How Russia’s central bank plans to give the FSB access to crypto exchange customers’ personal data

1What happened?Russia’s Federal Security Service (FSB) will gain a new tool to monitor Russian users of cryptocurrency services under a draft directive from Russia’s Central Bank. Documents the regulator published in late October clarify how the directive would work.The draft is essentially a detailed set of instructions for developers building the server side of a new SORM system. SORM is a Russian acronym for a system of technical tools used in law enforcement surveillance and investigations. Russian authorities use the technology to access user data.A SORM system consists of a server with specialized software and a dedicated communications line connected directly to FSB equipment. The server has access to a company’s databases and sends some of the information stored there to the security service on request.The following are required to have their own systems for transmitting data to the FSB:Postal service operatorsTelephone service providersInternet service providersOnline information distributorsHosting providersAutonomous system ownersFreight forwarding companiesVirtual telephone exchange operatorsSeparate orders from the Digital Development Ministry and the Transport Ministry set the requirements for each system.2What data will the FSB get about crypto service customers?It will include:Detailed information about the parties to a transaction: For individuals, this includes their full name, citizenship, taxpayer identification number, passport details, date and place of birth, phone number, and email addressInformation about a customer’s account on a cryptocurrency exchange or with a cryptocurrency exchange service, including whether the account has been frozen or transactions suspendedCryptocurrency wallet addresses and information about the wallets’ known or presumed ownersDetailed information about the cryptocurrency involved in a transaction, including its origin — for example, whether it was previously purchased, mined, or inheritedInformation about individual transactions, including the value of the cryptocurrency in rublesInformation about how customers use the websites and apps of cryptocurrency exchanges and exchange services — for example, records of registration and every account login, including the customer’s IP addresses and ports and the precise time of registrationCyberlaw attorney Sarkis Darbinyan also pointed out that the Central Bank declined to adopt a proposal that would have explicitly prohibited transferring private keys through SORM.3What keys are we talking about?Private keys to custodial wallets — the keys an organization uses to sign transactions on its customers’ behalf — as well as parts of those keys when distributed storage is used. These wallets effectively belong to the cryptocurrency exchange itself; customers can direct how the cryptocurrency in them is used, but they can’t control the wallets themselves because they don’t hold the private keys. If you hold your wallet’s private key, it’s a noncustodial wallet.If the FSB gains access to these keys, its officers will have the technical ability to carry out any transactions themselves using the cryptocurrency in the wallets.The Central Bank’s draft directive does not explicitly mention private keys. The regulator simply declined to add a provision explicitly barring the FSB from accessing them. It said: “The approach set out in the draft directive has been agreed upon with the authorized agency.”4So will cryptocurrency exchanges and exchange services now have to hand the FSB data on every transaction automatically?Not quite. They will store all this information for at least five years and transmit it automatically in response to FSB requests.The requests can be for archived data or real-time monitoring. For real-time monitoring, an FSB officer specifies a criterion, such as a particular party to a transaction or a wallet. As new data matching the request becomes available, the company must automatically send it to the FSB.The Central Bank’s draft directive calls the first type a “search request” and the second a “request to monitor targets.”5What does the Central Bank have to do with this?The Central Bank regulates Russia’s entire financial market. Under the new Law on Digital Currencies and Digital Rights, parts of which took effect on September 1, the Central Bank must therefore work with the FSB to establish procedures governing how the main cryptocurrency market participants interact with the security service.Many participants operating legally in Russia’s cryptocurrency market will have to install the new SORM system:Brokers: Intermediaries that carry out transactions on customers’ instructionsCryptocurrency exchanges: “Trading organizers”Cryptocurrency exchange services: “Organizations that exchange digital currencies”Digital depositories: Organizations that provide customers with custodial wallets6Is there any way to make a transaction without going through SORM?Of course. For example, you could arrange a transaction with friends or acquaintances and transfer cryptocurrency from one noncustodial wallet to another.Or you could use foreign cryptocurrency exchanges that ignore Russian legal requirements, or underground Russian cryptocurrency exchange services.Keep in mind that all of this will be prohibited starting July 1, 2027. The new cryptocurrency law allows ordinary citizens and organizations to buy and sell cryptocurrency only through brokers, cryptocurrency exchanges, and exchange services that comply with Russian law and have SORM installed. The Central Bank separately clarified that all direct P2P transactions will be prohibited.7What are the penalties for violating this ban?For now, there are no administrative or criminal penalties for violating it. The authorities still have until the middle of next year to come up with something, though.8But doesn’t that mean the ban won’t work?It will. Just in a different way:Banks will stop their customers from buying cryptocurrency abroad. Or at least they’ll try to. They will identify these transactions using payment identifiers such as merchant IDs.Banks will have to identify underground Russian cryptocurrency exchange services and exchanges and block their transactions. Mere suspicion of illegally “organizing the circulation of digital currencies” will be enough.Both rules will also take effect on July 1, 2027.9How will they identify P2P transactions?We don’t know. If someone occasionally buys or sells small amounts of cryptocurrency using noncustodial wallets, a bank will have a very hard time detecting those transactions.At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.If you find any errors in this translation, please contact us at [email protected].To read Meduza’s exclusive content in English, please subscribe to our newsletter.