Financial monitoring and your personal card in 2026: a guide for individuals and freelancers without a sole-proprietor status

Cards don't get blocked 'for something terrible'. In most cases, for months the client themselves fed the bank reasons for suspicion without realising it. Then one operation becomes the last straw and access to the money disappears at the worst possible moment.

For individuals, the rules are no softer than for businesses. As of July 2026 the Memorandum on the payments market signed by over 30 banks kicked off specifically with individual clients, and the version updated on 14 May 2026 extended it to everyone. Add NBU Regulation No. 65 with its suspicion indicators and you get a system that sees every move on your card. Here's how to live with it calmly.

Scope up front: no advice for sole proprietors or legal entities here. This is about an ordinary person with a bank card and a freelancer who works without a sole-proprietor (FOP) status.

Under the Memorandum, an individual client who hasn't documented their income lives with a transfer limit of up to UAH 100,000 per month. For 'high risk' clients the bank cuts it to UAH 50,000. Limits were phased in: UAH 150k/month from 01.02.25, then UAH 100k/month from 01.06.25. This is no longer new — it's over a year of practice.

Documented income exceeding the limit? The bank clears transfers within the confirmed amount. Clients can also formally ask the bank to raise the limit. The only condition: documentary proof of funds.

And the main change ahead: today the limits apply to transfers to individuals' accounts, and from 01.09.2026 they will also apply to transfers to accounts of legal entities and sole proprietors. Undocumented income will start getting in the way even for payments to a business.

Many people find UAH 100k enough and decide not to bother. Bad call. The limit is only the visible part. The invisible part is that a client without documented income stays a 'dark horse' for the bank — and any deviation from their pattern triggers questions faster.

The list sits right in the Memorandum, and it's wider than most think:

• OK-5 or OK-7 certificates. Generate them in the Diia app and share with the bank via the app or the bank's own app. Fastest route.
• Personal income and wealth tax return. Slightly odd on its own — a return isn't a great source of income proof by itself. But declared money is taxed, so for the bank and the state such funds become 'good'.
• Payslips or a certificate from your employer about salary or total annual income. If you live on salary, pension or a scholarship, you don't have to file a return: the tax agent paid the tax for you and will issue a certificate.
• Confirmation of receipts from state bodies: pensions, allowances, compensation.
• Confirmed income of family members: their tax return, payslips or confirmation of payments from state bodies. Yes, a spouse's income works too.
• Proof of volunteer activity.
• Contracts and payment documents for royalties and author fees if you receive remuneration for the use of intellectual property.

What isn't on the list: simple written IOUs and loan agreements. Explanations like 'my relatives chipped in' or 'they returned an old debt' aren't accepted anymore. Those arguments belong to the past.

When you opened the account, you filled out a questionnaire and stated, among other things, your expected inflows. Most people put a random number just to leave the branch faster. The bank remembers that number and builds a client profile on it.

You said up to UAH 50k a month, but 150 landed? Regulation No. 65 lists inconsistency between operations and what the client stated when entering the relationship as a risk indicator. The bank will ask where the money is from and what these operations are. Even if everything is lawful: you strayed from a portrait you drew yourself.

Hence two simple moves. Opening a new card? Enter expected amounts honestly, with room to grow. Income on an existing card grew? Don't wait for questions — update the bank's questionnaire yourself. Almost no one does this, and it removes the lion's share of future enquiries.

Banks introduced automated 24/7 anti-fraud rules with heightened control from 00:00 to 06:00. Unusual card activity at night is a fast track to a temporary hold. Plan large transfers for daytime.

For clients without documented income there is a cap: no more than three current accounts in one currency. Deposit, credit and state-programme accounts (eVidnovlennya, National Cashback) are outside the cap. Been collecting cards 'just in case'? Time for a review.

Banks have agreed to build a central registry of people whose payment activity requires enhanced control. Pushed someone else's money through your card? You risk landing on a list every market participant can see. Then questions come not from one bank but from every one.

Banks are working on access to official information about a client's income and court cases through the government e-services portal. For 2026–2027 automatic income verification via state registries and a single limit on all outgoing operations for individuals are on the roadmap. The 'the bank knows nothing about me' format has just a few years left.

Freelancing, selling handmade on a marketplace, trading on Etsy, taking payments from clients on a personal card? While amounts are small and irregular, the bank turns a blind eye. As soon as regularity appears and inflows show signs of entrepreneurial activity, the picture changes entirely for the bank.

One thing rarely said out loud: NBU regulations prohibit using an individual's account for entrepreneurial activity. They simply prohibit it. There's no fine for the breach itself, money isn't seized and no one goes to jail, but you are violating the account agreement. And a bank can terminate the agreement of a violator.

And watch the bank's behaviour. It periodically sends enquiries about the same inflows but still processes the operations? The bank isn't asking because it doesn't know: from transaction patterns, payers and periodicity it already has a rough idea.

Takeaway for those whose business is growing: register as a sole proprietor before the bank puts the question point blank. Compare the forms upfront in Sole proprietor vs LLC.

Card-to-card transfers between individuals remain the most common operation in the country — billions of them. Small amounts between people don't interest financial monitoring: chasing every UAH 1,000 transfer is physically impossible.

Questions start where transfers stop matching your profile. Textbook case from practice: a pensioner who declared pension as sole income when opening the account suddenly starts receiving tens of thousands per month and spraying them to other cards. For the bank this isn't 'relatives help the person', it's a flow with no explanation in the questionnaire.

