There is no official list of documents specifically for income from cryptocurrency. Neither the National Bank of Ukraine nor the Ministry of Finance has ever published one.
The lists banks publish on their own websites do not include cryptocurrency as a source of income at all: they cover salary, pension, sole proprietorship, sale of property, inheritance, rent and dividends. So what people send is not one document but a chain of several that shows the movement of money from start to finish.
The first thing worth doing is to look at the date in the request itself. The law sets no statutory deadline for a client's reply; the bank sets it through its own internal procedure. Now to what that chain is made of.
What customer due diligence is
A question about the source of funds is not one manager's initiative. It is part of customer due diligence, a duty the bank carries under Law No. 361-IX. The bank is obliged to know who its client is, what they do, and which operations are normal for them.
Due diligence consists of several actions: identifying the person, establishing the purpose of the business relationship, establishing the source of funds, and ongoing monitoring of operations.
The bank performs the first three when the account is opened; the fourth continues for as long as the account is alive. The terms behind this procedure are collected in our glossary: KYC and AML.
The key word here is profile. The bank compares your operation not against a threshold in hryvnia but against what it already knows about you.
Article 21, which describes suspicious operations, contains no figure at all: even an operation for five thousand can be suspicious if it does not fit the profile.
That is why people are surprised when a bank asks about an amount well below the mandatory financial monitoring threshold of UAH 400,000. The threshold and suspicion are two different mechanisms, and the second works without any numbers.
Why the bank asks about more than just crypto
The request rarely reads "confirm your income from cryptocurrency". Most often it is worded more broadly: confirm the source of funds in your account for such and such a period.
The reason is that the bank looks at the account as a whole. It is interested not in one operation but in the picture: how much comes in, from whom, how long the money stays, where it goes next. A crypto sale is only one line in that picture.
The second reason is that the bank may not know cryptocurrency is involved. It sees an incoming payment from an individual or a company and a payment reference, not the nature of the asset behind it. The crypto hypothesis is often raised by the client in the reply.
The third reason is purely procedural. If the bank is updating your questionnaire, it will collect the full set of income sources anyway, not only the one that prompted the question.
So it makes sense to name all your sources in the reply, not just one. An explanation in which salary and crypto income stand side by side reads as a coherent picture rather than an excuse for a single payment.
The three links the chain is made of
A caveat straight away: the three-link chain is a practice among lawyers, not a legal norm. No such requirement exists in Law No. 361-IX or in any secondary regulation. It is a generalisation of what banks ask for in practice, and it can vary from bank to bank.
The first link is the origin of the initial money used to buy the crypto. Salary, payouts from a sole proprietorship, the sale of a car, savings. This is the link banks most often care about, because it answers where the money came from in the first place.
The second link is the operations themselves: when you bought, what you bought, at what rate, when you sold. That means a statement or an operation history.
The third link is how the funds came back to your account: the payment that brought the hryvnia in, and its connection to the first two links.
A single statement from a trading venue closes only the middle link. It shows that you traded, but says nothing about where the money for the first purchase came from. A package consisting of nothing but that statement is the most common reason for a follow-up request from the bank.
Which documents close each link
The first link is usually covered by ordinary income documents: an income certificate from your employer, bank statements for the period when you were saving, a contract for the sale of property, inheritance documents, sole proprietor reporting.
The period rule applies here: the document must cover the time when the crypto was bought, not the current year. A certificate for 2026 explains nothing about a purchase made in 2021.
For the second link, the operation history from the trading venue for the whole period, not the last month. It helps if the file shows both purchases and sales: a package with sales only leaves the question of where the asset came from unanswered.
For the third link, a statement for your bank account showing the payment that brought the hryvnia in, plus confirmation of the withdrawal from the venue or service. The two sides of one operation must match on date and amount.
A word on the blockchain. A wallet address and a TXID show the movement of the asset and are often a useful addition. But on their own they do not prove whose funds these are, so they cannot replace a statement.
Why your case is missing from the bank's list
Banks wrote their document lists for classic sources of income, and cryptocurrency simply never made it in. We checked the lists of PUMB and Sense Bank: not a single mention of virtual assets as a source of funds.
That does not mean the bank will not accept crypto income. It means there is no ready-made form for it, and the bank judges the contents of your package at its own discretion.
Hence the first practical consequence: asking the call centre "which certificate exactly do you need" is often pointless. The operator is reading the same list that has no entry for your case.
A substantive answer comes from the financial monitoring unit, and it comes only after they have seen what you sent. In other words, the dialogue here happens after you submit the package, not before.
What a good reply to the bank looks like, and a bad one
A bad reply is a file with no explanation. Someone exports a statement from the trading venue for the last month, attaches it in a single message and waits.
The bank receives a table of operations with no beginning to the story and no link to the payment that arrived in the account. What follows is either a clarifying request or a refusal.
An overloaded reply works badly too: a page of emotional explanation, arguments that the limit is unlawful, promises never to do it again.
We covered the nature of limits separately in an article on why one hundred thousand is not a rule of the National Bank of Ukraine. In a request about the source of funds, that topic is simply in the wrong place.
