Self-custodial wallet / non-custodial software in Ukraine

Law of Ukraine "On Virtual Assets" (Закон України "Про віртуальні активи"): Link to Ukrainian Parliament (Verkhovna Rada) website - official legislative acts (You may need to use a translation tool for the full text).

While the VA Law is in force, its full implementation, particularly the practical licensing mechanism, depends on the adoption of secondary legislation (resolutions, procedures, and detailed requirements) by the NBU and MinDigital.

As of late 2023/early 2024, this secondary legislation has not yet been fully adopted, meaning the actual process for obtaining a license is largely suspended or not fully operational. The focus of the government has been on wartime priorities.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets. (This covers custody providers).

Custody Providers: Will require a VASP license covering "custody and/or administration services."

For other VASP activities (e.g., custody, transfer): Potentially around UAH 5 million (approx. $125,000 - $150,000).

This is a cornerstone of the VA Law and is largely aligned with international standards (FATF recommendations).

Law of Ukraine No. 361-IX "On Preventing and Counteracting Legalization (Laundering) of Criminal Proceeds, Terrorist Financing and Financing the Proliferation of Weapons of Mass Destruction" (dated December 6, 2019, with subsequent amendments).

This is the foundational AML/CFT law in Ukraine, bringing the country's framework closer to FATF recommendations and the EU's 4th and 5th AML Directives. It designates "virtual asset service providers" as "reporting entities" (subjects of primary financial monitoring).

Identification and Verification:

For Individuals: Obtain and verify the customer's identity, including full name, date of birth, place of birth, address, identification number (where applicable), and details of the identity document (series, number, date of issue, issuing authority). Verification must be based on reliable, independent source documents, data, or information.

For Legal Entities: Obtain and verify the legal entity's name, registration number, legal form, legal address, contact details, and identify the management structure.

Beneficial Owner (UBO) Identification: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer. This is crucial for both individuals (e.g., if acting on behalf of another) and legal entities.

Understanding the Business Relationship:

Understand the purpose and intended nature of the business relationship or transaction.

Conduct ongoing monitoring of the business relationship and transactions undertaken throughout the course of that relationship to ensure consistency with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring the source of funds and the destination of virtual assets.

Enhanced Due Diligence (EDD):

Customers who are Politically Exposed Persons (PEPs), their family members, or closely associated persons.

Transactions involving high-risk jurisdictions.

Complex, unusually large, or unusual patterns of transactions that have no apparent economic or lawful purpose.

Non-face-to-face business relationships without adequate safeguards.

Transactions above specific thresholds (e.g., equivalent of UAH 400,000 for certain types of operations, though suspicion requires reporting even below this).

Simplified Due Diligence (SDD):

May be applied in situations identified as lower risk, but VASPs must still be able to demonstrate that the risk is genuinely lower and maintain sufficient information to identify the customer and beneficial owner. Given the inherent risks associated with virtual assets, SDD is often limited in this sector.

Definition of VASP: Article 1 of the Law defines a "Virtual Asset Service Provider" (VASP) as a legal entity that, as part of its business activities, performs one or more of the following services for or on behalf of another natural or legal person:

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets. (This directly covers custody).

Separate Accounting: Article 12, Part 2, Point 2 requires VASPs to maintain separate accounting records for their own virtual assets and those of their clients. This is a foundational step towards ensuring client assets are not commingled with the VASP's proprietary assets.

Mandate: The Law "On Virtual Assets" mandates that any entity providing virtual asset services, including custody services, must obtain a permit (дозвіл). This permit functions similarly to a license.

AML/CFT Compliance: Obtaining a permit is intrinsically linked to strict adherence to the AML/CFT Law, including KYC procedures, transaction monitoring, and reporting suspicious activities.

Issuing Authority: The NSSMC is generally responsible for issuing these permits. For virtual assets secured by monetary values, the NBU would be the responsible authority.

Legal Basis: Criminal Code of Ukraine (Кримінальний кодекс України), Code of Administrative Offenses of Ukraine (Кодекс України про адміністративні правопорушення).