How Russia’s central bank plans to give the FSB access to crypto exchange customers’ personal data
1.
What happened?
2.
What data will the FSB get about crypto service customers?
3.
What keys are we talking about?
4.
So will cryptocurrency exchanges and exchange services now have to hand the FSB data on every transaction automatically?
5.
What does the Central Bank have to do with this?
6.
Is there any way to make a transaction without going through SORM?
7.
What are the penalties for violating this ban?
8.
But doesn’t that mean the ban won’t work?
9.
How will they identify P2P transactions?
What happened?
Russia’s Federal Security Service (FSB) will gain a new tool to monitor Russian users of cryptocurrency services under a draft directive from Russia’s Central Bank. Documents the regulator published in late October clarify how the directive would work.
The draft is essentially a detailed set of instructions for developers building the server side of a new SORM system. SORM is a Russian acronym for a system of technical tools used in law enforcement surveillance and investigations. Russian authorities use the technology to access user data.
A SORM system consists of a server with specialized software and a dedicated communications line connected directly to FSB equipment. The server has access to a company’s databases and sends some of the information stored there to the security service on request.
The following are required to have their own systems for transmitting data to the FSB:
- Postal service operators
- Telephone service providers
- Internet service providers
- Online information distributors
- Hosting providers
- Autonomous system owners
- Freight forwarding companies
- Virtual telephone exchange operators
Separate orders from the Digital Development Ministry and the Transport Ministry set the requirements for each system.
What data will the FSB get about crypto service customers?
It will include:
- Detailed information about the parties to a transaction: For individuals, this includes their full name, citizenship, taxpayer identification number, passport details, date and place of birth, phone number, and email address
- Information about a customer’s account on a cryptocurrency exchange or with a cryptocurrency exchange service, including whether the account has been frozen or transactions suspended
- Cryptocurrency wallet addresses and information about the wallets’ known or presumed owners
- Detailed information about the cryptocurrency involved in a transaction, including its origin — for example, whether it was previously purchased, mined, or inherited
- Information about individual transactions, including the value of the cryptocurrency in rubles
- Information about how customers use the websites and apps of cryptocurrency exchanges and exchange services — for example, records of registration and every account login, including the customer’s IP addresses and ports and the precise time of registration
Cyberlaw attorney Sarkis Darbinyan also pointed out that the Central Bank declined to adopt a proposal that would have explicitly prohibited transferring private keys through SORM.
What keys are we talking about?
Private keys to custodial wallets — the keys an organization uses to sign transactions on its customers’ behalf — as well as parts of those keys when distributed storage is used. These wallets effectively belong to the cryptocurrency exchange itself; customers can direct how the cryptocurrency in them is used, but they can’t control the wallets themselves because they don’t hold the private keys. If you hold your wallet’s private key, it’s a noncustodial wallet.
If the FSB gains access to these keys, its officers will have the technical ability to carry out any transactions themselves using the cryptocurrency in the wallets.
The Central Bank’s draft directive does not explicitly mention private keys. The regulator simply declined to add a provision explicitly barring the FSB from accessing them. It said: “The approach set out in the draft directive has been agreed upon with the authorized agency.”
Russian security services and user data
Cryptocurrency exchange Binance gave Russian security services data on one of its users. Now he’s on trial for donating to Ukraine’s military.
He helped build the surveillance system the FSB uses to spy on Russians. Then he escaped Russia with an archive of its internal documents. Here’s what he told iStories.
So will cryptocurrency exchanges and exchange services now have to hand the FSB data on every transaction automatically?
Not quite. They will store all this information for at least five years and transmit it automatically in response to FSB requests.
The requests can be for archived data or real-time monitoring. For real-time monitoring, an FSB officer specifies a criterion, such as a particular party to a transaction or a wallet. As new data matching the request becomes available, the company must automatically send it to the FSB.
The Central Bank’s draft directive calls the first type a “search request” and the second a “request to monitor targets.”
What does the Central Bank have to do with this?
The Central Bank regulates Russia’s entire financial market. Under the new Law on Digital Currencies and Digital Rights, parts of which took effect on September 1, the Central Bank must therefore work with the FSB to establish procedures governing how the main cryptocurrency market participants interact with the security service.
Many participants operating legally in Russia’s cryptocurrency market will have to install the new SORM system:
- Brokers: Intermediaries that carry out transactions on customers’ instructions
- Cryptocurrency exchanges: “Trading organizers”
- Cryptocurrency exchange services: “Organizations that exchange digital currencies”
- Digital depositories: Organizations that provide customers with custodial wallets
Is there any way to make a transaction without going through SORM?
Of course. For example, you could arrange a transaction with friends or acquaintances and transfer cryptocurrency from one noncustodial wallet to another.
Or you could use foreign cryptocurrency exchanges that ignore Russian legal requirements, or underground Russian cryptocurrency exchange services.
Keep in mind that all of this will be prohibited starting July 1, 2027. The new cryptocurrency law allows ordinary citizens and organizations to buy and sell cryptocurrency only through brokers, cryptocurrency exchanges, and exchange services that comply with Russian law and have SORM installed. The Central Bank separately clarified that all direct P2P transactions will be prohibited.
What are the penalties for violating this ban?
For now, there are no administrative or criminal penalties for violating it. The authorities still have until the middle of next year to come up with something, though.
But doesn’t that mean the ban won’t work?
It will. Just in a different way:
- Banks will stop their customers from buying cryptocurrency abroad. Or at least they’ll try to. They will identify these transactions using payment identifiers such as merchant IDs.
- Banks will have to identify underground Russian cryptocurrency exchange services and exchanges and block their transactions. Mere suspicion of illegally “organizing the circulation of digital currencies” will be enough.
Both rules will also take effect on July 1, 2027.
How will they identify P2P transactions?
We don’t know. If someone occasionally buys or sells small amounts of cryptocurrency using noncustodial wallets, a bank will have a very hard time detecting those transactions.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at reports@meduza.io.
To read Meduza’s exclusive content in English, please subscribe to our newsletter.
What is it?
It’s a way to protect digital assets by splitting the private key used to access the funds into several parts or distributing it across different devices to eliminate a single point of failure. While a conventional wallet stores one key in one place, distributed storage guarantees that even if an attacker hacks one device or steals one part of the key, they won’t be able to steal your assets.
What does a key like this look like?
A private, or secret, key looks like one very large number. A wallet owner can use it to transfer cryptocurrency to other wallets, authorizing these transactions with a digital signature.
What does that mean?
Transactions made directly between two asset owners, without going through a platform.
Which documents?
In late October, the regulator published a summary table of comments and suggestions on its own draft directive. These documents are no longer available through the link on the Central Bank’s website, but Meduza has a copy.