Insurance & Insurtech Compliance in Ukraine

Ukraine's insurance market is open to licensed insurers and is increasingly digital, despite martial law in force since February 2022. A single authority, the NBU, licenses insurers, registers intermediaries and supervises AML compliance, which gives online insurers one rulebook to follow.

The biggest obstacle for a new entrant is the licence itself: a Ukrainian joint-stock or additional-liability company (or a branch of a foreign insurer), minimum capital of UAH 32 million to UAH 48 million depending on the classes written, and NBU approval of owners and key officers. Once licensed, the onboarding rules are among the most specific in the region on what makes a remote identity check valid.

1. Who regulates this sector

All licensing and supervision is national; the Law on Insurance defines the "Regulator" as the NBU.

2. Licensing and authorisation

Under Article 11 of the Law of Ukraine "Про страхування" [On Insurance] No. 1909-IX of 18 November 2021 [In force], a legal entity becomes an insurer only after obtaining an NBU licence, and insurance activity without a licence is prohibited. Licences are granted by class: 18 non-life classes and five life classes (Article 4). A single company may not hold both life and non-life licences, apart from limited health insurance combinations (Article 11(7)).

Who may write business

Article 3(3) limits insurance activity to licensed resident insurers, licensed branches of foreign insurers, and foreign insurers acting under Article 6. Article 6 lets a foreign insurer write aviation, marine, cargo and related liability classes (classes 5, 6, 7, 11 and 12) and reinsurance without a Ukrainian licence. Conditions include WTO membership of the home state, no international AML warnings against it, and not being based in an aggressor state.

Process, timeline and capital

Insurers must be joint-stock companies or additional-liability companies (Article 8). The application package covers a three-year business plan, ownership structure, source of funds for share capital, and the fitness of executives, the chief risk, compliance and internal audit officers and the responsible actuary (Article 12). The NBU decides within three months, extendable by up to 30 working days (Article 13, as amended by Law No. 4017-IX). Article 40(3) sets minimum capital floors of UAH 32 million for most non-life classes and UAH 48 million for liability, credit and suretyship classes, life insurance and inward reinsurance.

Distribution licences

Agents, brokers and ancillary insurance agents may sell insurance only once entered in the NBU Register of Intermediaries (Articles 72 and 77). These rules, in Section XII of the Law, have applied since 1 January 2025. Brokers and intermediaries that handle client money must hold professional liability insurance and a segregated special-regime bank account, and pass premiums to resident insurers within three working days (Article 69).

3. AML, KYC and customer due diligence

Article 6(2)(1) of the Law of Ukraine No. 361-IX of 6 December 2019 on preventing money laundering, terrorist financing and proliferation financing [In force] names insurers (including when reinsuring) and insurance and reinsurance brokers as obliged entities. Unlike many FATF-based regimes, this covers non-life insurers too. Insurance agents are not listed. Article 18 makes the NBU their AML supervisor, and NBU Board Resolution No. 107 of 28 July 2020 (Regulation 107) sets the detailed rules.

When due diligence applies

Article 11(4) requires customer due diligence when a business relationship is established, on suspicion, on doubts about earlier data, and for one-off operations at or above the threshold. Business relationships under insurance contracts with no savings component and a total premium not exceeding UAH 40,000 are excluded from the establishment trigger; the other triggers still apply. Identification and verification must be completed before the relationship begins, although verification may finish as soon as possible after first contact where risk is managed (Article 11(5)).

Data to collect

For a resident individual, Article 11(9) requires full name, date of birth, identity document details, address, and taxpayer registration number (RNOKPP). Non-residents add citizenship (Article 11(10)). Beneficial owners of corporate customers must be established and verified, and insurers may not rely solely on the Unified State Register.

Enhanced due diligence

Required for high-risk relationships (Article 12). Politically exposed persons (PEPs) need senior approval, source of wealth and funds checks and ongoing enhanced monitoring (Article 11(14)).

Simplified measures

Permitted only where the insurer has established that risk is low, with monitoring sufficient to detect operations that do not fit the customer's profile (Article 13).

Reporting and record keeping

Article 20 defines threshold operations as those of UAH 400,000 or more that also have a listed feature. Reports go to the SFMS on two timetables under Article 8(2)(8):

Records of due diligence, including electronic files and refused applicants, are kept for at least five years after the relationship ends (Article 8(2)(18)). An insurer may designate its chief compliance manager as the employee responsible for financial monitoring (Law on Insurance, Article 30(2)).

