iGaming & Gambling Compliance in Ukraine

Ukraine's online gambling market is open but tightly controlled. Since the 2020 legalisation, the regime has been rebuilt by Law No. 4116-IX, in force since 1 April 2025, which moved licensing and supervision to the State Agency of Ukraine PlayCity and added strict player-protection, payment and ownership rules. Policy is set by the Ministry of Digital Transformation; anti-money laundering (AML) supervision sits with the central executive body responsible for AML policy.

The biggest obstacle for a new entrant is structural rather than procedural: the licensee must be a Ukrainian resident company with at least UAH 30 million of cash share capital, local servers, a .UA domain and a full-time integration with state systems (the State Online Monitoring System and the restricted-access register). Offshore operators cannot serve Ukrainian players under a foreign licence.

1. Who regulates this sector

Cabinet of Ministers Resolution No. 314 of 21 March 2025 created PlayCity, and Resolution No. 505 of 2 May 2025 sets out its powers. Under amendments made on 17 September 2026, the agency's work is coordinated by the Prime Minister, while proposals on policy go to the Ministry of Digital Transformation. Ukraine is a unitary state: there is no regional licensing.

2. Licensing and authorisation

Article 2 of the Gambling Law (Law No. 768-IX) permits only five activities: land-based casinos, online casino, betting (in betting shops and online), slot halls and online poker. Each requires a licence and the use of certified equipment and online systems connected to the State Online Monitoring System. Gambling in temporarily occupied territories is prohibited, and lottery-style games may not be offered by online casinos.

Under Article 14, the operator must be a Ukrainian resident legal entity whose main activity is gambling, with share capital of at least UAH 30 million paid in cash from documented sources. Banks and other financial institutions cannot hold licences. Managers and owners must have an impeccable business reputation, and no owner, beneficial owner or brand may be linked to the state conducting armed aggression against Ukraine, to sanctioned persons or to jurisdictions on the international list of non-cooperating countries. The operator must also provide a deposit or bank guarantee for payouts of 7,200 minimum monthly wages. Software suppliers need their own services licence and the same ownership tests (Article 14-1). Each licence covers one brand.

Applications are made under the Cabinet of Ministers' licence conditions (Resolution No. 1341 of 21 December 2020, as amended by Resolution No. 1117 of 1 September 2025) and, since 1 May 2026, can be filed through the Diia state portal. Operating without a licence exposes the business to website and app blocking, refusal of payments by banks and referral to law enforcement (Article 25).

3. AML, KYC and customer due diligence

Gambling operators are reporting entities under Article 6 of the AML Law (Law No. 361-IX), classed as "specially designated" entities. Article 15 of the Gambling Law makes compliance with the AML Law a licence obligation, and a sanction imposed by the AML supervisor can include termination of the licence (Article 51).

When due diligence applies

Article 11(12) ties customer due diligence to the financial operation: before or during a payout, a stake refund or a bet when the operation is subject to monitoring as a threshold or suspicious operation. For casinos, it applies to chip exchanges and payouts (Article 10).

Threshold

For gambling operators, an operation is a threshold operation at UAH 55,000 or more (against UAH 400,000 for other sectors) when it has a listed risk feature (Article 20).

Reporting deadlines

Threshold operations involving aggressor-state or high-risk jurisdictions, politically exposed persons or e-residents: within 5 working days. Cross-border transfers and cash operations: by the 5th working day of the following month. Suspicious operations: immediately (Article 8).

Records

Due diligence records and transaction documents are kept for at least five years after the relationship or one-off operation ends (Article 8(2)(18)).

The data collected for a resident individual include full name, date of birth, identity document details, address, taxpayer number and, where available, the demographic register number (Article 11(9)). Politically exposed persons require senior management approval at or above the threshold, source of wealth and funds checks and enhanced monitoring (Article 11(14)). Separately from the AML Law, the Gambling Law requires every player to be identified at registration, whatever the amount (see section 4).

4. Identity verification and onboarding

Article 17 of the Gambling Law defines identification as collecting the player's full name, age (date of birth) and status in the Register of Persons with Restricted Access to Gambling. Land-based staff check an original identity document at the first visit. Online, the operator identifies the player when the personal account is created using methods lawful under data protection law.

