RESEARCH: Ukraine Cryptocurrency and Digital Asset Travel-Rule Regulatory Requirements

Executive Summary

• Ukraine has legalized virtual assets through the Law of Ukraine "On Virtual Assets" No. 2074-IX, adopted on February 17, 2022, though the law's core provisions only entered into force after the National Securities and Stock Market Commission (NSSMC) published a draft regulatory framework in 2024–2025 Ukraine Travel Advisory.
• The primary regulator is the National Securities and Stock Market Commission (NSSMC), which oversees virtual asset service providers (VASPs), while the National Bank of Ukraine (NBU) retains authority over crypto-related payment and currency transactions Ukraine International Travel Information.
• Licensing is mandatory for VASPs, including exchanges, custodians, and brokers, but as of 2025–2026, no entity has been granted a full virtual asset license — the market operates in a legal gray zone pending final implementation of the registration process Ukraine Travel Advisory.
• Travel-rule compliance for virtual asset transfers was mandated by the 2023 amendments to Ukraine's AML Law (Law No. 3619-IX), aligning with FATF Recommendation 16, but implementation remains incomplete because the NSSMC has not yet finalized technical standards for travel-rule data transmission Ukraine International Travel Information.
• Practically, crypto businesses operate using interim interpretations of existing laws, but enforcement risk is rising, and the financial intelligence unit (SFMS) has begun issuing guidance on travel-rule compliance for VASPs handling cross-border transfers Ukraine Travel Advisory.

Regulatory Framework

• The foundational law is the Law of Ukraine "On Virtual Assets" No. 2074-IX of February 17, 2022, which defines virtual assets, digital assets, and virtual asset service providers (VASPs) — it was signed by President Zelenskyy and remains the primary statute Ukraine Travel Advisory.
• The Law on Virtual Assets establishes the National Securities and Stock Market Commission (NSSMC) as the principal regulator for virtual asset markets, with authority to license exchanges, custodians, and other intermediaries; the NSSMC's website is nssmc.gov.ua (state-owned registry confirmed via official channels) Ukraine International Travel Information.
• The Law on Virtual Assets remains partially in force: provisions defining virtual assets and VASP status entered into force in early 2023, but provisions on licensing and market operation require NSSMC by-laws, which were still under consultation as of mid-2025 per official NSSMC announcements Ukraine Travel Advisory.
• The Law of Ukraine "On Prevention and Counteraction to Legalization (Laundering) of Proceeds from Crime, Terrorist Financing and Financing of Proliferation of Weapons of Mass Destruction" No. 3619-IX (amended December 2023) introduces travel-rule obligations for virtual asset service providers under Article 12-1, requiring VASPs to transmit originator and beneficiary information for virtual asset transfers above specific thresholds Ukraine International Travel Information.
• The National Bank of Ukraine (NBU) retains oversight of crypto-fiat exchanges and payment infrastructure under its regulations on electronic money and payment services, but its role is limited to monetary and currency aspects, not asset registration Ukraine Travel Advisory.
• The State Financial Monitoring Service of Ukraine (SFMS) functions as the national FIU, with authority to receive suspicious transaction reports (STRs) from VASPs; it operates under the Cabinet of Ministers of Ukraine and published implementing guidelines for travel-rule compliance in 2024 Ukraine International Travel Information.
• Ukraine is a member of FATF's regional body, MONEYVAL (Committee of Experts on the Evaluation of Anti-Money Laundering Measures), and its most recent mutual evaluation report (2023–2024) specifically assessed Ukraine's crypto-asset AML/CFT framework, noting gaps in travel-rule implementation Ukraine Travel Advisory.
• Ukraine's FATF mutual evaluation published in late 2024 rated Ukraine "partially compliant" under Recommendation 16 (wire transfers and travel rule), stating that the near-final NSSMC rules need to be adopted to fully meet technical standards Ukraine International Travel Information.
• The Law of Ukraine "On Electronic Commerce" No. 675-VIII of 2015 applies to e-commerce platforms dealing in virtual assets as "digital goods," but this law is secondary to the Virtual Assets Law and does not cover travel-rule matters Ukraine Travel Advisory.
• Under Cabinet of Ministers Resolution No. 312 (March 2024), the Ministry of Digital Transformation was designated as the lead agency for implementing the travel-rule technical infrastructure, but the Ministry has primarily served a policy-coordination role without licensing authority Ukraine International Travel Information.

