, and will be posted on the site designated by Ria for Kazakhstan, with a corresponding notification sent to the National Bank of Kazakhstan ("Ria Kazakhstan Site"). These Rules and other documents provided by RIA to Participants holding all necessary licenses and permits to carry out money transfers in Kazakhstan under a money transfer agreement with RIA ("Participants") constitute the Ria Payment System with respect to Kazakhstan. RIA may amend these Rules at any time without prior notice to any party, with the Rules and subsequent amendments taking effect from the date of posting on the Ria Kazakhstan Site, unless otherwise specified by RIA. These Rules may not be judicially enforced against RIA by any third party; RIA does not assume any obligations to any party as a result of providing these Rules, and none of the provisions contained in these Rules shall be construed as conferring any right or advantage on any party. Under no circumstances shall RIA be liable for any indirect, incidental, actual damages determined by special circumstances, or consequential losses, for lost profits, or any other costs or expenses incurred by customers or any third party, arising from or in connection with the use or receipt of RIA Payment Systems, whether in the course of any action or under a contract. Each customer assumes all risk of using or receiving RIA Payment Systems.

The commission fee charged for servicing customers in connection with money transfers sent in Kazakhstan ("Commission"), and any changes to this Commission, will be published on the Ria Kazakhstan Site. Participants may only apply the Commission published on the Ria Kazakhstan Site.

2. PAYMENT SYSTEM OPERATING PROCEDURES

2.1 Procedure for Carrying Out Money Transfers in the Payment System

All Participants of the Ria Money Transfer System will sign a money transfer agreement with Ria. Such agreements include rules governing procedures between Participants, as well as obligating Participants to comply with the requirements of the RIA Payment System under the Payment Systems Law.

Participants, as independent legal entities holding all necessary licenses and permits to carry out money transfers in Kazakhstan, will cooperate with Ria on a non-exclusive basis for the purpose of providing money transfer services to customers in Kazakhstan.

Ria processes payment orders in its international network, takes measures to prevent and counter the legalization of criminally obtained funds ("Anti-Money Laundering"), and takes other actions related to compliance with legislative requirements or the requirements of the Payment System, and uses software that will contribute to the proper execution of money transfers. Ria operates with a network of international correspondent banks and agents in accordance with the rules and regulations of the sending countries, rules established by regulatory authorities within the relevant jurisdictions, including the laws of the United States of America.

Ria receives orders from customers through 1) its network of correspondent banks or agents in those countries and 2) its offices in certain countries ("International Network") for payment to recipients in countries where Ria operates through its International Network. Correspondent banks and agents in each country operate through their own proprietary software with closed source code.

Regarding the payment order instructions received by the Participant from RIA for making payment to a recipient in Kazakhstan ("Money Payment Services"), Participants will act in accordance with the received payment instructions and will provide funds to recipients in Kazakhstan in the agreed currency and in the amount specified in the payment order instructions. Funds are provided to the recipient with proper and convincing identification in accordance with local law requirements and RIA procedures, including confirmation of the identification of any Ria personal identification number (PIN). If payment of funds cannot be made for any reason within Ria's procedures, the Participant is obliged to immediately notify RIA of the relevant reasons. The Participant is obliged to provide Ria with confirmation of payment, and must maintain records in accordance with applicable law and Ria procedures.

For the Participant to collect money transfer funds and the Commission from the customer in Kazakhstan in order to initiate a money transfer operation ("Money Transfer Services"), Participants are obliged to act in accordance with applicable laws and Ria procedures, including compliance with all customer identification procedures, appropriate pre-checks for detecting fraud, anti-money laundering measures, and other regulatory checks necessary for initiating the operation, disclosing information, and obtaining consent from the customer in Kazakhstan. Participants use the Ria payment system to initiate and send to Ria payment order instructions for payment to recipients in the Ria International Network in accordance with applicable law and Ria procedures.

