October 2, 2026

Open Banking in Ukraine for FinTech Companies

Open Banking became operational in Ukraine on 1 August 2025. Account-servicing payment service providers (ASPSPs) are banks and non-bank payment service providers (PSPs) that hold current or payment accounts accessible to the user online. They must give authorised third parties programmatic access to those accounts through dedicated interfaces. The ASPSP implementation deadline expired on 1 January 2026. The NBU’s temporary non-enforcement for specified ASPSP breaches concerning continuous account access and dedicated interfaces ended on 1 August 2026.

For a FinTech company planning to provide AIS or PIS in Ukraine, client consent alone is not sufficient. A Ukrainian legal entity must obtain NBU authorisation as a non-financial payment service provider; a branch of a foreign payment institution must complete NBU accreditation and, to provide AIS/PIS, also obtain authorisation for the relevant non-financial payment services. Before connecting to bank APIs, the provider must also obtain a qualified Open Banking certificate for technical authentication.

This article is intended for foreign and Ukrainian FinTech companies, banks, payment institutions, investors, product teams and compliance teams planning to launch AIS or PIS in Ukraine.

Account information services (AIS) and payment initiation services (PIS) are classified as non-financial payment services under the Law of Ukraine on Payment Services No. 1591-IX. A Ukrainian legal entity may provide them without a payment institution licence, but only after NBU authorisation and entry in the Register of Payment Infrastructure. PSD2 authorisation does not apply automatically in Ukraine. A bilateral agreement with the ASPSP is not required for access to the base interface; separate requirements apply to the qualified Open Banking certificate, liability insurance, strong customer authentication and personal data protection.

1. The Ukrainian Open Banking framework

2. AIS and PIS Services for FinTech Companies

3. NBU Authorisation of AISP and PISP

4. NBU Authorisation Procedure and Timeline

5. Market Entry for Foreign FinTech Companies

6. Liability insurance and qualified Open Banking certificates

7. Access to Bank APIs

8. User consent and strong customer authentication

9. Data scope and restrictions for AISP

10. Personal data protection

11. AML, Cybersecurity and Internal Documentation

12. Liability allocation and contracts

13. Open Banking Pre-Launch Checklist

Frequently asked questions

How DLF can help

1. The Ukrainian Open Banking framework

The statutory foundation is the Law of Ukraine on Payment Services No. 1591-IX. The operational rules are set out in NBU Resolution No. 80/2025 on Open Banking, NBU Resolution No. 81/2025 on authorisation of non-financial payment service providers, and accompanying NBU acts.

The Open Banking framework uses the following core designations: ASPSP for an account-servicing payment service provider; AISP for an account information service provider; PISP for a payment initiation service provider; and TPP as the collective term for AISP and PISP.

Date	Event
1 August 2025	Open Banking launched: ASPSPs required to provide interface access; AISP/PISP authorisation open
1 January 2026	Five-month ASPSP implementation transition period expired
3 April 2026	NBU Resolution No. 32/2026 enters into force: PISP no longer completes the “recipient payment service provider name” field
1 August 2026	Temporary non-enforcement ends for specified ASPSP breaches concerning account access and dedicated interfaces
1 August 2026 — present	The transitional non-enforcement protection for ASPSPs no longer applies to those breaches
1 January 2027	Full insurance calculation methodology and prohibition on deductibles take effect

The NBU maintains the public Register of Payment Infrastructure. Current Open Banking information is published on the NBU Open Banking page.

2. AIS and PIS Services for FinTech Companies

The Law on Payment Services classifies AIS and PIS as non-financial payment services forming the core Open Banking offering for FinTech providers.

Account information service (AIS) means providing consolidated, real-time information about one or more accounts that a client holds at one or more payment service providers. An AISP accesses account data but does not move funds.

Payment initiation service (PIS) means initiating a payment instruction, at the payer’s request, from an account held at another PSP. A PISP triggers the payment but does not hold the client’s account.

A provider offering both AIS and PIS must satisfy the requirements applicable to both services. A separate minimum insurance amount applies to the combined model, while one qualified Open Banking certificate may cover both roles.

A payment technology operator is a separate regulated role for an entity performing operational, information and other technological functions. That status alone does not make the operator an AISP or PISP.

AIS and PIS are distinct non-financial payment services, so the applicable capital, insurance and strong customer authentication requirements differ.

3. NBU Authorisation of AISP and PISP

AISP

For a Ukrainian legal entity, AIS is classified as a non-financial payment service, so providing it does not require a payment institution licence. NBU authorisation is required instead, resulting in entry in the Register of Payment Infrastructure.