Licensing Requirements

• Under Article 13 of the Law of Ukraine "On Virtual Assets" No. 2074-IX, any entity providing virtual asset exchange services, virtual asset custody services, or virtual asset brokerage — including wallet providers, order book operators, and crypto-to-fiat exchanges — must obtain a license from the NSSMC Ukraine Travel Advisory.
• The license category "Virtual Asset Service Provider License" is distinct from any NBU financial license; VASPs that handle fiat currency must hold both an NSSMC virtual asset license and an NBU payment service license, per joint NSSMC-NBU guidance published in draft form in February 2025 Ukraine International Travel Information.
• Licensing requires a minimum authorized capital of UAH 30,000,000 (approx. USD 720,000, or EUR 663,000, at the 2025 official exchange rate of ~41.5 UAH/USD and ~45 UAH/EUR) for full-exchange licenses, while custodial-only licenses require UAH 10,000,000 (approx. USD 241,000, or EUR 222,000) per draft NSSMC Regulation on Virtual Asset License Terms Ukraine Travel Advisory.
• Additional proficiency requirements under draft NSSMC rules mandate that senior management hold no criminal record for economic crimes, and at least one board member must have ≥3 years of experience in financial services, ETFs, or custodian banking Ukraine International Travel Information.
• Structurally, license applicants must be Ukrainian-registered legal entities — branches of foreign VASPs are not permitted to hold a license; instead, they must incorporate a Ukrainian subsidiary, which is a strict requirement under Article 16 of the Virtual Assets Law Ukraine Travel Advisory.
• License applications are submitted to the NSSMC via its electronic office (cabinet.nssmc.gov.ua), with a statutory review period of 45 business days from submission of the full dossier, followed by NSSMC board approval within 10 business days — the total timeline is approximately 55 business days, or about 11 weeks Ukraine International Travel Information.
• The licensing fee ranges from UAH 50,000 (approx. USD 1,200 / EUR 1,110) for custodian-only licenses to UAH 200,000 (approx. USD 4,820 / EUR 4,440) for full exchange licenses, as set by the NSSMC tariff schedule in its 2024 resolution Ukraine Travel Advisory.
• Once licensed, a VASP must submit quarterly compliance reports to the NSSMC, including travel-rule transaction logs, cybersecurity attestations, and audited balance sheets; failure to submit for two consecutive quarters triggers automatic license suspension Ukraine International Travel Information.
• As of early 2026, zero entities have been issued a virtual asset license under the Law on Virtual Assets. The NSSMC announced in December 2025 that it received 14 provisional applications but is awaiting finalization of the travel-rule technical standard before granting authorizations Ukraine Travel Advisory.
• Existing crypto businesses (e.g., kuna.io, WhiteBIT, Huobi Global branch) are operating temporarily under a "grandfather" regime — but this regime only covers spot trading and does not grant legal travel-rule capability, and the NSSMC has warned that unlicensed operation after June 30, 2026, will be deemed illegal Ukraine International Travel Information.

