NBU rules for the mobile banking app your customers use.
The National Bank of Ukraine asks banks for security requirements in development, vulnerability control, OWASP for web applications and periodic penetration tests. Its rules on strong customer authentication add limits on failed attempts, a ten-minute inactivity time-out, dynamic linking and protections against modified software on customers' phones. Ostorlab helps you test those controls in your app and its APIs, on every release.
- Checks root and jailbreak detection, anti-tampering and anti-instrumentation, and what the app does when they trigger
- Tests login, one-time codes, lockout and session time-outs with your test accounts
- Follows the app into the payment APIs, even with TLS pinning
- Proves each failure with bypass evidence or a replayable exploit
- Who it applies to
- Banks in Ukraine; the authentication rules apply to payment service providers, including banks
- Legal basis
- NBU Board Resolutions No. 95 of 28 September 2017, No. 178 of 12 August 2022 and No. 58 of 3 May 2023
- Focus
- Penetration tests, vulnerability control, secure development, strong customer authentication
- Reference
- NBU information security, cyber protection and strong authentication regulations
The NBU's security rules, date by date
The information security rules have applied since 2018, the cyber protection rules since 2022, and the 2025 amendments added incident reporting deadlines and a yearly self-assessment.
- 1 March 2018
Information security regulation in force
Resolution No. 95 sets mandatory minimum information security and cyber protection requirements for banks. Its Section V, with additional measures such as OWASP, applies from 1 September 2019.
- 20 August 2022
Cyber protection regulation in force
Resolution No. 178 sets the cyber protection system of the banking sector, rules for critical information infrastructure and the external information security audit. Some provisions apply from 1 January 2023.
- 10 May 2023
Strong authentication regulation in force
Resolution No. 58 sets authentication and strong customer authentication rules for payment service providers. Its Section V, on electronic interaction between providers, applies once the matching chapter of the Law on Payment Services takes effect.
- 1 March 2025
Amendments on cyber protection and control
Resolution No. 24 adds reporting of significant cyber incidents within 24 hours, an update within 72 hours and a final report within a month, and a yearly self-assessment report.
- Every year
Self-assessment report
Banks prepare a self-assessment of information security and cyber protection as of 31 March and submit it within one month. It asks whether a penetration test was run and whether critical and high vulnerabilities were fixed.
The NBU's security rules, applied to your mobile app
Resolution No. 95 sets the minimum information security measures, Resolution No. 178 the cyber protection system and external audit, and Resolution No. 58 the strong authentication rules. For each rule: what the text says, what it means for a mobile banking app, how Ostorlab helps, and what stays with your team.
- NBU Resolution No. 95, points 124 and 125
Define security requirements when you build or buy
What the text says
The bank must define and document information security requirements for its information systems when they are developed, upgraded, including their components, or acquired. Development and testing must use a separate test platform on a dedicated network segment, and only anonymized data may be used as test data.
What it means for your mobile app
Each release of the app, and each SDK or vendor component it adds, needs security requirements and testing before it reaches the store, on an environment with no real customer data.
How Ostorlab helps
Mobile SAST analyses the APK, AAB or IPA directly, with no source code needed, including taint analysis across embedded SDKs. Mobile DAST runs the app, keeps authenticated sessions and captures traffic, stack traces and screenshots. On-premises scanning lets you test staging apps and APIs behind your firewall.
What stays with you
The requirements themselves, the test environment and anonymized test accounts.
- NBU Resolution No. 95, point 127; Resolution No. 178, point 18
Control vulnerabilities in software
What the text says
During operation, the bank must document how it controls vulnerabilities in the hardware and software of its information systems. Its cyber protection measures must include vulnerability analysis, and receiving, testing and deploying software updates that remove vulnerabilities.
Source:NBU Resolution No. 95, point 127; Resolution No. 178, point 18
What it means for your mobile app
The app and the third-party libraries inside it are software. Known vulnerabilities in them need to be found, and fixes shipped and checked.
