Banned software in retail: what businesses should check

Prohibited software in retail: what Ukrainian entrepreneurs should check

The State Service of Special Communications and Information Protection of Ukraine maintains an open list of software and communication network equipment prohibited for use in cases defined by law. As of June 30, 2026, the list has been expanded from 416 to 880 items; for retailers, the most practical attention should be paid to 1C/BAS accounting systems, certain Yandex services, Kontur, Macroscop/Axxonsoft video surveillance systems, as well as server, VPN and network software that may be installed on cash registers, office computers, warehouses, servers or in an online store.

For an ordinary private store, the mere presence of a program on the list does not automatically mean a fine simply for using it. The direct legal requirement not to use such software applies to information systems where state information resources, official information or state secrets are processed, as well as to critical information infrastructure facilities. At the same time, for retail this is a serious sanctions, cybersecurity, contractual and reputational risk: if the program keeps records of goods, cash registers, customers, payments, salaries, suppliers, deliveries or video surveillance, it must be checked, the result of the check must be recorded and, if necessary, it must be replaced.

What the SSSCIP list is

The open list is formed and maintained by the Administration of the State Service of Special Communications and Information Protection of Ukraine in electronic form. The procedure for maintaining it was approved by Resolution of the Cabinet of Ministers of Ukraine No. 1335 of October 22, 2025. Software and network equipment may be included in the list if sanctions have been applied to their rights holders, manufacturers, ultimate beneficial owners, founders or related persons, if international sanctions recognized by Ukraine apply, or if there is a relevant court decision.

The list includes the name of the software or equipment, manufacturer, rights holder, grounds for inclusion, date of inclusion and information about amendments or removal of an item. The SSSCIP must make changes within five working days from the moment the relevant grounds arise, and the list itself is open and published on the official SSSCIP website and on the Unified State Open Data Web Portal.

Who is directly affected by the prohibition

The Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine” establishes that a mandatory condition for using software and communication network equipment is their absence from the open list — but this requirement is directly tied to information, electronic communication and information-communication systems that process state information resources, official information, state secrets, as well as to critical information infrastructure facilities.

For a retailer, this means:

Which software from the list may be used by Ukrainian retail

The greatest risk for entrepreneurs is not server software, which a system administrator can easily notice, but familiar programs for accounting, bookkeeping, trade, warehouse operations, advertising, document flow and video surveillance. It is necessary to check not only the brand name, but also the specific configuration, module, rights holder, manufacturer and version.

What exactly an entrepreneur should check

The check should begin not with accounting, but with a complete list of programs and devices. In retail, risky software may be installed on a cash register, an accountant’s laptop, a warehouse server, an online store administrator’s computer, a marketer’s phone, a video recorder or a VPN gateway.

Minimum inventory list:

• accounting system of the store, warehouse or store chain;

• accounting software;

• CRM and loyalty program;

• software for RRO/PRRO and cash register integrations;

• bank terminal exchange modules;

• modules for importing/exporting invoices, price lists, orders;

• electronic document flow with suppliers;

• programs for salaries, schedules and staff motivation;

• online store, CMS, plugins, advertising and analytics scripts;

• mobile applications for the owner, sellers and couriers;

• video surveillance, video analytics, video archive;

• servers, operating systems, VPN, routers, firewalls;

• cloud services, backups, remote access;

• programs for printing price tags, labels, barcodes and warranty cards.

It is advisable to formalize the result of the check in an internal act or table: software name, version, manufacturer, where it is installed, what data it processes, whether it is on the list, who checked it, date of the check, decision — keep, replace, delete, isolate or conduct an additional legal review.

RRO, PRRO and cash discipline when replacing software

If a program is connected to the cash register, it cannot simply be deleted without a transition plan. The Law on RRO obliges business entities to conduct settlement transactions for the full purchase amount through registered RRO or PRRO and to create settlement documents in paper or electronic form. The buyer must be provided with a settlement document of the established form and content, including when ordering or paying online.

During the transition to a new system, the following must be checked:

• whether the RRO/PRRO is registered;

• whether sales, returns, discounts and payment amounts are transmitted correctly;

• whether product names, tax rates, excisable items and UKTZED codes for excisable goods are indicated correctly;

• whether the fiscal receipt is generated in the current format;

• whether electronic copies of settlement documents and fiscal reports are transmitted to controlling authorities;

• whether the history of sales, returns, warranties, cash on delivery, advances and deliveries has been preserved.

