NBU Resolution No. 99 sets out in detail what a contract between an institution and a cloud provider must contain. Without these terms a contract with a non-resident provider may not be signed, and institutions had six months from 1 November 2025 to bring existing contracts into line. For an overview of the resolution, see “NBU Resolution 99: cloud for banks and fintech”.
Below is the contract as a checklist: mandatory terms, the split of responsibilities, restricted data and what to do after signing.
This article is an overview based on the official text of the resolution, not legal advice. The contract must be reviewed by a lawyer.
Form of the contract
The contract is signed on paper with handwritten signatures, or electronically with qualified electronic signatures or advanced signatures based on qualified certificates. An institution that belongs to a financial group may sign an accession agreement under the group’s contract, or a contract with a provider that is a member of the group, but the resolution’s requirements must be in it if the group contract lacks them.
18 mandatory terms
Paragraph 26 of the Regulation lists the terms the contract must contain. We have grouped them to make checking easier.
Services and information security
- A list and description of the services.
- How information security is ensured by the institution and by the provider.
- How and when the provider reports on compliance with the contract, including information security.
- The provider’s obligation to give the institution, or publish (naming the resource), at least once a year, certificates of compliance with international information security standards that cover the very services the institution receives.
- The provider’s responsibility for vulnerability management and specialised support in the event of a security incident in its infrastructure.
- The provider’s obligation to let the institution monitor the provider’s access to restricted information that the institution owns.
Data and access
- Non-disclosure by the provider of information about the institution’s data, unless the law of the provider’s country of registration or the contract provides otherwise.
- A ban on processing and storing the institution’s data in clouds or data centres located in the aggressor state or the temporarily occupied territories, or in data centres owned by sanctioned persons.
- Terms for granting and revoking the institution’s access to cloud resources.
- Terms for providing, returning and deleting data — during the service, after the contract expires or is terminated — with complete and secure deletion that prevents recovery.
Continuity and exit
- The institution’s right to terminate the contract unilaterally and to amend it on the grounds set in the contract.
- Service continuity measures the provider must carry out.
The provider’s partners
- The provider’s responsibility for performing the contract when it engages partners.
- A duty to give notice of planned changes in partners or their services that may affect performance of the contract.
- The notice period. The institution chooses it so that it can assess the risks before the change takes effect; the provider stays responsible and may not shift its obligations onto partners.
- The institution’s right to terminate unilaterally if a change of partners harms the services, breaches the Regulation or increases risks.
Liability and law
- Liability of the parties.
- The governing law — if the provider is not a resident of Ukraine.
Splitting security responsibilities
Paragraph 28 requires the contract to define each party’s area of responsibility in nine fields. The Regulation does not say who does what — that is for the parties to agree. The split depends on the service model: in IaaS the institution is responsible for more than in SaaS (on the shared responsibility model, see “Cloud migration: a step-by-step plan for business”).
| Field | What to record |
|---|---|
| Cryptographic key management | who generates, stores, distributes, uses and destroys keys |
| Security monitoring, logs, vulnerabilities | whose logs, who analyses them, how the institution gets access to events |
| 24/7 availability of services | who ensures availability and how it is measured |
| Support and updates of services | who updates the OS, platform and applications |
| Configuration and access rights | who manages accounts, roles and settings |
| Response to cyber and security incidents | contacts, deadlines, who does what |
| Response to events affecting continuity | who decides on failover, how the institution is informed |
| Certification and audits | which certificates the provider supplies, how the institution can verify |
| Backup and recovery | who makes copies, where they are stored, how restores are tested |
Remember that under the resolution the continuity plan must provide for restoring the backup system on the institution’s own side too, so backup should not be handed over to the provider entirely. More in “3-2-1 backup rule: protecting business data”.
Restricted data
The institution must decide whether the data it hands to the provider is restricted information and describe in the contract the measures the provider takes to protect it. The provider undertakes to keep it confidential at least at the level set by the institution, and the contract sets the provider’s liability for a breach.
Special cases
- Critical information infrastructure. The contract must also contain the essential terms set out in part three of Article 10 of the Law of Ukraine “On Cloud Services”.
- Non-resident provider. A contract that does not meet paragraphs 26–30 of the Regulation may not be signed.
- Financial group. An accession agreement must contain the requirements of paragraphs 26–30 if the group contract lacks them.
Working with a provider’s standard terms
Large providers usually work on standard terms, a data processing agreement and addenda. A practical approach:
- Build a compliance table: the 18 terms of paragraph 26, the nine fields of paragraph 28, the requirements of paragraph 29 on restricted data.
- For each row, find the matching clause in the provider’s terms, data processing agreement or addenda and record the reference.
- Agree what is missing in a separate addendum — or choose another provider or model, such as a private cloud.
- Keep the table: you will need it for the annual review of the internal risk document and for NBU requests.
After signing
- Notify the NBU within one month of signing, using the Annex 1 form, at nbu@bank.gov.ua or through other NBU electronic document channels; signed by the head or another authorised person with a qualified electronic signature or an advanced signature based on a qualified certificate. Changes — within one month using Annex 2; termination — within one month using Annex 3.
- Monitoring. The institution monitors the provider’s access to restricted data and events affecting its services: cyber incidents, security incidents, continuity disruptions.
- Review. The internal document on cloud risks — at least once a year or when things change.
Pre-signing checklist
- The provider and its partners have no links to the aggressor state, the temporarily occupied territories or sanctions
- The risk analysis and the provider impact assessment are done
- All 18 terms of paragraph 26 are found in the contract or its addenda
- The split of responsibilities across the nine fields is recorded
- Restricted data is identified and its protection measures are described
- Terms for returning and securely deleting data are agreed
- The partner change notice period leaves time for a risk assessment
- The governing law is set (for a non-resident provider)
- Backups also exist on the institution’s side
- The person responsible for NBU notices knows the deadlines and forms
How Bereg-IT can help
We compare providers and platforms against your requirements, budget and risks and explain the choice (cloud solutions). We help build the compliance table and split the technical responsibilities — keys, logs, access, backup, incident response. If a public cloud does not fit, we build a private cloud. A compliance assessment and roadmap can start with a consultation or an audit; we recommend agreeing the legal wording of the contract with your lawyer.
The first consultation is free. Send a request and an IT engineer or security specialist will get in touch.
Sources
- Resolution of the Board of the National Bank of Ukraine of 25.08.2025 No. 99 “On approval of the Regulation on the use of cloud computing technology…”, Sections IV and V (in Ukrainian): https://bank.gov.ua/admin_uploads/law/25082025_99.pdf
- Law of Ukraine “On Cloud Services” of 17.02.2022 No. 2075-IX, Article 10 (in Ukrainian): https://zakon.rada.gov.ua/laws/show/2075-20