Russia Drafts 24/7 Data Access Rules for Regulated Crypto Firms

The Bank of Russia’s revised draft would require regulated crypto firms to make selected records remotely available to security authorities around the clock, with the proposed rule set to begin March 1, 2027.

The covered businesses are brokers, trading organizers, digital currency exchange firms and digital depositories. The requirement would apply to information held in those firms’ systems, placing the focus on regulated service providers.

The listed information includes client details, digital-currency transaction records, communications and client telemetry. Examples of communications data in the draft include text and voice messages, images, audio and video. The proposal does not describe direct access to every user’s self-custody wallet, and it does not identify private keys or signing tools as information available through the system.

Specialized Depository INFINITUM JSC and Association “Russia” asked to delay the instruction’s start until at least Jan. 1, 2028. The Bank of Russia rejected the request and revised the proposed start date to March 1, 2027. The date remains part of a draft instruction, rather than a final effective rule.

Federal Law No. 282-FZ took effect Sept. 1, 2026. It requires covered firms to retain information about digital-currency activity and provide information to the federal security authority in cases set by federal law. The proposed instruction would require round-the-clock remote access to specified information held by those firms.

The regulated market is also beginning to take shape. On Oct. 6, the Bank of Russia registered its first five digital depositories and four digital currency exchange firms.

The draft would add an ongoing remote-access requirement for information held by these regulated businesses, with March 1, 2027, as the proposed start date.