KAZAKHSTAN-

Central Securities Depository of the Republic of Kazakhstan

Rating Report Type: Public Rating

Overall Risk Rating: A Overall Outlook: Positive

Contents

Summary

Settlement Process

1.0 Asset Commitment Risk

2.0 Liquidity Risk

3.0 Counterparty Risk

4.0 Asset Safety Risk

5.0 Asset Servicing Risk

6.0 Financial Risk

7.0 Operational Risk

8.0 Governance and Transparency

General Key Indicators

Copyright © 2013 Thomas Murray Ltd.

Reproduction in whole or in part prohibited except by permission. All rights reserved. The services and analysis provided by Thomas Murray are provided on an "as is" basis

and Thomas Murray make no representations or warranties, express or implied, as to the accuracy, adequacy or completeness of its analysis or results to be obtained from

accessing and using this report (or any information included therein), including without limitation, any warranties of merchantability or fitness for any particular purpose or

use. Neither Thomas Murray nor their affiliates shall be liable to any user or anyone else for any inaccuracy, error or omission, regardless of cause, in this report or for any

damages resulting therefrom. In no event shall Thomas Murray have any liability for lost profits or for indirect, special, punitive or consequential damages, even if advised of

the possibility of such damages. Thomas Murray shall have no liability to any third party arising from or related to this report. Neither this report nor any component of the

service provided by Thomas Murray is a rating, endorsement or guarantee of any Depository or its financial strength or a recommendation to enter into any agreement with

any Depository. Thomas Murray relied on information provided by third parties believed to be accurate and reliable but due to the possibility of human or mechanical error,

Thomas Murray can not guarantee the accuracy of any such information.

1 of 39

Summary Central Securities Depository of the Republic of Kazakhstan

Role of the Depository

The Central Securities Depository of the Republic of Kazakhstan (KACD)began operations in September 1997 as a closed joint stock company. TheKACD is a not-for-profit organisation founded by professional securitiesmarket participants and provides custody, clearing and settlement ofsecurities, money transfer services, maintenance of the system ofconsolidated securities accounts and allocation of international numbers forsecurities and other financial instruments.

The legal framework for the KACD’s activity is the Law 'On Joint StockCompanies' dated 13 May 2003, #415-II, the Law ‘On Securities Market’dated 2 July 2003, # 461-II, the Law "On Banks and Banking Operations inRepublic of Kazakhstan" dated 31 August 1995, #2444, the Law "OnPayments and Money Transfers" dated 21 June 1998, #237-I, Internal Rulesof KACD and other relevant acts. KACD is regulated by the National Bank ofthe Republic of Kazakhstan.

KACD administers equities, fixed income and money market holdings, beingthe authorised depository for government securities issued by the Ministryof Finance of the Republic of Kazakhstan, NBK and local Municipal Bodies(Akimats). Deposit of securities in KACD is compulsory for securities tradedon Kazakhstan Stock Exchange (KASE) since KACD acts as a settlementorganisation for exchange trades. KACD settles internal and externaltransactions for its participants. With regard to domestic securities onlyKACD may act as nominee for other nominees. All securities administered bythe KACD are in book entry form only.

About the Depository

Date Commenced Operations: 1997

Legal status: Incorporated under the Law 'OnEconomic Partnerships' dated 1995 (supersededby the ‘Law On Joint Stock Companies’ dated 10July 1998 and then by the Law 'On Joint StockCompanies' dated 13 May 2003)

Regulated by: The National Bank of Kazakhstan(NBK)

Type of legal entity: Not for profit

Region: C&E Europe

Services Provided

SafekeepingMatchingClearingSettlement

Instruments Supported

EquitiesCorporate DebtGovernment DebtMoney Market Instruments

Overall Risk Summary

Overall, KACD has sound clearing and settlement processes with all securities being able to be settled on a BIS Model 1 basis at anytime during the day once cash is available. However a T+0 pre-funding model is not conducive to attracting foreign investors andas a result both KACD and KASE are considering introducing T+n settlement. About a third of trades are settled on an OTC basiswhere settlement is almost in real time. KACD supports active repo and reverse repo markets where both banks and brokers canobtain cash and securities liquidity. KACD follows sound financial practices and has consistently been profitable over the past fiveyears. Its revenues have mainly come from custody fees and have helped boost retained earnings, which is the largest componentof KACD’s KZT 1.87 billion (USD 12.4 million) capital. From an operational perspective, KACD has established procedures in placethat are reviewed periodically and has established a Risk Manager with responsibility for the risk management process, controls andcompliance. However, these arrangements are not supported by a thorough audit program as internal audit resources only consistof a single internal auditor and external operational audits are only undertaken every three years. KACD has well-equipped DisasterRecovery and Business Continuity facilities that were recently improved by the development of a new site in April 2012. AssetServicing mainly relates to interest payments for government bonds and there is considerable manual processing. Sound custodyarrangements are adopted with the availability of a segregated account structure, securities are all dematerialised and legalconventions are supportive in terms of providing protection to the beneficial owner.

Risk Analysis Summary Rating

Overall Risk A

Asset Commitment RiskThe asset commitment period is variable for sellers whose securities remain unavailable until settlementtakes place (i.e funds are provided by the buyer). But in reality, this period is likely to be short given thatKACD maintains cash accounts on behalf of brokers and therefore transfers securities and cash almostsimultaneously once they are both available. The asset commitment period is just a few minutes, theduration of the settlement process.

AA

2 of 39

For buyers, For OTC trades, the asset commitment period is shorter given that settlement takes place onceboth cash and securities are in place without any prefunding requirements (similar to an RTGS althoughKACD checks with KASE if securities and money are available before settlement delaying the process for afew minutes).

There appears to be a significant percentage of transactions settling FOP with a variable asset commitmentperiod, which impacts the overall rating for asset commitment risk.

Liquidity RiskThe depository uses a gross settlement system. Also, the lack of credit facilities, stock lending and failsmanagement arrangements contribute to some degree of liquidity risk exposure in particular for OTCsettlements. A fully pre-funded settlement model for on-exchange trades has been introduced, which is inplace to eliminate fails in this market.

A-

Counterparty RiskCounterparty risk exposure between participants is reduced as KACD provides DVP settlement(non-simultaneous but securities are blocked on the seller's account before the payment) and KASE leviespenalties for failing transactions. Participants (mainly brokers) are exposed to KACD as the settlement bank.The depository does not carry out regular surveillance of trading volumes or participants’ financial strengthalthough the regulatory body does, as one of its licence requirements. There is no CCP in the market.

A

Asset Safety RiskSegregation is mandatory for participants who must open separate accounts for proprietary and clients'assets. The nominee concept is recognised in Kazakhstan. There are no liens on securities. Reconciliationswith participants take place at least monthly while reconciliations with registrars take place every time thereis a change in balance. KACD has reported that it has controls and procedures in place for account accesscontrol.

AA-

Asset Servicing RiskKACD is not responsible for informing its participants about corporate actions. KACD does not undertakeproxy voting services. It accepts responsibility for direct losses where it has failed to correctly processinformation or instructions from participants. KACD acts as paying agent for government securities and it isexpanding this services to some non-government securities.

AA-

Financial RiskKACD’s financial risk was upgraded in April 2013 due to the improvements in some of the criteria. KACD hasbeen consistently profitable for more than five years (note that KACD is a non-profit institution).Furthermore, the central bank increased its ownership of the depository. This better reflects the situationwith NBRK and provides an implicit guarantee, especially as KACD is a systemically important infrastructure.The other major shareholder is the exchange (KASE) with nearly 35% holding. Other shareholders can onlybe financial institutions.

A

Operational RiskKACD has formal documented internal controls in place covering all operational aspects. These controls areregularly updated, and are subject to review by the Board of Directors and regulatory bodies. KACD hasrelevant disaster recovery procedures. KACD makes two copies of the whole database on a daily basis. Oncecopy is held in the KACD, another one is stored in the vault of one local bank. Databases copied are testedon a weekly basis. An interim reserve site was established and last tested in April 2012. This interim reservesite is rented by the KACD.

A

Governance and Transparency RiskKACD has reasonable board arrangements with an independent chairman and representatives fromshareholders and the industry. The board is responsible for risk management and there is an audit and riskmanagement at the board. The Board of Directors reviews the performance standards of the ManagementBoard against set performance targets. A user group has recently been created to discuss developments andchanges. Some corporate and statistical information is provided on the website.

A+

Outlook SummaryThe outlook for the overall rating is positive given the following developments planned within the next year :

- Following the implementation of the T+0 prefunding model, KACD and KASE are considering introducing T+n settlement withfails.- KACD will take insurance cover of KZT 250 million from 1 May 2013.- A User Group for all participants will commence this month.- KACD moved to new rented premises in September 2012 (following the termination of its lease in the previous premises) and

3 of 39

intends to consider moving to premises with the National Bank of Republic of Kazakhstan within 2 years.- There are plans to recruit a second internal auditor with IT audit expertise.- KACD commenced paying agency services for non-government securities from 1 April 2013.- KACD is discussing with NBRK the segregation of client cash accounts opened with KACD.- KACD is discussing the establishment of a single source of data on corporate events with NBRK (owner of TSIR).- KACD is discussing buy-in (including partial buy-in) arrangements with KASE. These will be necessary if T+n settlement isintroduced.