2.2 Description of Services Provided by Ria and Operations Carried Out in the Payment System

Ria provides money transfer services between customers through its International Network in more than 402,000 locations in more than 150 countries worldwide. Ria ensures, through Participants in Kazakhstan, the collection of funds intended for money transfers, for the purpose of initiating Money Transfer Services in favor of recipients in the Ria International Network. In addition, Ria provides Money Payment Services, through participants in Kazakhstan, in favor of recipients in Kazakhstan through Cash Pick-Up and Account Deposit.

There are 2 payment methods in Kazakhstan:

  1. Cash Payment

  2. Account Deposit

2.2.1 Cash Payment means Money Payment Services where the Participant pays cash to the recipient at its physical location in accordance with the payment order instructions, applicable law, and Ria procedures, including, among other things, verifying such a transaction using a PIN code and proper identification of the recipient.

2.2.2 Account Deposit means Money Payment Services where the Participant deposits funds directly into the recipient's bank account in accordance with the payment order instructions, applicable law, and Ria procedures.

Participants in Kazakhstan use their banking network to deposit money into recipients' bank accounts. If the account name and number do not match, money will not be credited to the account, and the payment order will be cancelled by Ria. Participants may contact recipients to verify the accuracy of banking information and to notify them that the money will be deposited into the bank on time.

Participants may, where permitted by applicable law, offer account deposits in Kazakhstan through remote channels.

Offering money transfers via remote channels means the ability for a customer to connect to the Participant's remote access servers by accessing the Participant's network from remote locations (devices), using a bank debit/credit card. To use a remote channel, the customer must register with the Participant and open a bank account with the Participant prior to initiating the money transfer operation. Remote channels are used to provide Money Payment Services and Money Transfer Services, and are restricted to only those customers of the Participant who were properly registered at the time of opening the bank account and prior to the initiation of the money transfer operation, in respect of which due diligence was conducted in accordance with applicable law, with ongoing monitoring of the customer and the transaction.

The Participant must establish filters and restrictions in accordance with applicable law. The customer may only receive/send money to/from their own account exclusively within Kazakhstan. The Participant is obliged to ensure that proper authority exists to conduct transactions using remote channels in accordance with laws and regulations applicable within the relevant jurisdictions.

Remote channels may consist of the following options — at the Participants' offering:

  • Bank payment terminal

  • ATMs

  • Internet banking system

  • Bank call center (if applicable)

2.2.3 Payment System Operating Schedule. Participants provide Money Payment Services and Money Transfer Services during normal working hours at all branches offering these services. Ria uses a group of dedicated customer service representatives in some countries, as well as specialized personnel on compliance and marketing research matters to support Participants. Dedicated customer service representatives, whom Participants can call to obtain information, submit complaints, and find solutions to problems, operate at Ria 24 hours a day, 7 days a week, 365 days a year.

2.3 General Requirements for Conducting Operations

The Participant is obliged to fulfill all of the following obligations:

  • All operations related to sending, paying, or modifying money transfer orders are carried out in the presence of the customer.

  • Customers and recipients must read and sign all receipts in which information is disclosed in accordance with applicable law requirements.

  • The Participant is not permitted to charge the customer any additional commission for the transaction, except for the Commission and any other fees agreed in writing between RIA and the Participant.

  • The Participant treats all information about operations, customers, and recipients as confidential information not to be disclosed to third parties, except as provided by the agreement between Ria and the Participant, and in accordance with applicable law requirements. Personal information of customers and recipients is used and disclosed strictly in accordance with applicable law and the agreement between Ria and the Participant.

  • Each of the Participant's customers performing transactions must use their individual login and password to access the Ria Payment System for processing transactions.

2.4 Procedure for Interaction Between Ria and Participants. Procedure for Using Payment Information

Initiating a Money Transfer Operation

Paying a Money Transfer Operation to the Recipient

Participants are obliged to train their employees on Ria procedures and applicable laws, including anti-money laundering programs, record-keeping requirements, information security, as well as consumer rights protection and data confidentiality laws. Any changes to the above procedures will be published on the Ria Kazakhstan Site within the period provided for by applicable law, and will additionally be communicated to all Participants in the Republic of Kazakhstan.