A separate indicator from the Memorandum is fragmenting transfers, including in round amounts, from a single counterparty or to a single counterparty over a month. Split a large transfer into ten of twenty thousand each? The bank will add them up and treat it as one operation.

Simple rules: don't push other people's money through your card, even for friends or an employer, and don't take part in transfer 'chains' whose purpose you don't understand yourself. Your card isn't a transit hub, and 'financial mule' status is now recorded in a shared bank registry. Every operation should be one you're ready to explain in one sentence.

A one-off transfer from a relative or a small payment from a foreign client rarely raises questions. Nobody confiscates a nominal USD 1,000; even a letter asking to explain a one-off receipt is rare.

Regularity creates risk. Systematic inflows from abroad are signs of entrepreneurial activity plus a separate question from the bank: who exactly is sending you this money. In our practice, questions to individuals arose at turnover in the hundreds of thousands of hryvnias per month. But this is a benchmark, not a guarantee: there are no 'safe' amounts fixed in law, each bank decides for itself. On terms and currency oversight in foreign trade, see our separate article.

• if you receive freelance payments regularly, register as a sole proprietor and take revenue on a business account — this removes two indicators at once;
• keep correspondence, invoices and order screenshots. A standard contract with a foreign client is unlikely, but the nature of the operation can be evidenced with non-standard documents — banks accept them;
• test a new-to-you operation on small amounts. Don't push all revenue at once: send part, watch the bank's reaction, then scale. Only practice shows how a specific bank's monitoring treats a specific operation in your hands;
• don't understate expected inflows from abroad in the questionnaire — that's the same profile trap.

No. Renting out your own apartment is a lawful operation, and there's no reason to hide it from the bank. The bank isn't a tax authority — it doesn't check tax payment.

If inflows are regular and the bank asks, explain it as it is: the tenant is paying for the apartment. They ask for proof? Provide the lease agreement. Standard, understandable operation — banks accept such explanations without issue.

The question of tax on that income is a separate matter — it lies between you and the tax authority, not the bank. Don't confuse the two and don't hide rent from the bank out of fear of the tax authority: that hiding itself breeds suspicion.

Planning to withdraw a large sum to buy real estate or a car? Know this: withdrawing a large cash sum is always a suspicious operation. Always. Even if the money is fully lawful and taxed. The bank may release the funds without delay and send an enquiry two or three months later — and it will concern not just that sum but your activity in general. That's how banks most often work.

• Prepare documents on the source of funds before the visit to the teller, not after the enquiry. Gathering papers when the money is already frozen is done under stress and haste, and the bank spots the mistakes of after-the-fact paperwork.
• Warn the bank about the operation in advance, especially if the amount is unusual for your card.
• Withdraw in parts if circumstances allow: pulled a share, watched the bank's reaction, pulled some more.
• Consider a cashless settlement with the seller. Banks treat cashless transfers far more softly: the money stays inside the banking system under supervision, cash goes fully off the radar.

First — what not to do. Don't drag out the response. Ignoring an enquiry or dragging your feet is treated by the bank under Regulation No. 65 as suspicious behaviour: it decides you're inventing a legend and 'drawing' documents. A response in 5–7 days is a normal timeframe even for a bulky enquiry. But a month or two of silence already gives grounds for unflattering conclusions.

And don't invent a legend on substance. Write it as it is. If the activity is lawful, an honest explanation works best; fairy tales about the origin of funds only deepen the problem — the bank sees payers, periodicity and transaction nature.

The most common fear — and the most exaggerated. About ordinary operations that raised no questions, the bank tells no one. There is no mechanism for automatic transfer of information on your card movements to the tax authority: to see your accounts, the tax authority today has to go to court.

Under art. 8 of Law No. 361, the bank reports to the State Financial Monitoring Service in defined cases: threshold operations from UAH 400,000 with specific features, suspicious operations regardless of amount, refusal to establish business relations, suspension of operations. Most often that's where it ends: the information sits in the SFM as analytics and no action follows against you.

Don't confuse 'suspicious operation' with suspicion of a crime. A suspicious operation in financial-monitoring terms is an operation with an indicator the bank is required to work through. It can be perfectly lawful — and in the vast majority of cases it is.

At least two. Not a life hack but a safety cushion: if one bank has suspended operations and is clarifying circumstances, you keep paying from an account at another and sort things out without panic. Clients with a single account 'thrash' with a block longest and most painfully.

There are no 'trouble-free' banks from a financial-monitoring standpoint. However friendly the bank at the acquisition stage, internal financial-monitoring rules don't go anywhere, and the NBU fines banks millions for being lenient. Good relations end where an indicator begins.

Don't rush to panic. There is a scheduled periodic identification: the bank periodically invites clients to refresh data — re-fill the questionnaire, provide a passport copy and taxpayer number. That's routine, not a disaster.

But read the context of the invitation. A question from our air: a person moved UAH 3 million through an individual's card in a year and the bank called with an invitation to the branch. That's more than routine. Questions about turnover will almost certainly join the questionnaire refresh. Come prepared: gather documents on the largest inflows in advance, don't promise to 'bring them later'.

• Legal tax optimisation or evasion — business purpose, the reality-of-transactions doctrine, fragmentation and article 212.
• Sole proprietor vs LLC — when it's time to move from a personal card to a business account.
• Tax planning as a tool — lawful ways to reduce the tax burden without reassessment risk.
• CFC reporting — controlled foreign companies: filings, deadlines and common mistakes.