Eligible Securities Depository under SEC Rule 17f-7

System of central handling of securities Yes

Regulated by a financial regulatory authority Yes

Holds assets of all participants on equivalent terms Yes

Identifies and segregates participant assets Yes

Periodic reports to participants Yes

Periodic examination by a regulator or independentaccountant

Yes

Regulatory and Independent Examination of the Depository

Deloitte LLP conducted an operational audit of the KACD against the standards: SAS70, ISO/IEC 27001:2005, PRINCE2 and CobITv4.1 in 2010.

Audits of the financial statements are conducted annually by BDO Kazakhstan audit (2008, 2009, 2010, 2011 and 2012).Also, the Committee for Control and Supervision of the Financial Market and Financial Organisations of the National Bank of theRepublic of Kazakhstan (Committee) may conduct routine inspection of the central securities depository to verify compliance withthe current legislation at its own discretion. The last inspection by the Committe took place between 12 October 2011 and 10December 2011 to cover the period 1 October 2010 to 1 October 2011.

KACD is regulated by the National Bank of the Republic of Kazakhstan. The regulator has the power to:

- Approve any new services or enhancements to existing services offered by the depository, including new types of securities.- Terminate or suspend given licenses- Approve internal rules- Conduct financial, risk and systems audits of the depository.

Regulation of the KACD’s operations is based on the Code of Rules developed internally and approved by the Board of Directors andfinally approved by supervisory agency. Remedies available to the regulators include restriction of depository activities, suspensionof depository activities and termination of depository activities. No enforcement action has been required by the regulators in thepast three years.

Relevent Legal Protection Mechanism

KACD has formal documented internal controls in place, which are regularly updated. KACD has implemented the followingprocedures to ensure that assets held for others are safeguarded against unauthorised use, loss or disposal:

- Securities are dematerialised.- Transaction processing functions are restricted to dedicated personnel.- Daily balance of accounts.- Reconciliation of balances with participants.- Reconciliation of balances with registrars.- Reconciliation of balances with custodians.

Internal operations are regulated by the ‘Set of Rules’. Rule changes require the approval by the regulator.

4 of 39

The Law "On Securities Market" dated 2 July 2003 recognises the nominee convention in Kazakhstan.

The Law also allows custodians and depositories to open accounts in other countries and foreign custodians and foreigndepositories to open accounts in Kazakhstan.

5 of 39

Settlement Processes

Settlement Process Options

Description of Settlement Processes

On-exchange settlements:

KASE manages a T+0 settlement process. Before KASE opens for trading, it receives a list of trade participants’ securities and cashaccount balances at KACD. Participants’ cash balances are uploaded to the KASE system at 9.30am. Cash prefunding is required forall buy orders placed by trade participants.

Participant bank cash balances at the KACD transition account can be increased/decreased throughout the day using SWIFT MT100and MT910 for confirmation. Brokers can increase/decrease cash balances at their KACD transition account indirectly by instructingtheir bank.

KASE is advised of cash credits throughout the day but must approve both security and payment debits for all OTC transactions(irrespective of the counterparties).

Prior to a trade being confirmed for settlement, KASE checks the underlying seller has sufficient security on their sellerssub-account. If the security is available then KASE sends trade settlement details to KACD. (There seems to be a risk of settlementfailure at this stage as the security is not frozen until after settlement details are received by KACD – this is mitigated by KASEbeing noted and approving any security debts that may arise from OTC transactions).

KASE sends KACD electronic matched trade details which are settled DVP real-time on a FIFO basis usually in less than 10 minutes.KACD notifies KASE once settlement is complete - security and money has been credited.

On receipt of the settlement instruction from KASE, the KACD system automatically:• Blocks securities in the seller’s sub-account• Debits the funds from the buyer’s respective KACD account which are then transferred to the KACD’s transition account. Forbanks, funds may be directly debited from their NBK account and credited to the KACD transition account by an electronic paymentorder via ISMT.• KACD then debits its transitory cash account and credits the sellers KACD cash account. Once KISC confirms the funds transfer toKACD’s transition account is complete, KACD credits the seller’s KACD cash account.• The security is transferred from the seller’s sub account to the buyer’s sub-account.

The gap between the securities and cash transfers or broker to broker trades is very short given that brokers maintain a bank

6 of 39

account at KACD and therefore the DVP is almost simultaneous.

Off-exchanges and OTC Settlements:

KACD accepts instructions from counterparties on a T+N basis. (Less than 0.5% by paper). Trades remain unmatched in the systemuntil SD when matching is initiated. If trade settlement details do not match, the trade must be deleted and settlement detailsre-entered by the party which made the mistake.Once matched, trades are settled as above - DVP real-time on a FIFO basis usually in less than 10 minutes.

Unsettled trades are deleted at the end of day.

Since on-exchange trades are pre-funded but securities are not blocked, KACD checks with KASE before transferring securities tothe buying party. Settlement takes place once both securities and cash are available and settlement takes place in real-time on agross basis.

The gap between the securities and cash transfers are not simultaneous given that banks maintain their cash accounts at thecentral bank (instead of KACD) and therefore the communication between KACD and the Central Bank delay the process for someminutes.

Settlement Process – Key Indicators

TransactionType

InstrumentType

BISModel

ClearingProvider

SettlementPeriod

Cash (Central Bank orCommercial bank funds)

On-exchange Equities, bonds 1 KASE T+0 KACD (through KACD's accounts atthe central bank)

OTC Equities, bonds 1 KACD T+n Central Bank funds

CSD - CSD Links

KACD operates direct links with the Central Securities Depository of Kyrgyzstan, Republican CSD of Belarus, Clearstream Bankingand Euroclear Bank. KACD has a two-way link with NSD in Russia. The Central Depository of Armenia has accounts at KACD.

KACD does not guarantee to its partner CSDs the performance of its own participants and, as such, will not take on any liabilitiesresulting from the failure of one of its participants while they are using these links. Losses, if any, will fall on the participant usingthe service.

Clearstream and Euroclear both use an overnight batch, multi daytime batches and real time processing cycles. The systemoperating parameters are internationally adopted. The Central Securities Depository of Kyrgyzstan operates real time processing.

7 of 39

1.0 Asset Commitment Risk RATING: AA

1.1 Summary

The asset commitment period is variable for sellers whose securities remain unavailable until settlement takes place (i.e funds areprovided by the buyer). But in reality, this period is likely to be short given that KACD maintains cash accounts on behalf of brokersand therefore transfers securities and cash almost simultaneously once they are both available. The asset commitment period isjust a few minutes, the duration of the settlement process.

For buyers, For OTC trades, the asset commitment period is shorter given that settlement takes place once both cash and securitiesare in place without any prefunding requirements (similar to an RTGS although KACD checks with KASE if securities and money areavailable before settlement delaying the process for a few minutes).

There appears to be a significant percentage of transactions settling FOP with a variable asset commitment period, which impactsthe overall rating for asset commitment risk.

1.2 Asset Commitment Periods Analysis

Securities are irrevocably committed to settlement upon receipt by KACD of matching instructions in real time during SD. Forextended settlement orders (T+n) assets are not blocked or committed during the period between the execution day and SD.

There is a minimal asset commitment period for both Buyer and Seller between the time funds are debited from the Buyer'saccount, subsequently transferred to the Seller and then the Seller’s securities released to the Buyer.

1.3 Irrevocability

Settlement is considered to be final and irrevocable when both cash and securities are credited to the seller’s and buyer’s accountsrespectively.

1.4 Finality

There is no definition of finality in the current legislation.

Asset Commitment Risk – Key Indicators

Transaction type Start of AC Period End of AC Period (finality) Asset Commitment Period Proportion

Securities - DVP trades 9:30 am 5:30 pm Variable -

Securities - FOP trades 9:30 am 6:30 pm Variable -

Cash 9:30 am 5:30 pm Minimal -

Comments

KASE operates a fully pre-funded settlement system on a T+0 cycle.

8 of 39

2.0 Liquidity Risk RATING: A-

2.1 Summary

The depository uses a gross settlement system. Also, the lack of credit facilities, stock lending and fails management arrangementscontribute to some degree of liquidity risk exposure in particular, for OTC settlements. However, the repo and reverse repo marketsappear to be active. A fully pre-funded settlement model for on-exchange trades is in place, which virtually eliminates fails in themarket.

2.2 Processing Models

All transactions are processed on a trade-for-trade basis (gross-gross settlement). Final delivery of funds precedes the final transferof securities with a very short gap. Cash is transferred between cash accounts with KACD for broker/dealers and between cashaccounts with KISC for custodians. KACD operates both cash accounts.

BIS Processing Model Type of transaction % of Trades settled (gross prior to netting)

1 On-exchange and OTC 100%

- - -

- - -

2.2.1 Processing Model Description

-

Processing Models - Key Indicators

BIS Model 1 BIS Model 2 BIS Model 3

Cash Yes N/A N/A

Number of batches Real-time N/A N/A

Netting Efficiency N/A N/A N/A

Securities Yes N/A N/A

Number of batches Real-time N/A N/A

Netting efficiency N/A N/A N/A

Comments All transactions settle on a model 1 basis in real-time

2.3 Fails Management

2.3.1 Fail Definition and Rate

-

2.3.2 Fails Management Mechanisms

Fails are rare in the Kazakhstan OTC market (although there are no exact estatistics since trades are cancelled at the end of theday if unsettled). KASE imposes penalties for brokers although KACD does not apply any to defaulted participants. There are nobuy-in or other fails management arrangements in place. For on-exchange trades, there is a pre-funding requirement in placewhich .eliminates fails on the sell side.