3 (Section 2.5). Requirements of Ria for the Execution of Money Payments

After receiving payment instructions from Ria, the Participant is obliged to:

  1. Pay funds in accordance with the payment order instructions.

  2. Verify each payment request by comparing the personal identification number ("PIN code") provided by the recipient with the PIN code provided by the party creating the payment order. Payment of funds to the specified recipient will be made only after verifying the recipient's personal data in accordance with applicable law.

  3. Participants are not permitted to charge the recipient any additional commission at the time of payment for the transaction.

  4. Payment on transactions may only be made if the customer provides the correct PIN code and if the recipient's personal data is confirmed in accordance with applicable law.

  5. Minor discrepancies may exist between the transaction data in the money transfer order and the customer's full name as stated in the identity document. For example, Maria and Marya with the same surname. In such cases, the Participant is obliged to confirm whether payment of money for the transaction can be made in accordance with its verification procedures and applicable law. The Participant may also contact the Ria call center and request a change of the recipient's name, with Ria making reasonable efforts to change the payment order, if possible.

  6. Payment on all transactions for money transfers is made in the currency indicated in the money transfer order and in the receipts provided to recipients in accordance with applicable law, together with copies provided for Ria in accordance with Ria procedures.

4 (Section 2.6). Requirements of Ria for Money Transfer Services

The sending of money transfer orders is carried out only after the customer pays the Participant the full amount, including the transfer amount under the order and the Commission, and also provides the following information:

  • Transfer amount

  • Payment currency

  • Commission currency

  • Sender's full name

  • Sender's document details

  • Recipient's full name

The sender must specify the currency in which payment under the order will be made, in accordance with the available currencies for the specific destination country.

The cost of the transaction will be indicated in the Commission published on the Ria Kazakhstan Site and in the system available to the Participant at the time of initiating the transaction. The Participant is obliged to perform the money transfer operation only in accordance with the system requirements, the Rules published on the Ria Kazakhstan Site (as amended and supplemented), the agreement between the Participant and Ria, and in other cases in accordance with Ria procedures.

5 (Section 2.7). Ria Procedure for Cancellation of a Payment and/or Money Transfer Instruction

If the customer wishes to cancel an order, they must contact the branch of the Participant where the customer initiated the money transfer order. Following such a cancellation request, and if payment in favor of the recipient has not yet been made (in cash or to an account), Ria will refund the amount, the order commission, and fees in accordance with applicable law, provided the customer provides a copy of (i) a valid order and (ii) presents a valid identity document. A money transfer operation cannot be cancelled and the amount cannot be refunded if funds have already been paid to the recipient.

If payment on the money transfer operation is not made in favor of the recipient within 21 days, Ria will automatically cancel that operation and notify the sender through the Participant in Kazakhstan or the correspondent bank/agent in the Ria International Network.

6 (Section 2.8). Ria Customer Service

The Participant must contact Ria in all cases where circumstances arise that may delay payment or cause complaints from customers, namely in the event of:

  • A change in the recipient's full name

  • An incorrect or incomplete recipient phone number

  • An incorrect or incomplete recipient address

It is not possible to make changes to transactions if the transaction status indicates a completed payment, blocking, or cancellation. It is not possible to change the destination country or the amount of a payment order. If there is an error in specifying the destination country or the amount of a sent payment order, this operation must be cancelled and a new one created. The commission provided for under applicable law must be refunded to the customer. Changes to the sending of orders on transactions may be made in two ways: in the System by the Participant's bank employee at the branch where the order was placed, or by contacting the Ria customer service system.

3. PROCEDURE FOR JOINING / LEAVING THE INTERNATIONAL NETWORK

Ria effectively assesses and manages risks related to money laundering, terrorist financing, customer (consumer) fraud, and compliance with consumer protection laws. The compliance risk assessment will identify risks associated with the regulatory framework, the products and services offered, the geographic location of operations, and the delivery channels used to deliver products and services to consumers.

