NBU Moves to Increase Resilience of Payments in the Context of Invasion

Ukrainian banks and the regulators have been in long discussions regarding the use of outsourcing outside Ukraine, in particular, cloud services for processing of payments and other data since the nature of the service is global while local data protection legislation and providers may not be contemplating the best standards or thresholds of the international banking groups.

On March 8, 2022, despite the banking holiday, the National Bank of Ukraine has finally established the ground rules for the use of cloud services, so far in the context of the martial law, which has been in effect on the territory of Ukraine since 24 February 2022. Weighing resilience of the payments against cybersecurity related to cross-border data transfer protocols, the NBU defined the safe place for the data processing - equipment located in the EU member-states of the European Union, Great Britain, the USA, and Canada. NBU Board Resolution no. 42 "On the Use of Cloud Services by Banks in Martial Law in Ukraine" (effective as of 9 March 2022) also mentions European Community and does not mention the United Kingdom, we would believe that the intention might have been to mention EFTA and the whole territory of the UK, at least in Europe, rather than only a great island.

If the data servers are located in the designated territories, NBU plainly allows the full outsourcing, cloud service, or use the offshore equipment for processing of the payments. The same conditions apply for storage and processing of the clients’ personal data, lists of deposits, and other banking secrecy. The contract with the providers should allow disclosure to the NBU, with the oversight purposes, of the terms and conditions of the service. The NBU and the Deposit Guarantee Fund must be able to access the relevant data that must be reported and/or disclosed under the legislation.

The cryptography of the data transfers and storage must comply with Ukrainian laws or laws of the respective jurisdiction.

Official source (in Ukrainian): https://bank.gov.ua/ua/news/all/pro-vikoristannya-bankami-ukrayini-hmarnih-poslug-v-umovah-voyennogo-stanu