A good reply has structure. First a short text of a few paragraphs: who you are, what your main income is, when and with what money you bought the cryptocurrency, when and where you sold it, and which payment brought the hryvnia into the account.
Then the documents in the same order in which the text mentions them, with readable file names. Not "scan_01.pdf" but "2023-income-certificate.pdf".
That sounds like a small thing, but a person reads the package, and a clear package gets processed faster.
And separately: the amount and date in your explanation must match the amount and date in the document. An unexplained discrepancy is the most common reason for a clarifying request.
What to do if the documents are gone
The situation is common: the crypto was bought long ago, the venue has closed, the card has been reissued, and there is no income certificate from a job five years back. An empty reply is worse than an incomplete one, so it is worth gathering whatever can be recovered.
A statement for an old bank account is issued on request, usually for a fee; retention periods are long. That often closes the first link even without a certificate from an employer.
Income data is held by the State Tax Service: information on income paid and tax withheld can be obtained through the taxpayer's electronic cabinet. For confirming salary from past years this is a workable route.
Some trading venues will provide an operation history even after access is closed, if you contact support and confirm your identity.
If the venue has shut down, the blockchain transactions remain: an address and a TXID show the movement of the asset, though not whose funds they are.
If part of it could not be recovered, say so in your explanation: what exactly, for which period and why. A gap you name openly looks different from an unexplained break in the chain.
Which document carries the most weight
The strongest document is not a statement from a trading venue but a filed tax return with the crypto income declared. That confirms the source at the level of the State Tax Service.
The difference is who authored the document. A statement is something you exported from your own account on the venue; technically nobody but the venue has certified its contents.
A tax return is a document filed with a state authority, with a mark confirming submission. For a bank these are different levels of trust.
A statement is assessed; a tax return is generally accepted, because checking it on the merits is no longer the bank's job. So for anyone who sells cryptocurrency regularly, declaring it settles not only the tax question but the banking one as well.
No promises can be made even so: the bank decides on the package, and a filed return is not a guarantee.
How much time you have to reply
There is no statutory deadline. We checked both Law No. 361-IX and the banks' own pages: no deadline for a client's reply, including the widely quoted "10 working days", appears anywhere in the rules.
The bank sets the deadline itself in its request. So the date in the letter is not a formality but the only real deadline you have.
Until the documents are provided, outgoing operations on the account may be restricted. That is PUMB's own wording on their own page, and it explains why delay is a poor idea even when the deadline looks generous.
It is worth distinguishing a request for documents from a suspension of an operation. Suspension is governed by Article 23: up to 2 working days by the bank's decision, up to 7 if extended by the State Financial Monitoring Service, up to 30 if the materials are passed to law enforcement.
Those deadlines have nothing to do with your reply. If no decision arrives within them, the operation resumes automatically on the third working day.
What happens after you send the package
There are three typical scenarios, and none of them plays out instantly: the package is read by the financial monitoring unit, not by the operator who received your message.
The first is that the bank accepts the documents without comment. The restrictions are lifted, there may be no separate letter saying all is well, and that is normal.
The second is a clarifying request: a link is missing, dates do not match, a document for a different period is needed. This is a routine situation, and you answer it the same way you answered the first request.
The third is a refusal of the operation or of service altogether. Article 15 applies here, and the consequences are set out below.
One thing worth doing in any of these cases: keep your correspondence with the bank and a copy of the package you sent. If the question comes up at another bank, a ready package saves weeks.
What happens if you do not send the documents
The bank does not merely "have the option" to refuse; it is obliged to. Article 15 of Law No. 361-IX is worded precisely as a duty: refuse the operation and, if necessary, terminate the relationship and close the account.
The bank reports a refusal to the State Financial Monitoring Service within one working day. Banks are also entitled to share information among themselves about people who have been refused. So the consequence does not stop at one account.
Silence is not a neutral option. It is worse than an incomplete package: an incomplete package brings a clarifying request, silence brings a refusal.
We cannot promise that any particular set of documents guarantees a positive decision: the decision is the bank's.
How to prepare in advance
The easiest part of this work is the part done before the request arrives. Collecting documents after the fact costs more and takes longer than keeping them as you go.
The minimum worth having at hand: confirmation of the income the crypto was bought with, covering the period when you bought it; and a full operation history from the trading venue, exported for the whole period rather than the last month.
Then bank statements for the accounts the funds came in and went out through, and saved confirmations of every withdrawal to your card, with dates.
And, if the income was subject to declaration, a copy of the filed tax return with the submission mark.
A word on habit: export your history from the venue once a quarter and save it locally. Access to an account can be lost, and by then the account restriction will already be in force.
It also helps to keep a short text file with a timeline: date, amount, what happened. When the request arrives, the explanatory part of your reply comes together from it in half an hour rather than a week.
We covered the broader context of why banks ask such questions at all in our article on financial monitoring.
We are an exchange service, not a law firm. What is set out here is what the documents say and what practice adds up to. How your particular bank will assess your package is something nobody can say in advance.
