Certification Authority Regulation of the A3 Ecosystem

Introduction

This Regulation of the Certification Authority of the A3 ecosystem (hereinafter referred to as the “Regulation”) defines the procedure for identity verification (KYC), issuance and use of electronic digital signatures (EDS), as well as issuance and use of digital powers of attorney within the A3 ecosystem.

This Regulation is an integral part of the User Agreement and the License Agreement for the right to use the software of the A3 ecosystem.

1. General Provisions

1.1. This Regulation has been developed taking into account the provisions of the Civil Code of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan “On Electronic Document and Electronic Digital Signature” dated January 7, 2003 No. 370-II (hereinafter the “EDS Law”), the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” dated May 21, 2013 No. 94-V (hereinafter the “PD Law”), the Law of the Republic of Kazakhstan “On Informatization” and other regulatory legal acts of the Republic of Kazakhstan.

1.2. The Certification Authority of the A3 ecosystem (hereinafter the “Certification Authority”, “CA”) is a component of the Platform that performs identification and verification of Users, issuance of electronic digital signatures and digital powers of attorney for use within the A3 ecosystem.

1.3. EDS issued by the Certification Authority are intended exclusively for use within the A3 ecosystem and are not registration certificates issued by an accredited certification authority of the Republic of Kazakhstan within the meaning of the EDS Law. The A3 ecosystem EDS ensures confirmation of authorship and integrity of electronic documents in the electronic document management system (EDM) of the Platform and is recognized by the parties within the framework of contractual relations.

1.4. The parties to contractual relations in the A3 ecosystem recognize the legal force of electronic documents signed with the EDS of the Certification Authority, in accordance with paragraph 3 of Article 7 of the EDS Law, which provides for the possibility of using EDS on the basis of agreement between the parties.

1.5. This Regulation applies to all Users of the A3 ecosystem using the services of the Certification Authority.

2. Terms and Definitions

2.1. Certification Authority (CA): a software and hardware complex within the A3 ecosystem that performs the functions of User identification, generation and management of EDS keys, issuance and revocation of EDS certificates, as well as issuance of digital powers of attorney.

2.2. KYC (Know Your Customer): a procedure for identifying and verifying the identity of a User, conducted in accordance with this Regulation.

2.3. Verification: the process of confirming the authenticity of data about the identity of a User (individual) or a business entity (sole proprietor, legal entity) using documents and biometric data.

2.4. Verification Provider: a third-party service Didit (or another service designated by the Operator) that performs technical verification of documents and biometric data of an individual on behalf of the Operator.

2.5. Electronic Digital Signature (EDS): a set of electronic digital symbols created by the EDS tools of the Certification Authority and confirming the authenticity of an electronic document, its ownership and integrity of content within the A3 ecosystem.

2.6. Private EDS Key: a sequence of electronic digital symbols known only to the EDS owner and intended for creating an EDS using EDS tools.

2.7. Public EDS Key: a sequence of electronic digital symbols available to any user of the A3 ecosystem and intended for verifying the authenticity of an EDS.

2.8. EDS Certificate: an electronic document issued by the Certification Authority confirming that a public EDS key belongs to a specific owner.

2.9. EDS Owner: an individual, sole proprietor, or legal entity in whose name the EDS certificate is issued.

2.10. Digital Power of Attorney: an electronic document certified by the EDS of the principal and issued through the Certification Authority, granting a specified individual (attorney-in-fact) the authority to act on behalf of the principal within the A3 ecosystem.

2.11. Principal: an individual, sole proprietor, or legal entity issuing a digital power of attorney on their behalf.

2.12. Attorney-in-Fact: an individual to whom a digital power of attorney has been issued and who is authorized to act on behalf of the Principal in the A3 ecosystem.

2.13. Operator: a legal entity, the owner and operator of the A3 ecosystem and the Certification Authority.

3. Verification Procedure (KYC)

General provisions of verification

3.1. Passing verification is a mandatory condition for obtaining an EDS, issuing digital powers of attorney, and using the electronic document management (EDM) service of the A3 ecosystem. In the future, verification may be extended to other services of the A3 ecosystem.

3.2. Verification is performed once. Verification results are valid for the entire duration of the User's account, unless otherwise provided by this Regulation.

3.3. The Operator has the right to request re-verification if there are reasonable suspicions of inaccuracy of previously provided data, when User data changes, and at the request of authorized state bodies.

