In Brief
- October 28, 2026 the Verkhovna Rada passed Law No. 16013 in full (270 votes). Transferring, receiving, purchasing, and storing payment instruments and account access for fraudulent schemes become a criminal offense.
- For transferring your own card — a fine of UAH 5,100–17,000. For buying or selling someone else’s payment instruments — up to 4 years of imprisonment. For repeat offenses or actions by a group — up to 6 years or a fine of up to UAH 170,000.
- A first-time offender may avoid punishment if they voluntarily report the offense and help solve it.
- Honest P2P on your own card with your own money is not money muling. The risk begins when other people’s money passes through your card.
- Below is a safe P2P checklist and an action plan if you have already given someone your card or access to your bank account.
“Rent out your card for UAH 2,000 a week,” “work from home: receive payments and forward them,” “open a sole proprietorship, and we’ll use it.” In the past, the worst-case scenario for this was having your card blocked. Now it is a criminal offense under the Criminal Code. The money mule law targets not only the organizers of such schemes, but also people who “just lent their card to an acquaintance.” Let’s break down what exactly has changed and how a P2P trader can continue working without risk.
- What exactly the Rada adopted
- Who is a money mule (a “drop”), and why the law affects ordinary people
- P2P trader or money mule: what’s the difference
- Safe P2P checklist after the law
- If you have already shared your card or account access
- Caution: scammers are already using the law for intimidation
- Risks and what is still unknown
- FAQ
- When will the money mule law come into force?
- What are the risks if I gave my card to a friend?
- Can you trade on P2P now?
- I received a transfer from someone I don’t know. Am I a money mule now?
- How can I prove to the bank that I’m not a money mule?
- Can I avoid liability if I have already handed over the card?
What exactly the Rada adopted
Bill No. 16013 was submitted by the president, and on October 28, 2026, the Rada passed it in full. It introduces amendments to the Criminal Code and the Criminal Procedure Code and implements EU Directive 2019/713 on combating fraud involving non-cash payment instruments into Ukrainian law.
Main changes:
- New Criminal Code article on “drop accounts” (money mule accounts). The transfer, receipt, acquisition, and storage of payment instruments, credentials, and access to bank accounts and electronic wallets now become criminal offenses if done for the purpose of fraud.
- Expanded Article 200 of the Criminal Code. It now covers payment orders and means of access to electronic wallets, as well as obtaining them through deception or abuse of trust.
- Liability of legal entities. The grounds for criminal law measures against companies have been expanded.
| Action | Penalty |
|---|---|
| Transferring your own card or access to your account | Fine of UAH 5,100–17,000 |
| Buying or selling someone else’s payment instruments | Up to 4 years of imprisonment |
| Repeat offense or an organized group | Up to 6 years of imprisonment or a fine of up to UAH 170,000 |
| First-time offense + voluntary disclosure and assistance to the investigation | Possible exemption from punishment |
The law will take effect after it is signed by the president and officially published. At the time of publication, it has been passed by the Rada in full. We will update the article when the exact date becomes known.
Who is a money mule (a “drop”), and why the law affects ordinary people
A money mule, or “drop” in Ukrainian slang, is a person whose card, account, or sole proprietorship is used to receive and forward someone else’s money: funds from victims of fraudulent call centers, illegal gambling, or cash-out schemes. The mule often does not know where the money comes from and receives a fixed amount for the “rental.” According to NBU estimates, this ranges from UAH 800 to UAH 4,000 per week, Forbes Ukraine reports.
Typical offers that hide a money mule scheme:
- “Rent out your Monobank or PrivatBank card, no money needed, only the app.”
- “Remote work: payments come to you, you transfer them to other cards and keep a percentage for yourself.”
- “Open a sole proprietorship and give us access to the account dashboard, we’ll pay monthly.”
- “We need your card for a P2P team, we’ll do the trading.”
- “We’ll buy a verified account on an exchange or at a bank.”
If an offer includes the phrases “card rental,” “access to an app,” or “processing other people’s payments,” it is money muling, no matter what it is called.
P2P trader or money mule: what’s the difference
| Indicator | Legitimate P2P | Money mule scheme |
|---|---|---|
| Exchange account | Yours, KYC completed in your name | Yours or purchased, but controlled by someone else |
| Card | Yours, and only you use the app | Yours, but third parties have access |
| Whose money passes through the card | Yours: you buy or sell your own crypto | Other people’s: you are an intermediary in the chain |
| Income | Spread or exchange for your own needs | Fixed fee “for the card” or a percentage of the transit volume |
| Turnover | Matches your income and experience | Has surged sharply, with dozens of incoming payments from strangers |
| Bank’s question “where did the money come from” | You can answer and show your transaction history | You cannot explain either the source or the recipients |
The law refers to actions carried out for the purpose of fraud. But the bank and the police only see the movement of money. If stolen funds passed through your card, they will first block the card and start asking questions, and only later will they look into your intentions. That is why it is important not only not to be a money mule, but also not to look like one.
