The Financial Technology Law Review: Russia

Overview

Digital transformation continues to rapidly impact the financial industry. The year 2020 was designated to be the stress test year for accelerating transformation processes and highlighting systematic problems in the financial technology market2 for both banks (and other credit institutions) and pure fintech players. These global changes compel Russian financial service providers to continue constant experiments with new technologies and business models, thus paving the way for a growing interest in fintech.

Even though there are some obstacles and uncertainties that may impact certain business models, overall, Russia can be categorised as a fintech-friendly jurisdiction with no unusually burdensome requirements on companies involved in this field of commerce. Moreover, since July 2020,3 digital transformation is outlined as one of the five key strategic goals for the country's future development until 2030, thus, making it clear that the Russian regulatory framework for digital economy and financial technologies will rapidly change.

The main regulator, the Central Bank of Russia (the Central Bank), also demonstrates an open-minded approach towards new financial technologies and maintains an informative website in English.4 Intending to increase information availability concerning financial market players, the Central Bank plans to unite all the existing registers of financial organisations and create a Unified Register (URUFR), which will contain information about all companies entitled to provide financial services.

Since 1 January 2021, the law5 establishing tax incentives for IT companies has entered into force. According to the 'tax manoeuvre' provisions, firstly, the insurance payments rate for IT companies has reduced from 14 per cent to 7.6 per cent. Secondly, the income tax rate has reduced from 20 per cent to 3 per cent. Finally, the obligation to pay VAT is excluded for IT companies, accredited in the Ministry of Digital Development, Communications and Mass Media of the Russian Federation, provided that its software products are included in the Unified Register of Russian Programs for Electronic Computers and Databases.

Despite certain bureaucratic obstacles, such legal benefits will certainly help large fintech companies and small start-ups develop the Russian IT industry and attract more big players on to the market.

Regulation

i Licensing and marketing

'Fintech' companies provide financial services using big data, artificial intelligence (AI), machine learning, robotisation, blockchain, cloud technologies, biometrics, etc. Thus, the business models range drastically from traditional payments and collective investments to such novel areas as cryptocurrencies, initial coin offerings (ICOs) and robo-advisers. Each business model is always subject to its specific set of regulations and licensing requirements.

Given this fact, as of March 2021, there is currently no universal fintech licence in Russia. Instead, each business model of fintech is regulated separately. However, as it is seen from the Central Banks's advisory report,6 the main regulator plans to change the current approach based on the global trends towards financial services market reforms. Instead of separate requirements for each type of financial service, it is proposed to group financial activities into 'blocks'7 and elaborate regulation based on the unified licences. The exact timeline for the changes is not set but the Central Bank's representatives presume that at least a year is needed to prepare for the first step of norms unification.

Apart from the main financial regulator, there are other authorities who have adjacent functions in the regulation of fintech:

  1. the Ministry of Finance is responsible for general financial policy and overall management in the field of finance in Russia;
  2. the Federal Tax Service is a part of the Ministry of Finance and supervises compliance with taxation rules, including taxation of cryptocurrency mining and transactions with cryptoassets;
  3. the Federal Financial Monitoring Service (Rosfinmonitoring) is mainly tasked with anti-money laundering (AML) and counter-terrorism financing functions; and
  4. the Federal Anti-Monopoly Service enforces regulations applicable to fair competition and advertising, including those related to financial products and services.

Despite the leading role of the Central Bank, with the adoption in 2015 of the Federal Law on Self-Regulated Organisations in Financial Markets,8 certain regulatory functions have been delegated to self-regulated organisations (SROs). As of March 2021, there are 25 SROs in the field of finance approved by the Central Bank. In addition to SROs, there are also industry organisations and unions active in the fintech area, such as the Association for Financial Technologies Development,9 launched by the Central Bank, and the Russian Association for Cryptocurrency and Blockchain.10

In line with global practice, the Central Bank and other regulatory authorities in Russia place special emphasis on consumer protection. This is achieved through the enforcement of rules applicable to marketing and advertising of financial products. The principal source of such rules is the Federal Law on Advertising,11 which sets basic principles, bans misleading and unfair advertising practices and provides for specific rules applicable to financial services and securities. In addition to that, the Federal Law on Consumer Protection12 sets forth detailed rules aimed to protect consumers.

