eCommerce & Marketplaces Compliance in Ukraine

The Ukrainian market is open to online retail and marketplaces without sector licensing. The rules that matter are disclosure and consumer rights for distance sales, product-specific licensing for regulated goods such as alcohol and tobacco, and, increasingly, tax rules that turn platforms into a source of data about their sellers.

The State Service of Ukraine on Food Safety and Consumer Protection enforces consumer law, the State Tax Service licenses and polices excise goods and is preparing to receive platform reports, and the National Bank of Ukraine regulates any payment activity a marketplace performs.

The biggest near-term obstacle is the 1 November 2026 start of mandatory online age verification for alcohol, tobacco and e-cigarette sales, which requires a two-step check (at order and at delivery) that most checkout flows do not yet perform.

1. Who regulates this sector

Ukraine is a unitary state: all licensing and supervision described here is national. Regional offices of the State Service on Food Safety and Consumer Protection and of the State Tax Service carry out inspections and publish guidance for their oblasts.

The Antimonopoly Committee of Ukraine also has powers over unfair commercial practices and competition on digital markets, which are outside the scope of this briefing.

2. Licensing and authorisation

There is no licence or registration specific to e-commerce. An online shop or marketplace operator needs the ordinary business registration of a legal entity or sole proprietor, and the Law of Ukraine on Electronic Commerce (No. 675-VIII of 3 September 2015) then governs how it contracts online. That Law requires every seller in electronic commerce to give other participants direct, simple and stable access to its full name, location, email or web address, identification code (EDRPOU for companies, taxpayer registration number for sole proprietors) and licence details where its activity is licensed.

Product-specific licences

Licensing attaches to the goods, not to the channel. Retail sale of alcoholic beverages, tobacco products and e-cigarette liquids requires a retail licence under Law No. 3817-IX of 18 June 2024 on state regulation of the production and circulation of ethyl alcohol, alcoholic beverages, tobacco products and related goods [In force], which replaced the 1995 law (No. 481/95-VR) from 1 January 2025. State Tax Service guidance confirms that a seller delivering alcohol to consumers needs a valid retail licence and a place of trade equipped with a cash register or software cash register, and must comply with Article 71 on age and sale restrictions.

Payment activity

A marketplace that only connects buyers and sellers, with payments processed by a licensed provider, needs no financial authorisation. A platform that collects buyers' money and pays it on to sellers is performing payment activity regulated by the National Bank under the Law of Ukraine on Payment Services (No. 1591-IX of 30 June 2021) and must either hold the relevant authorisation or route funds through an authorised provider.

3. Identity framework (AML rules do not apply)

Online retailers and marketplaces are not, as such, primary financial monitoring entities under the Law of Ukraine on Prevention and Counteraction to Legalisation (Laundering) of the Proceeds of Crime, Financing of Terrorism and Financing of Proliferation of Weapons of Mass Destruction (No. 361-IX of 6 December 2019). The Law's list of obliged entities covers financial institutions and a closed set of designated businesses. Two edges matter for e-commerce: businesses that trade precious metals, precious stones and articles made from them for cash are designated entities, and a platform that itself provides payment services falls within the financial-institution categories. For obliged entities, transactions of UAH 400,000 or more are threshold transactions that must be reported to the State Financial Monitoring Service.

For everyone else, identity in Ukrainian e-commerce is governed by contract and consumer law rather than due diligence rules:

Buyer data

Under the Law on Electronic Commerce the buyer must provide the information needed to conclude the electronic contract, and the seller may demand only the information without which the contract cannot be concluded and performed. There is no general duty to verify a buyer's identity.

Seller transparency

Every seller must disclose its legal identity and identification code. On a marketplace, each third-party seller is a "seller in electronic commerce" with its own disclosure duty.

Age-restricted goods

Law No. 3817-IX imposes the only mandatory buyer verification in the sector: proof of age 18 for alcohol, tobacco, e-cigarettes and related devices.

Sanctions

The Law of Ukraine on Sanctions (No. 1644-VII) applies to all businesses; restrictive measures are published in decisions of the National Security and Defence Council enacted by Presidential decree.

4. Identity verification and onboarding

For ordinary goods, onboarding a buyer means collecting contract data and delivery details; documentary checks are neither required nor encouraged by the data-minimisation rule in the Law on Electronic Commerce. Verification becomes mandatory in one case: the online sale of alcoholic beverages, tobacco products, e-cigarettes, refill containers, e-liquids and heated-tobacco devices.

