Digital Security. How to protect your data and how compliance helps businesses

Amina Akhmetshina, compliance/AML specialist at the payment organization Paspay, @paspay.kz

About Me

I graduated from Buketov Karaganda State University with a degree in Law and hold a Master’s degree in Jurisprudence. Before joining Paspay, I worked for five years in a payment organization. Initially, I was looking for a position as a legal assistant, but during the interview, I was offered a chance to try my hand at compliance. At that time, I didn’t know what compliance entailed, so this experience was new and interesting for me.

About Compliance

Compliance is adherence to the requirements and laws established by regulators. Regulators can be not only government bodies but also other supervisory companies. The task of compliance is to prevent and avoid non-compliance with the law. My main role at Paspay is to ensure that we comply with the rules of the Financial Committee, as we deal with electronic payments.

We are subject to the Financial Monitoring Committee and the National Bank. We identify potential problems and risks, which helps avoid fines and sanctions. The principle here is simple: money saved is money earned, and this works excellently in compliance.

A practical example: one company providing visa support wanted to use our payment services. However, during the verification process, it turned out that they assisted migration to countries with military conflicts. This created a risk of financing terrorism and other offenses. My task was not only to refuse cooperation but also to justify this decision to management, as violations of the laws of the Republic of Kazakhstan and international norms could lead to serious consequences—from financial losses to the revocation of the license.

Thus, compliance helps protect the business from risks that could threaten its existence.

How to Protect Personal Data

The most important thing is not to disclose confidential data. Such data includes phone numbers, card numbers, expiration dates, and CVV codes. We do not share this information with anyone and do not follow suspicious links, for example, in WhatsApp. If messages are not from an official source, it is better to avoid entering personal data.

When shopping online, check the website. The website name should be spelled correctly, without redirects. Also, check for the presence of a lock icon in the address bar, which confirms the security of the site.

If you frequently make online purchases, it is better to get a separate card for this purpose and not keep your main funds on it. For example, I receive my salary on a Halyk Bank card, but for purchases, I use a Kaspi.kz card, both of which are closed for online payments, which I open only when necessary. This protects against unauthorized deductions.

Be cautious of calls from bots with tempting offers. They may use your consent for fraud, as in the case of my friend, who said "yes," and his voice was used to take out a loan.

To protect against such cases, you can submit an application to eGov to refuse online loans and credits, which will prevent the issuance of a loan without your knowledge. It is also important never to share SMS codes with third parties and to remain vigilant to protect yourself from scammers.

Compliance for Business

Compliance plays a key role in business by preventing serious consequences. For example, in the staff of such large companies as Kazakhmys and Samruk-Kazyna, there is always a compliance manager. Even small companies need to verify employees during hiring to avoid risks.

There was a case where a company hired a remote developer without verification, issued him equipment, and he pawned it and disappeared. Preliminary checks for debts or criminal records could have prevented losses.

It is also important to check counterparties for debts and court cases, which helps assess their reliability and avoid fines and delays.

Compliance is important not only for financial institutions. Scammers try to obtain commercial information, financial data, developments, logins and passwords, access to software, databases, and personal information, including digital signatures.

To protect against these threats, it is necessary to limit access to information. For example, access to financial data should be available only to the accountant, financial director, and financier, not to the HR specialist or project manager.

Confidentiality means that information does not belong to everyone and does not go to third parties. Integrity refers to the measures we take to protect information, which should not violate its integrity, distort, or alter it.

There is a golden rule of data security: the cost of measures ensuring the security of your confidential information should not exceed the actual cost of this information. For example, information about key partners or suppliers should not be written on a piece of paper and left in a restaurant, as this could affect finances and contracts. At the same time, storing personal data, such as an employee's phone number, in a safe does not make sense. Therefore, it is important to match security measures with the actual cost of information.

Information leaks often occur due to employees. This can be done accidentally or intentionally to gain additional benefits.

In our company Paspay, there are rules according to which, upon completing work or leaving the workplace, the computer must be locked. Violation of the rule can lead to disconnection of access and exclusion from work, as this entails the risk of information leaks.

We also control access to information. An HR specialist should not request financial indicators, and a salesperson should not have access to the personal information of other employees. In processing personal data, we follow the Law of the Republic of Kazakhstan on the Protection of Personal Data and include it in the employment contract, as violation of legislation can lead to large fines.

It is also important to control the storage of archives. After the expiration of the information storage period, data must be deleted safely. Throwing it in the trash is a risk. It is better to use a shredder or other secure methods.

Backing up data helps protect against leaks, and in the event of a cyberattack, you will not have to pay large sums for data ransom.

Not everyone yet understands the importance of an electronic digital signature—it is often issued uncontrollably in the Data Center.

An electronic digital signature is equivalent to your regular signature and is used to sign important documents, such as real estate or business transactions. It must be stored securely and not sent via messengers to avoid theft. The signature should be stored on a secure medium, such as a flash drive in a safe, access to which is available only to you or designated persons.

The password for accessing the signature should be complex, including at least eight characters, uppercase letters, numbers, and special symbols.

Company management needs to explain to employees the importance of data protection, the necessity of locking computers, and adherence to rules. Correspondence should be conducted only from work email; personal email should not be used for professional matters to avoid compromise. Work email should not be left on third-party resources or used for online orders and following suspicious links to avoid attacks.

Advice for Those Who Want to Start a Career in Compliance

1. It is not necessary to know all laws by heart; it is important to be able to quickly search and analyze information. We gather a general picture from fragments of data for management.
2. Lawyers, accountants, and system administrators can work in compliance. System administrators deal with data security, while accountants and lawyers handle legal and tax risks.
3. In large companies, compliance is often represented by a separate department whose employees are responsible for implementing the compliance system.
4. To become a professional, you need a higher legal or economic education. The profession of a compliance specialist is in demand in Europe and America and is beginning to develop in Kazakhstan. Demand is growing as financial literacy increases and the importance of predicting risks is recognized.