AIS does not appear in the capital table of the Law on Payment Services, so no statutory minimum capital applies to a provider offering AIS exclusively.

PISP

For a Ukrainian legal entity, PIS is likewise a non-financial payment service. A provider offering PIS only requires NBU authorisation and entry in the Register, rather than a payment institution licence.

The minimum statutory capital for a PISP is UAH 1,000,000 (approximately USD 22,000). Where PIS is combined with money remittance without account opening, the minimum rises to UAH 3,000,000 (approximately USD 67,000); providing that financial payment service also requires the corresponding NBU authorisation.

Comparison of Key Parameters for a Ukrainian Legal Entity

Parameter	AISP only	PISP only	AISP + PISP	Payment institution (financial services)
Payment institution licence	Not required	Not required	Not required	Required
NBU authorisation + Register entry	Mandatory	Mandatory	Mandatory	Separate procedure
Minimum capital	Not set by statute	UAH 1,000,000 (approximately USD 22,000)	UAH 1,000,000 (approximately USD 22,000)	UAH 1–5 million (approximately USD 22,000–112,000)
Insurance (July–Dec 2026)	€110,000	€110,000	€180,000	Separate regime
Certificate role attribute	PSP_AI	PSP_PI	PSP_AI + PSP_PI	—

4. NBU Authorisation Procedure and Timeline

Key documents for a Ukrainian legal entity

#	Key document
1	Application
2	Legal entity questionnaire
3	Information statement
4	Business plan
5	Liability insurance contract (under the Regulation approved by NBU Resolution No. 71/2025)
6	Articles of association and corporate documents
7	Ownership structure and ultimate beneficial owner (UBO) information
8	Financial statements and auditor’s review report on the financial statements
9	Documents for managers and key persons (CVs, criminal-record certificates and credit reports)
10	Organisational structure and documents confirming sources of funds
11	Certificate of no tax arrears and credit reports for the applicant
12	Trade mark documentation (if a trade mark is used)
13	Confirmation of payment of the NBU fee for reviewing the application and documents

Timing and outcome

The NBU reviews the application within 60 business days and may extend the review by a further 30 business days. The authorisation is granted for an unlimited term and does not require periodic renewal.

Internal policies and procedures must be adopted no later than three months after authorisation and, in any event, before the first non-financial payment service is provided.

5. Market Entry for Foreign FinTech Companies

A foreign FinTech company planning to provide AIS or PIS in Ukraine must select an appropriate form of presence. The principal options are a Ukrainian legal entity or a branch of a foreign payment institution. Direct cross-border provision of AIS or PIS without Ukrainian registration is not provided for under the current legal framework.

Ukrainian Legal Entity

Any foreign company may incorporate a limited liability company (LLC) or joint-stock company (JSC) in Ukraine and undergo the full NBU authorisation process under the standard document requirements.

Branch of a Foreign Payment Institution

Ukrainian law permits foreign payment institutions to establish branches in Ukraine. Accreditation of such a branch is a separate procedure and does not replace AISP/PISP authorisation. To provide AIS or PIS, the branch must also obtain authorisation to provide non-financial payment services; a shortened document set applies to branches.

This route is available to a foreign payment institution, meaning a non-resident legal entity that is entitled under the law of its home jurisdiction to provide payment services. For a company planning to provide only AIS or PIS, the availability of this model should be assessed separately in light of the payment services the parent institution is entitled to provide and the licensing regime applicable to the branch.

Cross-Border Provision of Services

Ukrainian law does not provide a separate mechanism for direct cross-border provision of AIS or PIS from abroad without Ukrainian registration. Market entry therefore requires a form of presence recognised by Ukrainian law and completion of all applicable NBU procedures, including authorisation and, for a branch of a foreign payment institution, accreditation.

EU PSD2 authorisation

An authorisation obtained under EU law, including under PSD2, does not by itself confer a right to operate in Ukraine. The company must choose the appropriate form of presence and complete the relevant Ukrainian procedures: authorisation for a Ukrainian legal entity, and accreditation plus AIS/PIS authorisation for a branch of a foreign payment institution.

6. Liability insurance and qualified Open Banking certificates

Liability insurance

The Regulation approved by NBU Resolution No. 71/2025 establishes mandatory minimum sums insured for non-financial payment service providers. During the final transitional period (1 July – 31 December 2026), the minimums are:

Provider type	Minimum sum insured	Maximum deductible
AISP-only or PISP-only	€110,000	10%
AISP + PISP (combined model)	€180,000	10%

The insurance contract must be concluded for one year and remain continuous: each new policy must begin the day after the preceding one ends. Bank guarantees and other financial instruments cannot replace the required insurance contract, which must be issued under Class 13 (other liability insurance).

