Putin Signs Russia Crypto Law: What Accounting Firms and CFOs Must Review Before September 2026
President Vladimir Putin has signed bill No. 1194918-8, titled "On Digital Currencies and Digital Rights," into law. The core provisions take effect on September 1, 2026, and accounting firms, auditors, and CFOs with any Russian counterparty or cross-border digital asset exposure need to move quickly. This is not a consultation paper or a draft regulation. It is enacted legislation with hard deadlines, a licensed intermediary structure, and a central bank empowered to decide which assets can legally be offered in the Russian market.
What the Law Actually Creates
Russia's new framework is built around regulated market participants: exchanges, brokers, custodians, and other crypto service providers operating inside the country. Each category now faces a defined set of requirements to obtain and keep a licence.
The licensed intermediary model
Crypto exchange operators must satisfy regulatory requirements set by the Bank of Russia and, critically, must join a financial market self-regulatory organisation (SRO). This dual-layer structure, regulator plus SRO, is common in traditional Russian financial markets and means there will be two sources of binding rules that firms need to monitor: the Bank of Russia's own guidance and the SRO's member standards.
Retail investors cannot purchase crypto assets directly. They must go through a licensed intermediary, and the law caps their annual spend at 300,000 rubles (approximately $3,700) per intermediary. Qualified investors face no such cap and can purchase any cryptocurrency without restrictions on amount or asset type.
Bank of Russia as the gatekeeper
The Bank of Russia takes on three core powers under the new law: market oversight, the issuance of implementing rules, and the determination of which crypto assets licensed intermediaries are permitted to offer. That last point is significant. It means the approved asset list is not fixed in statute. It can be updated by regulatory decision, and any change could immediately affect what counterparties in Russia are legally able to hold or trade, with direct implications for how a firm classifies those positions in its ledgers.
Key Dates and Phased Implementation
The law does not come into force as a single block. Understanding the timeline is essential for scheduling compliance reviews and audit procedures.
September 1, 2026: Core provisions live
The bulk of the framework, including the licensing requirements for exchanges and other intermediaries, the retail investor cap, the qualified investor carve-out, and the Bank of Russia's oversight powers, takes effect on this date. Firms that have Russian crypto exchange counterparties, custody arrangements, or investment structures involving Russian entities need those relationships assessed and documented before this date.
July 1, 2027: Non-resident digital depositories
Rules applying to non-resident digital depositories have a later effective date of July 1, 2027. This deferred timeline affects firms that use or audit cross-border custody arrangements where the depositary sits outside Russia but holds assets on behalf of Russian clients or entities. The gap between September 2026 and July 2027 creates a period in which the domestic framework is live but the non-resident custody rules are not yet fully operative. Firms should flag this in their risk assessments and not assume the full picture is in place from day one.
The Continuing Ban on Crypto Payments
One provision that is often under-reported deserves clear attention: the law maintains an existing ban on using crypto assets to pay for goods and services inside Russia. This is not a new restriction, but its re-affirmation in enacted legislation has practical consequences for how accounting firms should treat crypto-denominated transactions involving Russian counterparties.
Transaction classification and ledger treatment
Any transaction that appears to use a crypto asset as payment for goods or services within Russia is, on its face, illegal under Russian law. For firms preparing financial statements or conducting audits, this creates a classification obligation. A transaction structured as a crypto payment to a Russian vendor cannot simply be recorded as a routine payable. It warrants a legal characterisation note, a risk flag in the audit file, and potentially a disclosure in the financial statements depending on materiality and the applicable reporting standard.
This is precisely the kind of edge-case scenario where robust crypto compliance reporting processes, supported by capable crypto accounting software, make the difference between a clean audit file and a regulatory exposure. Firms that have not yet built a structured workflow for classifying cross-border digital asset transactions involving sanctioned or restricted jurisdictions should treat the September 2026 deadline as the prompt to do so. For broader context on how AML and licensing developments in other jurisdictions are reshaping compliance expectations, see our coverage of AML and licensing implications your firm should track, and the emerging patterns covered in our analysis of how white-collar crime trends are reshaping digital asset compliance.