The purpose of the risk assessment is to identify common risks in each of the areas generally described above, develop policies and procedures to mitigate such risks, and effectively assess and manage residual risks.

Prior to formalizing business relationships with Participants, Ria conducts due diligence on each Participant:

  • Credit assessment of the Participant

  • Customer identification procedure (in accordance with the "know your customer" rule) and its evaluation

3.1 Credit Assessment of the Participant:

Ria conducts a credit assessment of the Participant ("Participant Credit Assessment") for each company that applies for Participant status, analyzing the overall credit risk of Ria with respect to the Participant, as well as the relative creditworthiness of the Participant and the relevant jurisdiction. The Participant is obliged to provide certain documentation and information as requested by Ria to complete this analysis and evaluation of the Participant.

3.2 Customer Identification Procedure (in accordance with the "know your customer" rule) and Evaluation:

Ria has established a customer identification procedure to ensure that all agents have a good reputation and a sound financial standing. For this purpose, Participants must comply with the customer identification procedure prior to establishing contractual relationships. The customer identification procedure is intended to verify the ultimate beneficiaries (actual users) of the Participants, as well as to verify the information provided by the Participants. The Participant is obliged to provide Ria with certain documentation and information to conduct due diligence, including the "Know Your Customer" customer identification procedure in accordance with Ria's policies and procedures on anti-money laundering and combating the financing of terrorism.

Enhanced due diligence is conducted for certain Participants using a risk-based approach.

The Regulatory Compliance Oversight Division approves each Participant before money transfers commence under the agreement with Ria, in accordance with Ria's compliance verification procedures and applicable law.

The agreement with the Participant is terminated, in particular, for the following non-compliance related reasons:

  • The Participant or its owner is included in the U.S. Treasury Specially Designated Nationals and Blocked Persons list or in the list of problem banks of another country;

  • The Participant has been identified as an enterprise involved in money laundering; or

  • Use of unacceptable negative media coverage; and/or the Participant has become an unacceptable risk to the company in accordance with Ria's regulatory compliance oversight policy.

3.3 Clearing Banks and Settlement Procedure:

Settlement bank accounts maintained by Participants and Ria are used for settling transactions through the Ria International Network. Payment and collection of funds may take place physically at a bank, or funds may be paid via bank transfer by an agent or by debit card. Ria settles with its Participants using global accounts in accordance with the settlement terms of the money transfer agreements, and the procedures provided for notifying the other party and transmitting the most up-to-date bank account details. Ria and Participants agree on a net settlement procedure for settling incoming and outgoing transactions, whereby the parties will settle after confirmation of transactions under which payment of funds to recipients is made.

3.4 Additional Participant Obligations and Regulatory Compliance:

Participants are obliged to immediately notify Ria of events that could have a materially adverse impact on its activities and/or its ability to fulfill its obligations and receive any communications from a governing or regulatory body, law enforcement or judicial authority, related to the Ria Payment System and money transfers. Ria may suspend or terminate activities with a Participant that does not comply with applicable law or Ria's compliance policies and procedures.

Participants are obliged to comply with all laws and regulations governing activities related to money transfers, by obtaining and maintaining in force all necessary licenses or permits in accordance with the requirements of the relevant regulatory, governmental, or other bodies, departments, or organizations, including, among other things, adopting and implementing programs and policies on anti-money laundering, combating corruption and fraud in accordance with applicable laws and Ria's compliance procedures, appointing a compliance officer, and training their employees appropriately. The Participant is obliged to notify the National Bank of Kazakhstan of the adoption of any mandatory money transfer monitoring measures and fulfillment of any reporting requirements to any governing or regulatory bodies, as necessary. The Participant is obliged to retain all transaction information, due diligence records on customers, and documents relating to compliance efforts with respect to transactions, for a minimum of five (5) years or the period provided for by local law, whichever is longer, in order to fulfill information requests within a reasonable period of time. Participants are obliged to cooperate fully with Ria, any governing or regulatory authorities, and law enforcement agencies in connection with compliance matters.