After the implementation of T+0 settlement on a gross trade-by-trade basis at KACD, KASE now imposes penalties to tradingparticipants in the following cases:

9 of 39

1) If a participant fails to settle a transaction due to a shortage of cash. In that case, the following penalties apply:1.A) The buyer will pay the seller 0.5% of the transaction value, if the seller does not wish to re-execute the transaction;1.B) The buyer will pay the seller 5% of the transaction value, if the transaction has been re-executed but failed to settle;1.C) If the re-executed transaction settles, then 50 Monthly Calculation Index (MCI) factors will be payable to KASE. In 2012one MCI was equal to KZT 1,618.

2) If a transaction fails to settle for any reason other than a shortage of cash, then the defaulting party will be required to paythe counterparty 5% of the gross settlement amount.

3) If a participant of the Confirmation System fails to confirm his liabilities on delivery or refuses to confirm a securitiespurchase deal by the deadline set by the KASE regulations, then he will be subject to a penalty of 50 MCI. Furthermore, suchparticipant must submit a letter to KASE on the next business day, explaining the reasons for not meeting the confirmationrequirement.

Fails Management - Key Indicators

Fail penalties applied: Yes

Buy-in execution relative to original settlement date of trade: No

Settlement Rate

-

2.4 Access to Funds

KACD does not provide credit facilities to its participants, nor does it provide credit facilities through intermediaries such ascommercial banks.

Access to Funds – Key Indicators

Sources of Credit

Yes/No

Commercial banks to domestic investors Yes

Commercial banks to foreign investors Yes

Interbank repo market Yes

Central bank repo Yes

- -

2.5 Securities Borrowing and Lending

2.5.1 SBL Description

Securities lending is not market practice. Securities may be obtained by reverse repos.

However, the use of reverse repos is not as efficient to mitigate liquidity risk since there is a change in ownership and thereforethe "lender" losses the entitlements.

2.5.2 Short Selling

-

Securities Borrowing and Lending – Key Indicators

10 of 39

Securities lending permitted in the market: No

Short Selling permitted in the market: No

Purpose of SBL: N/A

Providers of SBL: N/A

Minimum Settlement cycle of SBL: N/A

Comments -

2.6 Registration Period

Securities deliveries are achieved by automated entries. All securities that are deposited in KACD are treated as fungible and areable to be transferred or pledged by book-entry.

Registration at KACD is instantaneous. While local registrars/transfer agents typically take one business day to re-register a holding.In accordance with legislation, registrars are entitled to carry out transactions within three days, whereas KACD is capable ofsettling on a T+0 basis for almost all securities.

According to the Law "On Securities Market" issued in July 2003 nominees (custodians and broker/dealers), except for KACD,cannot open accounts for other nominees in relation to safekeeping of domestic securities. Consequently, transactions withdomestic securities between nominees are settled via KACD. For registrars, re-registration usually takes up to three daysirrespective of their location (in or outside of Almaty).

There is a single registrar in Kazakhstan. All registration / re-registration activities for securities ownership are conducted by thesingle central registrar, the United Registrar of Securities, which is currently owned by NBK.

Registration Period – Key Indicators

Securities are blocked during registration: Yes

Period of blocking during registration: 24 hrs

Period of time to deposit: 24hrs

Period of time to transfer ownership: 24 hrs

Number of registrars in the market: 1

Comments -

2.7 Deposited Securities

All securities held by KACD are in dematerialised form.

KACD holds around 59% by value of all securities eligible for deposit, around 49% of total market value of equities but over 90% offixed income instruments.

100% of government securities and KASE traded securities are held in nominee accounts with KACD.

Deposited Securities – Key Indicators

-

2008 2009 2010 2011 2012

Total Value of Securities undercustody (in local currency)

8,675 12,394.27 14,593.64 14,292.99 15,973.24

11 of 39

-

Equities

2008 2009 2010 2011 2012 2013

Lines of Equities N/A N/A N/A N/A N/A N/A

Value held at CSD 6,254.31 7,310.74 9,455.54 9,106 10,269 -

% of Domestic Market in CSD 72.1% 58.98% 64.79% 63.71% 64.29% -

Comments -

Fixed Income Securities

2008 2009 2010 2011 2012 2013

Lines N/A N/A N/A N/A N/A -

Value held at CSD 1,912.20 4,455.24 4,078.96 4,576.82 5,433.5 -

% of Domestic Market in CSD 22.04% 35.95% 27.95% 32.02% 34.02% -

Comments -

Money Market Instruments

2008 2009 2010 2011 2012 2013

Lines N/A N/A N/A N/A N/A -

Value held at CSD 508.5 628.29 1,059.14 610.17 270.29 -

% of Domestic Market in CSD 5.86% 5.07% 7.26% 4.27% 1.69% -

Comments -

How Securites Are Held

Equities Dematerialised

Corporate Debt Dematerialised

Government Debt Dematerialised

Money Markets Dematerialised

Other Instruments Dematerialised

2.8 Settlement Matching

2.8.1 On-Exchange Matching

All exchange trades are received with matched status.

2.8.2 OTC Matching

OTC trades must be key entered by the participant and matched for acceptance. Matching only takes place on SD (not the dateentered for forward dated trades).

12 of 39

Unmatched trades are rejected with no fail message pushed to the participant until the end of the value date. The system doesnot identify why the match failed. Unmatched trades must be re-entered and are deleted by the system at the end of day.

Electronic pre-matching for OTC trades is not standard local market practice but is conducted by phone.

13 of 39

3.0 Counterparty Risk RATING: A

3.1 Summary

Counterparty risk exposure between participants is reduced as KACD provides DVP settlement (non-simultaneous but securities areblocked on the seller's account before the payment) and KASE levies penalties for failing transactions. Participants (mainly brokers)are exposed to KACD as the settlement bank. The depository does not carry out regular surveillance of trading volumes orparticipants’ financial strength although the regulatory body does, as one of its licence requirements. There is no CCP in themarket.

3.2 Participation Criteria

Eligible participants include: banks (25), brokerage companies (23), and foreign depositories (8). As defined in the currentlegislation, professional stock market participants holding a licence to perform custody, broker-dealer activities, foreign depositoriesand custodians are eligible to open accounts with KACD.

KACD does not have its own formal participation criteria, including the minimum capital requirement. The only requirement is thatparticipants shall hold broker/dealer, custody or depository licence. The same criteria apply to all participants and all participantsare required to sign identical contracts with the KACD. Participants are actively monitored by KACD to ensure that their actions arein accordance with the depository's rules and procedures.

An applicant must submit the required documents and have/open a cash account with KISC or a cash account with KACD.Participants may open one securities account and an unlimited number of sub-accounts, two cash accounts, including one accountfor client money and the second for own money.

Principal stock accounts and agent stock accounts are required to be segregated. To facilitate segregation, participants normallyhold a mandatory sub-account for principal stock, and mandatory sub-accounts for agent stock.

The relationship between the KACD and its participants, as well as administration of securities transactions, is regulated by theCharter of the KACD and the KACD’s Internal Code. The relationship is also governed by relevant laws and regulations, a standardparticipation agreement, established terms and conditions of participation and by-laws of the depository.

Participants are not required to contribute to the depository capital.

Participation Criteria – Key Indicators

Number Minimum Capital Requirement Regulator

Brokers 23 KZT 692.4 million NBK

Banks/Custodians 26 KZT 5 billionDevelopment Bank of Kazakhstan - KZT 30 billionNational Bank of Kazakhstan - KZT 20 billion

NBK

NBFIs - - -

Other 8 Foreign depositories N/A N/A

3.3 Participant Surveillance and Oversight (CSD & Regulator)

3.3.1 General Monitoring (Regulator/Stock Exchange/Others)

-

3.3.2 Monitoring by the CSD

KACD does not monitor or manage the risk of a participant failing. Depo accounts of the participant may be suspended by thedepository in accordance with the instructions of the regulator and/or the decision of a court, or if the participant fails toperform its obligations under the contract.

14 of 39

3.3.3 Clearing/Settlement Exposure Monitoring

-

3.4 Participant Concentration

There is high concentration in the OTC market with 51% of transactions (by value) executed by the largest 10% of participants. Byvolume, there is less concentration since transactions are more widely spread out.

The repo market is equally highly concentrated since four participants (less than 10%) account for 55% of trades.

Participant Concentration – Key Indicators

% by value % by volume

10% of participants (51%) No concentration

- -

-

3.5 Delivery Versus Payment

3.5.1 DVP Settlement

The transfer of securities and cash is handled separately but is controlled by KACD. Non-simultaneous DVP is controlled byKACD, the settlement of cash precedes the settlement of securities so there is no simultaneous DVP. However securities areblocked on the seller's account before the payment. If the settlement of cash doesn’t occur, then the securities are unblocked,otherwise the securities are moved to the buyer's account.

3.5.2 FOP Settlement

-

DVP – Key Indicators

DVP Managed by

100% Model 1 KACD

- - -

- - -

3.6 Cash Exposure

Cash is settled through accounts at KISC. KACD and Bank participants have accounts at the central bank.