When it comes to competition, the main Act is the Federal Law on the Protection of Competition,13 which prohibits unfair competitive practices and outlaws abuses of dominant position, with special rules for financial organisations.

Since 2015, after the adoption of the Federal Law on Credit Histories,14 there is now a legal framework for credit information services provided by credit history bureaus. These are private companies providing information services about the creditworthiness of borrowers. Professional lenders are required to submit information about individual borrowers to at least one such credit history bureau. As of March 2021, there are nine credit history bureaus registered with the Central Bank.

ii Cross-border issues

Unlike in some other jurisdictions, regulated or licensed financial activities may not be passported from other countries into Russia (i.e., companies incorporated abroad and licensed or regulated under their local rules may not automatically become licensed or regulated in Russia). A certain level of passporting may become possible in the future among countries that are members of the Eurasian Economic Union (Armenia, Belarus, Kazakhstan, Kyrgyz Republic, Moldova and Russia).

Traditional financial services that are subject to licensing or registration, such as banking, insurance, brokerage and dealing in securities require a licence and may be carried out only via a local legal presence. Active targeting of Russian customers may result in liability and blocking of a perpetrator's website in the territory of Russia. Certain industries are also protected against foreign competitors willing to enter the Russian market. For example, there is a 50 per cent quota on the aggregate amount of foreign capital for banking and insurance industries. Otherwise, there are no restrictions on foreign investors willing to explore fintech opportunities via a local legal presence; nor are there requirements to partner or engage with local companies to enter the Russian market.

There is a general rule that foreign organisations engaged in regulated activities on the securities market under their local laws may carry out such activities in the territory of Russia only subject to prior accreditation with the Central Bank. However, the accreditation guidance developed in 2015 has not yet been adopted, which makes this rule of little practical value.

Despite the lack of passporting and certain restrictions, many fintech services are offered to Russian customers from abroad. This is particularly the case for unregulated segments of fintech, such as cryptocurrencies and ICOs. By way of example, until 2015, the trading of foreign currencies, universally known as 'forex', was unregulated in Russia and was actively marketed by offshore companies to a Russian audience.

Besides unregulated business, there are also examples of foreign financial service providers being available to Russian consumers, without being legally present on the Russian market. This may be the case when a consumer only needs to be able to speak English to access a website where a fintech product is offered, whereas the website itself may not necessarily be actively marketed to the Russian audience. As an example, many foreign crowd-investing and automated investment adviser platforms are available to Russian consumers, even though they are likely offering regulated services. In the era when many financial services are offered through desktop or smartphone application interfaces, one must take active steps to not to be present in a particular market, such as blocking by IP addresses, limiting traffic-generating campaigns to select areas or limiting incoming payments to certain banks.

Digital identity and onboarding

Over the past couple of years, the Russian government has made significant efforts to introduce a digital identity for individuals and companies. This was initially driven by the desire to improve and ensure access to public services via the internet, which required a stable identity management system in place. Such a system, the Unified System of Identification and Authentication (USIA), was created in 2010 to provide access to an online portal of public services, Gosuslugi.

Nowadays, the use of the USIA as a method of identification has been extended beyond public services. Certain financial service providers that were previously required by AML or know-your-customer (KYC) laws15 to identify clients in their presence may now use USIA as a gateway. For example, this applies to consumer (micro) loans, brokerage, securities trust management, and certain other financial services, thereby allowing full digital onboarding.

On 2 July 2018, the Unified Biometric System (UBS) was put into operation. UBS allows customers to undergo the biometric identification procedure. Customers need to visit one of the partner banks once, and can then use their unique biometrical profile to access financial products remotely. Since the end of 2019, UBS can be used to open bank accounts, obtain credit and carry out transactions for individuals in any bank.16 Since 1 January 2021, banks, insurance companies, microfinance organisations and securities market professionals are legally empowered to establish identity of legal entities agents via UBS and USIA.17 According to the Central Bank,18 in the near future UBS will become the 'state information system', and will give the opportunity to receive not only financial but also state services. The corresponding bill was adopted by the State Duma in the second reading.