The form and content of paper and electronic settlement documents are defined by Order of the Ministry of Finance No. 13 of January 21, 2016. It directly covers settlement documents for the sale and return of goods, provision of services, online orders and online payments.

For violations of the procedure for conducting settlement transactions, including failure to conduct a transaction through RRO/PRRO, conducting it for an incomplete amount or failing to issue a receipt, the Law on RRO provides for financial sanctions. For a first violation, the sanction is 100% of the sale amount conducted in violation.

Online store, delivery and marketplaces

If a store sells online, it is necessary to check not only warehouse software, but also the website, admin panel, payment modules, analytics, advertising scripts, delivery services and order imports. The Law “On Electronic Commerce” is in force and regulates electronic transactions, that is, the sale of goods and services remotely using information and communication systems.

When replacing software, it is important not to lose:

• customer orders;

• payment and delivery statuses;

• goods balances;

• price and discount history;

• bonuses, certificates, promo codes;

• warranty requests;

• correspondence with customers;

• data for returns and claims.

If the website or CRM collects customers’ personal data — name, phone, email, delivery address, purchase history, bonuses, requests, photos or videos — the Law “On Personal Data Protection” applies. The purpose of processing must be lawful and defined, processing must be open and transparent, and the scope of data must not be excessive for that purpose.

Labeling, prices, balances and goods accounting

When migrating from 1C, BAS or another system from the list, the correctness of goods directories must be checked separately. For retail, it is critical to preserve the item code, barcode, name, unit of measurement, purchase and retail price, serial number, warranty period, supplier, batch, warehouse, balance, characteristics, photo and product description.

The Law “On Consumer Rights Protection” requires the seller to indicate the price of each unit of goods or category of goods; price inscriptions must be clear and easy to understand, and the price must include all taxes and mandatory payments paid by the consumer when purchasing the goods.

Therefore, after migration, a control reconciliation must be performed:

• prices in the accounting system;

• prices on price tags;

• prices on the website and marketplaces;

• prices in the cash register software;

• VAT rates or other taxes, if applicable;

• excisable goods, if the store sells them;

• warranty and service documents.

Licenses, documents and rights to new software

New software must be used on legal grounds: a license agreement, invoice, act, supply agreement, public license or another document confirming the right of use. Under the law, a computer program is a set of instructions suitable for being read by a computer, and computer programs are protected by copyright if they are original.

The agreement with a new retail software supplier should provide for:

• product name, version, number of workstations;

• right of use and license term;

• update procedure;

• technical support;

• backup;

• the ability to export data in a clear format;

• liability for data loss or damage;

• personal data processing terms;

• a prohibition on using software or equipment from the SSSCIP open list when providing services, if this is important for the business or contracts with counterparties;

• procedure for terminating use and transferring the database to the entrepreneur.

Staff and access rights

Replacing a program is not only a technical project. It is necessary to update access rights for employees, roles of cashiers, administrators, accountants, goods managers, online store managers and the owner.

After the transition, it is necessary to:

• delete old accounts;

• change passwords;

• enable two-factor authentication, if available;

• restrict access to finances, salaries, purchases and personal data;

• train cashiers to conduct sales, returns, exchanges, cash deposits and withdrawals;

• train goods managers in goods receipt, inventory, repricing and printing price tags;

• record those responsible for backups.

The Code of Ukraine on Administrative Offenses provides fines for violations of personal data protection legislation. For example, failure to comply with lawful requirements of the Ukrainian Parliament Commissioner for Human Rights or their officials entails a fine for officials and sole proprietors from 500 to 2000 non-taxable minimum incomes of citizens, and violation of the procedure for protecting personal data that led to unlawful access or violation of the rights of a personal data subject entails a fine from 1000 to 2000 non-taxable minimum incomes.

Can a license or permit be revoked because of software from the list

For ordinary retail trade, the mere fact of using software from the list is not specified in legislation as a general independent ground for revoking a trade license or permit. The procedure for conducting trade activities establishes that a business entity conducts trade activities after state registration, and in cases provided by law — if it has permits and licenses.