Brokers have cash accounts with KACD and therefore are exposed to KACD overnight and intra-day.

3.7 Central Counterparty (CCP) Risk Containment Model

3.7.1 CSD Acting as CCP

KACD does not act as central counterparty to cash market transactions.

3.7.2 Other Entities Acting as CCP

There is no CCP in the market.

CCP Risk Containment Model – Key Indicators

CCP: N/A

15 of 39

Novation / Open Offer: N/A

Novation / Open Offer Timing: N/A

Timing of Margin Calls: N/A

Stress Testing: N/A

Stress Testing Frequency: N/A

Comments N/A

3.8 Settlement Guarantees

3.8.1 Coverage

There are no guarantee funds. KACD does not support especially designated funds to cover its losses and risks.

3.8.2 Characteristics

-

3.8.3 Analysis

-

Settlement Guarantees – Key Indicators

Name of Fund Managed by Coverage Value

- - - -

- - - -

- - - -

Comments-

16 of 39

4.0 Asset Safety Risk RATING: AA-

4.1 Summary

Segregation is mandatory for participants who must open separate accounts for proprietary and clients' assets. The nomineeconcept is recognised in Kazakhstan. There are no liens on securities. Reconciliations with participants take place at least monthlywhile reconciliations with registrars take place every time there is a change in balance. KACD has reported that it has controls andprocedures in place for account access control.

4.2 Segregation of Securities

Principal security accounts and agent security accounts are required by the Law on ‘Securities Market’ to be segregated (Section74(2)(2)). To facilitate segregation, participants normally hold a mandatory sub-account for principal securities, and mandatorysub-accounts for each client’s securities. Clients who have the right to open omnibus accounts for their foreign nonresidentcustomers may do so.

KACD maintains separate securities accounts from its participants under Section 10 of the Depository Services regulations andSection 45(5) of the Securities Market Law.

Securities posted as collateral remain in the same account but are flagged as ‘unavailable’.

4.3 Legal Conventions

Client securities held in a client omnibus account using a custodian nominee, are recognised under Section 60(3) of the Law ‘OnSecurities Market’ dated 2 July 2003 which recognises the nominee convention, and provides for the procedures of confirmation ofa client’s title to securities.

Under insolvency proceedings, custodian, or CSD recognised client assets are not included in the proprietary assets of the insolventparticipant. The court has the power to freeze/free disputed assets held at the client level until resolution.

The registry records are considered the legal record to which differences must be reconciled.Section 83(2)(2) of the Bankruptcy Law stipulates that assets not forming property of the debtor cannot be used to satisfy claims ofa creditor.

Section 9 of the Custody Services Regulations ensures custodians cannot utilise the assets of clients to fulfil its own interests.

4.4 Forms of Securities

100% of assets are held in registered dematerialised form.

4.5 Reconciliation and Audit

KACD reconciles its security holdings with participants monthly according to rules but can be requested more frequently (up todaily). Participants can reconcile transfers with KACD using end of day reports or on an ad hoc basis by importing an electronicsecurity holdings file.

KACD reconciles its total issue balances with the registries each time there is a change in balance, or no less than monthly. Thisprocess is automated where there is an electronic link with the registrar.

Typically reconciliation breaks are addressed and resolved on the same day. There is no apparent monitoring of reconciliationbreaks or escalation procedures.

There is no formal on-going regular audit of the reconciliation process.

4.6 Lien

KACD has no right of lien against participant securities or cash held in the depository.

KACD can not apply a lien for non payment of fees, but can suspend services.

17 of 39

4.7 Account Control

KACD has complete controls and procedures governing its staff access to the securities accounts. These controls and procedureshave been audited by Deloitte under the SAS70 Audit 2011. Participants also have the tools to manage their staff access.

Access to the accounts are by electronic entry initiated by the participant, or manual dual entry of the client’s instruction by twoauthorised KACD operators. Settlement is still subject to the transaction being matched by the counterparty.

4.8 Cash Deposit

The CSD has not sought a counterparty credit rating. Participant cash, which is recorded in the system, is segregated from thebroker/settlement bank with whom they deal.

KACD are the paying agent for government and NBK securities. Monies held by KACD are held in a transit NBK settlement accountand are distributed the same day. Other corporate action payments are made direct by the issuer or their agent.

Asset Safety - Key Indicators

Segregation by Law / Regulation: Yes

Nominee concept recognised: Yes

Frequency of reconciliation with participants: Monthly

Liens asserted by CSD: No

CSD holds cash deposits: No

18 of 39

5.0 Asset Servicing Risk RATING: AA-

5.1 Summary

KACD is not responsible for informing its participants about corporate actions. KACD does not undertake proxy voting services. Itaccepts responsibility for direct losses where it has failed to correctly process information or instructions from participants. KACDacts as paying agent for government securities and it is expanding this services to non-government securities.

5.2 Corporate Actions Supported

Mandatory Events Voluntary Corporate Actions

Interest and dividend payments No

5.3 Information Collection

5.3.1 Mandatory and Voluntary Events

There is no central source of information in Kazakhstan. KACD does not collect information on domestic securities as it is notresponsible for informing clients about upcoming corporate events.

For foreign securities, information is received electronically via SWIFT from Clearstream and Euroclear. This information is notdouble checked as they are considered as official sourced for these securities.

5.4 Information Dissemination

5.4.1 Mandatory Events

There is no central source of information in Kazakhstan. Information is distributed to market participants by the registrar, issuersand news agencies. KACD does not receive information on domestic securities as it is not responsible for informing clients aboutupcoming corporate events.

In the case of domestic securities, KACD is responsible only for preparation of share/bond holders lists and submitting them tothe registrar. The information on government and other fixed interest securities is known in advance and clients are informedvia KACD's system. KACD tends to send information to clients usually during the same day or the next business day.

In the case of foreign securities, SWIFT messages 564,566,568 received from Clearstream and Euroclear are forwarded via fax.Receipt is confirmed by the recipient by fax or phone. The information is not cross-checked against another source, but thedepartment head and two corporate action specialists check the information before it is sent.

5.4.2 Voluntary Events

-

Information Processing- Key Indicators

Central Source of Information: No

CSD takes liability for Information Collection: No

Issuers obliged to inform CSD of corporate action: No

Information sources used by CSD Clearstream & Euroclear (Foreign securities)

Information from issuers cross-checked with other sources: No

Mode of Information Collection by CSD SWIFT (from Clearstream and Euroclear only)

Information is provided in English: No

19 of 39

CSD Notification Period of Corporate Actions Same day or next business day

Mode of Information Dissemination/Notification by CSD fax and email

CSD takes liability for Information Dissemination: Yes

Comments -

5.5 Receipt of Voluntary Event Instructions

For domestic fixed interest, KACD has a three day advance approval process for payments which acts as a check that the rightinterest and principal payments are made on time. KACD has an electronic approval process with NBK but not with the MInistry ofFinance (MOF). MOF pay cash around 11.00am on SOD and payment is mostly completed by 4.00pm.

In the case of domestic equities, an entitlement schedule is received directly from the registry/issuer. For other domestic securities,participants provide the list of beneficial owner to KACD via physical paper.

For foreign securities, participants provide instruction by template (letter or Fax). KACD has written procedures to verify that areceived instruction is correctly and accurately completed.

5.6 Execution of Corporate Actions

5.6.1 Mandatory and Voluntary Events

Execution of corporate actions at KACD is a highly manual process. A team of four is responsible to manually processinginstructions on foreign securities. KACD does maintain a log of late receipt of money on corporate or foreign securities.The depository does not accept separate instructions by way of sub-account.

Payments and transfer of securities are made on an actual income (rather than contractual income) basis. Usually, payments arepassed on the same day as receipt. Late crediting is possible if there is a need to address discrepancies.

Principal and interest payments for Government, and local authority fixed income securities are made via KISC on pay date. Inthe case of domestic equities, the registrar is responsible for processing payments to participants and providing KACD withinstructions to create/allocate securities to beneficial holders accordingly. KACD acts as paying agent for all government andnon-government securities.

The instruction of foreign securities is transformed and sent to Clearstream or Euroclear as a Swift 599 message. Theinstruction has three checks (including the HOD of Secretary Dept.) against the clients received instruction before forwarding toClearstream or Euroclear.

Reports/confirmations on money transfers under redemption or interest payment on government securities are transmittedelectronically to clients via KACD's information system.

Payment confirmation of corporate events on domestic and foreign securities is made via SWIFT with notices on dividendpayments sent through ARMDEPONET (KACD’s proprietary system).

KACD accepts liability in the event of infliction of loss to a participant induced by the failure to perform or due to the improperperformance of obligations based on the Agreement. Improper performance is and understood as failure to execute instructionon a timely fashion or/and inaccurately. Liability is limited to direct losses only.

KACD provides same-day confirmation to participants once it has processed the action and supplies full accounting statements.An execution/non-execution report is sent electronically the day instructions have been processed. Payments on securities aremade only when money or other assets are received from issuer on KACD's account. Late crediting is possible if there is a needto find out discrepancies.

Instruction Processing - Key Indicators

Role of CSD

20 of 39

Mode of Receipt of Instruction by CSD Manual (via fax or direct mail)

CSD Allows Cancellation/Amendment of Instruction No

Calculates securities entitlements: No

Calculates cash entitlements Only when it acts as paying agent

Paying Agent Role

Equities Yes

Fixed Income Public debt

Percentage of cash entitlements paid onpay date in the last full year

For public debt instrument, all payments are made on pay-day. KACD doesnot track timeliness of money receipt on corporate securities.