Digital markets, payment services and funding

i Digital marketplaces

Digital marketplaces correspond to platforms where entrepreneurs place commercial offers for an indefinite range of consumers, who then select goods that best suit their needs. In the financial sector, marketplaces are used to conclude transactions between consumers (individuals) and financial institutions or issuers.19 Such transactions include the provision of banking, insurance, securities market and other services with the exception of bank account agreements for entrepreneurial activities. With the adoption of the Federal Laws Nos. 211-FZ and 212-FZ dated 20 July 2020,20 all the above-mentioned activities on financial marketplaces in Russia have been put into the legal framework.

According to the adopted legislation, to become a financial platform operator, a Russian legal entity in the form of a joint-stock company must comply with a set of obligatory requirements, namely:

  1. inclusion in the Central Banks' Registrar of Financial Platform Operators;
  2. possession of minimum amount of equity capital of 100 million roubles;
  3. not combining its activities with those of a credit institution or a non-banking financial institution, except for conducting activities as a trade organiser, depository, specialised depository or registrar;
  4. implementing an internal control system and a risk management system;
  5. having a hardware and software complex located in Russia;
  6. complying with information protection requirements established by the Central Bank; and
  7. complying with qualification requirements for members of its management bodies and for individual employees, and with requirements for shareholders of the marketplace operator (e.g., a shareholder with more than 10 per cent of voting shares cannot be a company registered in an offshore zone).

As of March 2021, three financial marketplaces21 are registered. New companies wishing to create such a platform must also take into account the requirements enacted for the relevant activity. With the growing popularity of goods marketplaces in the Russian market, the creation and development of financial marketplaces certainly has significant consumer potential.22

ii Digital and cryptoassets

Regulators all over the world are experimenting with the adoption of tokenised digital currencies. Russia is no exception. On 1 January 2021,23 legal regulation on digital and cryptoassets has come into effect. The law permits the sale and purchase of digital financial assets (DFA), as well as the exchange of DFAs for other DFAs or for other digital rights.

DFAs are defined as digital rights, which include:

  1. monetary claims;
  2. ability to exercise rights attaching to issuable securities; and
  3. interest in the capital of a non-public joint-stock company.

Instead of the term 'cryptocurrency' the law introduces the definition of 'digital currency'; that is, a series of digital data (digital code or reference) contained in the information system that is offered or can be accepted as a means of payment not constituting a monetary unit of Russia, a foreign country or an international monetary unit or a payment unit or as an investment. Therefore, the definition of digital currency should embrace classic cryptocurrencies (payment tokens), in particular, Bitcoin and Ether. It is expected that the status of digital currency ('digital rouble') and the relations arising out of its circulation will be regulated by a separate federal law. However, the Law contains the fundamentals of such regulation:

  1. Russian legal entities and Russian branches or representative offices of foreign legal entities and Russian individual tax residents are prohibited from making or accepting payment for works and services in digital currency; and
  2. dissemination of information about the offer or acceptance of digital currency as payment for goods, works or services is prohibited, which may potentially be inconsistent with the definition of the digital currency where it is stated that the digital currency 'is offered or may be accepted as a means of payment'.24

iii Collective investment schemes

Several legal forms can be used for collective investment purposes in Russia, ranging from purely contractual, such as 'investment partnership agreements', to corporate ones, such as joint-stock companies or incorporated investment funds. At the same time, available legal forms are not very well suited for modern-day crowd-investing purposes. The main hurdles are high incorporation costs, restrictions on the transfer of investment interests or other burdensome requirements.

The standard choice for a large-scale collective investment scheme remains a 'unit investment fund'. This legal form has been successfully used in the domain of collective real estate investments. The fund must be run by a professional investment management company.

Another option that is suitable for small-scale collective investments is a typical limited liability company (LLC). In this case, investment opportunities are marketed on an online platform, but actual transactions take place offline, because the transfer of interest in an LLC is subject to notary certification. The total number of members in the LLC is capped at 50.

iv Crowdfunding and crowd-lending

The law regulating crowdfunding and crowd-lending (or peer-to-peer lending)25 in Russia entered into force on 1 January 2020. The law determines the definition of an investment platform; establishes requirements for operators (that must be included in the Central Bank's register, prepare annual reports on the results of their activities and possess capital of no less than 5 million roubles), investors (for unqualified investors – no more than 600,000 roubles in a year) and persons attracting investments; and introduces restrictions on the total amount of investments (no more than 1 billion roubles in a year). It is worth mentioning that crowdfunding and crowd-lending activities in Russia are not subject to licensing or consumer lending regulations.

