Will banking secrecy cease to be a secret? What law are people's deputies preparing?

The Verkhovna Rada is preparing for the second reading bill 11043, which is aimed at improving the functions of the National Bank in state regulation of financial services markets. Among other things, the document contains provisions regarding bank secrecy and the procedure for its disclosure.

Banking secrecy and who can access it

Banking secrecy in Ukraine is guaranteed at the legislative level for both individuals and legal entities. In accordance with Article 60 of the Law “On Banks and Banking Activities”, these are:

• information about clients’ bank accounts, in particular correspondent bank accounts with the National Bank of Ukraine;
• information about transactions carried out in favor of or on behalf of the client, transactions made by him;
• financial and economic condition of clients;
• information on the organization and implementation of security of the bank and persons located on the bank premises;
• information about the organizational and legal structure of the client legal entity, its managers, areas of activity;
• information about clients’ commercial activities or trade secrets, any project, inventions, product samples and other commercial information;
• information on reporting for an individual bank, with the exception of those that are subject to publication;
• codes used by banks to protect information;
• information about an individual who intends to enter into a consumer loan agreement, obtained when assessing his creditworthiness;
• information on the organization and implementation of collection of funds and/or transportation of currency values;
• information about banks or bank clients, which is collected from banks during the implementation of banking supervision, currency supervision, supervision (oversight) of payment systems and settlement systems, as well as supervision in the field of preventing and combating the legalization (laundering) of proceeds from crime, the financing of terrorism and financing the proliferation of weapons of mass destruction;
• information about banks or bank clients received by the National Bank of Ukraine in accordance with an international agreement or on the principle of reciprocity from the banking supervisory authority of another state;
• the decision of the National Bank to apply enforcement measures, except for decisions to impose fines, to classify the bank as insolvent, to revoke the banking license and liquidate the bank.

Banks are obliged to ensure the preservation of banking secrecy, in particular, by limiting the circle of persons who have access to relevant information.

However, Article 62 of the Law “On Banks and Banking Activities” provides for the procedure for disclosing bank secrecy. Thus, information about transactions, bank accounts or payment cards can be provided by the bank exclusively:

• the clients themselves (their representatives);
• by court decision;
• law enforcement or government agencies that have the appropriate powers, but only in cases, in the manner and to the extent established by the Law “On Banks and Banking Activities”.

In November 2023, people's deputies already made amendments to the law. The National Bank, in turn, updated the Rules for the storage, protection, use and disclosure of banking secrecy. The changes took effect on March 20, 2024.

“In accordance with the norms of the previous edition of the Law of Ukraine “On Banks and Banking Activities,” law enforcement officers could request from banks the numbers of bank accounts, their balances and transactions performed. This list has been supplemented with the ability to obtain information about the bank client’s payment card number.

Relevant information can be provided exclusively at the request of the Prosecutor's Office of Ukraine, the Security Service of Ukraine, the State Bureau of Investigation, the National Police of Ukraine, the National Anti-Corruption Bureau of Ukraine, the Bureau of Economic Security of Ukraine, the National Agency for the Prevention of Corruption, the National Agency of Ukraine for Identification, Search and Management assets obtained from corruption and other crimes,” the regulator explained.

The NBU clarified that information about the payment card number will help law enforcement officers investigate cases of payment fraud, in particular the deception of funds through social engineering, phishing, and the like.

“After all, payment transactions can be carried out virtually and without using an account number, only using the payment card number,” the National Bank emphasized.

What changes are proposed?

According to bill 11043, Article 62 of the Law “On Banks and Banking Activities” wants to be supplemented with a clause according to which information about legal entities and individuals, constituting banking secrecy, is disclosed by banks “to the National Police of Ukraine - in the cases and to the extent specified in Article 31 of the Law Ukraine “On payment services”.

