NBU Regulation 143
National Bank of Ukraine Regulation on organising information security and cyber protection measures by financial service providers, approved by Resolution No. 143 — National Bank of Ukraine
Also known as: Постанова НБУ № 143, НБУ 143, Положення про організацію заходів із забезпечення інформаційної безпеки та кіберзахисту надавачами фінансових послуг, Кіберзахист надавачами фінансових послуг
Official site Official change log Subscribe to NBU Regulation 143 (RSS)
At a glance
- Current version
- NBU Resolution No. 143 of 9 December 2025 (as adopted)
- Published 9 December 2025. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Non-bank financial institutions: insurers, credit unions, finance companies and pawnshops; not payment service providers. source
- How it is assessed
- The provider's head designates a responsible person for information security and cyber protection, approves internal documents and runs an incident response plan. source
- Written by
- A resolution of the Board of the National Bank of Ukraine under the laws on the National Bank, on financial services and financial companies, and on insurance. source
- Enforced by
- The National Bank can demand information on incident response by written request, which the provider's head must answer with accurate information. source
- Last change
- None recorded yet
Resolution No. 143 brings non-bank financial service providers — insurers, credit unions, finance companies, pawnshops — under an information security regime for the first time. It is issued under the laws on the National Bank, on financial services and on insurance.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesVersion history
-
NBU Resolution No. 143 of 9 December 2025 (as adopted) Major versionCurrent
The Board approved the Regulation on organising information security and cyber protection measures by financial service providers; it entered into force on 13 December 2025. source
Who it applies to
The Regulation covers non-bank financial institutions and gives them 12 months from entry into force to comply.
- Covered providers
- Non-bank financial institutions: insurers, credit unions, finance companies and pawnshops (Regulation, point 1). source
- Not covered
- Providers of payment and ancillary services, and postal operators entitled to trade in currency values (Regulation, point 4). source
- Transition period
- Financial service providers must bring their activity into line with the Regulation within 12 months of the day the resolution entered into force (resolution, clause 2). source
- Reference frameworks
- Developed taking into account Regulation (EU) 2022/2554 (DORA), DSTU ISO/IEC 27001:2023 and DSTU ISO/IEC 27002:2023 (Regulation, point 1). source
How compliance is assessed
The provider's head designates a responsible person for information security and cyber protection, approves internal documents and runs an incident response plan.
- Responsible person
- The head of the provider appoints, by a separate decision, a person responsible for implementing information security and cyber protection requirements, or performs the role personally (points 11 and 12). source
- Asset register
- The responsible person updates the list or register of software and hardware at least once a year (point 13). source
- Incident response plan
- Providers implement an incident management process and approve a response plan that is part of, or consistent with, business continuity planning (points 39 and 40). source
Enforcement and penalties
The National Bank can demand information on incident response by written request, which the provider's head must answer with accurate information.
- Written request
- The National Bank may require a provider to give information on its response to cyber incidents and information security incidents by a written request sent by NBU email (points 44 and 45). source
- Duty to answer
- The provider's head must ensure accurate information is provided in the manner, time, scope and format set in the request (point 46). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 24 September 2026. Subscribe to NBU Regulation 143 (RSS)