4. RISK MANAGEMENT SYSTEM IN THE PAYMENT SYSTEM AND INFORMATION SECURITY COMPLIANCE PROCEDURE

Ria has been operating in the money transfer industry for more than 30 years and has continued to assess risks in this regard, which has contributed to its enormous growth in such a short time. Ria continues to operate with qualified teams and infrastructure in accordance with applicable law for carrying out its money transfer activities.

4.1 Staff Qualifications and Security Risk:

Participants are obliged to ensure that their personnel have adequate qualifications and have received appropriate training to perform money transfer services. Participants appoint a compliance officer who will implement and oversee the Participant's anti-money laundering policies and rules. Participants are obliged to report to the relevant governing or regulatory authorities and Ria employees about any events in which the Participant suspects fraud, money laundering, or terrorist financing.

4.2 Risk Related to the Use of Equipment and Software:

The Participant must have a training program that enables all employees to be aware of possible threats and informs them of the information technology usage policies they must follow. All Participants should establish key control measures and system procedures in accordance with Ria's policies and applicable law.

4.3 Risk Related to Legal Matters:

Ria uses a group of legal experts in various countries who analyze and advise on all matters related to operational activities at the international level and in accordance with local law requirements. This reduces the legal risks that Ria may encounter.

4.4 Regulatory Compliance Risk:

Ria strives to conduct its activities in compliance with safety and reliability requirements in accordance with the highest legal and ethical standards. We have established strict standards for compliance with applicable regulations designed to assist in detecting and preventing money laundering and terrorist financing, as well as for compliance with any other laws and regulations pertaining to the activities that Ria carries out in servicing financial transactions. Participants are obliged to cooperate with and promptly respond to all RIA requests to fulfill their compliance obligations.

4.4.1 Compliance Risk Management Program:

Ria has implemented an effective Compliance Risk Assessment Program to identify key areas of potential money laundering, terrorist financing, and consumer fraud; as well as to assist in identifying instances of Participant non-compliance with compliance policy.

4.4.2 "Know Your Agents and Foreign Participants":

Ria has developed policies, procedures, and controls in accordance with applicable laws and regulations to ensure the safety of consumer funds and protection against money laundering and terrorist financing, to detect and identify customers and/or any unusual/suspicious activity, and to protect the company from reputational, operational, and legal risks. Ria will conduct due diligence on its agents, correspondent banks, and Participants.

Ria has developed a policy for:

  • Conducting enhanced due diligence on all foreign Participants.

  • Monitoring the transactions of foreign Participants using a risk-based approach.

  • Ensuring corrective actions and termination of activities of those foreign Participants who do not comply with the prescribed policies and procedures.

4.4.3 Transaction Monitoring Program:

Ria has developed a comprehensive Transaction Monitoring Program that uses high-technology systems for: (i) detecting unusual/suspicious activity related to applicable anti-money laundering and banking secrecy law, terrorist financing, and fraud loss risks; (ii) investigating transactions considered unusual/suspicious or fraudulent; (iii) documenting relevant cases; (iv) reporting unusual/suspicious activity to senior management in accordance with policy and applicable law; and (v) reporting suspicious activity to the government, if required by policy and law. Ria has established a team of compliance specialists and analysts responsible for assisting in protecting the company's financial network system, Ria brands, and for reporting suspicious activity related to anti-money laundering, BSA, terrorist financing, and fraud loss risks. Participants are obliged to cooperate with and promptly respond to all RIA requests to fulfill their compliance obligations.

