Russia's Central Bank Plans to Give FSB Access to Crypto Exchange Customers' Data
A draft directive from Russia's Central Bank would require crypto market participants to install a new SORM system for passing data to the FSB. Data would be stored for at least five years and supplied on request.
Russia's Federal Security Service (FSB) is set to gain a new tool for monitoring users of cryptocurrency services in the country. A draft directive from Russia's Central Bank, with documents published by the regulator in late October, sets out how it would work. The draft is essentially a detailed set of instructions for developers building the server side of a new SORM system. SORM is a system of technical tools that Russian law enforcement uses for surveillance and investigations to access user data.
How SORM works
A SORM system consists of a server running specialized software and a dedicated communications line wired directly to FSB equipment. The server can reach a company's databases and, on request, forwards part of the stored information to the security service. Postal operators, telephone and internet providers and hosting providers, among others, are already required to have such systems.
What data the FSB would receive
The data would cover details of transaction parties (full name, citizenship, taxpayer number, passport details, date and place of birth, phone number, email), information on the customer's exchange account, crypto wallet addresses and their known or presumed owners, the origin of the cryptocurrency, individual transactions with their value in rubles, and records of how customers use exchange websites and apps, including registration, logins and IP addresses.
Cyberlaw attorney Sarkis Darbinyan noted that the Central Bank rejected a proposal to explicitly bar the transfer of private keys through SORM. The draft does not mention keys, and the regulator said its approach had been agreed with the authorized agency. If the FSB obtained keys to custodial wallets, its officers could carry out transactions themselves.
Requests and deadlines
Companies would store the data for at least five years and transmit it automatically upon FSB request, either as an archive search or as real-time monitoring based on a specified criterion, such as a particular party or wallet.
Brokers, crypto exchanges, exchange services and digital depositories will have to install SORM. From July 1, 2027, individuals and organizations will be allowed to buy and sell cryptocurrency only through such compliant intermediaries, and direct P2P transactions will be prohibited. No penalties have been set yet. Banks will be expected to try to block payments to foreign and underground exchanges.
