Financial monitoring and your personal card in 2026: a guide for individuals

Cards get frozen not "for something terrible". In most cases a person has been feeding the bank grounds for suspicion for months without realising it. Then one operation becomes the last straw — and access to the money disappears at the worst possible moment.

The rules for individuals are no softer than for business. Ukraine's Memorandum on the payment services market, signed by more than 30 banks as of July 2026, started precisely with retail clients, and the updated version of 14 May 2026 extended it to everyone else. Add NBU Regulation No. 65 with its suspicion indicators — and you get a system that sees every single move on your card.

The scope up front: no advice for sole proprietors and legal entities here — there is a separate article for them. This one is about the ordinary person with a bank card and about the freelancer working without sole-proprietor status.

How much you can transfer if the bank has never seen your income

Under the Memorandum, an individual client who has not documented their income lives with a transfer limit of up to UAH 100,000 per month. For "high-risk" clients the bank cuts the limit to UAH 50,000. Limits were phased in: first UAH 150,000/month from 01.02.25, then UAH 100,000/month from 01.06.25. So this is no longer a novelty — it is a working practice more than a year old.

Confirmed income above the limit? The bank processes transfers within the confirmed amount. Beyond that, the client can ask the bank to raise the limit. The single condition: documentary proof of funds.

Three details lost in the headlines

• the limit may not apply to low-risk operations — for example, paying taxes and utilities; each bank sets its own list of exceptions;
• payroll clients count as clients with confirmed income; nothing extra to prove;
• volunteers identified by the bank under Resolution No. 18 are exempt.

The main change is still ahead. Right now the limits apply to transfers to individual accounts; from 01.09.2026 they also apply to transfers to accounts of legal entities and sole proprietors. Unconfirmed income will start interfering even with settlements with business.

Many people find the UAH 100,000 enough and decide not to bother. That's a mistake. The limit is only the visible part. The invisible part is that a client without confirmed income remains a "dark horse" to the bank, and any deviation in their behaviour triggers questions faster.

Which documents banks accept as income proof

The list is spelled out in the Memorandum itself, and it is broader than commonly believed:

• OK-5 or OK-7 certificates. Generate them in the Diia app and hand them to the bank or send them through the app. This is the fastest route.
• Personal income and property tax return. On its own it proves the source of income only so-so, but declared money is taxed money — and to the bank and the state such funds become "good".
• Payroll statements or a letter from the employer. If you live on salary, pension or scholarship, filing a return is optional: your tax agent paid the taxes for you.
• Confirmation of state payments: pensions, benefits, compensation.
• Confirmed income of family members: their tax return, payroll statements or state payments. Yes, a spouse's income works too.
• Confirmation of volunteer activity.
• Contracts and payment documents on royalties and author's fees, if you receive remuneration for the use of intellectual property.

What is missing from this list: promissory notes and simple written loan agreements. Explanations along the lines of "relatives chipped in" or "an old debt was returned" are no longer accepted by banks. Those arguments are history.

What you promised the bank when you opened the card

When you opened the account you filled in a form and, among other things, indicated the expected inflows. Most people put a random figure there to get out of the branch faster. The bank remembers that figure and builds a client portrait on top of it.

Wrote that you expect up to UAH 50,000 a month and UAH 150,000 comes in? Regulation No. 65 lists as a risk indicator any mismatch between actual operations and what the client declared when starting the relationship. The bank will start asking where the money came from. Even if everything is legal — you have deviated from the portrait you painted yourself.

Hence two simple actions. Opening a new card — declare expected amounts honestly and with headroom for growth. If income has grown on an existing card, do not wait for questions and update your profile data yourself. Almost no one does the second thing, and it removes the lion's share of future queries.

What else the Memorandum changes for cardholders

Night-time antifraud. Automated 24/7 fraud rules with special scrutiny for operations between 00:00 and 06:00. Unusual activity at night is a fast track to a temporary hold. Plan large transfers for daytime.

No more than three accounts. For clients without confirmed income — no more than three current accounts in the same currency. Deposit, credit and state-programme accounts do not count.

"Money mule" registry. A centralised registry of people whose operations require enhanced control. Let someone else's money pass through your card — and you risk landing in a database visible to every bank.

Diia integration. Banks are working on access to official income and court data. For 2026–2027 automatic income verification and a single limit for all outgoing operations are on the roadmap.

Business on a personal card: why the bank pesters you again and again

Freelancing, selling handmade, trading on Etsy, taking client payments to your personal card? While amounts are small and irregular the bank looks the other way. As soon as regularity kicks in, inflows start showing signs of business activity — and the picture changes completely.

