The National Bank of Ukraine cancels anonymous top-ups via terminals: operations can only be confirmed through a mobile phone

From the end of June, the usual process of topping up a card with cash through a terminal will undergo fundamental changes. The National Bank of Ukraine, by Resolution No. 67, has introduced mandatory payer verification via a one-time password, effectively canceling the anonymity of most transactions.

The Board of the National Bank of Ukraine adopted Resolution No. 67, which makes significant changes to the Instruction on the procedure for organizing cash operations and the Rules for determining payment features of banknotes. The main goal of the document is to improve cash operations. However, for the average citizen, the most noticeable consequence will be the change in the operation algorithm of self-service terminals (PTKS). The new rules, effective from June 26, 2026, establish new requirements for payer identification when depositing cash.

Mandatory verification

The main change is the introduction of a procedure to confirm the operation via mobile phone. When initiating a cash deposit through PTKS regardless of the amount, the service provider is obliged to verify the ownership of the phone number by the payer. This is done in two ways:

• Sending a one-time password (OTP) via SMS to the entered number,
• Providing the password via a phone call.

Only after entering the received code on the terminal screen is the transaction considered confirmed and can be completed. At the same time, service providers are required to take measures to ensure that the password is not transmitted to other persons, including limiting its validity period.

New requirements for receipts and reporting

Updated requirements have also been introduced for the issuance of receipts by payment terminals. These changes aim to increase the transparency of financial operations and ensure better consumer protection.

Main changes to receipt issuance

From now on, each receipt issued by a terminal must clearly comply with the new standards. In particular, the requirements for payer identification and document content have significantly changed.

• The receipt must contain the full mobile phone number of the payer in international format: +380-XX-XXXXXXX.
• It is strictly forbidden to hide the payer's phone number using "asterisks" or any other symbols. The information on the receipt must fully match the data entered by the user on the terminal screen.

Expanded list of mandatory details

The receipt must now contain a full set of data about the operation:

• Details of the payment service provider;
• Unique terminal number;
• Exact date and time of the operation;
• Commission amount;
• Payment purpose.

Clarity of roles in the system

Special attention has been paid to distinguishing the parties involved in the operation. From now on, the payment service provider cannot be indicated on the receipt as the "payer" or "recipient" for operations initiated by the user.

This requirement aims to avoid confusion in accounting and ensures unambiguous identification of the real participants in the payment: the sender and the receiver of the funds.

Important: Owners and operators of payment terminals should check their software for compliance with the new requirements to avoid violations during financial operations.

Exceptions to the rules: when SMS confirmation is not mandatory

The National Bank of Ukraine has defined a list of financial operations for which entering a one-time password (SMS confirmation) is not required. This decision aims to simplify the payment of socially important services and transactions where other high-level user identification methods are already applied.

• Payment of taxes, fines, fees, and administrative services.
• Payment for housing and communal services (water, gas, electricity), as well as internet, television, security, and fixed-line communication services.
• Payment for railway tickets (including suburban) and urban public transport fares (replenishment of transport cards or payment for electronic tickets).
• Mobile operator account top-ups if the total amount of operations does not exceed 500 hryvnias per month for one number within one service provider.

• Cash deposits to one's own account (to which the card is issued), provided that the terminal successfully reads the card number and the payer confirms the operation using a PIN code or through a bank application.

Using these exceptions allows significantly speeding up the process of making regular payments while maintaining the necessary level of security through alternative identification mechanisms.

Financial inclusion and new-type banks

The resolution officially integrates the concept of a "financial inclusion bank" into the regulatory framework. Such institutions will be able to carry out cash operations and provide payment services within a limited banking license. This is expected to expand access to financial services in remote regions where full-fledged bank branches are impractical.

Information about all operations, including the full phone number and authentication protocols, must be stored in the service provider's operational accounting system. The storage periods are determined by Article 8 of the Law of Ukraine on the Prevention of Money Laundering.

Mandatory phone verification when depositing cash onto cards aims to complicate the use of terminals for anonymous money transfers in gray schemes. However, the requirement to print the full phone number on the receipt may spark discussions regarding personal data protection, but the NBU prioritizes the ability to identify the payer during supervision.

Subscribe to our Telegram channel t.me/sudua and to Google News SUD.UA, as well as to our VIBER and WhatsApp, Facebook page and Instagram to stay informed about the most important events.