How Ostorlab helps
SCA fingerprints statically compiled libraries that manifest-based scanners can miss, maps them to known vulnerabilities and tracks their closure from release to release. Findings are tracked as tickets in the platform or in Jira and ServiceNow, and retested once the fix ships.
What stays with you
Patching servers, networks and workstations, and the update process for the rest of your estate.
- NBU Resolution No. 95, point 143
Use OWASP to build secure web applications
What the text says
The bank must use the standards, documents and guidelines of the Open Web Application Security Project (OWASP) to develop secure web applications.
What it means for your mobile app
The web services and APIs behind your mobile app are web applications. OWASP guidance for APIs and mobile apps is the natural baseline for testing them.
How Ostorlab helps
Ostorlab intercepts the app's traffic, even with TLS pinning, and tests the APIs for broken authorization (BOLA, BFLA, IDOR), misuse of tokens and sessions, and abuse such as enumeration, replay and automation, with request and response evidence for each finding.
What stays with you
Secure coding standards, developer training and code reviews.
- NBU Resolution No. 95, point 108; Resolution No. 4, Annex 2, as amended by Resolution No. 24
Run periodic penetration tests
What the text says
The bank must check the effectiveness of its network perimeter protection by running periodic penetration tests. The yearly self-assessment asks whether a penetration test was run in the period, how and by whom, and whether the critical and high vulnerabilities it found were fixed.
Source:NBU Resolution No. 95, point 108; Resolution No. 4, Annex 2, as amended by Resolution No. 24
What it means for your mobile app
The services customers reach from the internet, including the mobile banking backend, sit on that perimeter. You need pentest results and proof that serious findings were closed.
How Ostorlab helps
An AI-agent pentest tests the app and its APIs behind login, typically in a few hours, with a working exploit you can replay for each AI-agent finding. Retesting confirms whether each issue is resolved.
What stays with you
Network perimeter tests, the choice of testers and the self-assessment report.
- NBU Resolution No. 178, points 42 to 46, as amended by Resolution No. 24
External information security audit, including pentests
What the text says
The bank sets how often its external information security audit takes place. The audit assesses the protection of cyber protection objects and the conformity of the information security management system with ISO/IEC 27001. Its methods include security analysis and penetration testing, and the bank sends the NBU the results and its approved remediation plan.
Source:NBU Resolution No. 178, points 42 to 46, as amended by Resolution No. 24
What it means for your mobile app
The external audit is run by an audit firm the bank selects among Ukrainian resident legal entities. Findings about the app and its APIs will need a remediation plan.
How Ostorlab helps
Ostorlab helps you go into the audit with known app and API issues already fixed, and retest the app and API items of the remediation plan afterwards.
What stays with you
Choosing the audit firm, the audit programme, and reporting to the NBU.
- NBU Resolution No. 58, points 15 and 17
Strong authentication, lockout and time-outs
What the text says
Payment service providers create an authentication code each time a customer accesses the account remotely or initiates a remote payment, subject to the exemptions the regulation allows. No more than five failed strong authentication attempts in a row are allowed before blocking, sessions must be protected, and inactivity after strong authentication must not exceed ten minutes.
What it means for your mobile app
Login, lockout and session time-out in the app are regulated controls. The server must enforce them, not only the app.
How Ostorlab helps
Ostorlab logs in with your test accounts, completes SMS, email or TOTP one-time codes, and tests login and logout, token refresh, timeouts, session invalidation and MFA enforcement, including step-up flows.
What stays with you
The choice of authentication factors, unblocking procedures and fraud monitoring.
- NBU Resolution No. 58, point 22
Link each authentication code to the payment
What the text says
With dynamic linking, the payer sees the payee and the amount, the authentication code is linked to them, and any change to the amount or payee makes the code invalid and cancels the initiation.
What it means for your mobile app
An attacker who changes the amount or the payee between confirmation and execution should fail. That logic lives in the app and the payment APIs.
How Ostorlab helps
The AI-agent pentest tests the business logic of payment and account flows, and Ostorlab tests MFA enforcement and step-up flows, including how attackers try to manipulate them, together with the API calls behind them.