Safe P2P checklist after the law
- Trade only from your own account and with your own card. Your account on Binance or Bybit must be verified in your name, and the card must be issued in your name.
- Check that the payer’s name matches the counterparty’s name on the exchange. If the money came from someone else, do not release the crypto. Open an appeal and return the payment through the bank.
- Do not accept payment “from a brother, wife, or friend.” This is the main sign of a triangular scheme: the buyer pays with money stolen from a third party.
- Choose counterparties with a track record. A high rating and hundreds of completed trades reduce the risk, but they do not replace checking the name.
- Keep volumes within your income level. Without confirmed income, the monthly limit for outgoing transfers for an individual is UAH 50,000 or 100,000. If you trade more, prepare documents confirming the source of funds in advance.
- Keep your trade history. Regularly export the report on P2P orders from the exchange. This is the main argument if the bank asks where the money came from.
- Never give anyone access to your bank account. Do not enter your login details on someone else’s devices, do not install the bank’s app on a “helper’s” phone, and do not forward SMS codes.
- Respond to the bank’s requests. If the bank asks you to explain transactions, reply on time and attach the documents. Ignoring this almost always ends with the account being closed.
If your card has already been blocked after a transaction, we covered what to do in the article Monobank blocked a card after P2P, and how to respond to a request about the source of funds — in the guide PrivatBank requested the source of funds.
If you have already shared your card or account access
- Stop immediately. Change your password in the banking app, sign out of all unauthorized devices, and reissue your card.
- Notify the bank. Write in the official chat that a third party used access to the account and ask them to review the transactions.
- Save all correspondence. The listing, messages, phone numbers, and the “payment” amounts. These are evidence of how you were drawn in.
- Do not follow any more instructions from the “employer.” Especially requests to “return” money, transfer the remaining balance, or open a new card.
- Get legal advice. The law allows a first-time offender to avoid punishment if they voluntarily report it and assist the investigation. A lawyer can explain how this applies in your case. Free legal advice is available through the free legal aid system at 0 800 213 103.
Caution: scammers are already using the law for intimidation
A high-profile law is the perfect pretext for new scams. Expect calls from the “cyber police,” the “bank security service,” or an “investigator”: “mule money passed through your card; to avoid criminal charges, transfer the funds to a secure account” or “pay a fine.” Remember:
- the police do not handle criminal cases over the phone and do not accept “fines” via a transfer to a bank card;
- a bank will never ask you to transfer money to a “safe account”;
- any such call is a reason to hang up and call the bank back yourself using the number on the back of your card.
Risks and what is still unknown
- Enforcement practice. The key wording is “for the purpose of fraud.” How courts will interpret it in disputed cases, for example when someone “lent a card to a relative,” will become clear only after the first cases.
- Banks will not become more lenient. The law does not change financial monitoring: blocks due to suspected transit activity will continue, and the Memorandum limits for individuals will remain in place.
- Money mule registry. The Verkhovna Rada has not yet considered a separate draft law on the registry, which would make it possible to restrict banking services for people included in it.
- The figures may be clarified after the law is signed and officially published. Refer to the final version in Holos Ukrainy and on the Rada website.
FAQ
When will the money mule law come into force?
The Rada adopted Law No. 16013 as a whole on October 28, 2026. It will enter into force after being signed by the president and officially published. It is worth checking the exact date on the Verkhovna Rada website.
What are the risks if I gave my card to a friend?
If the card was used in a fraudulent scheme, the law provides for a fine of 5,100 to 17,000 UAH for handing over your card. If this was your first offense, you reported it voluntarily, and helped solve the crime, you may be exempt from punishment.
Can you trade on P2P now?
Yes. The law does not prohibit P2P. It penalizes the transfer of cards and account access for fraud. Trade from your own account using your own card, verify the payer’s name, and do not accept payments from third parties.
I received a transfer from someone I don’t know. Am I a money mule now?
No, simply receiving money does not make you a money mule. But do not spend it or transfer it to other cards at the request of strangers. Notify the bank and return the money only through the bank.
How can I prove to the bank that I’m not a money mule?
Show that the card and the exchange account belong to you, and that the transactions are yours: export your P2P trade history, confirm the source of funds (salary, sale of property, savings), and explain why the transaction volumes match your income.
Can I avoid liability if I have already handed over the card?
The law provides for this possibility for those who committed a violation for the first time, voluntarily reported the offense, and helped solve it. Stop cooperating, notify the bank, and seek legal advice from a lawyer.