AML and KYC Implications for Accounting Firms and Auditors
Russia is already a high-scrutiny jurisdiction for AML purposes. The introduction of a formal licensing regime does not reduce that scrutiny. In some respects, it adds a new dimension: firms now need to track not just whether a counterparty is sanctioned, but whether it is licensed under the new framework and whether the assets it holds or trades are on the Bank of Russia's approved list.
Client due diligence file updates
Accounting firms servicing clients with Russian crypto exposure, whether through direct investment, cross-border trading relationships, or custodial arrangements, should review and update their client due diligence files before September 1, 2026. Specifically, the file should document: the nature of the client's relationship with any Russian crypto intermediary; whether that intermediary is or will be licensed under the new law; the asset types involved and whether they are likely to appear on the Bank of Russia's approved list; and the annual transaction volumes relative to the 300,000-ruble retail cap, which could be relevant if the client is interacting with a Russian intermediary on behalf of retail participants.
SRO membership as a due diligence data point
The requirement for exchanges and other operators to join a financial market SRO creates a verifiable compliance marker. Once the SRO publishes its member list (a step that will follow from the September 2026 implementation), firms can use SRO membership status as a basic due diligence check when onboarding or reviewing Russian crypto counterparties. Non-membership after the effective date should be treated as a red flag, equivalent to operating without a licence in other regulated markets.
CFO Considerations: Reporting, Disclosure, and Custody Risk
For CFOs at firms with treasury exposure to Russian crypto markets, the law raises several reporting and risk management questions that need board-level attention.
Asset eligibility and valuation risk
The Bank of Russia's power to determine which assets licensed intermediaries can offer creates a form of regulatory valuation risk. If an asset held by a Russian counterparty is removed from the approved list, its tradability in the Russian market is immediately affected. CFOs should consider whether their treasury policies and investment mandates account for this jurisdiction-specific eligibility risk, and whether it should be disclosed as a risk factor in financial reporting.
Custody and settlement arrangements
The deferred implementation of rules for non-resident digital depositories means that custody arrangements involving non-Russian entities holding assets for Russian clients will operate in a partially specified regulatory environment until July 2027. CFOs with structures of this kind should seek legal confirmation of how the gap period is treated and whether existing custody agreements need to be amended before the full framework is live.
Digital asset accounting software and workflow readiness
Firms that have not yet adopted purpose-built digital asset accounting software will find the Russian framework a useful forcing function. The combination of an approved-asset list that can change by regulatory decision, a tiered investor regime with a hard ruble cap, and a payment ban that must be reflected in transaction classification means that manual spreadsheet-based processes are unlikely to keep pace. Firms should assess whether their current tooling can flag Russian-jurisdiction transactions, apply the correct classification rules, and generate the audit trail that both the Bank of Russia's regime and their own home-jurisdiction regulators will expect.
Frequently Asked Questions
When do the main rules of Russia's new crypto law take effect?
The core provisions, covering licensing for exchanges and other intermediaries, the retail investor cap, and the Bank of Russia's oversight and asset-approval powers, take effect on September 1, 2026. Rules specific to non-resident digital depositories follow on July 1, 2027.
What is the retail investor cap and how does it work?
Retail investors in Russia are limited to purchasing crypto assets through licensed intermediaries, with an annual cap of 300,000 rubles (approximately $3,700) per intermediary. Qualified investors are exempt from this cap and may purchase any cryptocurrency without restriction on amount or asset type.
Does the new law change Russia's ban on using crypto as payment?
No. The law explicitly maintains the existing prohibition on using crypto assets to pay for goods and services inside Russia. Transactions structured as crypto payments to Russian vendors remain illegal under Russian law, which has direct implications for how such transactions are classified in cross-border ledgers and audit files.
Who regulates the Russian crypto market under the new law?
The Bank of Russia is the primary regulator. It will oversee the market, issue implementing rules, and determine which crypto assets licensed intermediaries are permitted to offer. Exchange operators must also join a financial market self-regulatory organisation, creating a two-layer compliance obligation.
What should accounting firms do before the September 2026 effective date?
Firms should review and update client due diligence files for any client with Russian crypto exposure, assess whether counterparties are on track for licensing and SRO membership, review the classification treatment of any cross-border transactions involving Russian entities, and check whether their crypto bookkeeping software can handle the jurisdiction-specific rules, including the retail cap, the approved-asset list, and the payment ban.
Source: Cointelegraph