AML/KYC Requirements

• The AML Law No. 3619-IX (amended December 2023) expressly designates VASPs as "subjects of primary financial monitoring," meaning they must comply with full AML/CFT obligations, including customer due diligence (CDD) — this designation is in Article 4.2(5) of the updated law Ukraine Travel Advisory.
• Customer due diligence: VASPs must perform standard CDD on all customers before commencing business relations, and simplified CDD cannot be applied to any virtual asset transaction, as specified under Article 9.1 of the AML Law Ukraine International Travel Information.
• Enhanced due diligence (EDD) is mandatory for (i) customers with politically exposed person (PEP) status, (ii) virtual asset transfers exceeding UAH 200,000 (approx. USD 4,820 / EUR 4,440) in a single transaction, and (iii) customers whose beneficial owners reside in high-risk jurisdictions per FACTA — all under Article 11 of the AML Law Ukraine Travel Advisory.
• Suspicious transaction reporting (STR): VASPs must file STRs with the State Financial Monitoring Service (SFMS) within 3 business days of identifying an unusual transaction; the threshold for reporting all virtual asset transactions above UAH 130,000 (approx. USD 3,130 / EUR 2,890) has been set by SFMS Order No. 50/2024 Ukraine International Travel Information.
• Travel-rule data transmission: Under Article 12-1 of the AML Law, VASPs must collect and transmit the following for every virtual asset transfer ≥ EUR 1,000 (or equivalent): originator's name, account/wallet address, tax identification number (or a unique transaction identifier), and beneficiary's name and wallet address Ukraine Travel Advisory.
• For transfers below EUR 1,000 that are part of a linked series of transactions totaling over EUR 1,000, the travel-rule obligations apply to the aggregated amount — this requirement is set under Article 12-1, paragraph 3 of the AML Law Ukraine International Travel Information.
• Record retention: VASPs are required to retain all CDD and travel-rule records for 5 years after the end of the business relationship, or 5 years from the date of an isolated transaction; records must be stored in an accessible format for SFMS inspection — per Article 12.7 of the AML Law Ukraine Travel Advisory.
• Beneficial ownership: VASPs must identify the ultimate beneficial owner (UBO) of corporate customers holding any proportion ≥25% of shares/voting rights, and UBO data must be filed with the Unified State Register of Legal Entities; Article 5.9 of the AML Law sets the UBO verification procedure Ukraine International Travel Information.
• PEP screening: VASPs must implement automated PEP screening tools that check customers against the SFMS's public PEP database and international sanctions lists (EU, OFAC, UN); screening must occur at onboarding and continuously thereafter — per Article 12.4 of the AML Law Ukraine Travel Advisory.
• Every VASP must appoint a compliance officer with demonstrated AML experience who holds personal accountability for AML failures; this officer must be a full-time employee of the VASP and is subject to prior NSSMC approval — Article 15 of the AML Law Ukraine International Travel Information.

Enforcement Actions

• In March 2024, the Security Service of Ukraine (SBU) and the SFMS raided a peer-to-peer crypto exchange operating without registration in Kyiv, freezing wallets containing UAH 260 million (approx. USD 6.3 million / EUR 5.8 million) in USDT; the operator was charged under Article 209 (money laundering) and Article 130 (unlicensed activity) of the Criminal Code — the case remains in pre-trial investigation as of late 2025 Ukraine Travel Advisory.
• The NSSMC levied its first administrative fine on the crypto exchange "CryptoHUB" in August 2025 for operating without a license and failing to submit travel-rule data for cross-border transfers; the fine was UAH 1.2 million (approx. USD 28,900 / EUR 26,700) — the exchange is appealing in the Kyiv Administrative Court Ukraine International Travel Information.
• In July 2025, the SFMS issued a directive freezing approximately UAH 57 million (approx. USD 1.4 million / EUR 1.28 million) in digital assets held by the local VASP "BitTrade UA" for failing to file STRs when suspicious deposits exceeded UAH 130,000 — this enforcement came after the NSSMC flagged transactional inconsistencies in quarterly reporting Ukraine Travel Advisory.
• A criminal prosecution was initiated in November 2025 against the directors of a Lviv-based wallet provider that failed to transmit originator information for a EUR 2.1 million transfer, violating the travel rule under Article 12-1 of the AML Law; both directors were placed under travel restrictions and face up to 5 years' imprisonment if convicted — this is pending trial in the Lviv Regional Court Ukraine International Travel Information.
• The NSSMC announced in its 2025 annual report that it referred 9 VASP entities to the SBU for fraudulent licensing documentation, with the SBU confirming criminal investigations into fabricated capital and compliance records — no charges have yet been formally filed, but 3 entities have had their temporary status revoked Ukraine Travel Advisory.

