Custodial wallet / SaaS in Russia
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Russia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Registration with Bank of Russia as a digital depository/custodian (specialized digital depository register) — ru.licensing.custody-providers-specialized-digital-depositories
- Registration as a DFA operator with Bank of Russia — ru.licensing.registration-as-dfa-operators-russian
- AML/CFT compliance under Federal Law No. 115-FZ, supervised by Rosfinmonitoring — ru.licensing.rosfinmonitoring-federal-financial-monitoring-service
- Transaction monitoring and de-anonymization procedures for all transactions — ru.licensing.amlkyc-implied-through-mandatory-intermediary
- Reporting of transactions exceeding 600,000 RUB per year to tax authorities (Federal Tax Service) — ru.aml.2020-law-on-digital-financial, ru.licensing.federal-tax-service-of-russia
- KYC on all users; retail users must pass a Bank of Russia competency test before accessing services — ru.licensing.amlkyc-implied-through-mandatory-intermediary, ru.licensing.compliance-with-kyc-competency-tests
- Suspicious transaction reporting to Rosfinmonitoring — ru.licensing.rosfinmonitoring-federal-financial-monitoring-service
- Custodial providers (including banks like Sberbank) must comply with prudential requirements and enable mechanisms for freezing suspicious assets — ru.licensing.custodial-service-providers-including-banks
Key Restrictions
- Must have Russian legal status (local entity incorporation required) — ru.licensing.local-presence-entities-must-have
- Must be registered as a specialized digital depository in Bank of Russia's register and/or as a DFA operator — ru.licensing.custody-providers-specialized-digital-depositories, ru.licensing.registration-as-dfa-operators-russian
- No lending of client crypto assets to third parties — ru.licensing.custody-providers-specialized-digital-depositories, ru.licensing.digital-depositories-are-required-to
- No domestic crypto payments for goods/services (ban in place since 2020) — ru.aml.2020-law-on-digital-financial, ru.licensing.prohibitions-no-domestic-payments-with
- Retail client annual purchase cap of 300,000 RUB via a single intermediary; requires passing a knowledge/competency test — ru.licensing.retail-limits-annual-purchases-capped
- Foreign platforms without Russian licenses are prohibited from domestic operations — ru.licensing.local-presence-entities-must-have
- Custodial providers may face liability limits for blockchain malfunctions or issuer blocks — ru.licensing.custody-providers-specialized-digital-depositories
- Unlicensed operation carries criminal liability (fines up to ~$13,000, up to 7 years imprisonment) — ru.licensing.criminal-liability-for-unlicensed-operations
Key Risks
- Regulatory framework still in flux — comprehensive bill 'On Digital Currency and Digital Rights' not yet final; proposed 2026 framework may significantly change rules — ru.licensing.comprehensive-bill-on-digital-currency, ru.aml.proposed-2026-framework-to-be
- Ambiguity around whether SaaS white-label custody falls under 'digital depository' rules, 'DFA operator' rules, or both — no explicit standalone custody license path clarified
- Tax reporting obligations (600,000+ RUB threshold) create compliance burden on the SaaS provider and/or white-label clients — unclear bifurcation of responsibility
- Sanctions-related risk: providing custody services may attract secondary sanctions scrutiny for any exposure to sanctioned persons or entities
- International trade exception (2024 law) creates complexity for distinguishing domestic (banned) vs. cross-border (permitted) use of crypto
- Enforcement risk is high: criminal penalties for unlicensed operation signal aggressive prosecution posture by Bank of Russia and Rosfinmonitoring
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Custody Providers: Specialized digital depositories must be licensed or registered in the Bank of Russia's register to maintain records of cryptoasset rights and register wallets. They face restrictions like no lending of client assets and no liability for blockchain malfunctions or issuer blocks.
Registration as DFA operators: Russian banks/exchanges must register with Bank of Russia, which maintains the registry and supervises operations.
Local Presence: Entities must have Russian legal status; foreign platforms without licenses are prohibited for domestic operations.
