Banks, payment services and foreign partners increasingly ask companies to explain the source of funds, the ownership structure or the nature of transactions. Companies that are themselves reporting entities for financial monitoring need internal rules, a responsible officer and customer due diligence procedures.
We work with the requirements of Law No. 361-IX on preventing the legalisation (laundering) of the proceeds of crime (AML) and the Law of Ukraine “On Personal Data Protection”. We prepare responses to bank requests, internal financial monitoring and KYC documents, privacy policies, consents and data processing agreements. For companies serving EU clients, we take GDPR requirements into account.
When to seek help
- Your bank has sent a request about transactions or restricted your account
- A payment service or marketplace requires you to pass KYC
- Your company is a primary financial monitoring entity and needs internal documents
- You collect customer data through a website, app or CRM
- A foreign partner asks you to confirm GDPR compliance
What the lawyer does
Responding to bank requests
We find out exactly what the bank is asking for, help gather supporting documents and prepare a consistent explanation of the source of funds, counterparties and the economic substance of transactions.
Developing AML/KYC documents
Financial monitoring rules, customer identification and verification procedures, risk assessment and a training programme — tailored to the size and type of your business.
Reviewing personal data processing
We find out what data you collect, on what basis, where you store it and to whom you transfer it. Based on the results, we suggest what to fix first.
Preparing policies and consents
A website privacy policy, processing notices, consents, data processor agreements, an internal order and rules on employee access to data.
Advising the team
We explain to staff responsible for customers and data how to act in typical situations: a bank request, a customer's request about their data, a data leak.
Documents to prepare
- The bank's or partner's request, if any
- Charter, ownership structure, ultimate beneficial owner (UBO/КБВ) details
- Contracts and primary documents for the transactions the bank is interested in
- A description of the product, customers and sales channels
- A list of systems where customer and employee data is stored
- Existing internal policies and procedures
What you get
- A response to the bank's request with a package of supporting documents
- A set of internal financial monitoring or KYC documents
- A privacy policy, consents and data processor agreements
- Instructions for the team on typical situations
Frequently asked questions
The bank has suspended a transaction due to financial monitoring. What should we do?
First, find out the grounds: the bank may suspend a specific transaction, request documents or refuse to provide services. It is important to respond on time and on substance, not just formally. We help prepare explanations and documents, and if the bank acts without proper grounds, we assess the possibility of a complaint to the National Bank of Ukraine or a court claim.
Does a small business need a personal data policy?
The Law of Ukraine “On Personal Data Protection” applies to everyone who processes people's data, regardless of business size. If you collect customers' names, phone numbers, e-mail addresses or employee data, you need a lawful basis for processing and must inform people of the purpose and their rights. A policy on the website is only part of this: what matters is that actual practice matches it.
Who is a primary financial monitoring entity?
The list is set out in Law No. 361-IX. In addition to banks and financial institutions, it includes, in particular, notaries, lawyers and accountants in certain cases, real estate intermediaries, businesses accepting cash payments above a set threshold, and virtual asset service providers. Whether your company falls under these requirements is determined by its type of activity and its transactions.