CSD takes liability for Event Execution Yes

Mode of Confirmation of Execution byCSD

SWIFT, electronic

Comments -

Corporate Actions – Key Indicators

Mandatory Corporate Action Voluntary Corporate Action

2011 2012 2013

Dividend Payment 85 192 -

Interest Payment 754 788 -

Redemption 107 100 -

2011 2012 2013

Rights Issues - - -

Merger/De-merger - - -

Etc... 1 1 -

5.7 Proxy Voting and Other Services

KACD does not provide proxy voting services and does not provide meeting agendas to participants. It does not attend thecompany annual and special meetings.

KACD does not provide any taxation services.

Proxy Voting and Other Services – Key Indicators

Proxy Voting Provided by CSD No

Electronic Voting Supplied by CSD No

Proxy Voting Provided by CSD but Outsourced to Third Party No

CSD Announces Meeting Details No

Elections (Voting) No

21 of 39

6.0 Financial Risk RATING: A

6.1 Summary

KACD’s financial risk was upgraded in April 2013 due to the improvements in some of the criteria. KACD has been consistentlyprofitable for more than five years (note that KACD is a non-profit institution). Furthermore, the central bank increased itsownership of the depository. This better reflects the situation with NBRK and provides an implicit guarantee, especially as KACD is asystemically important infrastructure. The other major shareholder is the exchange (KASE) with nearly 35% holding. Othershareholders can only be financial institutions.

Liabilities – Key Indicators

General

Gross Negligence, Omissions Yes

Wilful Misconduct Yes

Errors Yes

Fraud Yes

Force Majeure, political events No

Theft of securities Yes

Outsourced operations No

System Breakdown Yes

Consequential Losses No

Other businesses* No

Asset Servicing

Accuracy and timeliness of information -

Accuracy and timeliness of CAs execution -

Collection of information from third party -

CCP

CCP is the CSD No

CSD owns the CCP No

Lending

Securities lending No

Cash lending No

22 of 39

6.2 Analysis of Liabilities

KACD accepts liability for reconciliation errors with the registrars and/or issuers, theft of securities (either physical certificates orelectronically from accounts at the depository), failure of the depository’s systems that result in direct damages or losses toparticipants because they cannot use either securities or funds, and any loss caused by the depository due to errors, omissions orfraud that cause direct damages to participants.

The depository assumes liability for direct losses only, and excludes force majeure and system breakdowns. It would only acceptliability for indirect or consequential losses if directed by the court.

Although KACD has a large, well-managed liquidity portfolio, no formal analysis has been undertaken to set a minimum liquiditylevel to meet unexpected claims or events.

KACD has made quantitative assessment (stress testing) of operational, market and credit risks (including analysis of differentstress situations) in order to identify the adequacy of capital. Financial stress testing is conducted on an annual basis. The last testtook place in August 2012. The stress testing covered:

a) Losses from operational risks (failure, theft, law breaking, factors of external actions).b) Losses from market risks (adverse changes of market factors, interest and exchange rates).c) Losses from credit risks (defaults on financial instruments).d) Liquidity risk (reduction of liquid assets volume, deficiency of profits within 12 months).

6.3 Ownership & Access to Capital

Financial Risk - Key indicators

Ownership of the CSD

Number - Domestic Number - Foreign Percentage

Central Bank 1 0 54.98

Stock Exchange 1 0 35.69

Participant bank 13 0 6.29

Broker/dealers 8 0 3.04

- - - -

- - - -

- - - -

- - - -

- - - -

6.4 Capital Structure and Liquid Assets

KACD had a capital of KZT 1.87 billion (USD 12.4 million) in 2012, up KZT 0.23 billion (USD 1.55 million) over the previous year,largely as a result of increased retained earnings.

Capital was made up of paid-in capital of KZT 54 million (USD 0.3 million) and retained earnings KZT 1,580 million (USD 11.9million) in 2012. Most of KACD capital is held in the form of short term financial investments - KZT 0.86 billion (USD 5.7 million) isheld in money and short term financial assets, down from KZT 0.96 billion in 2011). This has been more than offset by an increasein investment in long term financial assets KZT0.94bn (USD 6.25 million), up from KZT 0.59 billion (USD 3.88 million), in 2011.Investment in other assets increased by around USD 0.5m.

KACD's authorised capital can increase through placement of its shares. The Board of Directors makes the decision on whether toplace additional shares of the depository. The shareholders have the right to buy but they are not obliged to buy KACD's shares.The shareholders have pre-emptive rights.

23 of 39

KACD has 24 shareholders, the largest being the NBRK with 55% of issued shares and KASE with 34.7%. Other shareholdersinclude banks and other financial institutions with shareholdings of either 0.74% or 0.37%. Shareholding for individual financialinstitutions is limited to 5% by law. Shareholders are restricted to financial institutions and the KASE. The NBRK is required to holdover 50% of the shares. Shareholders have no liability and losses are limited to their shareholding. Notwithstanding the financialobligation, NBK is tasked under law to assure the stability of the financial system of which KACD is an integral part, being deemed asystemically important institution.

In accordance with the Regulation on Depository Activity and KACD's Charter, profits of KACD may only be used to cover expensesand develop the depository system. No distributions have been or will be made to shareholders or participants.

Capital Structure and Liquid Assets – Key Indicators

Capital Structure (Local Currency)

Issued capital 54.2

Surplus 0

Reserves 0

Retained earnings 1,820

Total 1.874.2

Capital Structure CommentsFigures in KZT million at 31 December 2012

6.5 Earnings Performance

-

-

Operating Revenue Breakdown

2011

Settlement -

Custody -

Registration -

Others -

Comments/Footnotes -

6.5.1 Earnings Analysis/Overview

KACD has been steadily increasing its operating revenues over the last five years and has remained profitable over this period.Operating revenues stood at KZT 879 million (USD 5.9 million) as at 31 December 2012. In 2011, revenues were 872 million(USD 5.9 million), in 2010 KZT 775 million (USD 5.3 million), in 2009 KZT 721 million (USD 4.9 million) and in 2008 KZT 712million (USD 5.9 million). KACD revenue is mainly generated by custody fees, which were 91% of the depository’s total income.Changes to the fee schedule must be approved by the Board. There is no need to obtain authorisation from the regulator.

KACD has maintained a stable ratio of operational expenditure to operational revenue in the last two years. In any case, thecompany has been profitable for more than five years. The net profit generated in 2012 was KZT 234 million (USD 1.5 million),in 2011 was KZT 240 million (USD 1.6 million), 2010 KZT 341 million, 2009 KZT 240 million, 2008 KZT 129 million and KZT 216million in 2007.

24 of 39

KACD staff cost were KZT 323 million (USD 2.14 million) in 2012. Variables costs, which mainly consist of KISC, SWIFT,registrars, financial, stood at KZT 88 million (USD 0,59 million) in the same year.

6.6 Access to Credit / Liquidity

6.6.1 Credit Lines

KACD has the ability to borrow funds. There are currently no committed lines of credit in place.

6.6.2 Others

-

CSD has committed lines ofcredit:

No

6.7 Insurance

KACD does not have third party insurance coverage but the depository has plans to negotiate a policy during the second half of2013. The policy is expected to cover losses due to errors, crime, and operational breakdown.

CSD has insurance cover: No

6.8 Other Business Risks and Future Investments

-

6.9 Future PlansThey intend to eventually move into a new site (leasing space) that will be developed by NBRK.

25 of 39

7.0 Operational Risk RATING: A

7.1 Summary

KACD has formal documented internal controls in place covering all operational aspects. These controls are stated to be regularlyupdated and are subject to review by the Board of Directors and regulatory bodies. KACD has relevant disaster recovery proceduresand a reserve system in place and maintains testing of that system on a regular basis. All data is copied and safekept outside of theKACD's main building.

7.2 Identification of Risk and Key Controls

7.2.1 Risk Management

For risk management purposes, KACD uses the following:- Risk self-assessment;- Loss data collection;- Identification of operational risk in new and present business processes.

The functions of structure for operational risk management at KACD are as follows:- Board of Directors approves limits on risks and risk management policy;- Management Board ensures management of operational risks in accordance with policies approved by the Board of Directors;- Risk manager executes methodology of risks management process, controls compliance of established limits, as well ascoordinates actions of risk coordinators, participates in development of events on minimization of risks and other;- Risk coordinators (in each subdivision) manage operational risks of their subdivisions in compliance with internal documents,record operational risk events in loss data collection, inform risk manager about such events, and cooperate with risk manageron risk management issues.- Risk manager forms operational risk reports which are transferred on approval of the Boards of Directors and ManagementBoard based on occurrence of operational risk events, as well as quarterly.

KACD has documented indicators characterising influence of operational risk on KACD activities. Each business process owner isresponsible for identification and assessment of risk. Risks quantification is assessed on each type of KACD activities no lessthan once in a year, stress testing is executed quarterly on operational risk which contains assessment of influence of variousscenarios of operational risks on KACD activities.

In case of control failures the following measures will be executed:- Immediate inform the management, risk manager and auditor;- Assess the failure's scales;- Take measures including introduction of additional control procedures and responsible persons.