4. Identity verification and onboarding

Annex 2 to Regulation 107 sets out how an identity document must be obtained. An individual is verified either by presenting the original in person or through video verification under Annex 3, which is treated as equivalent to personal presence. Remote routes rely heavily on the qualified electronic signature (QES).

Accepted remote methods

Paragraph 30 of Annex 2 adds two fully remote routes for any risk level:

• NBU BankID: identification data received from a bank through the BankID system, plus a copy of the identity document signed with the customer's QES, cross-checked against each other.
• Diia e-passport: an e-passport carrying the Diia qualified seal and a timestamp matching the verification date, plus either a photo of the person taken with a liveness ("розпізнавання реальності особи") method or a document copy or questionnaire signed with the customer's QES.

Paragraphs 31 and 32 allow lighter remote methods only where risk is low, outgoing operations stay within UAH 40,000 a month and UAH 400,000 a year, and obligations between insurer and customer do not exceed UAH 40,000. These lighter methods are a QES-signed document copy, BankID data alone, an NFC chip read with PIN or liveness photo, or credit bureau data plus a one-time password and liveness photo.

Video verification standard

Annex 3 is prescriptive. The session must be live and uninterrupted, with recorded consent. The employee photographs the person and the document and checks for tampering, face match, data logic and visible security features. The process ends with a one-time password sent to the customer's stated financial phone number. Security-feature checks may be skipped if the chip is read with at least passive authentication under ICAO Doc 9303, or a Diia e-passport is used. Booklet documents without a chip need an extra control such as a BankID cross-check.

Beneficiaries and claimants

For life insurance, beneficiaries are identified at issuance and verified at payout (Law No. 361-IX, Article 11(11)). For third-party liability insurance, the person receiving the payout is identified and verified at the time of payment (Regulation 107, Annex 2, paragraph 17).

5. Digital channels: what's different

Bottom line: the due diligence obligations are channel-neutral, but Regulation 107 prescribes exactly which remote methods count, and some of them are available only for low-risk, low-value customers.

Remote risk is assessed, not presumed

Regulation 107 does not list remote onboarding as an automatic enhanced due diligence trigger. Instead, paragraph 38 requires an institution to pay particular attention to the risks of new technologies, naming remote establishment of business relationships, agents and reliance on others. Annex 18 lists channel risk criteria: agents that are not obliged entities taking part in identification, use of reliance, and technology that limits the institution's control over the process.

Limits for low-value onboarding

The paragraph 32 caps matter for embedded and micro-insurance: within them, BankID data alone or an NFC read suffices; above them, a paragraph 30 method or video verification is needed.

Electronic contracts

Article 97 of the Law on Insurance allows any insurance contract to be concluded as an electronic document or under e-commerce law; a contract not in written form is void. Article 11 of Law No. 3720-IX on compulsory motor third-party liability insurance [In force since 1 January 2025] requires those contracts to be concluded only in electronic form, and a contract takes effect no earlier than its entry in the Unified Centralised Database.

Pending

NBU Board Resolution No. 116 of 7 October 2026 [In force from 10 October 2026] moves non-bank reporting to the SFMS e-cabinet and gives institutions three months to update internal procedures. Its new photo-metadata rule for liveness checks applies to banks, not insurers.

6. Data protection and biometrics

The Law of Ukraine "Про захист персональних даних" [On Personal Data Protection] No. 2297-VI of 1 June 2010 [In force] governs identity capture. Article 7(1) prohibits processing biometric, genetic and health data unless an Article 7(2) exception applies. The exception most relevant to a private insurer is the data subject's unambiguous consent (Article 7(2)(1)); the Law contains no general exception for processing required by AML law. Face images used for liveness checks, and health data collected for life and health underwriting, therefore rest on explicit consent in practice.

Regulation 107 adds two onboarding-specific duties: the insurer must inform the customer during identification about processing personal data for AML purposes (Annex 2, paragraph 34), and must obtain clear consent to video verification and photography before it starts (Annex 3, paragraph 4).

Bill No. 8153, a new personal data protection law aligned with EU standards, was adopted at first reading [Bill, second reading pending]; in December 2025 the parliamentary human rights committee recommended a special procedure for preparing it for second reading. It is not law.

7. Sector-specific obligations

Embedded insurance through ancillary agents

Article 1(14) of the Law on Insurance defines an ancillary insurance agent (додатковий страховий агент): a sole trader or company whose main business is not insurance and which sells insurance as a supplement to its own goods or services. Among other conditions, ancillary agents may not sell motor, aviation, marine or other liability cover (classes 10 to 13) or life classes (19 to 23) unless the product supplements their own goods or services. They must be on the Register of Intermediaries, act under a contract with the insurer, and have a sales manager who meets the knowledge and reputation requirements of Article 73.

