Russia’s FSB to get 24/7 access to crypto exchange customer data from March 2027

From March 2027, Russian crypto exchanges will be required to provide the FSB with round-the-clock access to customer data, according to a summary of feedback on the draft federal law “On Digital Currencies and Digital Rights” published by the Central Bank. For high-risk payment businesses, the useful part is simple: the compliance burden is not limited to transaction monitoring anymore; it reaches into identity data, messaging, and access logs.

1. Under the draft framework, the data set is broad: full names, passport details and taxpayer numbers, phone numbers and email addresses, transaction data, bank details and account numbers, crypto wallet addresses, IP addresses, login times, and the platform’s correspondence with customers.
2. Banks, professional associations, depositories, and other market participants asked for a narrower setup: they proposed sending data to the FSB only upon request. They also asked to keep SORM, Russia’s lawful interception system, away from private keys and transaction-signing tools.
3. The Central Bank rejected those proposals, saying the approach had been agreed with the FSB. In other words, the regulator is not treating this as a negotiable technical detail.
4. According to an expert cited in the source, the equipment, integration, and maintenance costs for SORM would be very high for exchanges. The draft does not provide a simplified regime for smaller platforms, and a group of companies will not be able to connect through a single shared access point.
5. The law is still at the draft stage, so the final text may change. For PSPs and compliance teams with exposure to Russian crypto flows, that means the operational scope is clear enough to plan around, even if the wording is not yet final.