Russia’s NSPK warns of possible payment issues for Visa and Mastercard cards as security certificates expire

Russia’s National Payment Card System (NSPK) has warned users that online payments with foreign Visa and Mastercard cards may face disruptions after a move to Russian security certificates. For PSPs and acquirers, the key point is simple: this is an infrastructure and browser-certificate issue, not a network shutdown, and Mir cards are explicitly said to keep working.

1. NSPK said changes related to replacing security certificates could create problems when paying for purchases on the internet with Visa and Mastercard cards. The warning was reported by Prime based on a company statement.
2. The company said its services and websites are being moved to Russian security certificates. In some cases, users paying via SBP (the Faster Payments System) or opening NSPK resources through foreign browsers may see a warning that the connection is not secure.
3. NSPK said this warning is tied to the way foreign browsers work and “does not mean that the site is unsafe or that users’ data is at risk.” In other words, the browser message is about certificate handling, not a confirmed security incident.
4. The company also said the changes will not affect Mir cards, which will continue to work for both offline and online purchases.
5. The broader backdrop is that similar certificate problems have already appeared at other major Russian banks after international SSL certificates were revoked. NSPK said this is connected to sanctions lists in the EU and the US, since certification authorities cannot issue new certificates to companies under restrictions. Visa and Mastercard left Russia in 2022, but their cards kept operating in the country through NSPK’s infrastructure.

NSPK, created in 2014, was designed to keep Russian banks operational if international payment systems were cut off. The company said Mir accounts for two-thirds of card transactions in Russia, and the number of Mir cards reached 400.6 million as of 1 January 2025. For high-risk payment operators, that is the practical part of the story: Russia’s domestic stack remains large, and certificate-related browser warnings can still affect card acceptance flows even when the underlying network is intact.