← Regulations / Russia / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Russia

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Russia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • Registration with Bank of Russia as a digital depository/custodian (specialized digital depository register) — ru.licensing.custody-providers-specialized-digital-depositories
  • Registration as a DFA operator with Bank of Russia — ru.licensing.registration-as-dfa-operators-russian
  • AML/CFT compliance under Federal Law No. 115-FZ, supervised by Rosfinmonitoring — ru.licensing.rosfinmonitoring-federal-financial-monitoring-service
  • Transaction monitoring and de-anonymization procedures for all transactions — ru.licensing.amlkyc-implied-through-mandatory-intermediary
  • Reporting of transactions exceeding 600,000 RUB per year to tax authorities (Federal Tax Service) — ru.aml.2020-law-on-digital-financial, ru.licensing.federal-tax-service-of-russia
  • KYC on all users; retail users must pass a Bank of Russia competency test before accessing services — ru.licensing.amlkyc-implied-through-mandatory-intermediary, ru.licensing.compliance-with-kyc-competency-tests
  • Suspicious transaction reporting to Rosfinmonitoring — ru.licensing.rosfinmonitoring-federal-financial-monitoring-service
  • Custodial providers (including banks like Sberbank) must comply with prudential requirements and enable mechanisms for freezing suspicious assets — ru.licensing.custodial-service-providers-including-banks

Key Restrictions

  • Must have Russian legal status (local entity incorporation required) — ru.licensing.local-presence-entities-must-have
  • Must be registered as a specialized digital depository in Bank of Russia's register and/or as a DFA operator — ru.licensing.custody-providers-specialized-digital-depositories, ru.licensing.registration-as-dfa-operators-russian
  • No lending of client crypto assets to third parties — ru.licensing.custody-providers-specialized-digital-depositories, ru.licensing.digital-depositories-are-required-to
  • No domestic crypto payments for goods/services (ban in place since 2020) — ru.aml.2020-law-on-digital-financial, ru.licensing.prohibitions-no-domestic-payments-with
  • Retail client annual purchase cap of 300,000 RUB via a single intermediary; requires passing a knowledge/competency test — ru.licensing.retail-limits-annual-purchases-capped
  • Foreign platforms without Russian licenses are prohibited from domestic operations — ru.licensing.local-presence-entities-must-have
  • Custodial providers may face liability limits for blockchain malfunctions or issuer blocks — ru.licensing.custody-providers-specialized-digital-depositories
  • Unlicensed operation carries criminal liability (fines up to ~$13,000, up to 7 years imprisonment) — ru.licensing.criminal-liability-for-unlicensed-operations

Key Risks

  • Regulatory framework still in flux — comprehensive bill 'On Digital Currency and Digital Rights' not yet final; proposed 2026 framework may significantly change rules — ru.licensing.comprehensive-bill-on-digital-currency, ru.aml.proposed-2026-framework-to-be
  • Ambiguity around whether SaaS white-label custody falls under 'digital depository' rules, 'DFA operator' rules, or both — no explicit standalone custody license path clarified
  • Tax reporting obligations (600,000+ RUB threshold) create compliance burden on the SaaS provider and/or white-label clients — unclear bifurcation of responsibility
  • Sanctions-related risk: providing custody services may attract secondary sanctions scrutiny for any exposure to sanctioned persons or entities
  • International trade exception (2024 law) creates complexity for distinguishing domestic (banned) vs. cross-border (permitted) use of crypto
  • Enforcement risk is high: criminal penalties for unlicensed operation signal aggressive prosecution posture by Bank of Russia and Rosfinmonitoring

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Custody Providers: Specialized digital depositories must be licensed or registered in the Bank of Russia's register to maintain records of cryptoasset rights and register wallets. They face restrictions like no lending of client assets and no liability for blockchain malfunctions or issuer blocks.

licensing 20% confidence

Registration as DFA operators: Russian banks/exchanges must register with Bank of Russia, which maintains the registry and supervises operations.

licensing 20% confidence

Local Presence: Entities must have Russian legal status; foreign platforms without licenses are prohibited for domestic operations.

licensing 20% confidence

Rosfinmonitoring (Federal Financial Monitoring Service): Russia's lead agency for combating money laundering and terrorist financing. It analyzes financial transactions, ensures institutional compliance with AML/CFT standards and Federal Law No. 115-FZ, and enforces Enhanced Due Diligence requirements.