7.2.2 Key Controls

Adequate records are maintained by the KACD in order to facilitate the segregation of the depository’s assets/liabilities fromthose that are held by participants. Participants are required to segregate securities held for their own benefit from those thatthey hold on behalf of their clients. To do this they can open a single account and any number of sub-accounts. Should aparticipant’s single account be blocked for any reason, the securities held in the participant’s account on behalf of clients wouldbe accessible by the client and their creditors. Securities would not however be accessible by KACD’s creditors.

The KACD initially established two different electronic proprietary systems. One is for government securities and the second oneis for corporate securities. However these have since been united as one system.

All messages (files) are encrypted and signed with a digital signature. 92% of participants are connected to the proprietarysystem (Securities Settlement System).

All electronic messages between participants and the depository flow through KISC. Electronic links are controlled bypasswords, which must be changed regularly. Each user has a unique identifier and a lock-out facility is triggered after three ormore unsuccessful user ID attempts. Unauthorised access attempts are not logged and investigated.

Automated transaction processing allows participants connected to the system to send instructions and receive reports after the

26 of 39

instruction has been processed. Participants are provided with reports on the safekeeping of assets and transfers to and fromparticipants’ accounts. Correction of errors in the system is based on office memos approved by the Management Board orsupervisor of department.

All exchange trades automatically and electronically downloaded to the CSD system (not for OTC / Off-exchange trades). Paperinstructions are entered to the system using dual entry by operators and settled automatically. Electronic instructions are bothentered to the system and settled automatically. 4 out of 11 registrars are using the automated process of re-registeringsecurities between the registry and CSD.

The interface between the CSD and its participants is based on both SWIFT and proprietary system (non-SWIFT electronicmessage), including settlement instructions, settlement confirmations, transaction reports, statement and some corporate actionnotifications from KACD. SWIFT messages are accepted only from international clients.

The reports for After End-of-Day processing include:- account statement on financial instruments;- report on registered operations;- report on execution of instruction;- bank account statement.

Report on execution of instruction, debit or credit confirmation, monthly statements and reports on registered transactions aretransmitted automatically. All other reports are transmitted upon participant's request. Participants can also access historicaldata from the system, the data includes account statements and reports on registered operations. Electronic data is beingstored from 1997 (since the establishment of KACD). Clients can get electronic data for the last 90 days and no time restrictionsfor paper-based information. Data is also available on a real time basis on business days.

7.2.3 Physical/Building/Access Security

Access to the KACD facility is controlled by the use of an alarm, unarmed guards, reception staff and password controls. Alldepository staff are required to carry company identification cards at all times. Operational areas are equipped by access controlsystem, only authorised employees have access to operational areas. KACD employs a video surveillance system for key areaswith tapes retained indefinitely.

7.3 Established Documented Procedures

7.3.1 Scope

The procedures for cooperation with clients are fully described in Code of Rules. However, detailed instructions for staff are noton all processes. Head of department and each specialist within his/her duties, specified by job description, is responsible forthe maintenance of the procedures. Risk manager and internal auditor can give recommendations for development of/makingamendments to documents. In addition all KACD documents are legally examined by Legal Department. Furthermore, theMethodology and Development Department assists with the writing of procedures and ensure they are consistent withregulations.

7.3.2 Form

The manual procedures are paper versions, scanned copies are also published for access of staff and in KACD informationsystem and partially on website. New employees will be ensured to be familiar with procedures, their activities are supervisedby head of department.

7.3.3 Oversight

Procedures are reviewed if there is a process change, but not less than once a year. That said, there is no evidence that anestablished schedule of reviews is in place.

Any changes must to be approved by the Board of Directors and Committee for the Control and Supervision of the FinancialMarket and Financial Organisations of the National bank of Republic of Kazakhstan. After approval. KACD participants will beinformed of such changes within 15 days before the implementation date.

Errors are corrected based on notifications of participants or KACD employees involving the Management Board and the Boardof Directors (if necessary).

7.4 Operational Audit

27 of 39

7.4.1 Internal Audit

There is an internal audit department since 2010, which operates on the basis of annual audit plan containing the list ofoperations subject to internal audit during the year. Operational audit is included in the annual audit plan on the basis of risksanalysis. The audit including internal controls audit, financial audit and compliance audit, however, IT is not covered by internalaudit.

In 2011, 3 audits were performed with 43 recommendations. The recommendations are monitored by the department, thecompliance will be reported to Audit committee.

7.4.2 External Audit

The external auditor is Deloitte LLP. The last (also the only one as CSD is not committed to regular external audit) externaloperational audit (SAS 70 Type 2) was conducted in January 2011. The audit covered the depository activities and certain typesof banking operations.

Auditor provided recommendations on 47 identified shortcomings after preliminary stage of audit. Based on results of auditor'srecommendations, KACD has developed Plan on the recommendations within operational audit in compliance with SAS 70. Inaccordance with this plan, all recommendations were introduced by KACD that was confirmed by auditor under provision of finalreport. All shortcomings were eliminated by KACD in the final stage. Auditors' reports have been provided to the Board ofDirectors. Auditors can address directly to the Board of Directors.

Operational audit reports are not available to public which is limited by the agreement between KACD and the auditor. However,financial audit reports are published on KACD website.

7.4.3 Other Audits / Reviews

KACD has a single internal auditor responsible for planning and conducting annual audits and reports to the Board AuditCommittee. The internal auditor works independently from the external auditor.

The Internal auditor has no IT audit experience. Accordingly, the internal auditor can only audit about 66% of the identifiedprocess at the depository (that is 40 processes). On an annual basis, the auditor is able to complete 12 processes. A full cycle iscompleted in three to four years. KACD was seeking a second auditor with the necessary IT audit expertise to complement theinternal audits.

Operational Audit – Key Indicators

Risk Committee/Manager/Department exists: Yes

Internal Operational Audit: Yes

Internal Operational Audit Coverage: IT is excluded from internal audit

External Operational Audit Frequency: Every three years

External Operational Auditor Firm: Deloitte

External Operational Audit Coverage: SAS 70

Comments -

7.5 IT Operations

7.5.1 Systems Software / Database

Access to information system is based on password (Microsoft AD), access to software in information system is based onpassword (ORACLE database). Passwords are temporary (42 days; remembering depth is no less than 5; 3 unsuccessfulattempts of entering password – user account will be blocked). Only authorised individuals have access to the database (it isdefined in the job description), programmers do not have access to the database. System administrator blocks and unblocksuser accounts in Microsoft AD, database administrator blocks and unblocks user accounts Oracle.

Software used by KACD is developed and supported by KACD specialists. Communication terminal between KASE and KISC is

28 of 39

supported by specialists of KASE and KISC during business days and business hours (there is Agreement on support). SWIFTterminal is supported via SWIFT-Bureau KISC. KACD specialists also provide technical support to its participants.

Changes to software or creation of new software are regulated by internal documents. Changes to software are made based oninquiry of certain subdivision and requirements specification agreed with subdivisions and approved by supervisor. There are noseparate business analysts that provide a link between the business and the software developers. Within KACD the softwaredevelopers specify the detailed business requirements that a business analyst would typically do.

Separate testing line is used for tests (data base + software). Full testing is executed by employees of KACD departments.Changes into operational environment can be made only after testing is executed. Any changes are documented. It isimpossible to make changes to software in a live production environment. All changes to software are regulated by KACDinternal documents. For the last 3 years, there was not disruption caused by software changes.

7.5.2 Systems Hardware

IT equipment is replaced every 5 years (in practice but not a fixed policy) – the current equipment is 3 years old. Servers havebeen virtualised.

7.5.3 Network with Participants

-

7.5.4 Security and Resilience

Server room is equipped by access control system. Server room is accessible by using three keys:- The Head of System Administration Department has keys from the first key lock;- The Head of Information Systems Development Department has keys from the second key lock;- The Heads of System Administration Department and Information Systems Development Department have keys fromelectronic key lock.Keys from different key locks are kept in different vaults excluding access of unauthorised individuals.

For security purposes server room has the following security systems:- Temperature control;- Humidity control;- Smoke alarm;- Access control system;- Video control.

The machine room in the existing (new) primary site does not have standard fire prevention systems in place.

The following measures are taken in order to prevent IT fraud:- Delimitation of employees' access to different systems, defining access roles, passwords for access to IT systems;- Prohibition to use outside storage and data processing devices and connect these devices to information system andautomatic information system of KACD;- Usage of antivirus programs;- Dual entry of instructions to the system (two operators with different privileges enter the same instruction to the system);- Other measures of information security.

IT Operations – Key Indicators

Name of System: ARMDEPONT - proprietary system

Annual System uptime (%): -

CSD has back-up power generator at main site: Yes

CSD has uninterruptible power supply (UPS): Yes

Use multiple network providers: -

Penetration Testing undertaken < 24 months: None yet

29 of 39

7.6 Processing

7.6.1 System Automation

Trade information from KASE is processed automatically without manual intervention. Less than 0.5 % of accepted transactionsare accepted in paper and require manual processing. This is because KACD has an electronic link to NBK’s settlement accountsvia the KISC network. Linked transactions (such as repos) have their second leg component automatically settled on settlementdate.

The system allows users to set-up layers of authorisation for staff i.e. input trades, authorise trades. Errors identified in thesystem can only be corrected by written request to KACD.