These amounts are transitional. Contracts concluded under the applicable transitional requirements remain effective until expiry without an automatic increase in the insured amount. From 1 January 2027, the full calculation methodology based on activity and risk indicators will apply; no deductible is permitted for new contracts.

Qualified Open Banking certificates

The Regulation approved by NBU Resolution No. 82/2025 sets the requirements for qualified Open Banking certificates.

Before connecting to the dedicated interfaces, every AISP and PISP must obtain a qualified Open Banking certificate after completing the applicable NBU procedure. The certificate identifies the provider and enables the ASPSP to authenticate it technically.

Two certificate types are permitted: a qualified electronic seal certificate or a qualified website authentication certificate, each carrying Open Banking attributes. From 1 August 2026, an ASPSP may require a PISP to apply a qualified or advanced electronic seal to the message containing the payment-instruction details.

Qualified Open Banking certificates may be issued by Ukrainian QTSPs listed in the Trust List only where their relevant procedures are set out in their regulations and approved by the NBU. An EU eIDAS certificate does not, by itself, replace a qualified Open Banking certificate that meets the NBU’s specific requirements.

7. Access to Bank APIs

Ukrainian law establishes a two-tier access model through dedicated interfaces.

Parameter	Base interface	Commercial interface
Mandatory for ASPSP	Yes	No (ASPSP’s right, not obligation)
Agreement with the bank	Not required	Bilateral contract required
Cost to TPP	Free of charge	ASPSP’s commercial terms
Data / functionality	AIS: account balance + transactions for the last 31 calendar days; PIS: transmission of a payment instruction for a one-off credit transfer	Extended data / functionality — defined by contract
Access conditions	NBU authorisation + qualified Open Banking certificate	NBU authorisation + certificate + contract

The base interface is mandatory: any ASPSP must grant free access to any authorised AISP or PISP. Refusal of access without a statutory ground is not permitted.

A bilateral agreement between the AISP/PISP and the ASPSP is not required for access to the base interface. A bilateral contract is required for the commercial interface with its extended data scope. For actual account access, the ASPSP must also verify the TPP’s authorisation, obtain the user’s consent, and have the user’s permission to disclose information protected as bank secrecy, commercial secrecy or payment-service-provider secrecy.

8. User consent and strong customer authentication

AIS Consent and SCA

For AIS, the user provides the ASPSP, through the AISP, with consent to the provision of account information; once confirmed by strong customer authentication (SCA) and while valid, that consent is considered active. In addition, the ASPSP must obtain the user’s permission to disclose information protected as bank secrecy, commercial secrecy or payment-service-provider secrecy; the manner in which this permission is granted is determined by the agreement between the user and the ASPSP. Active consent may remain valid for a maximum of 180 calendar days, after which new consent is required.

Two separate time limits apply within the 180-day consent period:

• Active-consent validity: up to 180 calendar days, the period during which the user’s consent to account access remains effective.
• Strong customer authentication (SCA) cycle: the ASPSP may continue providing access without repeating SCA for no more than 90 days from the last SCA event. If the AISP requests further access after that period, the ASPSP must repeat SCA; new consent is not required while the 180-day active-consent period remains in force.

SCA is performed by the ASPSP when active consent is first established and, where further access is requested after the relevant 90-day period, again by the ASPSP. The AISP initiates the request but does not authenticate the user itself.

PIS Consent and SCA

For each initiation of a one-off payment transaction, the payer provides the ASPSP through the PISP with separate consent to execute the payment transaction. There is no standing consent mechanism for one-off payment transactions.

The PISP requests the ASPSP to carry out SCA; the ASPSP performs it. Dynamic linking (binding the authentication code to the specific payment amount and payee) is also the ASPSP’s responsibility.

The ASPSP also authenticates the TPP itself (AISP or PISP) as a technical participant via the qualified Open Banking certificate.

9. Data scope and restrictions for AISP

Through the base interface, an AISP acting within AIS accesses only:

• the account balance;
• the list of transactions for the last 31 calendar days from the date of the request.

Access to an extended data set (longer history, additional attributes) is available only through the commercial interface under a contract with the ASPSP.

An AISP is prohibited from:

• requesting or storing sensitive payment data;
• requesting from the user information unrelated to the provision of AIS.