Here you need to know one thing that is rarely said out loud. NBU regulations forbid using an individual's account for business activity. Just forbid. The breach itself carries no fine, no confiscation, but you are violating the terms of the bank account contract. And the bank can terminate the contract with a violator.

Watch the bank's behaviour. Does it periodically send queries about the same inflows but still process operations? The bank asks questions not because it doesn't know the answer. A repeated query is a warning: stop doing this.

Case from practice. A person without sole-proprietor status was selling shoes and taking payments to a personal card. The bank refused to release about UAH 70,000 accumulated on the account. The client registered as a sole proprietor and told the bank — it didn't help. The questions concerned inflows for the period before registration, and backdated registration does not legalise past operations.

Important. Systematic trade or services without registration is also an administrative offence under Article 164 of the Ukrainian Code of Administrative Offences. Real fines from practice: UAH 17,000 or 34,000, with a ceiling of UAH 85,000 and confiscation. Rarely applied — proving systematic activity is hard. Worse than the fine are tax reassessments: in court practice people with million-hryvnia turnover on a personal card were charged PIT, military levy and USC, up to half of the inflows in total.

Is it safe to send money card-to-card

P2P transfers remain the most massive operation in the country. Small amounts do not interest financial monitoring: chasing every thousand-hryvnia transfer is physically impossible.

Problems start where transfers stop matching your profile. A classic example: a pensioner who declared their pension as the only income when opening the account suddenly starts receiving tens of thousands a month and scattering them across other people's cards.

A separate indicator is structuring — including in round amounts, from a single counterparty or to a single counterparty within a month. Broke a big transfer into ten of twenty thousand each? The bank will sum them up and treat them as one operation.

Simple rules: do not let other people's money pass through your card, even at the request of friends or an employer, and do not participate in "chains" of transfers whose meaning is unclear even to you. Every operation should be one you can explain in a single sentence.

Money from abroad: where the line between normal and suspicious sits

A one-off transfer from a relative or a small payment from a foreign client usually raises no questions. Risk comes from regularity. Systematic inflows from abroad are signs of business activity plus a separate question from the bank: who exactly is sending you this money. In our practice, questions started at turnovers of hundreds of thousands of hryvnia a month. But that is a benchmark, not a guarantee: "safe" amounts enshrined in law do not exist.

What to do

• receive freelance payments regularly — register as a sole proprietor and take revenue on the business account: this removes two indicators at once;
• keep correspondence, invoices, order screenshots. You most likely have no standard contract with a foreign client, but the nature of the operation can be confirmed with non-standard documents too;
• test a new-to-you operation on small amounts: bring in part, watch the bank's reaction, then scale up;
• do not understate expected inflows from abroad in the profile — it is the same portrait trap.

Renting out an apartment, money comes to the card. A problem?

No. Renting out your own apartment is a legal operation, and there is zero sense hiding it from the bank. The bank is not a tax authority; it does not check tax payments.

If inflows are regular and the bank gets curious — explain as it is: the tenant is paying rent. Ask for proof — provide the lease. A standard, clear operation.

The tax question on this income exists separately, but it belongs to the plane of your relations with the tax office, not the bank. Do not confuse the two: it is precisely hiding that breeds suspicion.

Big cash: buying an apartment or a car

Planning to withdraw a large sum for a real-estate or car purchase? Know this: withdrawing a large amount of cash is always a suspicious operation. Always. Even if the money was earned entirely legally and taxed. The bank may release the funds without delay and send a query two or three months later — covering not just that amount but your activity in general.

How to get through this without stress

• prepare source-of-funds documents before the visit to the cashier, not after the query;
• warn the bank about the operation in advance, especially if the amount is unusual for your card;
• withdraw in parts if circumstances allow;
• weigh a cashless settlement with the seller — banks treat cashless transfers much more leniently.

A bank query has arrived. How much time, and what to write?

First — what not to do. Do not drag out the reply. Ignoring or stalling is, per Regulation No. 65, treated by the bank as suspicious behaviour: it will conclude you are cooking up a story and "drawing up" documents. A reply within 5–7 days is a normal timeframe even for a bulky query. A month or two of silence gives grounds for conclusions not in your favour.

And do not invent a story on substance. Write it as it is. If the activity is legal, an honest explanation works best: the bank sees the payers, the periodicity and the character of transactions.

Technical points people keep asking about

• a query in the form of a message in the app or client-bank is legal: the law prescribes no special form, no seals or signatures needed;
• the bank has the right to ask about operations a year and even three years old — there are no limitation periods in financial monitoring;
• explain the operation simply, in "business language": what it was and why. The operation must have a reasonable economic reason, not only formal legality.

