Russia's crypto surveillance plan could put customers' wallet keys in FSB hands

Russia's central bank has published a draft directive that would wire the FSB directly into cryptocurrency companies' databases. The documents, released in late October, are a detailed build guide for developers creating the server side of a new SORM system — the surveillance toolkit Russian law enforcement already uses to pull user data. This time, the target is crypto.

The setup works like this: a server loaded with specialized software that can reach a company's databases, connected to FSB equipment by a dedicated line. Data flows automatically when the security service asks, and companies must hold onto it for at least five years. Officers can request archives or set a live target — a specific wallet, a party to a transaction — and every new match gets sent over as it appears. The central bank calls those two options a search request and a request to monitor targets.

The sharpest detail is what the draft leaves unsaid. Cyberlaw attorney Sarkis Darbinyan noted that the central bank refused to adopt a proposal that would have explicitly banned private keys from traveling through SORM. Custodial wallets belong to the exchange; customers direct the funds but never hold the keys themselves. Hand those keys to the FSB and its officers would have the technical ability to execute transactions on their own. The regulator's explanation, per Meduza, was that the draft's approach had been agreed with the authorized agency.

Context matters here. The central bank oversees Russia's entire financial market, and under the new Law on Digital Currencies and Digital Rights — partly in force since September 1 — it must work with the FSB to set the rules for how major crypto players deal with the security service. Separate orders from the Digital Development Ministry and the Transport Ministry lay out the technical requirements for each system. Plenty of legally operating Russian crypto businesses will have to install SORM.

Loopholes survive for now. Users can still shuffle crypto between noncustodial wallets, lean on foreign exchanges that shrug off Russian law, or use underground Russian services. All of that gets banned on July 1, 2027, when the new law limits buying and selling to brokers, exchanges and exchange services that comply with Russian rules and run SORM. The central bank has separately made clear that direct person-to-person trades are out.

Penalties are still a blank page — nothing administrative or criminal exists yet for breaking the rule, and authorities have until the middle of next year to invent something. Both new rules land on the same July 1, 2027 date. And even then, a bank will have a very hard time spotting someone quietly buying or selling small amounts through a noncustodial wallet.