At the same time, Article 31 of the Law “On Payment Services” will be supplemented with a new part 7. According to it, if the payment service provider receives from the National Police of Ukraine, whose task is to implement state policy in the field of combating cybercrime, a written (electronic) request regarding the implementation of payment transaction of the user, if such operation contains signs of a criminal offense provided for in Articles 185, 190-192, 200, 361, 361-2, 362-363 (see table below) of the Criminal Code of Ukraine, such supplier is obliged within the shortest possible time (but no later than 24 hours after receiving the request) provide the following information

• amount and currency of the payment transaction;
• date of the payment transaction;
• type of payment transaction;
• geospatial data, IP address, address of the remote communication device (including a payment application) or payment device that was used to carry out the payment transaction (if any), and in the case of a payment transaction through a cash register - the cash register address (if available);
• identification data of the recipient: for an individual – last name, first name and patronymic (if available), registration number of the taxpayer’s registration card; for a legal entity - full name, identification code in accordance with the Unified State Register of Enterprises and Organizations of Ukraine;
• full name of the recipient's payment service provider;
• unique identifier of the recipient and/or full number of the electronic payment instrument and/or account of the recipient;
• name and code of the acquirer (if available);
• payment device identifier (if available);
• code identifying the transaction in the payment system (if available);
• unique identifier of the payer and/or full number of the electronic payment instrument and/or payer's account.

Criticism of the bill

The Main Legal Department of the Verkhovna Rada conducted an examination of the bill and provided its conclusions regarding changes to Article 31 of the Law “On Payment Services”.

They are convinced that we are talking about an extremely broad volume of information. At the same time, the legislator did not limit the grounds for the National Police to send a request to the bank.

“It is also unclear how a payment service provider will determine whether a transaction contains elements of a criminal offense,” the General Legal Directorate noted in its findings.

In addition, such a legislative approach does not take into account the requirements of the second part of Article 32 of the Constitution of Ukraine (regarding the protection of confidential information about a person) and does not correspond to the criterion of the quality of the law in the context of the requirements of the same article of the Constitution, since it contradicts such elements of the rule of law as legal certainty and prohibition of arbitrariness, which may lead to a violation of everyone’s constitutional right to private life, contradicts the legal positions of the Constitutional Court of Ukraine, does not comply with international acts, and also does not take into account practice

At the same time, the text of the presented draft does not contain legal norms that would link restrictions on the rights of citizens protected by the Constitution with the interests of national security, economic well-being and human rights.

“Consequently, the introduction of the dissemination of “information about all owned property (assets) and obligations of persons,” which is confidential information, without the consent of the owners of this data, is unreasonable, disproportionate and such that it does not take into account the requirements of Article 3 of the Constitution of Ukraine,” experts emphasize .

Lawyer Yuriy Demchenko also expressed his thoughts regarding the bill:

“The police, by electronic request - not a court order, just an electronic request - can obtain all the information about a person’s banking transactions. Even up to the moment where it was made, that is, geolocation data, the device from which the operations were carried out, and the like. It’s essentially stalking a person.”

According to the lawyer, bill 11043 is an interference in private life, because with the help of information about payment transactions you can find out in which country or city a person is located. In addition, the document violates the norms of the Constitution and the convention on the protection of rights and freedoms. Demchenko suggests that if this bill is adopted, many Ukrainians will close their cards and say goodbye to the Ukrainian banking system.

“This is terrible, because the police will know where you are, in what country. You paid at a gas station in Poland or went to Germany, bought something in a supermarket, and the police will see all this. This is a violation of the Constitution and the right to confidentiality of information. Such information should be provided only by court order,” the lawyer sums up.

Again for drops of money

Bill 11043 in particular arose on the basis of agreements between Ukraine and the International Monetary Fund. Our state has committed itself to strengthening regulatory requirements for payment market participants and increasing requirements for their capital.

In addition, the document talks about increasing the amount of fines for payment service providers (in particular banks), which will be commensurate with their income. The fine will be up to 5% of the amount of transactions carried out with violations. Now the maximum fine is 170 thousand UAH.

The fact is that during the work of the temporary investigative commission of the Verkhovna Rada, it previously became clear that some participants in the payment market committed various violations. For example, we made transfers to gambling organizers who operate without a license; replaced payment transaction codes (miscoding); distorted information that should accompany a payment transaction, etc.

In general, the bill is aimed at participants in the payment services market, but experts are convinced that it will affect everyone who makes transfers. After all, almost any payment transaction can be considered potentially illegal. All due to increased responsibility for payment market participants. It’s easier for them to block the operation than to receive a multi-million dollar fine from the National Bank.

Therefore, if bill 11043 is adopted, it will perfectly complement the NBU’s new restrictions on card transfers, which will start working on October 1.

Let us remind you that from October 1, there will be a limit of 150 thousand UAH per month on weekend transfers from card to card for six months. It will apply to all customer accounts in one bank. As the National Bank explained, such steps are needed to combat illegal activities, primarily the so-called “drops”. The regulator promises that neither volunteers nor ordinary Ukrainians will suffer from this decision.