NBU Resolution #99

NBU Resolution No. 99 is a regulatory document that defines how regulated financial institutions in Ukraine may use cloud services. The document establishes requirements for cloud provider selection, contractual arrangements, risk management, data protection, business continuity, partner chains, and notification of the National Bank of Ukraine (NBU). The resolution came into force on November 1 of the previous year; however, a six-month transition period was established for organizations with existing contracts. As of May 1, 2026, these requirements are mandatory for all entities.

The document is primarily aimed at cloud service users—banks, payment systems, and similar institutions—which are required to notify the NBU, manage risks, control contractual relationships, and assume responsibility for the use of cloud infrastructure. At the same time, the resolution is also highly significant for cloud providers, as financial-sector clients are now required to demand transparent contractual models, verified certifications, security reporting, incident management, and disclosure of partner chains.

Within Resolution No. 99, the NBU formalizes the use of cloud services in the regulated financial sector. Organizations are permitted to use cloud service models such as IaaS, PaaS, SaaS, SECaaS, and others, including within private, community, and hybrid cloud models. Users may independently select a cloud provider but are required to comply with Ukrainian legislation on the protection of personal and other types of data.