Prohibited software in Ukraine: who the SSSCIP list covers and what about 1C and BAS
The direct ban applies to systems that process state information resources, official information or state secrets, and to critical information infrastructure: software on the State Special Communications Service (SSSCIP) list may not be used there. For other companies and NGOs the law sets no such ban, but the list shows which rights holders are under sanctions, and that is why the accounting software becomes a question the auditor asks.
The list is kept under Cabinet of Ministers Resolution No. 1335 of 22.10.2025. In February 2026 the SSSCIP answered frequently asked questions, including on 1C and BAS software. Below we explain who the ban covers directly, what it means for everyone else and what the accounting team should do now.
What has changed
Article 4(4) of the Law on the Basic Principles of Cybersecurity of Ukraine sets a mandatory condition: in systems that process state information resources, official information or state secrets, and at critical information infrastructure facilities, software and network equipment must not be on the open list of software and equipment prohibited for use. Text of the law: zakon.rada.gov.ua.
The procedure for compiling the list was approved by Resolution No. 1335 of 22.10.2025. The list is kept by the SSSCIP Administration, is open data and is published on its website and on the national open data portal. A product is added if its owner, ultimate beneficial owner, author or another holder of property rights is under Ukrainian sanctions or international sanctions recognised by Ukraine, or by court decision. Changes are made within five working days of the grounds arising.
On 18.02.2026 the SSSCIP published answers to frequently asked questions: cip.gov.ua. The key points:
- the criterion for inclusion is not a technical security assessment of the product but the sanctions status of those holding property rights in it;
- as of the date of the answers the list had 40 entries, and it continues to grow;
- the “1C” and “BAS” software products whose rights holder is 1C LLC have been added to the list;
- lack of internet access or updates does not lift the requirements if the system falls under the law;
- the cloud model (SaaS) is also covered, because the law does not distinguish software by how it is used.
Who is affected
| Your situation | What the law says | Consequence |
|---|---|---|
| A system processing state information resources, official information or state secrets; a critical information infrastructure facility | Software on the list may not be used (Article 4(4) of the Cybersecurity Law) | The system will not obtain security authorisation or certification, and existing ones may be revoked; failure to comply with an order leads to a report under Article 188-31 of the Code of Administrative Offences |
| An ordinary company or NGO without such systems | This law sets no direct ban | Questions remain about the rights holder’s sanctions risk, continuity of accounting and your partners’ requirements |
Under Article 188-31 of the Code of Administrative Offences, failure to comply with lawful demands of SSSCIP officials carries a fine on officers of 50 to 100 tax-free minimum incomes, and 100 to 150 for a repeat offence within a year.
What to do and by when
The law sets no general deadline for businesses. For systems covered by the law, the requirement already applies. For everyone else, we recommend starting with an inventory. Record the result in a short dated internal memo: it is easy to show to an auditor, donor or bank when they ask about your software.
- List the software used for accounting, payroll, HR and inventory, and your network equipment. For each item, note the rights holder and how it is used: on premises or in the cloud.
- Check this list against the SSSCIP open list. Since it keeps growing, check regularly.
- Determine whether your organisation processes state information resources or is a critical information infrastructure facility. If so, replacing listed software is mandatory.
- If not, assess the risks yourself: who the rights holder is, how the software is updated, whether you have current database backups and whether you can export data to another system.
- Review contracts with donors, banks and counterparties: if they contain sanctions clauses, document how you comply.
- If you decide to migrate, plan the switch for the start of a reporting period and keep an archive of the old database accessible for audits.
Risks for accounting and audit
- Data continuity. The auditor checks which system produced the financial statements and whether the ledgers for the period can be reproduced. If the old database was closed without an archive, supporting balances and turnover becomes difficult.
- Switching mid-year. Two programs in one reporting period mean two sets of ledgers and a risk of differences in balances at the switch date. The auditor will ask for that reconciliation separately.
- Rights holder status not checked. A product’s name does not always match the person holding property rights in it. The SSSCIP states plainly that it is the rights holder that matters.
- “We work offline”. For systems covered by the law this is no argument: the requirements do not depend on internet access.
- A cloud service instead of a boxed product. Moving to SaaS of the same product does not change the situation.
If records for past periods need to be moved to new software or some data have been lost, this becomes an accounting restoration task, best done before the audit rather than during it.
FAQ
Are businesses in Ukraine banned from using 1C and BAS in 2026?
The “1C” and “BAS” products whose rights holder is 1C LLC are on the list. The direct ban under Article 4(4) of the Cybersecurity Law covers systems with state information resources, official information or state secrets and critical information infrastructure facilities. For other organisations, this law sets no direct ban.
Where can I see the list of prohibited software in Ukraine?
The list is kept by the SSSCIP Administration. Under Resolution No. 1335 it is open data published on the official SSSCIP website and on the Unified State Open Data Portal.
Does the ban cover cloud software and computers without internet access?
Yes, for systems covered by the law. The SSSCIP explains that the law does not distinguish on-premises installation from SaaS, and the requirements apply regardless of internet access.
How we help
We keep accounts in the software the client chooses, help migrate accounting to another system and restore ledgers for past periods. In audits we check whether the financial statements are supported by data in the accounting system. See accounting outsourcing, accounting restoration and statutory audit. For NGOs we offer free webinars for NGOs.
Prepared by the MK Audit team