Verification of individuals

3.4. Verification of an individual is carried out using the Verification Provider (Didit service) and includes the following stages:

a) providing an identity document (passport, identity card of a citizen of the Republic of Kazakhstan, or another document accepted by the Verification Provider);

b) verification of biometric data (matching the User's face with the photo in the document using a liveness check);

c) automatic verification of the authenticity and validity of the document by the Verification Provider;

d) formation of the verification result (confirmed / rejected).

3.5. Upon successful verification, the Platform saves: the User's full name, date of birth, document number and type, country of issuance, verification date, and unique verification identifier. Biometric data is processed by the Verification Provider and is not stored on the Operator's servers.

3.6. The User gives explicit consent to the transfer of personal data and biometric data to the Verification Provider for identification purposes. Data processing by the Provider is carried out in accordance with its own privacy policy, with which the User must familiarize themselves before starting verification.

3.7. In case of rejection of verification, the User is notified of the reason for rejection (poor image quality, data mismatch, expired document, etc.) and has the right to repeat the procedure.

Verification of sole proprietors

3.8. For verification of a sole proprietor, the User must:

a) pass verification as an individual in accordance with paragraphs 3.4-3.7;

b) upload to the Platform documents confirming the registration of the sole proprietorship: certificate (notification) of state registration, or an extract from the register, or a similar document from the country of registration;

c) provide the TIN (or similar identifier of the country of registration) and other data requested by the Platform.

3.9. The Operator verifies the provided sole proprietor documents. The verification period is no more than 5 (five) business days. The Operator has the right to request additional documents.

Verification of legal entities

3.10. For verification of a legal entity, the User must:

a) pass verification as an individual (director or authorized representative) in accordance with paragraphs 3.4-3.7;

b) upload to the Platform the following documents:

• certificate of state registration of a legal entity (or a similar document from the country of registration);

• charter (memorandum of association) or an extract from the register of legal entities;

• a document confirming the authority of the director (appointment order, protocol, founder's decision);

• power of attorney, if registration is carried out by an authorized representative;

c) provide the BIN (or similar identifier), full name of the organization, and other data requested by the Platform.

3.11. The Operator verifies the provided legal entity documents. The verification period is no more than 7 (seven) business days. The Operator has the right to request additional documents and conduct additional checks.

Refusal of verification

3.12. The Operator has the right to refuse verification in the following cases:

a) provision of knowingly false, forged, or invalid documents;

b) mismatch of biometric data with the identity document;

c) grounds to believe that verification is being carried out for fraudulent purposes;

d) inability to confirm data by technical means of the Verification Provider;

e) other grounds provided by the legislation of the Republic of Kazakhstan.

3.13. The decision to refuse verification is final. The User has the right to appeal the refusal by sending a written request to the Operator.

4. Electronic Digital Signature (EDS)

General provisions of EDS

4.1. The Certification Authority issues EDS for use exclusively within the A3 ecosystem. The A3 ecosystem EDS is not an analogue of an EDS issued by an accredited certification authority of the Republic of Kazakhstan (NCA RK) and is not used outside the A3 ecosystem.

4.2. The A3 ecosystem EDS is recognized by the parties to contractual relations within the Platform on the basis of this Regulation and the User Agreement. By accepting this Regulation, the User agrees to recognize the legal force of electronic documents signed with the A3 ecosystem EDS.

4.3. The A3 ecosystem EDS ensures:

a) confirmation of authorship of the electronic document (identification of the signatory);

b) confirmation of the integrity of the electronic document (immutability of content after signing);

c) impossibility of the signatory's denial of the fact of signing the electronic document (non-repudiation).

Conditions for obtaining EDS

4.4. To obtain an EDS, the User must pass verification in accordance with Section 3 of this Regulation.

4.5. The User has the right to obtain an EDS for:

a) themselves as an individual: based on successful verification of the individual;

b) their sole proprietorship: based on successful verification of the individual and verification of the sole proprietorship;

c) their organization (legal entity): based on successful verification of the individual (director or authorized representative) and verification of the legal entity.

4.6. A separate key pair (private and public) is generated and a separate EDS certificate is issued for each entity (individual, sole proprietor, organization).

