NBU Identified 16 Signs of Suspicious Transactions: Which Card Payments May Fall Under Financial Monitoring

The National Bank of Ukraine has published for public discussion the draft resolution "On Certain Issues of Payment Service Providers' Control over Payment Transactions". This document is part of the NBU’s strategy to cleanse the financial market from miscoding schemes, fraud, and improper use of payment infrastructure.

The document aims to introduce unified standardized approaches to controlling payment transactions and managing operational risks for payment market participants.

The draft stipulates that the new requirements will apply to banks, payment institutions except small payment institutions, electronic money institutions, postal operators authorized to provide payment services, as well as financial institutions engaged in such activities.

The draft is aimed at creating a unified legal framework for monitoring and reconciliation of payment transactions. In particular, market participants will have to implement internal procedures that allow timely detection of errors, discrepancies, and other operational risks, as well as ensure proper control over payment transactions.

After the resolution comes into force, banks and other market participants will have 90 calendar days to bring their activities into compliance with the new requirements. The public discussion of the draft will last until July 31, 2026.

Monitoring and Reconciliation

The NBU highlights three key control directions that must be integrated into the institution’s overall operational risk management system.

Monitoring of payment transactions. Banks and other payment service providers must systematically control payment transactions to timely detect atypical or suspicious transactions and prevent unauthorized payments.

Mandatory reconciliation of transactions. The draft provides for daily reconciliation of payment transaction information by at least three parameters, including the transaction amount, its unique identifier, recipient details, or other specified indicators. This mechanism should ensure timely detection of discrepancies and operational errors.

Prevention of miscoding (MCC miscoding). Acquirers will be required to implement measures that prevent assigning merchants category codes (MCC) that do not correspond to their actual business activities. This aims to prevent situations where risky transactions, including those related to gambling, are disguised as other types of business activities to bypass established restrictions and control procedures.

AI and Machine Learning

For the first time at the regulatory level, the NBU explicitly allows and encourages the use of artificial intelligence (AI) and machine learning (ML) to detect atypical transactions.

A separate novelty of the draft is the possibility to use AI and ML technologies during payment transaction monitoring. The draft regulation provides that AI and ML technologies may be applied to detect atypical transactions and analyze risks.

At the same time, payment service providers using AI or ML models must ensure their continuous training, regular updating of input data, and quality control of their operation.

Additionally, the draft introduces a requirement for regular back-testing of monitoring rules. It is envisaged that at least once a month, market participants must verify the effectiveness of such rules by comparing their application results with actual payment transaction data. This should ensure timely detection of shortcomings in monitoring systems and improve their efficiency.

Risk Marker System

The draft regulation provides a risk-oriented approach to monitoring payment transactions. Depending on the assessment results, each transaction will be assigned an appropriate risk level.

For transactions with a low risk level, automatic execution is envisaged. If a transaction is classified as medium risk, the payment service provider may suspend it to obtain additional confirmation from the client or conduct further verification. Transactions with a high risk level are proposed to be automatically stopped until the circumstances of their execution are verified.

Signs of Atypical Behavior

Moreover, the draft provides for the formation of a list of users requiring enhanced control. Information about such clients is proposed to be stored for one year.

The document also defines a list of signs of atypical payment behavior, presence of which obliges the institution to initiate additional transaction verification. The draft contains a detailed Appendix 2 with signs that require the institution to start verification:

1. Excessive number of accounts: opening or having a significant number of accounts or electronic payment instruments (EPI) by a user, significantly exceeding average database indicators and not corresponding to standard financial behavior.
2. Concentration of certain transactions: presence of a large number of similar transactions on the account, such as transfers by EPI details, transfers between accounts, or purchases of goods in atypical amounts at unique merchants.
3. Abnormal payment frequency: excessively high transaction intensity per day, week, or month compared to other users (e.g., more than 10 account top-ups within less than 60 minutes).
4. Minimal balances with large turnovers: situations where account balances are significantly lower than those of clients with similar profiles despite substantial daily or weekly transaction volumes.
5. Credit anomalies: frequent transactions of issuing and repaying loans in significant amounts with atypically high frequency.
6. Rapid forwarding: funds received on the account are almost immediately transferred further, leaving a minimal balance.
7. Gambling anomalies: receiving gambling winnings (code 7995) without operations replenishing gambling accounts, accompanied by regular transfers by EPI details.
8. Hidden entrepreneurial activity: systematic receipt of transfers to personal accounts opened for own needs but showing signs of business (by keywords in payment purpose, repeated amounts, etc.).
9. Spike in new merchant activity: a merchant achieves abnormal transaction volumes immediately after starting operations, after which the account is quickly closed or becomes inactive.

• Transit through merchants: complete match of incoming and outgoing transfer dynamics on the merchant’s account.
• Atypical payment purposes: use of descriptions uncharacteristic for the merchant’s activity for operations benefiting recipients with different MCC codes.
• Frequent changes of technical and personal data: atypical changes of addresses, phone numbers, device parameters (Device ID, Application ID), IMEI, operating system, or IP addresses.
• Shared "digital fingerprints": use of devices with identical parameters for remote access by different, unrelated users.
• Geographical illogicality: transactions made from different cities or regions within a time frame physically impossible to travel between these locations.
• Abnormal "one-to-many" transfers: when one individual payer transfers funds to a large number of other individuals in amounts not corresponding to usual needs.
• Abnormal "many-to-one" transfers: when one individual recipient receives funds from a large number of different payers in quantities and frequency significantly different from the norm.

If the resolution is adopted, payment market participants will have to bring internal procedures into compliance with the new requirements. This will concern, in particular, the organization of payment transaction monitoring, reconciliation, operational risk assessment, and internal control.

The draft also provides for the separation of operational risk monitoring processes and financial monitoring in the field of prevention of legalization (laundering) of proceeds and financing of terrorism. Thus, institutions will have to ensure the functioning of separate procedures for managing operational risks and complying with financial monitoring legislation requirements.

Additionally, internal audit must assess the effectiveness of the payment transaction monitoring system and its compliance with the regulation requirements at least once a year.

At the same time, the draft provides that in case of detection of risky transactions, payment service providers may apply additional verification measures, including enhanced user authentication or requesting documents to confirm the transaction.

Subscribe to our Telegram channel t.me/sudua and to Google News SUD.UA, as well as to our VIBER and WhatsApp, Facebook page and Instagram to stay updated on the most important events.