4.4.4 Sanctions Compliance Program:

Ria advocates full compliance with sanctions within the jurisdictions in which it operates, including compliance with U.S. sanctions applied by the U.S. Treasury Office of Foreign Assets Control (OFAC). Transactions can be checked against various national and international sanctions lists, such as the OFAC Specially Designated Nationals and Blocked Persons (SDN) List, the OFAC Consolidated Sanctions List, and any other applicable local jurisdiction sanctions list. Potential matches are flagged, and Participants may only unblock such transactions after receiving authorization from Ria's Compliance Division.

Ria maintains a comprehensive program for ensuring compliance with applicable economic sanctions and may take necessary measures to prevent or suspend the commencement of Participants' activities in the Ria International Network, or the carrying out of transactions on behalf of, in the name of, or in the interests of an individual, legal entity, country, or organization subject to such sanctions.

4.4.5 Training:

Staff Training:

Participants are obliged to implement an effective staff training program. Anti-money laundering training programs are essential to the success of any compliance program. The objective of compliance training is to ensure that each employee has a thorough understanding of the laws and regulations they are obliged to follow, which may include:

  • Onboarding of new employees

  • Ongoing training for all employees

  • Retraining as necessary

Agent Training:

RIA is obliged to conduct training for new Participants, ongoing training using a risk-based approach, and skills upgrade training as necessary.

4.4.6 Record-Keeping:

Regulatory authorities require financial institutions to maintain records of their transactions. Accordingly, RIA has adopted appropriate record-keeping policies for each jurisdiction, and the Participant is obliged to adhere to the record-keeping policy prescribed for Kazakhstan.

4.5 Risk Related to the Use of the Operating System and Software:

RIA has a dedicated team of fraud prevention specialists who continuously monitor and manage fraud prevention measures. Their duties include, among other things:

  • Working "hand in hand" with the compliance team to study and research market trends

  • Managing built-in system functions

  • Managing security tokens

  • Working "hand in hand" with the police technology division

  • Advising and training Participants

  • Forming teams responsible for post-transaction investigations

The Participant is obliged to cooperate fully with Ria in conducting its policies and procedures related to this risk, including, without limitation, filtering suspicious transactions, identifying unusual orders, automatic system logout after inactivity on the site, and conducting transactions outside designated working hours.

4.6 Information Security:

Participants are responsible for ensuring the security of their own systems used in connection with fulfilling their obligations, in developing and maintaining an information security program that includes appropriate measures in accordance with applicable law and commercially reasonable industry standards designed to ensure security and confidentiality.

5. CONDITIONS FOR PARTICIPATION IN THE PAYMENT SYSTEM

A Participant has the right to participate in the Ria Payment System based on the results of the Participant due diligence conducted by Ria, in accordance with the terms of the agreement concluded between the Participant and Ria, and in accordance with Ria's policies and procedures for ensuring compliance and executing operations. The operation of the agreement and participation in the Ria Payment System terminates in accordance with the concluded agreement.

5.1 Procedure for Resolving Participant Insolvency in the Payment System and Measures Applied to Payment System Participants for Violations:

The agreement between RIA and the Participant expressly grants the parties the right to its immediate termination, at any time and upon written notice to the other party, in the following cases (among others): (i) if one of the parties is declared or acknowledges that it is insolvent or is otherwise unable to repay its debts by the set deadline; (ii) after the initiation of any judicial proceedings (whether voluntary or compulsory) on matters of bankruptcy, insolvency, or relief from creditors' claims; (iii) if a regulatory authority initiates an investigation against a party that causes material damage to its operations or business reputation; (iv) if one of the parties fails to obtain or maintain in force all necessary licenses and/or permits for carrying out activities; (v) if one of the parties breaches the terms of the agreement; (vi) if one of the parties is unsatisfied with the other party's internal control policies, procedures, or measures relating to anti-money laundering/counter-terrorist financing legislation — this directly provides the right to immediate termination.

Furthermore, Ria has the right, at its discretion, in accordance with the terms of the agreements concluded with each Participant, to suspend or cancel any specific money transfer operation. Thus, in the event of the Participant's insolvency or non-compliance with these Rules, Ria has the right to suspend or cancel any money transfer operation or service if it deems this necessary.