According to the Association of Investment Platform Operators statistics, the size of Russian crowd-lending market in 2020 has reached 4.8 billion roubles. However, the pandemic crisis made several crowdfunding and crowd-lending platforms, namely Sberkredo, StartTrack, JetLend stop their activities, thus the growth pace in 2021 may not be sustainable.

v Payment services

Payment services is a regulated activity in Russia. The main piece of legislation is the Federal Law on the National Payment System26 (the NPS Law), which is supplemented by numerous detailed regulations. The NPS Law describes different types of activities within the national payment ecosystem and imposes requirements depending on the type of activity. Credit institutions, including banks, may engage in most types of payment activities, whereas non-banking credit institutions are limited to certain activities (such as payment-clearing services and processing). As of March 2021, there are 52 active payment systems listed in the register maintained by the Central Bank.27

Since 28 January 2019, following the Central Bank's roadmap of 2018–2020, the Faster Payments System (FPS) along with the National Payment Card System are fully operated. As of March 2021, 213 banks are participating in the system. The FPS enables private consumers to make instant online payments 24/7 using simple identifiers (e.g., a mobile number, QR code) regardless of in which banks the senders or recipients have their accounts.

Notably, since the grace period of 2019, the FPS transfers between individuals are free of charge for banks, but from 30 June 2022, banks will have to pay rates. Nowadays, rates are established for funds transfers from legal entities to individuals, effective from 1 April 2020.

Since the adoption of several federal laws28 in 2019, there are other noteworthy developments concerning foreign payment systems (Visa, MasterCard, etc.) operating in Russia that prohibit foreign payment systems from refusing to provide services to Russian banks as of April 2020 and oblige them to create separate subdivisions in Russia and register with the Central Bank as of July 2020.

vi Open API

Unlike the European Union, where Payment Services Directive II will oblige banks to provide access to their customers' account information through application programming interfaces (API) to third parties, banks in Russia are not presently subject to such obligation. Nonetheless, the Central Bank has already elaborated Standards on Open API,29 which are currently used in creating partner services.

Cryptocurrencies, initial coin offerings (ICO) and security tokens

As early as 2014, various regulators in Russia for the first time acknowledged the existence of Bitcoin by demonstrating their negative views towards it. In 2017, the attitude of regulators towards Bitcoin shifted from 'banned, unrecommended' to 'the concept is under investigation, regulation will come soon.'

Since 1 October 2019, under Russian law tokens are legalised as objects of civil rights and are considered 'digital rights'.30 As described in Section IV.ii, tokens and cryptocurrencies ('digital currency') have also received legal framework. Nowadays security tokens (both shares tokens and tokenised securities) deriving their value from real assets (e.g., gold or nickel) constitute 'DFA' and have legal value.

Internationally, one of the most widely discussed legal aspects of token sales was whether tokens constitute securities. Following the report of the US Securities and Exchange Commission on the DAO project,31 many regulators all over the world agreed that certain tokens may qualify as securities or other financial instruments. In Russia, the issue was resolved with the adoption of the Federal Law on DFA, which refers tokens to the category of 'DFA'.

Russian securities law limits the circulation of foreign financial instruments, with the Central Bank having a final say on whether a particular instrument may be allowed to the public market. Unless cleared by the Central Bank, foreign securities may only be offered to accredited investors in Russia and no general solicitation is permitted.

AML and KYC rules apply to transactions with cryptocurrencies to the extent such transactions are carried out via 'organisations carrying out transactions with monetary funds and other property' as defined in Article 6 of the Federal Law on Combating Legalisation (Laundering) of Illegally Gained Income and Financing of Terrorism.32

Other new business models

New business models in the area of fintech appear every now and then. Most of the time such models are beyond existing regulations and fall in one of the following two groups:

  1. unregulated models, which may be implemented within the existing legal framework; and
  2. prohibited models, which are explicitly outlawed.

Most new models fall within the unregulated domain. We will briefly cover several such business models below.

i Smart or self-executing contracts

Until recently, there was no specific mention of smart contracts in Russian law. As of October 2019, Article 309 of the Civil Code provides that 'within the occurrence of certain circumstances legal transaction may be executed without additionally expressed will of its parties by applying information technologies under the terms of transaction'.