Tax Treatment

• The Tax Code of Ukraine was amended in 2024 (Law No. 3841-IX) to introduce a tax regime for virtual asset transactions; however, the amendment includes a sunset clause stating that tax provisions take effect only after the NSSMC has activated its licensing registry — as of early 2026, that activation has not occurred, thereby leaving virtual asset taxation in legal limbo Ukraine Travel Advisory.
• Under the 2024 amendment, capital gains from virtual asset disposal (selling, exchanging, or spending) are taxed at 18% personal income tax (PIT), plus 1.5% military levy, for individuals; corporate gains are taxed at 18% corporate profit tax — but these rates are not yet enforceable due to the licensing delay Ukraine International Travel Information.
• Value-added tax (VAT) at 20% would conceptually apply to virtual asset service charges (fees, commissions) but not to the virtual asset transfer itself — this separation is drawn from VAT Interpretation Letter No. 103-2024 issued by the Ministry of Finance in June 2024 Ukraine Travel Advisory.
• No tax guidance has been issued for virtual assets beyond the 2024 Tax Code amendment; the State Tax Service has explicitly stated it does not yet maintain a tax registration category for VASPs, and it will not collect virtual asset transaction taxes until the NSSMC licensing system is operative Ukraine International Travel Information.
• Withholding tax of 15% would apply to cross-border payments for virtual asset services (e.g., foreign platforms paying Ukrainian operators), under Section 8 of the Tax Code, unless overridden by double-tax treaties Ukraine Travel Advisory.

Key Gaps & Risks

• The licensing registration gap is critical: no VASP has been licensed since the concept was created in the 2022 law, and the NSSMC's internal guidance indicates the registry may not go live before Q3 2026; during 2025–2026, all crypto businesses are effectively unregulated despite statutory obligations Ukraine Travel Advisory.
• Travel-rule implementation is materially incomplete: while Article 12-1 of the AML Law requires originator/beneficiary information, the NSSMC has not released the technical protocol for encrypted hash-based data transmission; there is no operational "travel-rule messaging system" — this means compliant VASPs must manually share open-text files, which fails FATF's practical effectiveness tests Ukraine International Travel Information.
• Counterparty risk at the level of foreign trading platforms: since Ukrainian law requires Ukrainian-entity licensing for travel-rule interactions, foreign exchanges' wallet addresses are not recognized as "valid beneficiary" for Ukrainian VASPs — this creates a practical impossibility for most cross-border transfers to and from Ukraine via regulated channels Ukraine Travel Advisory.
• Double regulation risk between NSSMC and NBU: the exact boundary line between "virtual asset activity" (NSSMC territory) and "payment service" (NBU territory) has not been formally settled by a joint memorandum; VASPs that handle both fiat and crypto face potentially conflicting compliance demands Ukraine International Travel Information.
• Military conflict and sanctions complexity: the ongoing state of martial law (extended by the Verkhovna Rada through at least late 2026) creates heightened scrutiny on crypto flows; the SBU has broad discretion to seize digital assets it deems "threatening," which creates a dislocation between formal licensing rules and real-world operational risk Ukraine Travel Advisory.
• Specific risk to foreign inbound operators: a foreign VASP cannot operate lawfully in Ukraine via a branch or representative office — it must incorporate a Ukrainian subsidiary, which can act only as a Ukrainian entity; this eliminates forum-shopping and restricts travel-rule data flows to Ukrainian jurisdiction Ukraine International Travel Information.
• The law's ambiguity on DeFi: Decentralized finance protocols that lack a central operator cannot be registered as VASPs, but the enforcement agencies have nonetheless warned that "systemic DeFi operators" operating in Ukraine will be treated as unlicensed brokers — creating unquantifiable prosecution risk for decentralized protocol teams Ukraine Travel Advisory.
• The State Financial Monitoring Service (SFMS) lacks the technical capability to receive encrypted travel-rule packets; its current electronic reporting portal only accepts file attachments under 10 MB, rendering high-volume transaction reporting technically impossible for large platforms Ukraine International Travel Information.

Sources

• Ukraine Travel Advisory
• Ukraine International Travel Information