In Ukraine, bankers are required to disclose information about accounts and payments to the National Police in case of criminal offenses

Ukrainian President Volodymyr Zelensky has signed a law requiring bankers to provide the National Police with all information on accounts and payments related to crimes.

Ukrainian banks and non-banking financial institutions (primarily payment organizations) will now share customer information with the National Police. On November 6, the President signed bill No. 11043, passed by the Verkhovna Rada in early October, titled “On Amending Certain Laws of Ukraine to Improve the Functions of the National Bank of Ukraine in the Regulation of Financial Services Markets.”

The document tightens requirements and penalties for financiers, expands the National Bank’s powers, and, most notably, mandates that payment organizations provide requested data to law enforcement upon a written request from the police.

This is not an automatic transfer of financial information about everyone and everything. It pertains to responses to specific requests by the National Police in connection with open criminal cases where there is evidence of criminal activity. The law lists specific criminal code articles under which such data may be disclosed.

“Information on measures taken by the payment service provider in response to a written (electronic) request from the National Police of Ukraine regarding a user’s completed payment transaction, if such a transaction contains signs of a criminal offense, provided for by Articles 185, 190-192, 200, 361, 362-363 of the Criminal Code of Ukraine,” the document states.

These listed Criminal Code articles cover theft of funds (Articles 185, 192), fraud (Article 190), unauthorized transfers/actions involving accounts (Article 200), and hacking of information networks belonging to banks and other payment organizations (Articles 361, 362, 363).

The information gathered is expected to assist law enforcement, particularly the Cyberpolice division, in combating fraud. This includes addressing system hacks, card account breaches, and schemes that deceive Ukrainians into losing their money.

To achieve this, law enforcement will be able to obtain not only information on clients involved in crimes—victims or suspects—including their full names, card/account numbers, and transaction types, but also data on their geolocation to determine their physical location. The list of data that can be disclosed to quickly identify all suspects/victims of financial thefts and participants in payment operations is extensive and includes:

• Full name and legal entity name involved in the operation.
• Identification code (or EDRPOU) of all suspects involved.
• IP address of participants.
• Geolocation data.
• Physical address of the device used for the transaction.
• Data on the application used to conduct the payment.
• Address of the cash register where the payment was made.
• Data on the payment service provider—bank, non-banking organization, and other participants.
• Payment device identifier.
• Unique payer identifier and the payer’s electronic account number.

It is worth noting that even before the full-scale war, many banks required the tracking of their clients’ geolocation as a mandatory feature. Customers who did not enable geolocation could not perform transactions via mobile applications, allowing financiers to monitor user movements.