The National Bank of Ukraine (NBU) has updated the requirements for the organization of internal control systems of financial companies. The amendments were approved by Resolution No. 12 of the NBU Board dated 2 February 2026 and enter into force on 5 February 2026.
The updates affect corporate governance, risk management systems, and the internal audit function. Financial companies must bring their internal processes into compliance with the new regulatory requirements within the established deadlines throughout 2026.
Key сhanges to internal control requirements
The amendments provide for:
- clarification of internal control system requirements in line with the Global Internal Audit Standards;
- updated approaches to operational risk management for financial companies working with collateralized assets;
- strengthened requirements for credit risk and liquidity risk management for companies planning to conduct factoring activities following the enactment of the Law of Ukraine “On Factoring”;
- clarification of rules governing the outsourcing of key functions (not of public interest).
The new framework effectively requires a comprehensive review of internal policies, risk matrices, control procedures, and documentation of internal audit activities.
Compliance deadlines in 2026
Financial companies must ensure the implementation and functioning of credit, operational, and liquidity risk management systems by 30 July 2026. Specific deadlines for implementing the Global Internal Audit Standards include:
- by 31 March 2026 – conduct a self-assessment of the internal audit function;
- by 31 May 2026 – develop or update internal audit documentation;
- by 30 September 2026 – achieve full compliance of the internal audit function with NBU requirements.
Failure to comply may result in regulatory risks, including supervisory measures by the NBU.
Practical risks for financial companies
The updated requirements increase management responsibility for the effectiveness of internal control systems. Key risks in 2026 include:
- formal implementation of standards without substantive process changes;
- lack of an integrated risk management system;
- non-compliance of the internal audit function with international standards;
- improper structuring of outsourced key functions.
A comprehensive review of internal control and risk management systems helps minimize potential violations and prepare for regulatory inspections.
As part of its tax advisory and corporate governance services, Kreston Ukraine assesses internal policies for regulatory compliance.
During NBU inspections, professional regulatory and tax audit support becomes particularly important in mitigating potential sanctions.
Updating internal procedures also requires proper organization of accounting processes, including tax accounting advisory and transformation of internal control systems.
FAQ: new internal control requirements
What has the NBU changed in 2026?
The NBU updated requirements for corporate governance and internal control systems of financial companies, particularly regarding risk management and the internal audit function in line with Global Standards.
Who is affected?
The requirements apply to all financial companies, as well as entities working with collateralized assets or planning to conduct factoring activities.
What are the compliance deadlines?
The key deadline for implementing risk management systems is 30 July 2026. Separate milestones for internal audit apply in March, May, and September 2026.
Is there liability for non-compliance?
Yes. Non-compliance with internal control requirements may lead to supervisory measures by the NBU.
Need a readiness assessment?
Kreston Ukraine specialists can conduct a comprehensive gap analysis of your internal control system, assess regulatory risks, and update internal policies in line with NBU requirements.
Contact our team for tailored advice and practical recommendations.
