Cloud services for financial institutions and banks
On August 25, 2025, the Decree of the Board of the National Bank of Ukraine No. 99 approved the Regulation on the use of cloud computing technologies (hereinafter referred to as the Regulation).
It is determined by the Regulation that the use of cloud services is carried out on the basis of the agreement on cloud services concluded between the institution - the user of cloud services and the provider of cloud services (hereinafter - the Agreement). The contract is either in the form of a paper document with handwritten signatures of the parties, or in the form of an electronic document with qualified electronic signatures of the parties.
In particular, the Contract must contain: 1) a list and description of the services provided; 2) procedure and conditions of information security provision by the institution – user of cloud services and provider of cloud services; 3) procedure and terms of reporting by the provider of cloud services to the institution – the user of cloud services on compliance with the requirements of the Agreement, including information security issues; 4) the condition of the right of the establishment - the user of cloud services to unilaterally terminate the Agreement, make changes to the Agreement on the grounds and in the order provided by the Agreement; 5) measures to ensure the continuity of the provision of services to the institution - the user of cloud services, which must be performed by the provider of cloud services; 6) the obligation of the cloud service provider not to disclose to third parties information about the data of the cloud service provider-user, which became known to the cloud service provider when providing the services, unless otherwise determined by the legislation of the country of registration of the cloud service provider or the terms of the Agreement; 7) the obligation of the provider of cloud services periodically, but not less than once a year, to provide the institution - the user of cloud services or to publish (with the name of the resource) certificates of compliance with international standards of information security, which include the certification of those cloud services that are provided to the institution - the user of cloud services; 8) conditions for granting and canceling access to the institution - user of cloud services to cloud resources of the provider of cloud services; 9) Prohibition on processing and storing data of institutions - users of cloud services with the help of cloud computing technology and data processing centers located on the territory of the aggressor state, the state carrying out armed aggression against Ukraine, the temporarily occupied territory and/or belonging to subjects whose activities are subject to the Law of Ukraine "On Sanctions" and in respect of which a decision has been made to apply sanctions in Ukraine, as well as other conditions stipulated By position.
The provision also provides that the institution - the user of cloud services is obliged to provide information about the conclusion of the contract within one month from the date of conclusion of the contract by sending a corresponding notification to the National Bank of Ukraine.
In addition, the specified Provision provides that the institution - the user of cloud services is obliged to determine the responsible persons for the implementation and use of cloud services.
I draw your attention to the fact that the Decree of the Board of the National Bank of Ukraine No. 99 "About the approval of the Regulation on the order of application of cloud computing technology and the introduction of changes in the Regulation on the organization of accounting in banks of Ukraine" comes into force on November 1, 2025.
