The NBU fined RozetkaPay and Portmone Group 21.4 million UAH for systemic violations in the payment services sector

In November 2025, the National Bank of Ukraine (NBU) published a decision on imposing significant financial sanctions on two non-bank financial institutions — LLC “FC EVO” (RozetkaPay) and LLC “FC MBK” (Portmone Group). Following scheduled inspections of these payment services in 2025, the regulator imposed fines totaling UAH 21.4 million and issued written warnings regarding internal control and the organization of the companies’ operations.

Reasons for Imposing Fines

According to NBU and independent sources, RozetkaPay was fined UAH 13.6 million for a series of violations in cash transactions, client account management, information security, issuance and acquiring of payment instruments, as well as deficiencies in client contracts. The inspection was conducted between June and August 2025, allowing the regulator to identify systematic flaws in the company’s processes, namely:

• Violations of client account management requirements: improper transaction documentation, payment delays, issues with account balances.
• Insufficient protection of personal data and financial information of users, creating risks of unauthorized access.
• Issues with issuance and maintenance of payment cards and other instruments, affecting consumer protection.
• Deficiencies in legal contract structures for client interaction: unclear service terms, lack of transparent compensation and service liability provisions.

Portmone Group, 100% owned by Kaspi Pay LLC (Kazakhstan), holds an NBU license for money transfers without opening accounts. An audit in March–May 2025 revealed violations concerning the issuance of payment instruments, client data storage, and compliance with prudential regulations, resulting in a fine of UAH 7.8 million. Additionally, the company received a written warning for shortcomings in information disclosure, internal control, corporate governance, and documentation.

Legal Basis and Regulatory Context

NBU’s decisions are based on the requirements of the Law of Ukraine “On Payment Services,” as well as consumer protection standards in the financial sector and prudential regulations. For non-bank financial institutions, comprehensive control over compliance with operating standards is increasingly important:

• Mandatory consumer notification regarding contract terms, tariffs, and restrictions.
• Personal data protection according to GDPR and Ukrainian law.
• Introduction of strict criteria for internal audits, risk management, and transaction documentation organization.

In 2024, RozetkaPay demonstrated rapid financial growth: revenue increased 2.5 times (UAH 899.54 million), net profit grew 1.5 times to UAH 16.69 million. Portmone Group for the same period received a net profit of UAH 30.09 million, which is only 3% less than in 2023.

Impact on Market and Services

The imposition of fines on leaders of Ukraine’s payment services market has multifaceted consequences:

• Higher transparency and compliance demands for every market entity, especially regarding information security and legal service support.
• Owners and top management must revise corporate governance policies, invest in internal audits and compliance.
• Increased focus on customer service standards, both online and offline, legal process automation, and enhanced consumer rights protection.
• “Warning effect” for other market participants: a wave of internal audits, compliance investments, and legal due diligence is expected.
• Potential strengthening of state control may spur the integration of new security technologies (KYC, AML, multi-level data verification, encryption).
• For the companies themselves, fines mean not only financial payments, but also radical restructuring of procedures: contract documentation audits, data processing policy updates, modernization of IT systems for information security guarantees.

Judicial and Administrative Perspective

According to NBU decisions, companies must pay the fines within 14 calendar days of receiving the committee’s decision and rectify all violations by December 17, 2025. If these requirements are not met, administrative proceedings may be initiated, with additional sanctions — up to temporary license suspension or restriction of certain activities.

Challenging the regulator’s actions in court remains common in the legal field, but the evidence and justification provided by the NBU committee in the cases of RozetkaPay and Portmone Group suggest strong prospects for the regulator to prevail in administrative proceedings.

Legal Commentary on Impacts

Given current trends in the digitalization of Ukraine’s payment market, the RozetkaPay and Portmone Group cases illustrate key risks for non-bank institutions: insufficient compliance control, neglect of legal changes, formal attitudes to personal data protection and contractual procedures. For lawyers and financial service executives, this case is an example of the necessity for ongoing legislative monitoring, comprehensive internal control policies, and legal support.

Conclusions

The fines against RozetkaPay and Portmone Group mark a significant episode in the new phase of state oversight of Ukraine’s payment market, reinforcing requirements for transparency, safety, consumer protection, and corporate governance. For market competitors, this is a stimulus to invest in compliance, legal audits, and consumer rights protection. For legal support teams, it highlights the importance of developing standardized contracts, data protection policies, and consulting on new regulatory requirements.

Author: Ihor Yasko, Managing Partner of WINNER Law Firm, PhD in Law.