Certification of Masterchain, an Ethereum-based blockchain developed by the consortium of major Russian banks cooperating within the Association for Financial Technologies Development, was made on 7 October 2019 and demonstrates the readiness of blockchain technology (and smart contracts, in particular) to be used in the financial sector. Its White Paper names several use cases, such as a decentralised depository of mortgages, a distributed ledger of digital bank guarantees and electronic letters of credit.33

ii Automated digital advisery

Since 21 December 2018, automated digital advisory services (robo-advisers) have been subject to regulation. Specifically, Article 6.2 of the Federal Law on Securities Market imposes mandatory accreditation for software used to provide investment advice. However, at this stage, the Central Bank has not yet adopted the procedure for such accreditation and, accordingly, no robo-advisers have been accredited.

iii AI

Currently, there are no special rules applicable to the use of AI in financial products. However, this does not preclude it from being actively developed. In early November 2019, Sberbank, Gazprom Neft, Yandex, Mail.ru Group, MTS and Russian Direct Investment Fund created the Russian AI Alliance. The parties joined forces to create technological components that will stimulate the development of AI. The President of Russia also instructed the government to stimulate investments into implementation of domestic AI software.34 Investors will receive certain tax incentives, which must be adopted no later than 1 May 2021.

Thus, there are great drivers to develop legal regulations for AI in finance.

iv Financial product comparison

No specific regulation applies to websites comparing financial products or services. Such websites are nonetheless subject to general advertising and fair competition principles.

v Binary options

The Central Bank has not yet taken any stance on binary options. However, it did announce in its regulatory strategy for 2016–2018 that it would provide guidance on this issue. This announcement was made in the document's section related to consumer protection and gambling.

Intellectual property and data protection

i Intellectual property

Russian law is familiar with all standard concepts of intellectual property (IP) used to protect business. The most commonly used are:

  1. patents (protecting inventions, utility models and industrial designs);
  2. trade secrets;
  3. copyright; and
  4. trademarks, including service marks.

Information of any nature relating to the results of intellectual activity may be treated as a trade secret and be protected as IP provided basic confidentiality conditions are met.

Software and databases are usually protected under copyright laws. Copyright is acquired automatically as of the date a copyright object is manifested in objective form. Registration is optional.

Rights over trademarks are granted by virtue of registration with Rospatent,35 a local patent and trademark office. Alternatively, rights may also be acquired by virtue of international agreements to which Russia is a party, such as the Madrid Convention.36 Russia is a 'first-to-file' jurisdiction.

Any foreign company may seek protection of its intellectual property in Russia provided national law requirements are met. Russia is also a signatory to most international treaties covering intellectual property protection.

Disputes often arise in the context of employment relationship as to who owns newly created IP. For an employer to acquire rights over such IP, it is important that an employment contract or a job assignment explicitly states that the creation of IP falls within the duties of an employee.

ii Data protection

Overall, Russian data protection law is in line with international standards. The Strasbourg Convention 1981 (ratified by Russia in 2005) laid the foundation for the Russian personal data protection legislation, which was adopted in 2006.

The main pieces of legislation governing the collection, storage and use of personal data in Russia are the Federal Law on Personal Data37 and the Federal Law on Information, Information Technologies and Data Protection.38

Unlike in some other jurisdictions, there is currently no general obligation to report cybercrimes, although such legislation was proposed in 2017 and may be adopted soon.

Year in review

The most relevant global fintech market developments in 2020 included: the growth of contactless payments, branchless banking and parametric insurance. According to EY,39 Russia is in the top three countries with a growing interest in fintech. As of 2020, there were over 400 fintech start-ups in Russia.

The fintech agenda in Russia for the last 18 months was primarily focused on developing the legal framework for the digital era of finance. Specifically, the main achievement of Russian fintech legislation in 2020 was the adoption of the Law on DFA, which gave rise to numerous other developments, described in Sections IV and V.

Outlook and conclusions

The changes in the global financial industry are going to take place gradually in 2021. Analysts see the greatest potential in 2021 in such areas as biometrics, digital profile, digital assets and tokenisation. We will see changes in the value chain, new business models, types of players and product types.