Important. Do not disinform the bank. Write an untruth that contradicts the character of transactions — and the next step will be not another query but termination of the contract and refusal of service.

Will the bank report you to the tax office and the police

The most common fear — and the most exaggerated. About ordinary operations that raised no questions the bank does not report to anyone. There is no mechanism of automatic transmission of tax information about movements on your card: to see your accounts, the tax office today has to go to court.

Under Article 8 of Law No. 361 the bank informs the State Financial Monitoring Service in defined cases: threshold operations from UAH 400,000 with certain features, suspicious operations regardless of amount, refusal to establish a business relationship, suspension of operations. Most often that is where it ends: the information is stored as analytics.

Do not confuse a "suspicious operation" with suspicion of a crime. A suspicious operation in financial-monitoring terms is an operation with an indicator the bank is required to work through. It can be entirely legal — and in the overwhelming majority of cases it is.

One bank is not enough. How many do you need?

At least two. This is not a life hack but a safety cushion: if one bank suspends operations and investigates, you keep paying from the account in the other and sort things out without panic. Clients with a single account struggle with a freeze the longest and the hardest.

"Problem-free" banks — from a financial-monitoring standpoint — do not exist. However lenient the bank at the acquisition stage, internal rules do not go away, and the NBU fines banks by the millions for softness. A good relationship ends where an indicator begins.

If funds are stuck, ask the bank to transfer them to your own account in another bank. Banks often agree to that more readily than to a cash release: the money stays in the banking system.

The bank calls you to the branch to "update data". Prepare for the worst?

Do not rush to panic. There is scheduled periodic identification: the bank periodically invites clients to refresh data — refill the form, provide a copy of the passport and tax ID. Routine.

But read the context. A question from our broadcast: a person moved UAH 3 million through an individual's card in a year, and the bank called with an invitation to the branch. That is more than routine: almost certainly there will be questions about turnover on top of the form. Come to that meeting prepared — collect documents on the largest inflows in advance, do not promise to "bring them later".

FAQ

From what amount does financial monitoring start? From none. Threshold operations of UAH 400,000 and up are tracked always, but an operation of any amount can become suspicious if it carries indicators. The UAH 30,000 threshold applies only to transfers without opening an account and to virtual-asset operations — it has nothing to do with your card.

Someone will send me a small one-off amount from abroad. Will there be problems? Unlikely. Financial monitoring physically cannot chase every small transfer. At most — an email asking you to explain the inflow, and even that with low probability. Risk grows with regularity and amounts.

Can money on my card be frozen? Freezing is applied when the bank is ready to report a suspicion of financing terrorism, weapons of mass destruction proliferation or laundering of criminal proceeds. If your money is legal, you face at most a temporary suspension of operations pending clarification — and it is lifted by documents.

The bank asks about a transfer from a year ago. Is that legal? Yes. The law sets no limitation period for financial-monitoring queries. The bank can pull an operation two or three years old to build an up-to-date client portrait. Prepare explanations, not objections.

My family is raising money for treatment, transfers come from different people. What to do? Hide nothing. Fundraising is legal, but from the bank's angle it looks like many inflows from different individuals — formally similar to an indicator. If a query arrives, explain the situation as it is and show where the funds go: clinic invoices, payment purposes.

Will the bank find out that I don't pay taxes on rent or freelance? The bank is not a tax authority and does not check tax payments. It cares about the source of funds and the character of operations. But keep in mind: confirmed and declared income removes questions both from the bank and for the future.

Can I be fined for sales from a personal card without sole-proprietor registration? Yes, under Article 164 of the Code of Administrative Offences: in practice UAH 17,000 or 34,000, up to UAH 85,000 with confiscation. Rarely applied because systematic activity has to be proven in court. Tax reassessments of PIT and military levy are more dangerous.

What happens if I don't confirm income to the bank at all? You will live with a limit of UAH 100,000 per month, and at high risk — UAH 50,000. From 01.09.2026 the restrictions will also apply to your transfers to sole-proprietor and company accounts. Plus every atypical operation will trigger questions faster. Collecting the paperwork once is easier than living under the magnifying glass for years.

---

Make sure every operation on your card can be explained in one sentence and supported by one document. Do it before the bank's query, not after.

This material is informational and analytical and does not constitute individual legal advice. Terms of the Memorandum on the payment services market, NBU regulations and internal bank rules change; verify specific limits and document lists with your bank on the date of application.