On 9 December 2025 the Board of the National Bank of Ukraine (NBU) approved the Regulation on organising information security and cyber protection measures by financial service providers (Resolution No. 143). The resolution was officially published on 12 December 2025 and came into force the next day. Financial service providers have 12 months to bring their operations into line — that is, until mid-December 2026.
Here is who the resolution applies to, which of its requirements are the most specific, and how to plan the remaining time.
This article is an overview based on the official text of the resolution, not legal advice. Agree how the requirements apply to your institution with your lawyer and check the current version.
Who it applies to
The Regulation sets requirements for non-bank financial institutions (NBFIs):
- insurers;
- credit unions;
- finance companies;
- pawnshops.
It does not apply to payment and ancillary service providers or to postal operators entitled to trade in currency values. For insurers, credit unions and finance companies, the requirements apply together with the regulations on their management systems — NBU Resolutions No. 194, No. 204, No. 15 and No. 185.
The objects of protection are information that constitutes an insurance secret or a financial service secret, and the information and communication systems that support core business processes or interact with NBU systems.
The Regulation was drafted with reference to the EU Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) and the standards DSTU ISO/IEC 27001:2023 and 27002:2023.
The basis: risk management
An institution must introduce a process for managing cyber and information security risks and apply protection at every stage of its systems’ life cycle. The measures in the Regulation are implemented with a risk-based approach. The process can be built into the existing risk management system, and the assessment methodology can be chosen by the institution itself.
Who is responsible
- The head organises the work, approves internal documents and control mechanisms and appoints a responsible person by a separate decision — or performs that role personally.
- The responsible person drafts internal documents, updates the register of software and hardware at least once a year, monitors and investigates incidents, controls security tools, prevents unapproved software and hardware from being installed and approves changes to systems.
- Users acknowledge the internal security documents by signature or in another verifiable way. The documents are reviewed every year.
Access and authentication
This part of the Regulation has the most specific numbers:
| Requirement | What the Regulation sets |
|---|---|
| Multi-factor authentication | mandatory for users and privileged users accessing systems remotely; biometrics only as one of the factors |
| Password length | at least 12 characters for users and 15 for privileged users; digits, mixed-case letters, special characters |
| Password changes | on compromise, but at least every 90 days or when the password appears in compromised password databases; reuse not before the eighth change |
| Account lockout | after several (up to five) failed logins; after 90 days without a login; on dismissal or change of duties; when a client contract ends (except insurers) |
| Administrators | stronger password rules or multi-factor authentication; separate accounts for administration and everyday work |
| Access rights | least privilege; rights reviewed at least once a year |
| Workstations | screen lock after 15 minutes of inactivity; default accounts blocked or renamed, guest accounts disabled |
| Devices | equipment connecting to the systems is identified; it cannot work in the systems without identification |
Event logs
Systems must record, and protect from modification, among other things: logins and logouts, failed authentication attempts, account creation and blocking, password and access right changes, configuration changes, access to settings and to the logs themselves. Logs are archived at least once a year and kept for at least one year from archiving, unless the law requires otherwise. Only the responsible person has access to them.
Network protection
- Network segmentation, with access between segments restricted by firewalls or equivalent tools.
- Connections to external networks only through controlled access points, kept to the minimum needed.
- No transfer of protected information when security tools fail.
- Unused ports on network equipment disabled.
- Protection against denial-of-service and other known network attacks.
- Services open to clients from external networks placed in a network zone with a higher level of security.
- Malware protection with up-to-date signatures.
Software
Operating systems and application software must be official versions with security update support. For software that is no longer supported, a risk analysis and compensating measures are required: additional protection, regular monitoring and audit, backup, an incident response plan. The plan to move to supported versions is approved by the supervisory board or another oversight body and must be carried out within two years, unless the law provides otherwise. The Regulation also requires internal rules for removable media and their identification.
Incidents and contractors
- An incident management process and an approved response plan linked to the business continuity plan. The plan must cover impact assessment, the actions of the responsible person and users, interaction with business units, how the head is informed, and how incident data is kept and analysed. The NBU may request information on incident response in writing.
- Contractors may be engaged for security measures and incident response, but the contract must include non-disclosure terms and terms for cooperation during incidents. A contractor may not be a resident of the aggressor state or have such ultimate beneficial owners, nor process or store data in clouds or data centres located in the aggressor state or the temporarily occupied territories, or owned by sanctioned persons.
We will cover the incident response plan under Resolution No. 143 in a separate article.
How to plan the work until December 2026
- Gap analysis. Go through every point of the Regulation and record what is done and what is not.
- Responsible person. A separate decision by the head, authority and a training plan.
- Register of systems and software. An inventory of software and hardware; separately — software without vendor support.
- Quick technical measures. Multi-factor authentication for remote access, a password policy, account and screen lockout, default accounts.
- Logs. Event logging, central collection, protection from modification, retention for at least a year.
- Network. Segmentation, a zone for public services, DoS protection, unused ports closed.
- Internal documents. Security policy, access management, network protection, removable media, response plan.
- Contractor agreements. Non-disclosure, cooperation during incidents, checks of residency, beneficial owners and where data is processed.
- People. Acknowledgement of documents by signature and training.
- Verification. A test incident run through the response plan and a repeat compliance assessment.
Checklist
- The responsible person is appointed by a separate decision of the head
- A cyber risk management process is in place, the methodology is approved
- The software and hardware register is up to date, unsupported software has a migration plan
- Multi-factor authentication for remote access
- Passwords: 12 / 15 characters, changed at least every 90 days, lockout after failed attempts
- Separate admin accounts, access rights reviewed every year
- Event logs are set up, protected and kept for at least a year
- The network is segmented, public services are in a separate zone, DoS protection is in place
- An incident response plan linked to the business continuity plan is approved
- Contractor agreements include non-disclosure and incident cooperation terms
How Bereg-IT can help
Start with a consultation or an audit: we check compliance with the resolution and draw up a prioritised roadmap to the deadline. We help implement the technical measures — from network security and NGFW and endpoint protection to vulnerability management. And SOC as a Service takes over collecting and analysing event logs, investigation, notification and regular reports — for institutions with regulatory requirements for logging and incident response.
The first consultation is free. Send a request and an information security specialist will get in touch.
Sources
- Resolution of the Board of the National Bank of Ukraine of 09.12.2025 No. 143 “On approval of the Regulation on organising information security and cyber protection measures by financial service providers” (officially published 12.12.2025, in Ukrainian): https://bank.gov.ua/admin_uploads/law/09122025_143.pdf
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA): https://eur-lex.europa.eu/eli/reg/2022/2554/oj