Amongst other developments, the Bank of Russia is considering the possibility of issuing the central bank digital currency (CBDC), a 'digital rouble', as an alternative to cryptocurrencies, following the objective to develop the NPS.40 This will stimulate innovations both in retail payments and in other areas and support the development of the digital economy.

Also, we believe that the trend of embedded finance development in 2021−2023 will lead to lower marketing and branding costs for traditional banks, because aggressive promotion will not be necessary. As a result, some large banks can become truly invisible.

Footnotes

1 Roman Buzko is a partner at Buzko Krasnov.

3 Decree of the President of the Russian Federation No. 474 On the Russian Federation's National Development Goals until 2030.

5 Federal Law No. 265-FZ on Amendments to the Second Part of Russian Tax Code dated 31 July 2020.

6 The Central Bank's Advisory Report for Public Consultations on Improving Admission Process to the Financial Market. New Opportunities for the Players. Available at: http://www.cbr.ru/Content/Document/File/116463/Consultation_Paper_22122020.pdf.

7 The current edition of the Advisory Report allocates 8 'blocks': (1) banks and microfinance organisations; (2) insurance; (3) property storing and accounting; (4) asset management; (5) agency; (6) microlending; (7) infrastructure; (8) information services and estimation.

8 Federal Law No. 223-FZ on Self-Regulated Organisations in Financial Markets dated 13 July 2015.

9 See footnote 4.

11 Federal Law No. 38-FZ on Advertising dated 13 March 2006.

12 Law of the Russian Federation No. 2300-1 dated 7 February 1992.

13 Federal Law No. 135-FZ on Protection of Competition dated 26 July 2006.

14 Federal Law No. 218-FZ on Credit Histories dated 30 December 2004.

15 Federal Law No. 115-FZ on Combating Legalization (Laundering) of Illegally Gained Income and Financing of Terrorism dated 7 August 2001.

16 As of the end of 2020, such services are provided by 11 banks.

17 Federal Law No. 479-FZ on Amendments to Certain Legislative Acts of the Russian Federation dated 29 December 2020.

18 Available in Russian at: https://cbr.ru/press/event/?id=9404.

19 As of March 2021, the draft bill allowing legal entities to use financial marketplaces is under consideration in the State Duma.

20 Federal Law No. 211-FZ On Concluding Financial Transactions Using a Financial Platform dated 20 July 2020. Federal Law No. 212-FZ On Amendments to Certain Legislative Acts of the Russian Federation Concerning the Conclusion of Financial Transactions Using a Financial Platform dated 20 July 2020.

21 Moscow Exchange, VTB Registrar, Special Depositary INFINITUM.

23 Federal Law No. 259-FZ on Digital Financial Assets, Digital Currency and Amendments to Certain Russian legislation dated 31 July 2020.

25 Federal Law No. 259-FZ on Investments Through Investment Platforms and Certain Amendments to Other Laws of the Russian Federation dated 2 August 2019.

26 Federal Law No. 161-FZ on National Payment System dated 18 July 2011.

27 Available in Russian at: http://www.cbr.ru/PSystem/rops/.

28 Federal Laws No. 33-FZ dated 18 March 2019, No. 166-FZ dated 3 July 2019, No. 173-FZ dated 3 July 2019 and No. 264-FZ dated 2 August 2019.

30 Federal Law No. 34-FZ on Amendments to Parts One, Two, and Article 1124 of Part Three of the Civil Code of the Russian Federation dated 18 March 2019.

31 Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, http://www.sec.gov/litigation/investreport/34-81207.pdf.

32 Federal Law No. 115-FZ on Combatting Legalisation (Laundering) of Illegally Gained Income and Financing of Terrorism dated 7 August 2001.

34 List of Instructions Following the AI Conference approved by the President of Russia (No. Pr-2242) dated 31 December 2020.

35 Federal Service for Intellectual Property, Patents and Trademarks.

36 Madrid Agreement Concerning the International Registration of Marks of 1983.

37 Federal Law No. 152-FZ on Personal Data dated 27 July 2006.

38 Federal Law No. 149-FZ on Information, Information Technologies, and Data Protection dated 27 July 2006.

Get unlimited access to all The Law Reviews content