licensing 20% confidence

Federal Tax Service of Russia: Handles tax-related compliance, requiring individuals and organizations to report cryptocurrency holdings and transactions exceeding certain thresholds (notably 600,000 rubles).

licensing 20% confidence

AML/KYC: Implied through mandatory intermediary routing, de-anonymization procedures, transaction monitoring, and tax reporting. Retail users must pass a Bank of Russia competency test; residents report foreign wallets/transactions to tax authorities.

licensing 20% confidence

Compliance with KYC, competency tests for retail (via intermediaries), and reporting thresholds (e.g., transactions >600,000 RUB/year to tax authorities).

licensing 50% confidence

Custodial service providers, including banks like Sberbank, must comply with prudential requirements; Sberbank proposed custody services to the central bank, treating crypto assets similarly to bank deposits with mechanisms for freezing suspicious assets. (https://www.binance.com/en/square/post/27079019931473)

licensing 50% confidence

Digital depositories are required to maintain records of rights to cryptoassets, register wallets, and face restrictions like prohibiting lending of client coins to others. (https://forklog.com/en/the-end-of-shadow-trading-russias-forthcoming-crypto-market-rules/)

licensing 20% confidence

Retail limits: Annual purchases capped at 300,000 RUB (~$3,700–$3,800) via one intermediary; requires knowledge test. Qualified investors (e.g., high income >20M RUB/year, finance master's) face no limits.

licensing 20% confidence

Prohibitions: No domestic payments with crypto; reporting mandatory for large transactions. International trade exception since 2024.

licensing 20% confidence

Criminal liability for unlicensed operations: Entities organizing digital currency circulation without Bank of Russia approval face fines ($1,300–$13,000), up to 4–7 years imprisonment, or forced labor; applies to exchanges and large operators.

licensing 20% confidence

Comprehensive bill “On Digital Currency and Digital Rights” for State Duma submission: Covers licensing, caps, infrastructure: Detailed in .

licensing 50% confidence

Exchanges and exchangers with monthly turnover ≥3.5 million rubles can serve users directly, while smaller ones must use licensed intermediaries; all must be licensed or registered with the Bank of Russia. (https://forklog.com/en/the-end-of-shadow-trading-russias-forthcoming-crypto-market-rules/; https://crypto.news/russia-clears-draft-laws-to-tighten-crypto-trading-and-limit-retail-participation/)

licensing 20% confidence

Mandatory licensing for intermediaries: Covers digital exchanges, custodial services, trading platforms, and DFA operators; banks, brokers, and securities firms can provide services after authorization.

licensing 20% confidence

Simplified process for banks/brokers: Existing financial institutions may use a "notification process" tied to current banking licenses, rather than full standalone applications.

aml 20% confidence

2020 Law on Digital Financial Assets (DFAs): Legalizes crypto transactions but prohibits use as payment for domestic goods/services; mandates reporting of transactions over 600,000 rubles to tax authorities.

aml 20% confidence

Rosfinmonitoring (Federal Financial Monitoring Service): Handles anti-money laundering (AML) and counter-terrorism financing (CFT); monitors transaction data from crypto providers.

aml 20% confidence

Proposed 2026 Framework (to be adopted 2026, retail implementation by July 1, 2026): Legalizes buying/selling digital currencies and stablecoins as monetary assets for retail/qualified investors under tests/caps; allows licensed financial firms (exchanges, brokers) to offer services; permits purchases abroad via foreign accounts with tax reporting; prohibits privacy coins.

aml 20% confidence

Bank of Russia (Central Bank of Russia): Primary regulator; proposes/implements rules, supervises financial institutions, registers digital financial asset (DFA) operators, establishes experimental regimes, and bans domestic crypto payments.

licensing 20% confidence

Bank of Russia (Central Bank of the Russian Federation): Establishes AML regulations for financial institutions, supervises compliance, issues and revokes licenses based on AML adherence, and provides guidance on AML best practices. The Bank also proposes crypto-specific rules and maintains registration of digital financial asset operators.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet/SaaS providers can operate in Russia only as locally-incorporated, Bank-of-Russia-registered digital depositories/DFA operators, subject to strict segregation rules (no lending of client assets), AML/CFT supervision by Rosfinmonitoring, retail purchase caps of 300,000 RUB/year, and a ban on domestic crypto payments; the comprehensive licensing framework is still evolving via draft legislation.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?