The NBU Tightens Bank Capital and Cybersecurity Requirements: Why It Concerns You
On 30 June 2026, the National Bank of Ukraine adopted Resolution No. 71, changing the approach to calculating capital adequacy for banks and banking groups. The new rules take effect on 31 July 2026, with banking groups following from 31 December 2026. The wording sounds dry and purely technical, but behind it lies a simple idea: the bank holding your money now has to keep a bigger safety margin against unexpected losses. In parallel, in June 2026, the regulator also approved a package of documents on cybersecurity for the financial sector and on managing outsourcing risk — again, not a bureaucratic footnote but a direct response to real threats the banking system faces during the war.
What Capital Adequacy Means in Plain Terms
A Bank's Capital Is Not Depositors' Money — It Is a Safety Cushion
When you bring money to a bank as a deposit or keep it in a current account, the bank does not lock those funds in a vault and wait for you to withdraw them. It lends the money out, invests in securities, and trades foreign currency. That is the normal banking model the whole economy runs on. But any of these operations can end in a loss: a borrower may fail to repay a loan, an exchange rate may move against the bank, or a counterparty may fail to honor its side of a deal. To absorb exactly these kinds of losses, a bank holds its own capital — shareholders' money, not clients' money. The larger a bank's capital relative to the risks it takes on, the higher the chance it survives a crisis without touching your deposit or turning to the state for a bailout.
A capital adequacy requirement is a formula that sets how much of its own capital a bank must hold relative to the risks it carries. As the regulator, the NBU continuously refines this formula, adding new risk categories that were previously either ignored entirely or only partially accounted for.
What Settlement Risk Is, and Why It Is Being Addressed Only Now
Resolution No. 71 adds a new element to the formula: settlement risk. This is the risk of losses a bank may incur if, during a transaction involving securities, commodities, or foreign currency, a counterparty fails to settle its side of the deal on time or at all. For example: a bank sells foreign currency to another market participant and expects hryvnia in return by an agreed date, but the counterparty fails to deliver. Until now, this risk could exist off the books of the capital requirement — not directly factored into the capital adequacy calculation. Banks are now required to set aside a dedicated capital buffer against it.
This is not an abstract change made merely for the sake of statistics. Resolution No. 71 is part of a broader process of harmonizing Ukrainian banking regulation with European Union standards, a path Ukraine is following on its way to EU membership. The closer Ukrainian banks operate under rules identical to European ones, the easier it becomes for them to integrate into the European financial space, attract foreign capital, and work with foreign partners — and, as a result, the more stable the whole system holding your money becomes.
Bank Cybersecurity: Just as Important as Capital
The Financial Sector Is a Prime Target for Cyberattacks During the War
Alongside the updated capital requirements, in June 2026 the NBU approved a package of documents on cybersecurity for the financial sector, including critical information infrastructure, as well as on managing third-party risk — that is, the risks tied to outsourcing technology and operational services. These decisions logically continue earlier NBU steps on information security for the financial sector and introduce a unified approach to third-party risk management for banks, banking groups, payment service providers, and insurers.
To an ordinary customer, this may sound like internal IT-department business. But behind it is a very practical question: will you be able to log into your bank app tomorrow, make a transfer, receive your salary on your card, or use your personal account to pay utility bills? During the full-scale war, Ukraine's banking system regularly faces attempted cyberattacks on payment infrastructure, remote-service systems, and the communication channels between banks and their customers. A successful attack on a large bank is not merely a technical glitch — it is a potential threat to millions of people who use online banking, cards, and mobile apps every day.
Why Outsourcing and Third Parties Are a Weak Point
A modern bank rarely does absolutely everything in-house: data processing, cloud services, support for processing systems, and app development are often handed to external contractors. This is a normal and economically sound practice. But every such contractor is an additional entry point for attackers and an additional failure risk the bank does not always fully control. That is exactly why the NBU's new third-party risk management requirements oblige banks to spell out contractor agreements more precisely, verify contractors' level of protection, and maintain a contingency plan in case a contractor fails. For you as a customer, this means one thing: a bank that meets the new requirements is less vulnerable to a situation where a failure at an outside supplier suddenly leaves you unable to use your card or app.
How an Ordinary Person Can Assess Their Bank's Reliability
Deposit Guarantee Fund Coverage — the First and Most Important Filter
The simplest and most concrete indicator of protection for your money is whether your bank participates in the Deposit Guarantee Fund for individuals (DGF). During martial law and for three months after it ends, the Fund reimburses a depositor the full amount of their deposit, together with accrued interest. This is an exceptional wartime rule — in peacetime a lower reimbursement ceiling will apply. Before entrusting a bank with a significant sum, check on the Deposit Guarantee Fund website whether your bank participates in the guarantee scheme. For the vast majority of operating banks this is standard practice, but the check takes literally a minute and removes a basic layer of worry.
It is important to understand that the Fund's guarantee is the last line of defense, not a reason to stop thinking about your bank's reliability altogether. If a bank is withdrawn from the market, you will get your money back, but the compensation process takes time and nerves — both in short supply during a war. That is why it makes sense to assess a bank's reliability before anything goes wrong, not after.
Reputation, Transparency, and the Regularity of NBU Inspections
A second benchmark is a bank's public track record and how often, and how transparently, it interacts with the regulator. The NBU regularly publishes statistics and sector reviews on its website, including information on banks' compliance with capital and liquidity requirements and on any enforcement measures applied to individual banks. A bank that has consistently met its requirements for years, has not made headlines over market withdrawal, resolution, or large-scale technical outages, and regularly passes inspections without critical findings has a longer track record of reliability than one that entered the market recently or has had troubled episodes in the past.
Pay attention to everyday, practical signals too: does the bank app work reliably, do transaction notifications arrive on time, does customer support respond promptly. Day-to-day technical stability is an indirect but genuinely useful indicator of how seriously a bank takes the infrastructure and security issues that the new NBU requirements specifically address.
Diversification — a Simple Way to Reduce Risk Regardless of Your Bank
Even the most reliable bank is not one hundred percent immune to force majeure, especially in wartime conditions. A sound strategy, therefore, is not to keep all your savings in one place. Funds you might need quickly are best kept in a savings account that allows deposits and withdrawals without losing accrued interest. Money for a longer horizon can go into a term deposit, provided the amount at any single bank stays within the guaranteed reimbursement limit. And if you are planning to use credit products, it is worth comparing terms across several banks on BankSorter in advance, looking not only at the loan rate but also at how transparently the bank discloses information about itself.
Summary: What You Should Do Right Now
Resolution No. 71 and the accompanying package on cybersecurity and third-party risk management are not just news for bankers — they are a signal for every customer that the regulator is systematically closing gaps in the protection of the banking system, moving it step by step closer to European standards. For you, that means it is worth taking a few simple steps:
- Check whether your bank participates in the Deposit Guarantee Fund — a basic step that takes just a few minutes.
- Follow official NBU announcements about the state of banks rather than relying solely on rumors or advertising.
- Do not keep all your savings in a single bank, especially if the amount exceeds the guaranteed limit — split it between a savings account and a deposit at different banks.
- Pay attention to the technical stability of your bank app — it often correlates with how seriously a bank invests in cybersecurity.
Compare bank terms on BankSorter — from personal accounts to deposits and loans — and make financial decisions based on facts, not guesswork.