Age verification at order

Article 71(9) of Law No. 3817-IX allows these goods to be sold through electronic trade (remote communication or online shops) only if three conditions are met at the same time [Applies from 1 Nov 2026]. First, the end consumer's age of 18 must be identified before the sale, at the ordering stage, using information from one of:

• an e-passport or e-passport for travel abroad, or an electronic driving licence;
• another electronic display of document information generated through the Unified State Web Portal of Electronic Services (Diia);
• other identification means that unambiguously establish that the person is 18 or over;
• recognition technology; or
• an operator engaged by the seller that carries out remote identification of the consumer in real time and checks age.

Second, goods must be dispatched from the licensed place of trade. Third, the goods must be handed directly to the consumer with the in-person age check in Article 71(5) and (6): if the seller or courier doubts that the buyer is 18, it must ask for a passport, passport for travel abroad, driving licence or other document confirming age, or electronic copies of them, including through the Diia app; if the buyer refuses, the sale or handover is prohibited.

Accepted documents and methods

The Article does not specify a liveness standard, an assurance level or a certification scheme for the remote operator or the recognition technology. The test is outcome-based: the method must establish age unambiguously. Diia electronic documents are expressly accepted at both stages. During martial law, Cabinet of Ministers Resolution No. 248 of 2022 also recognises the "eDocument" in Diia as an identity document displaying passport data.

Seller onboarding on marketplaces

No law currently requires a marketplace to verify its sellers' identity documents. In practice the disclosure duty means the platform must capture and display each seller's legal name, location and identification code, and a seller of licensed goods must hold the relevant licence. The platform tax law described in section 7 would add formal seller identification and reporting once it is signed and in force.

5. Digital channels: what's different

Bottom line: for ordinary goods the online channel adds disclosure and cancellation rights but no identity checks; for alcohol, tobacco and e-cigarettes it adds a mandatory remote age check at order, on top of the counter-style check at delivery, from 1 November 2026.

Remote age assurance becomes a legal condition of sale

Article 71(2)(10) of Law No. 3817-IX prohibits selling these goods by electronic trade except as allowed by Article 71(9). The final provisions originally brought both rules into effect 18 months after the Law, and Law No. 4698-IX of 3 December 2025 moved the date to 1 November 2026 [Applies from 1 Nov 2026]. A tick-box declaration does not meet the text, which requires information from an identity document or a method that establishes age unambiguously.

Payments and blocking

Article 71(10) requires sellers of these goods online to settle payments only through accounts at payment service providers in Ukraine, and empowers the State Tax Service to monitor the internet and require sellers, hosting providers and digital distribution platforms to restrict access from Ukraine to infringing websites, domains, IP addresses and apps within three working days, with domain blocking ordered through the national centre for operational and technical management of electronic communications networks.

Distance contracts

A buyer in electronic commerce has the rights of a consumer under a distance contract. Under Article 13 of the Law of Ukraine on Consumer Protection (No. 1023-XII of 12 May 1991), the seller must provide pre-contract information on its identity and complaints procedure, the product, the price including delivery, warranty and termination, and the consumer may terminate within 14 days of confirmation or receipt of the goods.

6. Data protection and biometrics

The Law of Ukraine on Personal Data Protection (No. 2297-VI of 1 June 2010) applies to all identity data captured at checkout, supervised by the Ukrainian Parliament Commissioner for Human Rights. Two sector rules sharpen it. The Law on Electronic Commerce limits what a seller may request to information without which the contract cannot be concluded and performed, and requires a seller that asks for payment-instrument details to protect them. Commercial electronic messages may be sent only with the recipient's consent.

The age-verification rule creates the main tension. Article 71(9) permits recognition technology and real-time remote identification, both of which process facial images, but sets no retention period or specific legal basis for that data; the general personal data law therefore governs consent, purpose limitation and storage. Collecting only an age attribute (for example a yes/no result from a Diia document or a remote operator) rather than a full document copy is the approach most consistent with the data-minimisation rule.

A replacement Law on Personal Data Protection aligned with the EU General Data Protection Regulation (bill No. 8153) [Proposed, first reading adopted] was adopted at first reading in November 2024; the Verkhovna Rada human rights committee was still preparing it for second reading in December 2025.

7. Sector-specific obligations

Platform reporting and tax withholding

The Verkhovna Rada adopted Law No. 4903-IX on international automatic exchange of information on income earned through digital platforms and its taxation (bill No. 15111-d) on 9 June 2026 and sent it to the President for signature on 12 June 2026 [Passed, awaiting signature]. The Law implements the OECD model reporting rules for platform operators and the EU's DAC7 directive. According to the Ministry of Finance, platform operators would report users' income to the State Tax Service and act as tax agents for individual sellers, and taxation under the new rules would start no earlier than 1 January 2027. Marketplaces should expect to collect and verify seller identity and tax data once the Law takes effect.

