Lyudmila Mironova, lawyer of ALARIUS Law Firm, spoke about the peculiarities of access to banking secrets

Today, banking secrecy is not just statements from accounts. It is a detailed portrait of your life: habits, sources of income, expenses and business connections. But under the pressure of international standards (FATF, CRS) and internal changes, the line between privacy and transparency is getting thinner.
“We see a tendency to blur the very essence of information privacy,” says Lyudmila Mironova, a lawyer at ALARIUS, in a new material for Financial Club.

‍

— What is bank secrecy and why is it important for customers?

— Banking secrecy, as defined by the legislator in the Law of Ukraine “On Banks and Banking Activities”, is mostly information about the client's activities and financial condition. An example of such information is information about clients' bank accounts; information about transactions carried out for or on behalf of the client, transactions made by him; information about an individual who intends to conclude a consumer loan agreement, obtained during the assessment of its creditworthiness, etc.

But in fact, it is much broader information that combines the details of the financial and economic life of clients with sensitive aspects that characterize their business and personal relationships, habits, lifestyle, sources of income and expenses, which each client entrusted to the bank, entering into a bank-client relationship with him.

How has the balance between privacy and transparency changed in recent years? In particular, what international standards or practices influenced the updating of the Ukrainian approach to banking secrecy?

— Banking secrecy has always been protected by the state at the level of the law, because the stability and efficiency of the banking system and the stability of the state economy as a whole, of which the banking sector is a systematic link, depends significantly on the trust of customers, the reputation of banks and the legislative provision of guarantees of customer transactions in compliance with the necessary level of their confidentiality, saving their savings and guaranteeing a return on investment.

The relevant law on banks provides for an exhaustive list of cases when such information is disclosed by banks to third parties without the consent of the client. And this list is gradually expanding.

This process is caused not only by internal state processes, where the need to access such information to a significant number of persons is due to the development and complication of social relations within the country, but also by the implementation in the legislation of Ukraine of international norms requiring the transfer of information in order to combat money laundering, for tax transparency.

Thus, Ukraine implements the standards of the Financial Measures Development Group against Money Laundering and the Financing of Terrorism (FATF). In view of this, the legislation of Ukraine is saturated with new norms to ensure transparency of transactions and identification of clients (up to the ultimate owners of legal entities) and provides for the collection, analysis and storage of more differentiated types of data by banks.

In addition, in 2022, Ukraine joined the Multilateral Agreement of Competent Authorities on Automatic Exchange of Financial Account Information (CRS). Within the framework of such exchange, banks and other financial institutions shall collect and communicate information on the accounts of individuals, organizations that are residents of jurisdictions that are parties to the Multilateral Agreement.

So, we see very clearly the tendency to blur the very essence of the secrecy of information protected by banking secrecy.

— What grounds for disclosure of banking information are currently provided by law, who has the right to initiate such disclosure?

— The only normative legal and special act that regulates the grounds for disclosure of information containing banking secrets is the Law of Ukraine “On Banks and Banking Activities”. Article 62 of this law establishes which bodies/persons have the right to access bank secrets, and the bank is obliged to provide it. Conventionally, such persons can be divided into four categories: the clients themselves, who are the owners of such information; their creditors (cash encumbers, beneficiaries under escrow agreements); public bodies defined by this law; other officials (public/private executors, arbitration managers, notaries ousi). Also, for the period of martial law, the Ministry of Justice of Ukraine is allowed to collect certain information for the exercise of the powers defined by the Law of Ukraine “On Sanctions”.

The basis for the bank to provide such information is to receive in the prescribed manner a duly executed request from a government authority/person for the provision of relevant information or a court decision, which can be submitted to the bank both in paper and in electronic form.

— Are there cases of abuse by people who request information from banks?

— Unfortunately, there are attempts to gain access to bank secrets bypassing the law, and they are not isolated. Such cases include registration of requests from state bodies, determined by law, signed by an inappropriate person. In particular, this applies to requests from investigators who are not authorized by law to sign the relevant requirements, or by heads of territorial bodies of certain state bodies, which are also not empowered by law, and this position is observed both by the regulator in the person of the National Bank and by the courts. But not all banks read the law as it is. There are also cases when a public authority, not having the right to receive certain information, still requires it, for example, information regarding the availability of an individual bank safe, the right to receive which is provided only for public/private executors, notaries, arbitration managers.

Lawyers, by the way, are also not empowered to obtain information containing bank secrets regarding a third party, but subject to the correct execution of the client's consent, such information about him can be obtained.

— What are the risks for the bank in case of improper disclosure of information related to banking secrets?

— The bank, as the owner of the information entrusted to it for storage by clients, bears criminal, civil law (compensation for losses, moral damage) and other liability for its violation of the procedure for disclosure of information constituting a banking secret.

In addition, it is necessary to take into account such negative consequences of the bank's violation of the procedure for disclosing banking secrets, such as reputational damage, which means loss of confidence in the bank, affecting its image, customer base and competitiveness in the banking services market. After all, the client expects that the bank will protect its interests and information from unlawful encroachments and will not allow such unlawful interests of certain bodies and persons to prevail over the client's legal right to secrecy.

— How can banks balance between legally exchanging information with public authorities and protecting clients' interests?

— The key to such balancing is the clear fulfillment of the requirements of the law. Thus, each request for the provision of information containing bank secrets should be subject to legal assessment for compliance with the requirements of an exhaustive list of regulatory acts on procedural issues — the design and content of the request. For example, very often requests do not contain a specific date or period for which the provision of information is required, the mandatory availability of which is determined by the law on banks. Already at this stage, the bank's refusal to provide information will be legal, and the fair expectations of the client regarding the protection of information about him will be justified by the bank.

— How to protect the interests of the bank in the event of a claim by the client regarding the unfounded disclosure of information about him?

— Groundless disclosure by the bank of information entrusted to it by the client is a violation of both the requirements of the law and promises to the client to properly store information about him. If such a violation occurred, it is necessary to analyze the reasons, as well as the fulfillment by the bank and the requester of such information of all the requirements of the law. I am in favor of formalism in this matter: if the law dictates a certain rule, the bank is obliged to comply with it. There are public rules of the game, and they are the same for everyone.

‍