What stays with you
The cryptographic design of the authentication code and transaction monitoring.
- NBU Resolution No. 58, point 33
Protect authentication on the customer's phone
What the text says
When authentication elements or codes are processed on a multi-purpose device such as a mobile phone, the provider must use separate secure execution environments, mechanisms that prevent the payer or a third party from changing the software, and measures that reduce the impact of unauthorized changes.
What it means for your mobile app
The app must resist tampering, repackaging and runtime hooking, and react when the device is rooted or jailbroken.
How Ostorlab helps
Mobile Shielding Scan runs the app in rooted and jailbroken environments, attempts bypasses of root and jailbreak detection, anti-tampering, anti-instrumentation and TLS pinning, and shows whether the app blocks the workflow, refuses to start or keeps running. You get a hardening score and bypass evidence.
What stays with you
The choice of shielding product and how the app responds to a compromised device.
- NBU Resolution No. 58, points 59 and 95
Keep sensitive payment data confidential
What the text says
Sensitive payment data must be masked on display and not shown in full when entered. It must be stored, with its encryption keys, in a form protected from unauthorized viewing and modification, and protected by cryptography or made unreadable when transmitted.
What it means for your mobile app
Passwords, codes, keys and card data must not leak from the app's storage, logs, screenshots or traffic.
How Ostorlab helps
Ostorlab looks for session tokens and personal data in local storage, caches, logs and screenshots, checks for misconfigurations that weaken transport and session protections, and finds hardcoded API keys, tokens and credentials in the app package.
What stays with you
The key management methodology, approved by your management, and backend storage.
Summary of Ukrainian-language texts published by the National Bank of Ukraine, checked on 27 September 2026. The authentication rules apply to payment service providers, as noted. This page is not legal advice.
NBU rules, control by control
The controls the NBU texts point to, how Ostorlab tests them in your app and its APIs, and the evidence you can keep.
| Control | How Ostorlab helps | Evidence you keep |
|---|---|---|
| Security testing when systems are developed or acquiredRes. 95, point 124 | Mobile SAST on the binary and Mobile DAST on the running app, before release. Details | Findings with decompiled source context, traffic, stack traces and screenshots |
| Vulnerability control in softwareRes. 95, point 127; Res. 178, point 18 | Fingerprints statically compiled libraries and maps them to known vulnerabilities, release to release. Details | Mapped vulnerabilities with upgrade or replace recommendations, and closure tracked across releases |
| Periodic penetration testsRes. 95, point 108 | AI-agent pentest of the app and its APIs, behind login, on the build you ship. Details | A working exploit you can replay for each AI-agent finding, and a coverage heatmap |
| Fixing critical and high vulnerabilitiesRes. 4, Annex 2, items 34 and 35 | Groups findings into tickets in the platform or in Jira and ServiceNow, and retests after the fix. | Ticket history and retest result for each finding |
| OWASP for web applications and APIsRes. 95, point 143 | Intercepts traffic even with TLS pinning and tests authorization, token misuse and abuse such as enumeration and replay. Details | Request and response evidence for each API finding |
| Failed attempts, time-outs and session protectionRes. 58, point 17 | Tests login and logout, token refresh, timeouts and session invalidation. Details | Session and token findings, with request and response logs |
| Strong authentication and dynamic linkingRes. 58, points 15 and 22 | Logs in with one-time codes and tests MFA enforcement and step-up flows, and the API calls behind them. Details | Findings on login and step-up flows, with reproduction steps |
| Protection against modified software on the phoneRes. 58, point 33 | Runs the app in rooted and jailbroken environments and attempts to bypass root and jailbreak detection. Details | Hardening score, and bypass evidence for each protection that failed |
| Protection against runtime hookingRes. 58, point 33 | Injects debuggers and hooks and adapts the attempt to get past anti-instrumentation defenses. Details | Evidence of which protections held and which were bypassed |
| Sensitive payment data on the device and in transitRes. 58, points 59 and 95 | Looks for tokens and personal data in storage, caches, logs and screenshots, and checks transport protections. Details | File system evidence showing what was written, where and when |
Ostorlab tests controls in the app and its APIs. The information security management system, network and perimeter security, critical information infrastructure, transaction monitoring, business continuity, incident reporting to the NBU Cyber Defense Center and the external audit stay with your teams.
