BankID NBU: Participation and user data protection requirements are strengthened

On September 1, 2023, the National Bank of Ukraine (NBU) adopted Resolution No. 105 to enhance the protection of user data and clarify a range of requirements related to the responsibility of its participants within the BankID System to ensure its effective development.

One of the key changes made to the system is the clarification of the requirements for subscribers - identifiers, which currently includes 38 banks that are connected to the system.

According to the new requirements, users must perform multi-factor authentication. This means that a user must use at least two authentication factors, each belonging to a different category (knowledge, possession, inherency) and independent of the other factors, to prove his identity. This provides a higher level of security because it makes it difficult for all factors to be compromised at the same time.

Subscribers of the system have until March 1, 2024 to adapt their activities and meet the requirements for multi-factor user authentication.

In addition, NBU expanded its rights and clarified the powers of the System Council to strengthen the responsibility of subscribers to comply with the terms of use of the BankID System and streamline processes in it. This will contribute to increasing the security and efficiency of the system.

Another significant change is the extension of the data retention period for information on the transmission of user data through the BankID System to five years. This is done to protect the rights of subscribers in case of disputes and increase the reliability of the system.

Changes come into effect on September 5, 2023, except for the provisions regarding multi-factor authentication of users, which will begin on March 1, 2024. The NBU urges BankID System participants to bring their activities in line with the updated requirements by December 1, 2023. These measures will enhance security and user trust in the BankID NBU system.