• Remote methods named in the law: electronic signature, a SIM card supporting Mobile ID, BankID "or other verification methods used in accordance with the law" (Article 17(4)).
• Additional evidence: the operator may request further documents under its rules, including an image of the player holding the document, or require a video call (Article 17(5)).
• Age: players must be 21 or older; operators must have procedures that reliably verify age (Articles 17(7), 18(1)). Operators may set a higher minimum age.
• Timing: no personal account may be created, and no balance topped up, without identification (Cabinet Resolution No. 1370 of 29 October 2025, point 3(4)).
• One account, one bank account: a player may use only one personal account and one own account for all settlements; third-party funding and payouts are prohibited (Article 16(2)).

The register is searched by taxpayer number (or passport number for those who refused one), demographic register number, name and date of birth, or document number (point 19 of the procedure approved by Cabinet Resolution No. 1046 of 26 August 2025).

5. Digital channels: what's different

Bottom line: online operators need a separate online licence and must identify every player electronically before an account exists or money is deposited, under lower spending and time caps and cashless-only payment rules.

Electronic identification is the gateway

Article 17(4) names qualified electronic signatures, Mobile ID and BankID, which gives Ukrainian residents a fully remote route. For foreign players, whom online licensees may accept (Articles 24(3), 37(4) and 42(6)), the operator must rely on "other verification methods used in accordance with the law" and its own rules, such as document images and video calls under Article 17(5).

Lower limits and in-session controls

Ministry of Digital Transformation Order No. 207 of 26 December 2025 caps online spending at 15%, 25% and 40% of the player's self-declared monthly income per day, week and month, and online play at 6, 21 and 100 hours. Players set all three periods at once, may change spending limits only once a month, and must take a break of at least 15 minutes after 2 hours of continuous play. If the player sets no limit, the operator must set one (Resolution No. 1370). Online sites must also show a real-time clock on every page (Article 24(12)).

Blocking of unlicensed sites and apps

PlayCity may order access to unlicensed websites restricted through internet providers, which must act within three working days, and may ask app stores to remove unlicensed apps. Banks and payment providers must refuse payments to unlicensed operators (Article 25). During martial law, providers also block on orders of the national centre for operational and technical management of telecommunications networks issued at PlayCity's request (Law No. 4116-IX, amending the Electronic Communications Law).

Pending: military checks at login

Cabinet Resolution No. 804 of 17 June 2026 [Adopted, effective on publication of the PlayCity test report] will bar service members listed in the State Register of Military Personnel. Online operators must send a request to the restricted-access register that is verified with the qualified signature of the electronic identification provider; the operator sees only "restricted", never the reason.

6. Data protection and biometrics

The Gambling Law requires identification methods and verification through electronic signature, Mobile ID or BankID to comply with personal data protection legislation (Articles 17(2) and 17(8)), and obliges online operators to protect player information (Article 24(11)). Images of the player with a document, or video calls, are optional tools that the operator must cover in its rules and data protection basis.

Player data sent to the State Online Monitoring System is not personalised: it travels as a unique player identifier generated by an algorithm approved by Ministry of Digital Transformation Order No. 61 of 27 March 2026, in force since 8 May 2026. Only the restricted-access register holds identified records. Online systems and the data they process must stay in Ukraine (Article 23(3)). AML records must be kept for at least five years; the monitoring system keeps data at least for the licence term and the tax limitation period (Article 13).

7. Sector-specific obligations

Self-exclusion and family restrictions

A person may self-exclude for six months to three years, on paper or through the Diia portal; the request cannot be withdrawn and one filing binds every operator. Close family members or legal representatives can request a restriction of up to six months, for example where gambling exceeds income or the person receives housing subsidies, and courts can impose up to three years (Article 16). When a player is added to the register, the operator must pay out balances within five days and close access. Admitting a barred player obliges the operator to repay ten times the losses.

Player-protection duties

Operators must track playing behaviour and stop play when signs of problem or pathological gambling appear, show regular time and spend messages that the player must acknowledge, keep a history of play in the personal account and offer support by online form or telephone (Resolution No. 1370). Loss-linked bonuses and gifts, credit for betting, and advertising of financial services are prohibited (Articles 15 and 16).

Payment settlement rules

Article 15-1 requires all settlements to pass through current accounts at Ukrainian banks. Operators may not use payment institutions, e-money institutions, postal operators or commercial agents, and banks may not route gambling payments through them. The National Bank may sanction a bank that breaches these rules.