Rosfinmonitoring (Federal Financial Monitoring Service): Russia's lead agency for combating money laundering and terrorist financing. It analyzes financial transactions, ensures institutional compliance with AML/CFT standards and Federal Law No. 115-FZ, and enforces Enhanced Due Diligence requirements.
Federal Tax Service of Russia: Handles tax-related compliance, requiring individuals and organizations to report cryptocurrency holdings and transactions exceeding certain thresholds (notably 600,000 rubles).
AML/KYC: Implied through mandatory intermediary routing, de-anonymization procedures, transaction monitoring, and tax reporting. Retail users must pass a Bank of Russia competency test; residents report foreign wallets/transactions to tax authorities.
Compliance with KYC, competency tests for retail (via intermediaries), and reporting thresholds (e.g., transactions >600,000 RUB/year to tax authorities).
Custodial service providers, including banks like Sberbank, must comply with prudential requirements; Sberbank proposed custody services to the central bank, treating crypto assets similarly to bank deposits with mechanisms for freezing suspicious assets. (https://www.binance.com/en/square/post/27079019931473)
Digital depositories are required to maintain records of rights to cryptoassets, register wallets, and face restrictions like prohibiting lending of client coins to others. (https://forklog.com/en/the-end-of-shadow-trading-russias-forthcoming-crypto-market-rules/)
Retail limits: Annual purchases capped at 300,000 RUB (~$3,700–$3,800) via one intermediary; requires knowledge test. Qualified investors (e.g., high income >20M RUB/year, finance master's) face no limits.
Prohibitions: No domestic payments with crypto; reporting mandatory for large transactions. International trade exception since 2024.
Criminal liability for unlicensed operations: Entities organizing digital currency circulation without Bank of Russia approval face fines ($1,300–$13,000), up to 4–7 years imprisonment, or forced labor; applies to exchanges and large operators.
Comprehensive bill “On Digital Currency and Digital Rights” for State Duma submission: Covers licensing, caps, infrastructure: Detailed in .
Exchanges and exchangers with monthly turnover ≥3.5 million rubles can serve users directly, while smaller ones must use licensed intermediaries; all must be licensed or registered with the Bank of Russia. (https://forklog.com/en/the-end-of-shadow-trading-russias-forthcoming-crypto-market-rules/; https://crypto.news/russia-clears-draft-laws-to-tighten-crypto-trading-and-limit-retail-participation/)
Mandatory licensing for intermediaries: Covers digital exchanges, custodial services, trading platforms, and DFA operators; banks, brokers, and securities firms can provide services after authorization.
Simplified process for banks/brokers: Existing financial institutions may use a "notification process" tied to current banking licenses, rather than full standalone applications.
2020 Law on Digital Financial Assets (DFAs): Legalizes crypto transactions but prohibits use as payment for domestic goods/services; mandates reporting of transactions over 600,000 rubles to tax authorities.
Rosfinmonitoring (Federal Financial Monitoring Service): Handles anti-money laundering (AML) and counter-terrorism financing (CFT); monitors transaction data from crypto providers.
Proposed 2026 Framework (to be adopted 2026, retail implementation by July 1, 2026): Legalizes buying/selling digital currencies and stablecoins as monetary assets for retail/qualified investors under tests/caps; allows licensed financial firms (exchanges, brokers) to offer services; permits purchases abroad via foreign accounts with tax reporting; prohibits privacy coins.
Bank of Russia (Central Bank of Russia): Primary regulator; proposes/implements rules, supervises financial institutions, registers digital financial asset (DFA) operators, establishes experimental regimes, and bans domestic crypto payments.
Bank of Russia (Central Bank of the Russian Federation): Establishes AML regulations for financial institutions, supervises compliance, issues and revokes licenses based on AML adherence, and provides guidance on AML best practices. The Bank also proposes crypto-specific rules and maintains registration of digital financial asset operators.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers can operate in Russia only as locally-incorporated, Bank-of-Russia-registered digital depositories/DFA operators, subject to strict segregation rules (no lending of client assets), AML/CFT supervision by Rosfinmonitoring, retail purchase caps of 300,000 RUB/year, and a ban on domestic crypto payments; the comprehensive licensing framework is still evolving via draft legislation.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?