The risk for permits and licenses arises not because of the program name itself, but because of the consequences of its use: incorrect fiscal receipts, violations in accounting for excisable goods, loss of primary documents, unlawful processing of personal data, absence of confirmation of goods origin, failure to comply with contract terms or cybersecurity requirements for critical infrastructure or government systems.

How an entrepreneur should act

1. Compile a complete list of programs, services, modules, servers and network equipment.

2. Check each item against the SSSCIP open list.

3. Record the result of the check in an internal act or table.

4. Do not renew licenses, support or payments for services that are on the list.

5. Prepare a database backup and data export.

6. Check which data needs to be transferred: goods, balances, prices, customers, suppliers, documents, sales, warranties, bonuses, salaries, users.

7. Choose a Ukrainian or other safe alternative with documented proof of the right of use.

8. Carry out a test migration.

9. Check RRO/PRRO, receipts, tax rates, returns, discounts, online orders.

10. Train staff and delete the old software after a successful launch.

What to replace 1C with

For retail, replacing 1C must cover not only accounting, but also the daily operation of a store: sales, warehouse, procurement, prices, barcodes, inventory, customers, suppliers, salaries, analytics, documents, online store and cash register processes. The Ukrainian Torgsoft system is positioned as an alternative to 1C, BAS and other accounting systems for stores and warehouses: it keeps goods records at a retail outlet and multiple warehouses, records receipts, sales, returns, transfers, balances, settlements, customer database, online orders, production, printing of price tags and barcodes, and also provides for transferring the item catalog from 1C through data export and import.

Official sources

1. SSSCIP open list of prohibited software and communication network equipment — current list page and notice of expansion to 880 items: https://cip.gov.ua/ua/statics/perelik-zaboronenogo-do-vikoristannya-programnogo-zabezpechennya-ta-komunikaciinogo-merezhevogo-obladnannya1

2. Resolution of the Cabinet of Ministers of Ukraine of 22.10.2025 No. 1335 “On Approval of the Procedure for Forming and Maintaining the Open List of Software and Communication Network Equipment Prohibited for Use”, paragraphs 1–11 of the Procedure: https://zakon.rada.gov.ua/go/1335-2025-%D0%BF

3. Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine”, No. 2163-VIII, part four of Article 4 — condition of absence of software and equipment from the open list for defined information systems and critical information infrastructure: https://zakon.rada.gov.ua/go/2163-19

4. Law of Ukraine “On the Use of Registrars of Settlement Transactions in Trade, Catering and Services”, No. 265/95-VR, Articles 3, 15, 17 — conducting settlements through RRO/PRRO, issuing receipts, control and financial sanctions: https://zakon.rada.gov.ua/go/265/95-%D0%B2%D1%80

5. Order of the Ministry of Finance of Ukraine of 21.01.2016 No. 13 “On Approval of the Regulation on the Form and Content of Settlement Documents/Electronic Settlement Documents”, Section I — form and content of settlement documents, including for online orders: https://zakon.rada.gov.ua/go/z0220-16

6. Law of Ukraine “On Electronic Commerce”, No. 675-VIII — legal framework for electronic transactions in distance trade: https://zakon.rada.gov.ua/go/675-19

7. Law of Ukraine “On Personal Data Protection”, No. 2297-VI, Article 6 — requirements for the purpose, transparency, scope and term of personal data processing: https://zakon.rada.gov.ua/go/2297-17

8. Code of Ukraine on Administrative Offenses, Article 188-39 — liability for violations of personal data protection legislation: https://zakon.rada.gov.ua/go/80731-10

9. Law of Ukraine “On Consumer Rights Protection”, No. 1023-XII, Articles 4, 15 — consumer rights, information about products and prices: https://zakon.rada.gov.ua/go/1023-12

10. Law of Ukraine “On Copyright and Related Rights”, No. 2811-IX, Articles 1, 20 — legal regime of computer programs: https://zakon.rada.gov.ua/go/2811-20

11. Resolution of the Cabinet of Ministers of Ukraine of 15.06.2006 No. 833 “On Approval of the Procedure for Conducting Trade Activities and Rules of Trade Services in the Consumer Goods Market”, paragraph 5 — state registration, permits and licenses in cases provided by law: https://zakon.rada.gov.ua/go/833-2006-%D0%BF