State Online Monitoring System

Every bet, refund and payout must be recorded in the operator's online system and transmitted in real time to the State Online Monitoring System (Articles 12, 13 and 15). The system entered test operation on 10 April 2026, and the first 11 operators were connected in testing by 12 May 2026. Failure to connect within ten days of licensing is a ground for licence termination (Article 51).

8. Risk indicators and red flags

Gambling-specific indicators drawn from Ukrainian law and PlayCity

• Third-party funding: deposits from a card or account not in the player's name, which Articles 15 and 16 prohibit.
• Peer-to-peer card transfers: deposits paid to personal cards rather than the operator's bank account.
• Payout redirection: requests to pay winnings or refunds to another person.
• Multiple accounts: one person behind several personal accounts or bank accounts.
• High-risk counterparties: operations linked to the aggressor state or non-cooperating jurisdictions, or by politically exposed persons, at UAH 55,000 or more.
• Unlicensed-market signs: foreign licence claims, crypto deposits, non-.UA domains and betting without identification, as listed by PlayCity.
• Unusual betting on sport: atypical player behaviour that must be reported under the sports integrity law (Article 18(5)).

9. Enforcement and penalties

PlayCity fines are fixed multiples of the minimum monthly wage per breach (Article 58 of the Gambling Law): 500 for breaching any player-protection duty in Article 16(2), such as identification, register checks or limits; 1,000 for breaching the settlement rules; 150 for failing to submit reports; 100 for refusing access to the online system during an inspection. A second breach within a calendar year, or a single breach of the settlement or brand rules, is a ground for licence termination (Article 51). Internet providers that do not block unlicensed sites face fines of 2,000 non-taxable minimum incomes, doubled for repeat breaches.

AML fines under Article 32 of Law No. 361-IX are expressed in non-taxable minimum incomes: up to 12,000 for due diligence breaches and up to 20,000 for reporting failures, among other tiers. Where several breaches are fined together, the total for non-financial entities is capped at twice the benefit obtained or, if that cannot be determined, 1,590,000 non-taxable minimum incomes.

On 22 April 2026, PlayCity terminated the online casino licence of TOV "Spacix" (brand Cosmolot) for settlement breaches, including peer-to-peer payments, and imposed fines of UAH 8.6 million for those payments and UAH 4.3 million for allowing deposits from third parties' cards. In March 2026, the Supreme Court (case No. 320/33758/24) upheld a fine on the basis that displaying a gambling brand in outdoor advertising is gambling advertising.

10. Recent changes and what to watch

• 1 September 2026: Bill No. 11231 on a gambling moratorium [Bill, not enacted] was included in the parliamentary agenda; it remains in committee and would suspend gambling if adopted.
• 28 August 2026: national strategy against gambling addiction to 2035 [Adopted] with an operational plan for 2027 to 2029, including programmes for military personnel and systematic blocking.
• 17 June 2026: Resolution No. 804, military restriction [Partly in force]; the blocking mechanism starts when PlayCity publishes the test report with the Ministry of Defence, targeted by 24 December 2026.
• 10 April 2026: State Online Monitoring System in test operation [Testing]; operators should complete integration before connection becomes mandatory in practice.
• March 2026: Ministry of Digital Transformation draft amendments [Proposed, public consultation] to the Gambling Law and Tax Code, including mandatory behaviour monitoring and stronger ownership checks.
• 26 December 2025: Order No. 207 on spending and time limits [In force] since its official publication in January 2026.
• 1 April 2025: Law No. 4116-IX [In force]; PlayCity replaced KRAIL, and the payment, ownership and player-protection rules described above apply.

11. What this means for identity verification

Verification sits at the very start of the online journey: an unverified visitor cannot open an account or deposit. For Ukrainian residents, integrations with qualified electronic signature, Mobile ID and BankID cover the methods named in the law; document capture with a face image and video calls serve as additional evidence and as the route for foreign players. Age logic must use 21, not 18.

The identity data captured must support the register search identifiers (taxpayer number, demographic register number, name and date of birth, document number) and, once Resolution No. 804 applies, a verified request carrying the identification provider's qualified signature. Payment-instrument checks matter as much as document checks, because the deposit account must belong to the verified player. Re-verification is needed when identification data are doubtful and at payouts or refunds reaching UAH 55,000 or appearing suspicious. Evidence should be retained for at least five years and stored in Ukraine where it forms part of the online system.