On 25 August 2025 the Board of the National Bank of Ukraine (NBU) approved the Regulation on the use of cloud computing technology (Resolution No. 99). The resolution came into force on 1 November 2025. Institutions that were already using the cloud had six months to bring existing contracts into line and report them to the NBU — that period has already ended. For every new contract a one-month notification deadline applies.
Here is who the resolution applies to, what it allows and prohibits, which risks must be assessed before choosing a provider, and how to notify the National Bank.
This article is an overview based on the official text of the resolution, not legal advice. Agree how the requirements apply to your institution with your lawyer and check the current version.
Who it applies to
The Regulation covers banks, financial service providers, operators and participants of payment systems, and technological operators of payment services that use cloud services for their core business processes. It was drafted under the Law of Ukraine “On Cloud Services”.
What is allowed
- Service models: infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS), security as a service (SECaaS) and other services that meet the definition of cloud services.
- Deployment models: private, community, public and hybrid cloud.
- Choice of provider — up to the institution.
- The contract — on paper with handwritten signatures, or electronic with the parties’ qualified electronic signatures or advanced signatures based on qualified certificates.
The cloud must be used in line with the law on personal data protection, information protection and cybersecurity. How to choose a model and platform in general: “Cloud migration: a step-by-step plan for business”.
Who may not be engaged
An institution may not work with a provider that is a resident of the aggressor state or has ultimate beneficial owners resident there, or that processes or stores data in clouds or data centres located in the aggressor state or the temporarily occupied territories, or in data centres owned by sanctioned persons. The same restrictions apply to the partners a provider engages to deliver its services (“chained cloud services”).
The institution’s duties
- It is liable for the unlawful disclosure of restricted information while using the cloud.
- It monitors the provider’s access to restricted information that the institution owns.
- It monitors events concerning data in the cloud: cyber incidents, information security incidents, continuity disruptions that affect its services.
- It names, in an internal document, the people responsible for introducing and using cloud services.
- It uses chained services only if the provider has confirmed, in the manner set by the contract, that its partner will fully meet the obligations towards the institution.
Risks: what to assess before choosing a provider
The institution introduces a process for managing the risks of using cloud services — within its existing risk management system or separately, with its own methodology. The internal document on these risks is reviewed at least once a year or when things change.
Before choosing a provider, the analysis must cover at least:
- The risk of disrupted continuity due to cloud service failures.
- The risk to continuity, integrity and availability of data when moving to another provider.
- Concentration risk — when one provider delivers several different services.
- Differences in how restricted information is handled under Ukrainian law and the law of the provider’s country of registration.
- Operational risks, including information security and cyber risks.
- Risks of chained cloud services.
- Compliance risks.
The provider’s impact on business continuity and on meeting obligations to clients, and on the confidentiality, integrity and availability of data, is assessed separately. The decision to use the cloud is taken based on this analysis.
Business continuity
The business continuity plan for using the cloud must provide for:
- restoring operations after the provider stops working;
- restoring the backup system on the institution’s own side — to guarantee recovery of its systems and preservation of restricted information;
- what to do when use of the cloud services ends;
- what to do when moving to another provider.
In other words, the cloud does not replace your own backups. How to build them: “3-2-1 backup rule: protecting business data”.
The contract: the essentials
Section IV sets the mandatory contents of the contract: the list of services, information security terms, provider reporting, the institution’s right to terminate, continuity measures, non-disclosure, an annual confirmation of certificates of compliance with international information security standards, a ban on processing data in the aggressor state and the temporarily occupied territories, the provider’s responsibility for vulnerability management and support during incidents, return and secure deletion of data, notice of changes in partners and more. The contract must also split responsibilities between the parties across nine areas — from cryptographic key management to backup. A contract with a non-resident provider that does not meet these requirements may not be signed.
We will cover the contract as a checklist in a separate article.
Notifying the National Bank
| Event | Deadline | Form |
|---|---|---|
| A contract is signed | within one month of signing | notice under Annex 1 |
| The contract is amended or Annex 1 information changes | within one month | notice under Annex 2 |
| The contract is terminated | within one month | notice under Annex 3 |
The notice is sent to the NBU’s official mailbox nbu@bank.gov.ua or through other NBU electronic document channels. It is signed by the head or another person authorised to act for the institution with a qualified electronic signature or an advanced signature based on a qualified certificate. The National Bank may request information on cloud use and check the terms of service, and processing data in the cloud cannot be a reason to delay or refuse information requested lawfully by competent authorities.
What to do now
- Inventory. A list of all cloud services supporting core business processes — including SaaS (email, CRM, accounting systems) and security services.
- Check providers and their partners for residency, beneficial owners, data centre locations and sanctions.
- Risk analysis and impact assessment across the seven categories; an internal document naming the responsible people.
- A continuity plan with the four scenarios and your own backups.
- Contracts. Compare every contract with Section IV.
- NBU notices. Check that all existing contracts have been reported, and set up a process for new, amended and terminated ones.
- Monitoring of the provider’s access to data and of security events in the cloud.
- An annual review of the internal document.
Checklist
- There is a list of cloud services supporting core business processes
- Providers and their partners are checked against the aggressor state and sanctions restrictions
- The risk analysis across seven categories and the provider impact assessment are done
- The internal document on cloud risks is approved, responsible people are named
- The continuity plan covers a provider outage, leaving the cloud and moving to another provider
- Backups also exist on the institution’s side
- Contracts are checked against Section IV
- NBU notices have been sent for all existing contracts
- Monitoring of provider access and cloud security events is in place
- The document is reviewed at least once a year
How Bereg-IT can help
We inventory your systems and cloud services, record availability and security requirements, compare platforms and providers by requirements, budget and risks, and explain the choice — more on cloud solutions. If some systems must stay under the institution’s full control, we build a private cloud or a hybrid setup. At a consultation or an audit we assess compliance and prepare a roadmap; we recommend agreeing the legal side of contracts with your lawyer.
The first consultation is free. Send a request and an IT engineer or security specialist will get in touch.
Sources
- Resolution of the Board of the National Bank of Ukraine of 25.08.2025 No. 99 “On approval of the Regulation on the use of cloud computing technology and amendment to the Regulation on organising accounting in banks of Ukraine” (officially published 02.09.2025, in force 01.11.2025, in Ukrainian): https://bank.gov.ua/admin_uploads/law/25082025_99.pdf
- Law of Ukraine “On Cloud Services” of 17.02.2022 No. 2075-IX (in Ukrainian): https://zakon.rada.gov.ua/laws/show/2075-20