NBU wants to introduce new payment control rules: banks will check atypical transactions according to new criteria

NBU wants to introduce new payment control rules: banks will check atypical transactions according to new criteria

The National Bank of Ukraine has submitted for public discussion a draft resolution that significantly changes approaches to payment transaction control. The document provides for the introduction of unified standards for payment monitoring, the use of artificial intelligence for risk analysis, and strengthening the fight against fraud and miscoding.

The new requirements will apply to banks, payment institutions, electronic money institutions, postal operators, and other financial institutions that provide payment services.

What will change

The draft resolution provides for the creation of a unified system for controlling payment transactions and managing operational risks. In particular, financial institutions will be required to:

conduct constant monitoring of payment transactions;
conduct daily reconciliation of payments;
identify operational errors and atypical transactions;
implement internal risk control rules;
prevent cases of miscoding – the use of inappropriate MCC codes to hide the real type of merchant’s activity.

After the resolution enters into force, payment market participants will have 90 calendar days to bring their internal procedures into line with the new requirements.

NBU will allow the use of artificial intelligence

One of the key innovations will be the official use of artificial intelligence (AI) and machine learning technologies to analyze payment transactions.

Such models will be able to automatically detect atypical financial behavior of customers and assess the risk level of transactions.

At the same time, institutions that will use AI must ensure constant updating of models, training of algorithms and quality control of their work.

Transactions will be assessed by risk level

The document proposes a risk-based approach to payment monitoring.

Depending on the results of the analysis, each transaction will be assigned one of three risk levels:

low – the transaction is performed automatically;

medium – the payment may be temporarily suspended for additional verification or confirmation by the client;
high – the transaction will be blocked until the verification is completed.

What transactions will be considered suspicious

The project contains a list of signs of atypical financial behavior that may be grounds for additional verification.

Among them:

a large number of bank accounts or cards;
an excessive number of payments of the same type;
dozens of account replenishments in a short period of time;
large turnover of funds with minimal account balances;
instant transfer of received funds to other persons;
regular receipts to personal accounts with signs of hidden entrepreneurial activity;
receiving a large number of transfers from different persons;
use of the same device or IP address by different unrelated users;
making payments from different regions during a period of time during which it is physically impossible to move between these places.

Special attention will also be paid to gambling-related transactions, the use of incorrect MCC codes, and the sharp increase in the activity of new merchants.

Public discussion continues

Discussion of the draft resolution will continue until July 31, 2026. If the document is adopted, financial institutions will be required to update internal monitoring systems, and internal audits will check the effectiveness of new control mechanisms at least once a year.

The NBU notes that the new rules should strengthen the security of the payment infrastructure, minimize operational risks, and make it more difficult to use the financial system for fraudulent schemes.