Mobile app controls to test for the NBU rules
A practical list for security and compliance teams working on the NBU information security, cyber protection and authentication rules.
Security requirements per release
Document security requirements for the app and each vendor component, and test every build on a separate environment with anonymized data.
Libraries and SDKs
Track the third-party libraries in each release, map them to known vulnerabilities and ship the fixes.
Login and lockout
Verify blocking after five failed strong authentication attempts in a row, and a safe unblocking procedure.
Session time-out
Check that sessions end after no more than ten minutes of inactivity, and that the server enforces it.
Dynamic linking
Try changing the amount or the payee after confirmation, and confirm that the code becomes invalid and the payment is cancelled.
Compromised and modified devices
Run the app on rooted and jailbroken devices, try a modified build and runtime hooks, and confirm the app reacts.
APIs and sensitive data
Test authorization on every account and payment API, and look for codes, keys and tokens in storage, logs and traffic.
Evidence for the self-assessment
Keep pentest results and retests of critical and high findings for the report as of 31 March and for the external audit.
A suggested list, not an NBU template. This is not legal advice.
The capabilities behind this page
Each one has its own page with the details.
- Mobile Shielding ScanTest root and jailbreak detection, anti-tampering and pinning at runtime, and see which protections held and which were bypassed.Learn more
- Mobile Agentic Deep ScanAI agents pentest the store build on every release, with a working exploit you can replay for each AI-agent finding.Learn more
- Authenticated testingTest login, one-time codes and step-up flows with your test accounts.Learn more
- API and backend testingIntercept app traffic even with TLS pinning, then test the APIs and backends behind accounts and payments.Learn more
- Mobile SASTBinary-based static analysis of APK, AAB and IPA files, with taint analysis across the app and its embedded SDKs.Learn more
- SCA and SBOMFind vulnerable dependencies, including statically compiled native libraries, and track their closure release after release.Learn more
- On-premises scanningScan staging apps, APIs and repositories behind your firewall or VPN, on infrastructure you control.Learn more
- Bring your own AI keyRun AI-agent scans on your own AI provider key with a spend cap per scan, so usage follows your internal policies.Learn more
Trusted by banks and fintechs, including
Sources
The official texts this page is based on, checked on 27 September 2026.
- Положення про організацію заходів із забезпечення інформаційної безпеки в банківській системі УкраїниNational Bank of Ukraine, Board Resolution No. 95 of 28 September 2017, in force since 1 March 2018 (Section V since 1 September 2019). Minimum information security measures for banks. Ukrainian only
- Положення про організацію кіберзахисту в банківській системі УкраїниNational Bank of Ukraine, Board Resolution No. 178 of 12 August 2022. Cyber protection system, critical information infrastructure and the external information security audit. Ukrainian only
- Зміни до деяких нормативно-правових актів Національного банку України з питань інформаційної безпеки та кіберзахистуNational Bank of Ukraine, Board Resolution No. 24 of 25 February 2025, in force since 1 March 2025. Amends Resolutions No. 4 and No. 178: significant incident reporting and the yearly self-assessment. Ukrainian only
- Положення про автентифікацію та застосування посиленої автентифікації на платіжному ринкуNational Bank of Ukraine, Board Resolution No. 58 of 3 May 2023. Authentication, strong customer authentication and payment data protection for payment service providers. Ukrainian only
Frequently asked questions
Straight answers on coverage, setup, and how results reach your team.
Can't find your answer? Book a demo or contact us.
Test your mobile banking app against the NBU rules
Start with a free scan of your app from the store, or book a demo to run shielding and logged-in tests with our team.