There is however significant manual processing in corporate actions as instructions are mostly received in paper or fax form andinformation on foreign securities is distributed via fax (although received electronically via SWIFT from Euroclear andClearstream).

7.6.2 Straight-Through-Processing

Although some of KACD key processes are highly automated, in sensitive areas there is a significant amount of manualprocessing. There is no STP in corporate actions. SWIFT messages are not fully implemented. Apart from overseas payments,instructions and messaging are passed via fax, emails or physical correspondence.

Processing – Key Indicators

Number of Employees -

Types of Messages Used -

Proprietary -

SWIFT-format -

SWIFT Only for international clients

SWIFT messages used for

Settlement -

Reporting -

7.7 Reporting

7.7.1 Current Information

A report on execution of each instruction is sent immediately after the registration of the transaction.KACD provides the following reports to participants at the end of each business day: account statement on financialinstruments, report on registered operations, report on execution of instructions, bank account statement. All other reports haveto be requested. However, some basic reports (general statistics) can be obtained via KACD’s website. This is available togeneral public.

Participants can electronically download the report data/information to their own system and audit reports for user activity andaccess in the core functions participant use can be electronically requested and downloaded.Reports are received via the ARMDEPONET system.

KACD provides participants with a monthly electronic statement for reconciliation purposes. Participants can also request apaper statement on a monthly basis if required.

7.7.2 Historical Information

Participants can electronically access account statements and reports on registered operations for any 90-day period. Data back

30 of 39

to 1997 (date of KACD's establishment) can be requested.

Reporting – Key Indicators

Activity report available to participants online: Yes

CSD sends settlement/entitlement confirmation: Yes

Types of Report Available

CSD sends settlement/entitlement confirmation: Yes

Settlement Report Yes

Securities Borrowing and Lending Report N/A

Custody Report Yes

7.8 Disaster Recovery Procedures

7.8.1 Disaster Recovery Arrangements

KACD has disaster recovery procedures and a reserve system in place and maintains testing of that system on a regular basis(the reserve system is not a remote DR system). KACD also has procedures of restoration of activities in case of emergencies.However, there is no document defining working procedure between KACD and clients and other counterparties in case ofemergency. Although KACD conducts tests twice a year, none of the test involve the DR site of participants.

The procedures incorporate computer file backups, storing of data off-site, uninterruptible power supply (UPS) and firemanagement with clearly defined roles and responsibilities in the event of disaster recovery. The procedures are available forreview by participants. In the event of a failure it would take the depository approximately 1 to 2 days to resume operations ofthe primary system. System interruptions would be publicly announced to all related parties.

Each server is copied identically in order to substitute in case of breakdown of the main server. There are dual power supplies ineach server. There is a 15 minute delay in applying transactions to the back-up site. This could result in a loss in data in theevent of a move to the DRP.

External high speed disk drive RAID 5, RAID 1 connected to both servers (the main and backup) is used in order to store data.The disk drive has dual power supplies. Servers of automatic information system have dual power supplies. Data is mirrored inthe backup site on a daily basis. Database journal is mirrored every 15 minutes automatically after backup is finished. Additionalcopies of backups are placed in vault by KACD employee on a daily basis.

Data and software are backed up daily. KACD has back-up site although the back-up data is copied on the disks and storedoutside the main building in the vault of one local bank on a daily basis. KACD has a temporary backup site which allows totransfer all work from the main office. It takes up to 2 hours for the staff to get to backup site, and 1 - 5 hours in order torecovery data.

7.8.2 Disaster Recovery Site Details

KACD has a new DR site, 35 km from the main site. Although this distance is adequate in most cases of natural disasters andsocial unrest, the DR site might be affected in case of a severe earthquake.

The site has security cameras and guard and dual network access. No dual power supply but backup generator is place. Thesite has fuel autonomy for 10 days. There is also a damp control but no pest control. Staff can only access key areas accordingto their role. The DR site has insufficient fire extinguishing systems; currently, there is only one system and no redundancies arein place.

It is not possible to operate KACD information system and automatic information system out of KACD information systembecause there is no remote access to internal information system of KACD. Operation is possible only between the main office

31 of 39

and backup site. Backup site is monitored from the main office on a daily basis.

7.8.3 Disaster Recovery Test and Audit

KACD transfers its activities to the backup site for one business day twice a year. Testing can be conducted both during businessdays and non-business days.The full testing is conducted through transferring all activities to the backup site. The testingresults are also audited but not to be published to the public.

The DR test does not include participants' DR sites.

KACD has a recorded outage in November 2011, which occurred a 20-minute downtime.

7.9 Business Continuity Procedures

7.9.1 Business Continuity Arrangements

KACD has a centrally-managed BCP. KACD also plans to form management system of business continuity in accordance with BS25999. The BCP procedure was approved by the decision of the Management Board on 13 November 2009 and all employeeswere informed.

7.9.2 Business Continuity Site Details

Currently, the BCP is in the same site as the DRP. The BCP facility is set-up to cater for about 25 staff and has been tested. Thesite of the BCP is also set-up for use by KASE which potentially could also be used by KACD if not needed by KASE.

Each desk has a CPU. There is no allocated positions for staff if there was a need to operate from the BCP site.

7.9.3 Business Continuity Procedures Test and Audit

-

Disaster Recovery / Business Continuity – Key Indicators

Disaster Recovery

Disaster Recovery Site Yes

Distance from main site 35 kms

DRP Testing Yes

Frequency of Tests Semi annual

DRP Audit Yes

Business Continuity

Disaster Recovery Site Yes

Distance from main site 35 km

BCP Testing Yes

Frequency of Tests Semi-annual

BCP Audit Yes

7.10 Human Resources

7.10.1 Training

KACD employees have advanced training on various themes depending on duties are at KACD's expense. Market regulator

32 of 39

imposes requirements on work experience and education for management board, risk manager, internal auditor and chiefaccountant of KACD. Training is conducted externally, although some courses are conducted by contractors in-situ.

Training requirements are mapped to the need of KACD and according to job description. These plans are then approved by theCEO. The training budget is less than 1% KACD's overall budget.

7.10.2 Policies

KACD also has the policies that cover:- Security screening for new staff;- Discipline procedures;- Career and succession planning;- Appointment procedures.

Human Resources - Key Indicators

Staff Turnover: -

Budget / Actual Spending Ratio: -

33 of 39

8.0 Governance and Transparency Risk RATING: A+

8.1 Summary

KACD has reasonable board arrangements with an independent chairman and representatives from shareholders and the industry.The board is responsible for risk management and there is an audit and risk management at the board. The Board of Directorsreviews the performance standards of the Management Board against set performance targets. A user group has recently beencreated to discuss developments and changes. Some corporate and statistical information is provided on the website.

8.2 Board arrangements

8.2.1 Board Structure

Managerial bodies of Central Depository consist of: superior body - General meeting of shareholders, management body - Boardof Directors, and executive body - Company Management.

The General meeting of shareholders of the Central Depository elects the Board of Directors, which have to consist of an oddquantity of members not less than 3 and no more 13.The Board of directors consists of representatives of the shareholders of Central Securities Depository, the Committee for thecontrol and supervision of financial market and financial organizations of the National Bank of Kazakhstan and the President ofKACD.

8.2.2 Board Responsibilties and Performance

The board is responsible for risk management, and general management which includes approving strategy, there is a StrategyCommittee – 4 members of the board. Furthermore, the Board approves rule changes and reviews proposals for regulatorychanges, parovides Audit oversight - there is an audit committee composed of 3 board members and an external expert,executes risk oversight and decides on remuneration of KACD Management Board.

8.2.3 Board Relationships

-

8.3 Establishment of risk management

8.3.1 Audit and Risk Management Commitees

KACD has a risk manager and a risk committee at the board.The Audit Committee, which comprises 3 independent directors, is responsible for the assessment of internal control and riskmanagement systems at KACD.

The Internal Auditor reports to the Board. A written report is delivered annually and quarterly reports are provided to the AuditCommittee. A record is maintained of any occurrences of risk and breach of risk limits or where losses have been made. Suchevents are reported to the Board when they occur.

8.3.2 Commitee Performance

The Risk manager provides quarterly reports to the Board including the results of the quarterly stress testing. A risk matrix hasbeen structured attempting to measure the operational risk exposures faced by KACD.

The Board receives the following quarterly risk reports:-Legal risk report-Reputation risk report-Report on quantity of risks and size of damage from them

Stress testing reports measure price risk, interest rate risk, foreign exchange risk and operational risk.

8.4 Management Performance

8.4.1 Management Structures

34 of 39

The Board of Directors reviews the performance standards of the Management Board against set performance targets.

There are quarterly performance assessments of management that are signed off by the President of KACD.KACD has a Code of Conduct for all employees.

8.4.2 Management Communication

Management Board meetings are held at least once a month.Unsatisfactory performance is dealt with through reduced bonuses or termination of contract.

8.5 User Group Arrangements

8.5.1 User Group Structures

A participant user group was created in March 2013 to discuss market developments and changes at KACD.

8.5.2 User Group Particiapation

Participants' interests are represented through the Financial Institution’ Association. This association spans the financial sectorand represents the market. KACD is a member and is both reactive and pro-active in its dealings.

For significant projects KACD sends questionnaires for market consultation. Also, the participant user group is used to discussfuture developments.KACD has staff responsible for participant relationships.