Key generation and transfer

4.7. Key pair generation (private and public key) is performed by the Certification Authority using cryptographic algorithms that ensure a sufficient level of protection.

4.8. Following key pair generation, the User receives a private key container file in .pfx (.p12) format, protected by a password set by the User. The container file contains the private EDS key and the EDS certificate with the public key.

4.9. The private EDS key is not stored on the Operator's servers. After transferring the container file (.pfx/.p12) to the User, the private key is deleted from the Certification Authority's systems. The Operator does not possess copies of Users' private keys and has no technical capability to recover a private key.

4.10. The User independently bears full responsibility for storing the container file (.pfx/.p12) and the password to it. The Operator bears no responsibility for loss, damage, or compromise of the container file caused by the User's fault.

4.11. In case of loss of the container file (.pfx/.p12) or the password to it, recovery of the private key is impossible. The User must:

a) immediately submit a request to revoke the current EDS certificate;

b) initiate the issuance of a new EDS certificate with the generation of a new key pair.

4.12. The User is prohibited from:

a) transferring the container file (.pfx/.p12) and/or the password to it to third parties;

b) storing the container file in open access (public cloud storage without encryption, publicly accessible directories, etc.);

c) using simple or easily guessable passwords to protect the container.

4.13. The public EDS key is included in the EDS certificate and is available for signature verification by any user of the A3 ecosystem.

EDS Certificate

4.14. The EDS certificate contains:

a) a unique certificate serial number;

b) the name of the Certification Authority (A3 ecosystem);

c) the full name of the owner (for individuals and sole proprietors) or the name of the organization (for legal entities);

d) the owner's identifier (TIN, BIN, or other);

e) the public EDS key;

f) the certificate validity period;

g) information about usage restrictions (A3 ecosystem only).

4.15. The EDS certificate validity period is 1 (one) year from the date of issuance, unless otherwise determined by the Operator. Certificate renewal is carried out upon the owner's request, subject to the validity of verification, and involves the generation of a new key pair and issuance of a new container file (.pfx/.p12).

Use of EDS

4.16. EDS is used for signing electronic documents in the A3 ecosystem services, including but not limited to: electronic document management (EDM), document approval, contract execution, acceptance certificates, and other legally significant actions within the Platform.

4.17. To sign a document, the User uploads the container file (.pfx/.p12) and enters the password to it. Signing is performed on the User's side (in the browser or client application). The private key is not transmitted to the Operator's servers.

4.18. An electronic document signed with the A3 ecosystem EDS is considered signed by the owner of the corresponding EDS certificate and is recognized as equivalent to a document signed with a handwritten signature, within the framework of relations between users of the A3 ecosystem.

4.19. The User bears full responsibility for all actions performed using their EDS, including cases where the container file (.pfx/.p12) was transferred to third parties or compromised through the User's fault.

Suspension and revocation of EDS certificate

4.20. The EDS owner has the right at any time to submit a request to revoke their certificate through the personal account. Revocation takes effect immediately upon confirmation of the request.

4.21. The Operator has the right to suspend or revoke an EDS certificate:

a) at the owner's request;

b) upon discovery of private key compromise (including loss of the container file .pfx/.p12 or its transfer to third parties);

c) upon detection of inaccuracy of data on the basis of which the certificate was issued;

d) upon blocking of the User's account;

e) by court decision or at the request of an authorized state body;

f) upon expiration of the certificate;

g) upon cessation of the Certification Authority's activities.

4.22. Documents signed with EDS before the moment of certificate revocation retain their legal force within the A3 ecosystem.

4.23. In case of compromise or suspicion of compromise of the private key (loss of the container file, suspicion of copying by third parties, loss of password with grounds to believe that the password has become known to third parties), the User must immediately submit a request to revoke the certificate and notify the Operator. Until the moment of revocation, responsibility for actions performed using the EDS lies with the certificate owner.

5. Digital Powers of Attorney

General provisions

5.1. A digital power of attorney of the A3 ecosystem is an electronic document certified by the EDS of the Principal, granting the Attorney-in-Fact (individual) certain authority to act on behalf of the Principal within the A3 ecosystem.

5.2. A digital power of attorney is valid exclusively within the A3 ecosystem and has no legal force outside the Platform, unless the parties have agreed otherwise.