VAT on imported parcels

On 15 October 2026 the Verkhovna Rada adopted bill No. 16051-1 amending the Tax Code on value added tax for distance sales of goods sent across the customs border in international postal and express shipments [Passed, awaiting signature]. Cross-border marketplaces selling to Ukrainian consumers should monitor the signed text for registration and collection duties.

Consumer protection reform waiting for the end of martial law

The new Law of Ukraine on Consumer Protection (No. 3153-IX of 10 June 2023) [Adopted, effective after martial law] regulates off-premises and distance contracts with a 14-day withdrawal right and new fines. It takes effect no earlier than the day martial law ends or is lifted; until then, Law No. 1023-XII applies. The Cabinet of Ministers approved new Rules of Trade Service by Resolution No. 144 of 11 February 2025, which take effect together with Law No. 3153-IX.

8. Risk indicators and red flags

Online retail and marketplace risk indicators

• Anonymous seller pages: only an email or phone number shown, with no legal name, location or identification code.
• Excise goods without a licence: alcohol, tobacco or e-liquids offered by a seller with no retail licence or place of trade.
• Self-declared age only: age-restricted orders accepted on a checkbox, without document-based or remote verification.
• Payments routed abroad: excise goods paid through accounts outside Ukrainian payment service providers.
• Handover without checks: couriers delivering restricted goods to a recipient who cannot show proof of age.
• No receipt: goods delivered without a settlement document, leaving the buyer unable to enforce consumer rights.
• Precious metals for cash: jewellery or bullion sold with cash on delivery, which brings the seller into AML scope.

9. Enforcement and penalties

Penalties in Ukrainian consumer and excise law are set either as multiples of the non-taxable minimum income of citizens or of the statutory minimum wage, or as a multiple of the value of the goods.

Martial law limits inspections. Cabinet of Ministers Resolution No. 303 of 13 March 2022 [Inspections suspended, with exceptions] suspends planned and unplanned state supervision for the period of martial law, while allowing unplanned measures on listed grounds, including unplanned consumer-protection measures on the decision of the State Service on Food Safety and Consumer Protection. The Resolution was last amended in July 2026. The online-sale blocking powers in Article 71(10) operate without an inspection.

10. Recent changes and what to watch

• 1 November 2026 [Applies from 1 Nov 2026] Mandatory online age verification for alcohol, tobacco and e-cigarettes under Article 71(9) of Law No. 3817-IX, after the deferral by Law No. 4698-IX of 3 December 2025.
• 15 October 2026 [Passed, awaiting signature] Parliament adopted bill No. 16051-1 on VAT for distance sales of goods in international postal and express shipments; cross-border sellers should prepare for VAT collection once it is signed.
• 12 June 2026 [Passed, awaiting signature] Law No. 4903-IX on digital platform reporting and taxation was sent to the President; platforms should plan seller identification and reporting for 2027.
• December 2025 [Proposed] The GDPR-aligned personal data bill No. 8153 remained in committee preparation for second reading.
• 11 February 2025 [Adopted, effective after martial law] New Rules of Trade Service approved, to apply together with Consumer Protection Law No. 3153-IX.
• 1 January 2025 [In force] Law No. 3817-IX replaced Law No. 481/95-VR as the regime for alcohol and tobacco retail, including online sales.

11. What this means for identity verification

For most of the catalogue, identity verification is a fraud-control choice, not a legal requirement, and the data-minimisation rule argues against collecting identity documents from ordinary buyers. Design priorities differ by role:

• Age-restricted goods: build a pre-order age gate that accepts Diia electronic documents and e-passports and, for buyers without them, a real-time remote identification or recognition-based check. Keep a record that the check was performed, because the Tax Service enforces Article 71.
• Delivery: equip couriers to inspect physical documents or Diia copies and to refuse handover; the delivery person carries the sanction for its own breach.
• Data handling: retain the age result rather than document images where possible, and apply the general personal data law to any facial images processed.
• Marketplace sellers: capture legal name, location, EDRPOU or taxpayer number and licence details for display now, and prepare to verify tax identity for platform reporting from 2027.
• Re-verification triggers: a change in a seller's legal details, a new category of licensed goods, or a switch to cash payment for precious metals.