The National Bank Sets Risk Management Requirements for Non-Financial Payment Service Providers

The National Bank of Ukraine (NBU) has established risk management requirements for non-financial payment service providers as part of preparations for the introduction of open banking under the Law of Ukraine "On Payment Services."

The relevant NBU Board Resolution No. 73, dated July 2, 2025, titled “On Approval of the Regulation on Risk Management Requirements for Non-Financial Payment Service Providers and Amendments to the Regulation on Risk Management Requirements for Financial Payment Service Providers,” will enter into force on August 1.

The regulator announced that the Regulation on Risk Management Requirements for Non-Financial Payment Service Providers (hereinafter – the Regulation) will apply to non-bank payment service providers engaged in account information services and payment initiation services.

At the same time, payment institutions, electronic money institutions, as well as branches of foreign payment institutions and foreign electronic money institutions, must additionally comply with the Regulation on Risk Management Requirements for Financial Payment Service Providers if they combine their activities with the provision of non-financial payment services.

The Regulation sets out requirements regarding:

• the organization of a risk management system for non-bank non-financial payment service providers;
• the development of internal documents concerning the management of operational, cyber, and security risks;
• the development of a methodology to ensure the continuity of non-financial payment services;
• timely and periodic review of internal documents on managing operational, cyber, and security risks.