5.3. The rules on power of attorney provided for in Chapter 4 of the Civil Code of the Republic of Kazakhstan (Articles 167-170 of the Civil Code of RK) apply to digital powers of attorney of the A3 ecosystem to the extent not inconsistent with this Regulation and the technical features of the Platform.

Principal

5.4. The Principal may be:

a) an individual: acting on their own behalf;

b) a sole proprietor: acting on behalf of their sole proprietorship;

c) a legal entity: represented by the director or another authorized representative.

5.5. To issue a digital power of attorney, the Principal must:

a) pass verification of the appropriate level (individual, sole proprietor, or legal entity);

b) have a valid EDS certificate issued by the Certification Authority.

Attorney-in-Fact

5.6. The Attorney-in-Fact may only be an individual registered on the Platform.

5.7. The Attorney-in-Fact must pass verification as an individual in accordance with Section 3 of this Regulation before accepting the power of attorney.

5.8. The Attorney-in-Fact has the right to accept or reject a digital power of attorney through the personal account. The power of attorney takes effect from the moment of its acceptance by the Attorney-in-Fact.

Content of digital power of attorney

5.9. A digital power of attorney contains:

a) a unique power of attorney identifier;

b) information about the Principal (full name / organization name, TIN / BIN or other identifier);

c) information about the Attorney-in-Fact (full name, identifier);

d) a list of the Attorney-in-Fact's authorities (specific actions, services, document types);

e) the power of attorney validity period;

f) indication of the right or prohibition of sub-delegation;

g) date and time of issuance;

h) the Principal's EDS.

Authorities of the Attorney-in-Fact

5.10. The Principal independently determines the list of the Attorney-in-Fact's authorities from among the actions available on the Platform, including but not limited to:

a) signing electronic documents on behalf of the Principal;

b) document approval;

c) managing subscriptions and services;

d) access to certain sections of the Principal's account;

e) other actions provided for by the Platform's functionality.

5.11. The Attorney-in-Fact has the right to perform only those actions that are explicitly specified in the power of attorney. Actions beyond the specified authority have no legal force.

Validity period and termination of power of attorney

5.12. The validity period of a digital power of attorney is set by the Principal and may not exceed 3 (three) years. If the period is not specified, the power of attorney is valid for 1 (one) year from the date of issuance, in accordance with Article 168 of the Civil Code of RK.

5.13. A digital power of attorney terminates:

a) upon expiration of the validity period;

b) upon revocation of the power of attorney by the Principal (at any time through the personal account);

c) upon the Attorney-in-Fact's refusal of the power of attorney;

d) upon revocation of the Principal's EDS certificate;

e) upon blocking of the Principal's or Attorney-in-Fact's account;

f) upon liquidation of the legal entity: Principal;

g) upon termination of the sole proprietor: Principal's activities;

h) in case of death of the Principal (individual) or Attorney-in-Fact, as well as recognition of them as incapacitated.

5.14. Revocation of the power of attorney takes effect immediately. Actions of the Attorney-in-Fact performed before the moment of revocation retain their legal force within the A3 ecosystem.

5.15. Sub-delegation is permitted only if it is explicitly provided for in the power of attorney. Sub-delegation is formalized as a separate digital power of attorney signed by the EDS of the original Attorney-in-Fact.

6. Processing of Personal Data and Biometric Data

6.1. Within the framework of the Certification Authority's operation, the Operator processes the following categories of data:

a) personal data: full name, date of birth, identity document number and type, TIN/BIN, country of residence, contact information;

b) biometric data: facial image of the User transmitted to the Verification Provider for liveness check;

c) documents of sole proprietors and legal entities: registration certificates, charters, orders, powers of attorney;

d) technical data: data on EDS certificates, activity logs, dates and times of operations.

6.2. The legal basis for processing is the User's consent (Article 8 of the PD Law), as well as the necessity of contract performance (Article 7 of the PD Law).

6.3. Biometric data is transferred to the Verification Provider (Didit) exclusively for identification purposes. The Operator does not store biometric data on its servers. The Verification Provider processes data in accordance with its own privacy policy.

6.4. The User gives separate explicit consent to the processing of biometric data when undergoing verification. Without such consent, verification cannot be carried out.

6.5. Documents of sole proprietors and legal entities uploaded to the Platform are stored in a secure storage facility and are used exclusively for the purposes of verification and ensuring the functioning of the Certification Authority.