8.6 Disclosure of Corporate Information

8.6.1 Public Information Management

The KACD website is available in Kazakh, Russian and English as an option for foreign investors.The site appears to have various operational documents and statistics, news and annual reports and appears to be reasonablywell maintained. The fee structure is also available. KACD does not provide information on the relevant capital market laws onits website.

8.6.2 Response to Regulatory Information Requirements

-

8.7 Disclosure of Statistical Information

8.7.1 Statistical Information Management

KACD has an English website that provides information on transactions and assets under custody. A variety of statistics areprovided including holdings (split by resident/non-resident), monthly transaction volumes, issue and issuer info, ISIN info, andresults of NBK auctions.

The statistical information does not appear easy to reconcile. There is no information on fail rates and no risk based informationon stress testing provided on the website.

Historical information is available on request and can be sent in electronic or hard copy form.

8.7.2 Data Mining Capability

Data mining capabilities are unknown.

General Key Indicators Central Securities Depository of theRepublic of Kazakhstan

About the Depository Matching

35 of 39

Name and AddressCentral Securities Depository JSCMicro-district "Samal" -1, House 28Almaty, 050051Republic of Kazakhstan

Websitewww.kacd.kz

Is use of the CSD required?

Settlement Safekeeping

By Law Yes Yes

By Market Practice Yes Yes

Domestic eligible participants25 banks and 23 brokerage companies

Foreign eligible participants8 foreign participants (4 depositories, 3 banks and 1investment company)

OwnershipThe National Bank of the Republic of Kazakhstan,Kazakhstan Stock Exchange, 13 second tier banks and 8broker organisations.

Segregation of Assets at the Depository

Depository assets from participantsYes

Participant assets from clientsYes

Participant Eligibility Criteria

Minimum Capital StandardsYes

Financial Aspects

Ability to raise capital/borrowYes

Committed lines of credit in placeNo

Pre-matching servicesNo

Matching servicesYes

Clearing

Clearing servicesYes

Securities Settlement

Book-entry settlementYes

Fails managementYes

Cash Settlement

Internal cash settlementYes

Stock Lending

Securities lending for fails coverageNo

Asset Servicing

NotificationsYes

Securities processingYes

Paying agentYes

Central registrarYes

Proxy voting servicesNo

36 of 39

Publish audit financialsYes

Take lien on stock heldNo

Central Bank GuaranteeNo

Other third party guaranteeNo

Third party insuranceNo

Safeguard Facilities

Offsite BackupPlanned

Disaster Recovery

Disaster Recovery PlanYes

Back-up power generatorYes

UPS (Uninterruptible power supply)Yes

CommentsDR and BCP sites are located in the same premises, 35 kmfrom the main site.

Communications

Electronic communicationsYes

Reporting Services

Electronic reportingYes

Reporting of every movementYes

Regular statement of securities depositedYes

DefinitionsPublic Rating. This assessment has been compiled from information provided by third parties and the CSD and has been verified byThomas Murray analysts during an on-site visit to the CSD. The report has been reviewed by the CSD. The ratings that have beenassigned to the risks that are reviewed in the report have been determined by Thomas Murray analysts and approved by theThomas Murray Rating Board. The ratings have been assigned in accordance with the process outlined in the publishedmethodology as developed by Thomas Murray and on the basis of information confirmed by Thomas Murray analysts during a sitevisit to the CSD.

37 of 39

RISK EXPOSURE DEFINITIONS

Asset Commitment Risk - The period of time from when control of securities or cash is given up

until receipt of countervalue. This risk concerns the time period during which a participant’s assets,

either cash or stock, are frozen within the CSD and payment system pending final settlement of the

underlying transaction(s). Following settlement, the risk period is extended until the transfer of

funds and stock becomes irrevocable. It excludes any periods when assets, cash or stock, are

committed to a market participant including brokers, banks and custodians, not caused by CSD

processing.

Liquidity Risk - The risk that insufficient securities and or funds are available to meet

commitments; the obligation will be covered some time later. This is where for certain technical

reasons (e.g., stock out on loan, stock in course of registration, turn round of recently deposited

stock is not possible) one or both parties to the trade has a shortfall in the amount of funds (credit

line) or unencumbered stock available to meet settlement obligations when due. These shortfalls

may lead to settlement ‘fails’ but do not normally lead to a default.

Counterparty Risk - The risk that a counterparty (i.e., a participant) will not settle its obligations

for full value at any time. This is simply the total default of a direct participant of the CSD. This is

the event when a participant is unable to meet its financial liability to other participants. This risk

only goes as far as direct participants of the CSD and excludes clients of direct participants that

default on liabilities to such participants, even if such a default should systemically cause the direct

participant to subsequently default.

Asset Safety Risk. The risk that assets held in custody at the CSD may be lost or

misappropriated, either due to a default or an omission, misuse, or breakdown of controls (legal,

operational or other). The CSD should protect against the risk of loss of assets of the participant or

their clients due to an insolvency, the CSD’s negligence, misuse of assets, fraud, poor

administration, inadequate recordkeeping or other failure to protect a participant’s assets. Asset

segregation at the CSD and/or the domestic custodian by account structure and naming

convention, assertion of liens, form and nature of securities (e.g. dematerialised, physical, bearer,

registered), certain key concepts in local law (e.g. recognition of nominees), reconciliation of

holdings, vault controls and the nature and placing of client cash deposits, are all factors taken into

consideration in the assessment.

Asset Servicing Risk - The risk that a participant may incur a loss arising from missed or

inaccurate information provided by the depository, or from incorrectly executed instructions, in

respect of corporate actions and proxy voting. This risk arises when a participant places reliance on

the information a depository provides or when the participant instructs the depository to carry out

an economic transaction on its behalf. If the depository fails either to provide the information or to

carry out the instruction correctly then the participant may suffer a loss for which the depository

may not accept liability. The depository may provide these services on a commercial basis, without

statutory immunity, or it may provide the service as part of its statutory role, possibly with some

level of protection from liability. This risk is likely to become much higher when international

securities are included in the service.

Financial Risk - The ability of the CSD to operate as a financially viable company. This risk

concerns the financial strength of the depository and if its financial resources are sufficient to meet

the on-going operation of the organisation. This risk also includes where the CSD may act as

central counterparty, or otherwise acts in a Principal capacity.

Operational Risk - The risk that deficiencies in information systems or internal controls, human

errors or management failures will result in losses. The risk of loss due to breakdowns or

weaknesses in internal controls and procedures. Internal factors to be considered in the

assessment include ensuring the CSD has formalised procedures established for its main services.

The CSD should have identified control objectives and related key controls to ensure operation and

proper control of established procedures. Systems and procedures should be tested periodically.

There should be external audit processes in place to provide third-party audit evidence of the

adequacy of the controls.

Governance and Transparency - The risk that a participant may incur a loss arising from the

depository not acting according to its rules and regulations or not providing full and accurate

information on its activities and the activities of the market. This risk arises when a participant

places reliance on the depository to act in a fit and proper manner according to its rules and

regulations and to provide full and accurate disclosure of information about itself and the

depository and settlement activities of the market. There is an obligation on the management and

the directors to ensure that the depository is operated according to high international management

standards which includes ensuring that information and data relating to its activities and the

activities of the market it represents are freely available to participants and the public in a timely

manner. If the depository fails either to provide full and accurate information or to strictly abide by

its own rules and regulations, then the participant and public may be misled and may suffer a loss

for which the depository may not accept liability.

RATING SCALE

AAA Extremely low risk

AA+ Very low risk

AA

AA-

A+ Low risk

A

A-

BBB Acceptable risk

BB Less than acceptable risk

B Quite high risk

CCC High risk

N/R No rating has been given due toinsufficient information

Contact:

Thomas Murray Depository Service

Horatio House,

77 – 85 Fulham Palace Road

LONDON,

W6 8JA

Tel: +44 (0) 20 8600 2300

Fax: +44 (0) 20 8741 7468

E-mail: depositoryservice@thomasmurray.com

Web-site: www.thomasmurray.com

Names of analysts available on request.

Copyright © 2013 Thomas Murray Ltd.

Reproduction in whole or in part prohibited except by permission. All rights reserved. The services and analysis provided by Thomas Murray are provided on an "as is"

38 of 39

basis and Thomas Murray make no representations or warranties, express or implied, as to the accuracy, adequacy or completeness of its analysis or results to be

obtained from accessing and using this report (or any information included therein), including without limitation, any warranties of merchantability or fitness for any

particular purpose or use. Neither Thomas Murray nor their affiliates shall be liable to any user or anyone else for any inaccuracy, error or omission, regardless of cause,

in this report or for any damages resulting therefrom. In no event shall Thomas Murray have any liability for lost profits or for indirect, special, punitive or consequential

damages, even if advised of the possibility of such damages. Thomas Murray shall have no liability to any third party arising from or related to this report. Neither this

report nor any component of the service provided by Thomas Murray is a rating, endorsement or guarantee of any Depository or its financial strength or a

recommendation to enter into any agreement with any Depository. Thomas Murray relied on information provided by third parties believed to be accurate and reliable but

due to the possibility of human or mechanical error, Thomas Murray can not guarantee the accuracy of any such information.

This report is updated as and when new and additional information becomes available. A full annual review exercise is alsoconducted with the assistance of support banks and the depository itself. The latest full review was performed on (Month/Year ).

39 of 39