The account holder’s name and the account or payment card number, without the other details necessary to initiate a payment, are not sensitive payment data.

Open Banking in Ukraine covers current and payment accounts that the user can access online. Other financial products that are not such accounts, including separate credit and investment products, fall outside the current regime. Ukraine does not yet have a formal Open Finance legal framework.

10. Personal data protection

The processing of clients’ personal data is governed by the Law of Ukraine on Personal Data Protection No. 2297-VI. Account access under Open Banking is based on the user’s consent under payment legislation. The legal basis for any further processing of personal data must be assessed separately in light of the processing purpose and applicable law.

Using account data for marketing or profiling outside the purpose for which the user gave consent requires a separate lawful basis. The user may withdraw consent at any time. After withdrawal, the AISP must cease account access; data already obtained may be retained only where another lawful basis exists and the purpose and retention period justify continued processing. Documents relating to PIS and all AIS consents must be retained for at least five years after the business relationship ends; this does not require all account data obtained through AIS to be retained for five years.

Cross-border transfers of personal data are carried out in accordance with the procedure established by law. EU/EEA member states and states party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data are treated as providing an adequate level of personal data protection.

11. AML, Cybersecurity and Internal Documentation

AML and financial monitoring

The Law of Ukraine “On Prevention and Counteraction to Legalisation (Laundering) of the Proceeds of Crime, Terrorism Financing and Financing the Proliferation of Weapons of Mass Destruction” No. 361-IX does not expressly list AISPs or PISPs as a separate category of primary financial monitoring subjects. The law also covers other legal entities that are not financial institutions but provide certain financial services, whereas AIS and PIS are non-financial payment services. The AML status of a particular AISP or PISP should therefore be assessed separately, taking into account any other activities and the provider’s actual service model.

Branches of foreign payment institutions require a separate AML assessment as well.

Cybersecurity

NBU Resolution No. 43/2021 sets information-security and cybersecurity requirements that apply to payment-market participants according to their regulatory status. In addition, the Regulation approved by NBU Resolution No. 73/2025 establishes a risk-management framework for non-financial payment service providers covering operational risk, cyber risk and security risk.

Internal documentation

The authorisation regulation requires an authorised non-financial payment service provider to adopt the required internal policies and procedures no later than three months after authorisation and, in any event, before providing the first service. Risk-management policies must also comply with the Regulation approved by NBU Resolution No. 73/2025.

12. Liability allocation and contracts

A bilateral agreement between the AISP/PISP and the bank (ASPSP) is not required for base interface access. The ASPSP grants access on the basis of the NBU authorisation and the qualified certificate. For the commercial interface, a bilateral contract is required and governs data scope, fees and liability terms.

A client agreement (terms of service) is required for any AISP or PISP. It must cover the type of service (AIS or PIS), the scope of account access, the duration of consent and the procedure for withdrawing it, and the FinTech company’s liability to the client.

For payment transactions initiated through a PISP, the ASPSP is liable to the user in the cases provided by law. Where the breach is attributable to the PISP, the PISP must reimburse the ASPSP for losses and amounts paid to the user. Other liability issues require case-specific analysis. Liability insurance covers defined risks: for a PISP, incorrect initiation of payment transactions; for an AISP, unauthorised access to data or its improper use.

13. Open Banking Pre-Launch Checklist

1. Service classification. Determine whether AIS, PIS, or both will be provided; this drives capital, insurance, and certificate requirements.
2. Legal structure. Choose between a Ukrainian legal entity (LLC or JSC) and a branch of a foreign payment institution. For a branch, take into account both accreditation and separate AIS/PIS authorisation.
3. Capital. For a Ukrainian legal entity applying for PIS authorisation, confirm minimum statutory capital of UAH 1,000,000 (approximately USD 22,000); for an AIS-only provider, note that the statute does not set a separate minimum capital amount. A branch of a foreign payment institution is subject to a separate regime.
4. Insurance. Conclude the required liability insurance contract; this requirement also applies to a branch of a foreign payment institution undergoing AIS/PIS authorisation.
5. Market-entry documents. For a Ukrainian legal entity, prepare the main authorisation document set; for a branch of a foreign payment institution, prepare the accreditation documents and the shortened document set for non-financial payment service authorisation.
6. Qualified Open Banking certificate. After completing the applicable NBU procedure and before connecting to the dedicated interfaces, obtain a qualified Open Banking certificate from a Ukrainian QTSP.
7. Internal documentation. Adopt the required documents no later than three months after authorisation and, in any event, before providing the first service.
8. Consent and secrecy-disclosure permission. Design the process for obtaining user consent (for AIS, valid for up to 180 calendar days) and confirm with the ASPSP how the user’s permission to disclose bank secrecy, commercial secrecy and payment-service-provider secrecy is documented.
9. SCA coordination with ASPSP. Agree the technical integration for ASPSP-performed strong customer authentication.
10. Interface access model. Determine whether base interface access is sufficient or a commercial interface contract with the ASPSP is needed.
11. Personal data. Prepare the required personal-data-processing documentation.
12. AML status. Determine the applicable financial-monitoring obligations separately, taking into account the provider’s status and any other activities.
13. Cybersecurity, risk management and business continuity. Implement the applicable protection measures and risk-management framework required by Ukrainian law.
14. Client and ASPSP contracts. Prepare client terms of service and, if required, a commercial interface contract with the ASPSP.
15. Register confirmation. Verify Register of Payment Infrastructure entry before commencing commercial operations.