6.6. The Operator ensures the protection of personal data with organizational and technical measures in accordance with the PD Law and accepted information security standards.

6.7. The retention period for personal data processed within the framework of the Certification Authority is the entire period of the User's account and 5 (five) years after its deletion or blocking, unless a longer period is established by legislation.

7. User Obligations

7.1. The User is obliged to:

a) provide accurate, complete, and up-to-date data during verification;

b) immediately notify the Operator of changes to data provided during verification (document change, change of organization name, etc.);

c) ensure the confidentiality of access to their account and not transfer account credentials to third parties;

d) ensure safe storage of the container file (.pfx/.p12) and the password to it; not transfer the container file and/or password to third parties;

e) immediately notify the Operator of compromise or suspicion of compromise of the private key (loss of container file, unauthorized copying, loss of password);

f) immediately submit a request to revoke the EDS certificate upon loss of control over the container file (.pfx/.p12);

g) use EDS and digital powers of attorney exclusively within the A3 ecosystem and in accordance with this Regulation;

h) familiarize themselves with the privacy policy of the Verification Provider (Didit) before undergoing verification.

8. Liability

8.1. The User bears full responsibility for:

a) the accuracy of data provided during verification;

b) safe storage of the container file (.pfx/.p12) and the password to it;

c) all actions performed using their EDS, including actions performed by third parties in case of loss or transfer by the User of the container file (.pfx/.p12) and/or password, until the moment of certificate revocation;

d) actions of the Attorney-in-Fact performed on the basis of a digital power of attorney issued by the Principal, within the specified authority;

e) the consequences of providing knowingly false data during verification.

8.2. The Operator bears no responsibility for:

a) losses caused by loss, damage, or compromise of the container file (.pfx/.p12) through the User's fault;

b) impossibility of recovering the private key upon loss of the container file or password to it;

c) actions of the Attorney-in-Fact performed within the authority specified in the digital power of attorney;

d) actions and decisions of the Verification Provider (Didit), including refusal of verification for technical reasons of the Provider;

e) losses caused by untimely notification of key compromise;

f) impossibility of using the A3 ecosystem EDS outside the Platform.

8.3. The Operator ensures reasonable technical and organizational protection measures for the Certification Authority, but does not guarantee the absolute impossibility of unauthorized access caused by circumstances beyond the Operator's control.

8.4. The Operator's liability is limited in accordance with the terms of the License Agreement and the User Agreement.

9. Certification Authority Operations Log

9.1. The Certification Authority maintains an operations log that records:

a) the fact and result of verification of each User;

b) issuance, renewal, and revocation of EDS certificates;

c) each instance of signing an electronic document with EDS (date, time, document identifier, certificate identifier);

d) issuance, acceptance, revocation, and expiration of digital powers of attorney;

e) actions of Attorneys-in-Fact performed on the basis of digital powers of attorney.

9.2. Operations log records are stored for at least 5 (five) years and may be used as evidence in dispute resolution.

9.3. The User has the right to request an extract from the operations log regarding their actions by submitting a request through the personal account or by written request to the Operator.

10. Suspension and Cessation of the Certification Authority

10.1. The Operator has the right to suspend the operation of the Certification Authority for technical maintenance with prior notification to Users at least 48 (forty-eight) hours in advance.

10.2. In the event of a decision to cease the activities of the Certification Authority, the Operator:

a) notifies Users at least 90 (ninety) calendar days in advance;

b) ensures the possibility of exporting signed electronic documents;

c) ensures storage of the operations log for 5 (five) years after the cessation of the CA;

d) revokes all valid EDS certificates on the date of cessation.

10.3. Documents signed with EDS before the cessation of the Certification Authority retain evidentiary value provided that operations log records are available.

11. Final Provisions

11.1. This Regulation takes effect from the moment of its publication on the Platform.

11.2. The Operator has the right to amend this Regulation with prior notification to Users at least 15 (fifteen) calendar days in advance.

11.3. Continued use of the Certification Authority's services after the amendments take effect constitutes the User's agreement with the new version of the Regulation.

11.4. In case of conflicts between this Regulation and the User Agreement regarding the Certification Authority, this Regulation shall prevail.

11.5. Issues not regulated by this Regulation shall be resolved in accordance with the User Agreement, the License Agreement, and the legislation of the Republic of Kazakhstan.