On 16 November 2021, the Ukrainian Parliament adopted the Law of Ukraine “On Critical Infrastructure” No. 1882-IX (“Law”). Although the Law entered into force on 15 December 2021, it will become operative only from 15 June 2022 (save for the compulsory insurance requirements becoming effective in late 2024).
Affected entities
- The Law will apply to the critical infrastructure (“CI”) operators – legal entities/individual entrepreneurs managing and operating the CI assets in Ukraine.
- The CI is defined broadly to include any infrastructure assets (objects, systems, or their parts) essential for the economy, national security, and defence, the disruption of which would cause damage to the vital national interests.
- The supervisory authority will determine the CI assets based on several criteria, including the relevant asset’s economic sector, and record such assets in the special register. The Law lists 17 critical sectors, which cover, among others, energy, health, ICT, and financial services.
Potential impact
- Compliance requirements. The CI operators will have to, among others, (a) protect a CI asset, (b) address (and notify a supervisory authority of) any security incident, and (c) annually report on compliance with the Law. The relevant penalties for any breach of the above requirements are yet to be introduced.
- Impact on M&A. A CI operator must (a) notify a supervisory authority of any planned (i) change of the designated use of a CI asset/its operation regime or (ii) transfer of rights to a CI asset and (b) comply with any conclusions/recommendations provided by such authority. Such notification must be made reasonably in advance (but in any case, at least 30 days before any of the above events). Still, the relevant supervisory authority is to further clarify the scope of this obligation (whether it applies to the acquisitions of the CI assets (asset deals) only or also extends to other operations involving the CI assets (lease, concession etc.).
- Ownership restrictions. The legal entities/individuals (the residents or citizens, as applicable, of the Russian Federation) may not acquire certain CI assets. The list of such assets is yet to be determined. The same restrictions will apply to the legal entities (a) whose UBO is a citizen of the Russian Federation or (b) registered in the countries included by the FATF in the list of the countries failing to counter money laundering. To enforce the above restrictions, the Ukrainian Government will verify the ownership structure of the CI assets within 3 years following the Law entering into force.
Further steps
Ukraine should now form a list of the CI assets and establish the relevant register (together with the supervisory authority responsible for the CI protection). Before that, the Ukrainian authorities may not enforce the requirements set out in the Law.