Frequently asked questions

Is Open Banking currently operational in Ukraine?

The framework entered into force on 1 August 2025. The ASPSP implementation deadline expired on 1 January 2026. The NBU’s temporary non-enforcement for specified ASPSP breaches concerning account access and dedicated interfaces ended on 1 August 2026. The relevant transition periods have expired.

Does an AISP require a payment institution licence?

For a Ukrainian legal entity providing AIS only, no payment institution licence is required. NBU authorisation and entry in the Register of Payment Infrastructure are required instead. A branch of a foreign payment institution must undergo separate accreditation and, for AIS, must also obtain authorisation for the non-financial payment service.

What is the minimum capital for a PISP?

For a Ukrainian legal entity applying for PIS authorisation, the minimum statutory capital is UAH 1,000,000 (approximately USD 22,000). Where PIS is combined with money remittance without account opening, the minimum is UAH 3,000,000 (approximately USD 67,000). No separate statutory minimum is set for an AIS-only provider. A branch of a foreign payment institution is subject to a separate regime.

Does an EU PSD2 authorisation cover Ukraine?

No. PSD2 authorisation does not apply automatically in Ukraine. Depending on the chosen form of presence, the company must complete Ukrainian authorisation or, for a branch of a foreign payment institution, both accreditation and separate AIS/PIS authorisation.

Can a foreign company provide AIS or PIS without establishing a Ukrainian entity?

Yes, through a form of presence recognised by Ukrainian law. A foreign payment institution may establish a branch in Ukraine if it meets the statutory requirements and completes NBU accreditation and AIS/PIS authorisation. Other foreign companies may incorporate a Ukrainian legal entity and obtain NBU authorisation. Direct cross-border provision of AIS or PIS without Ukrainian registration is not provided for.

Is a contract with the bank needed to access the base interface?

No bilateral agreement with the ASPSP is required for base interface access. Any authorised AISP or PISP is entitled to free access without a prior agreement. A bilateral contract is required for the commercial interface with extended data.

How long does AIS consent remain valid?

One active AIS consent may remain valid for up to 180 calendar days. After expiry, new consent is required. If the AISP requests further access more than 90 days after the previous SCA event, the ASPSP must perform SCA again; no new consent is required while the 180-day consent remains valid.

Who performs strong customer authentication?

The ASPSP — the bank or other account-holding PSP — performs user SCA. The AISP or PISP initiates the relevant request, but neither authenticates the user independently.

What are the insurance requirements for AISP/PISP in 2026?

From 1 July through 31 December 2026, the minimum insured amount is €110,000 for a single-service provider (AIS-only or PIS-only) and €180,000 for a combined AISP + PISP model. Contracts concluded under the applicable transitional requirements remain effective until expiry. From 1 January 2027, the full calculation methodology will apply and no deductible is permitted for new contracts.

How DLF can help

DLF supports FinTech companies and financial institutions at every stage of entering the Ukrainian market: from choosing the corporate structure and preparing documents to NBU authorisation, capital structuring and insurance, agreements with ASPSPs and clients, personal data protection, AML analysis and cybersecurity. For such projects, DLF’s Corporate Law / M&A and Contract Law practices are particularly relevant.

Iurii Dynys, Counsel, Attorney-at-law, DLF attorneys-at-law.

Contacts: +380 44 384 24 54, info@dlf.ua.

This material is intended for general information. The application of the approaches described depends on the circumstances of the specific situation and requires a separate legal assessment.