Oversight of agents and brokers

Brokers are obliged entities in their own right. Agents are not, so their identity checks are the insurer's responsibility: Annex 9 to Regulation 107 lets an insurer delegate identification and verification to agents under a written contract, but requires a prior reliability review, including screening the agent against the sanctions list, and keeps liability with the insurer. A breach of AML law by an intermediary is a ground for removing it from the register (Law on Insurance, Article 82).

Payout controls

For life policies, a PEP beneficiary must be reported to senior management before payment, and a high-risk legal-entity beneficiary's beneficial owner must be verified at payout (Law No. 361-IX, Articles 11(14) and 12(4)). Paying claims to anyone other than the policyholder or beneficiary is a listed red flag.

Sanctions

Insurers screen customers, beneficiaries and agents against sanctions imposed under the Law on Sanctions No. 1644-VII and published in the State Register of Sanctions, and freeze terrorism-related assets under Law No. 361-IX.

8. Risk indicators and red flags

Annex 19 to Regulation 107 lists indicators specific to insurance and reinsurance services. Selected items:

Insurance indicators (NBU Regulation 107, Annex 19, paragraph 49)

• Overpayment: premiums paid well above the amount the contract requires.
• Early surrender: frequent or unexpected termination of life policies with the surrender value sent to different banks or third parties.
• Third-party payers: premiums paid by or through unrelated third parties.
• Payouts to strangers: claims paid to persons who are neither policyholder nor beneficiary.
• Quick claim: an insured event shortly after the contract is concluded.
• Structuring: premiums kept just below reporting thresholds to avoid reports and due diligence.
• Mismatch: sums insured or insured property out of line with the customer's risk or finances.
• Churning: frequent changes of insurer or of the accounts used for premiums and payouts.

9. Enforcement and penalties

Article 32 of Law No. 361-IX lets the NBU apply a written warning, licence revocation, removal of an official, a fine, or a settlement agreement, within six months of detecting a breach and three years of its commission. Fines are set as multiples of the non-taxable minimum income of citizens (NMDG), with one fine per breach and amounts added when several types are found:

Under the Law on Insurance, the NBU may revoke an insurer's licence for a further AML breach after at least two enforcement measures for AML breaches within two years (Article 123(2)(8)).

In its announcement of 5 June 2026 on May 2026 decisions, the NBU fined insurer PrJSC "IC "VUSO" UAH 40,705,622.60 for failing to organise primary financial monitoring. The NBU cited weak internal AML documents, customer due diligence, PEP checks and risk assessment.

10. Recent changes and what to watch

• 1 January 2027 [Adopted, effective 1 Jan 2027]: insurers meeting the criteria in Article 39 of the Law on Insurance must assess solvency under the basic approach, which affects capital planning.
• 10 October 2026 [In force]: NBU Resolution No. 116 updates Regulation 107 on SFMS registration and e-cabinet reporting; insurers have three months to align procedures.
• 5 June 2026 [Enforcement]: a UAH 40.7 million AML fine on an insurer shows the NBU applying large fines to insurers, not only banks.
• December 2025 [Bill, second reading pending]: Bill No. 8153 on personal data protection awaits second reading; it would replace the 2010 law.
• 1 January 2025 [In force]: the intermediaries section of the Law on Insurance applies, creating the Register of Intermediaries and the ancillary agent route for embedded insurance.
• 1 January 2025 [In force]: Law No. 3720-IX makes compulsory motor liability contracts electronic-only and restates the life insurance beneficiary rules in the AML law.

11. What this means for identity verification

Design the onboarding flow around the product's AML scope. Non-savings policies with total premiums up to UAH 40,000 can be sold without full due diligence at the outset, but sanctions screening and suspicion-based checks still apply. Savings, investment and higher-premium products need full identification of the policyholder and beneficiaries.

For remote verification, support at least one paragraph 30 route: NBU BankID combined with a QES-signed document copy, or a Diia e-passport combined with a liveness-checked photo or QES. Video verification is the fallback for customers without Ukrainian eID, such as non-residents. It requires a trained employee, a live recorded session with consent, document authenticity checks or NFC passive authentication, and a closing one-time password.

Retain recordings, photos, timestamps, signature files and check results for at least five years after the relationship ends. Build re-verification triggers for doubtful data, changes of life beneficiaries and payouts. Where agents or embedded partners capture data, keep contractual control and audit rights, because liability stays with the insurer.