Russia: technology regulation at a glance

Framework: Patchwork of federal laws led by Law No. 259-FZ 'On Digital Financial Assets' (in force 2021), Law No. 259-FZ amendments legalizing mining (in force Nov 1, 2024), Law No. 418-FZ recognizing digital currency as property and setting crypto taxation (in force Jan 1, 2025), and a comprehensive Bank of Russia framework legalizing regulated retail trading scheduled to take effect Sept 1, 2026 (transition to July 1, 2027). Bank of Russia is the primary regulator; the Ministry of Finance and Rosfinmonitoring share oversight.

Crypto ownership and trading are legal, but using cryptocurrencies for domestic payments is prohibited — the ruble remains the sole legal means of payment. Russia currently relies on a patchwork of laws (DFA Law, mining law, tax law) rather than a single comprehensive regime; a unified Bank of Russia framework licensing exchanges, brokers, depositories and stablecoins is scheduled to enter force on Sept 1, 2026, with a transition period until July 1, 2027. Cross-border settlements in crypto are permitted under an Experimental Legal Regime, while the state simultaneously develops a digital ruble CBDC.

Framework: National Strategy for AI Development to 2030 (Presidential Decree No. 490, 2019; updated by Decree No. 124, Feb 2024) plus the voluntary AI Code of Ethics (2021); no binding comprehensive AI statute yet in force, though a draft federal law was published in March 2026.

As of May 2026 Russia has no binding, AI-specific comprehensive law in force; AI is governed by a state policy document (the National AI Strategy to 2030) and a voluntary national AI Code of Ethics, supplemented by sectoral rules and high-level governance bodies. A draft federal law 'On the Fundamentals of State Regulation of AI Technologies' was published for discussion in March 2026 and could take effect on 1 September 2027, signaling a planned shift toward sovereignty-focused binding regulation.

Framework: Federal Law No. 152-FZ 'On Personal Data' (2006, as amended), enforced by Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media), supplemented by the data-localization rule introduced by Federal Law No. 242-FZ (2014).

Russia has a comprehensive, GDPR-predating personal-data protection regime centered on Federal Law No. 152-FZ (in force since 2006 and repeatedly amended). It imposes consent-based processing, a strict data-localization mandate requiring personal data of Russian citizens to be stored on servers physically in Russia, controlled cross-border transfers, and, following 2024-2025 reforms, substantially heightened administrative, turnover-based, and criminal liability for breaches. The supervisory authority is Roskomnadzor.

Framework: Federal Law No. 161-FZ 'On the National Payment System' (2011), administered and supervised by the Bank of Russia (Central Bank of the Russian Federation), supplemented by the 2025 installment-services (BNPL) law and the digital-ruble legislation.

Russia operates a clear, central-bank-led licensing and registration regime for payments and e-money under Federal Law 161-FZ. The Bank of Russia registers payment system operators and supervises the sector; e-money may only be issued by licensed credit institutions (banks). The state runs key rails directly, the Faster Payments System (SBP) and the Mir card scheme via NSPK, and is rolling out mandatory open APIs (from 2026), a regulated BNPL regime (from April 2026), and a digital ruble (mass launch from September 2026).

Framework: Federal Law No. 115-FZ 'On the Legal Status of Foreign Citizens', administered by the Ministry of Internal Affairs (MVD); supplemented by Presidential Decree No. 702 (19 Aug 2024) 'shared values' TRP, Government Decree No. 2573 (2022) golden visa, and the Highly Qualified Specialist (HQS) regime.

Russia has no dedicated digital-nomad or remote-work visa; remote workers cannot obtain status specifically for working online for a foreign employer and typically use tourist/business visas or register as an individual entrepreneur (IP). Relocators can, however, obtain residency through several other routes: the Highly Qualified Specialist (HQS) regime, residency-by-investment ('golden visa'), and the simplified 'traditional/shared values' temporary residence permit (Decree 702). A new simplified skilled-specialist visa-and-residency route is reported to take effect on 15 April 2026.

Framework: Layered state-control regime centered on Roskomnadzor: the 2019 'Sovereign Internet' Law (No. 90-FZ), the 2021 social-media 'self-censorship' law and 'landing law' (No. 236-FZ) on foreign internet companies, the broad 'extremist'/'undesirable' content blocking framework, and the July 2025 amendments penalizing searches for 'extremist' content and VPN promotion.

Russia operates one of the world's most restrictive internet regimes, combining centralized traffic-control infrastructure (DPI, a national DNS) with sweeping content-blocking, platform-liability and surveillance laws administered by Roskomnadzor. Rather than a single online-safety statute, the state uses overlapping censorship laws to block foreign platforms (YouTube, WhatsApp, Telegram features), throttle traffic, ban VPNs, and push users toward the state-controlled MAX messenger. Through 2025-2026 controls escalated sharply, including full blocking of WhatsApp and YouTube in February 2026 and new authority to isolate or reroute traffic from March 2026.

Framework: Federal Law No. 187-FZ 'On the Security of Critical Information Infrastructure of the Russian Federation' (2017, in force 2018), supplemented by Federal Law No. 152-FZ on Personal Data and the GosSOPKA/NKTsKI state incident-response system, with sector rules from the Bank of Russia (FinCERT) and oversight by FSTEC, the FSB and Roskomnadzor.

Russia operates a comprehensive, state-centric cybersecurity regime built around the 2017 Critical Information Infrastructure (CII) Law No. 187-FZ, which mandates protection measures, asset categorization and incident reporting for operators in defence, energy, finance, healthcare, transport, telecoms and other sectors. Incidents are reported through the FSB-run GosSOPKA system and its National Coordination Center for Computer Incidents (NKTsKI), while personal-data breaches must be notified to Roskomnadzor under Law No. 152-FZ. Penalties were sharply increased from 30 May 2025, introducing turnover-based administrative fines and new criminal liability for data leaks.

Framework: Civil Code & Federal Law No. 14-FZ 'On Limited Liability Companies'; Federal Law No. 160-FZ 'On Foreign Investments'; Federal Law No. 57-FZ on strategic-sector FDI screening; and 2022 Presidential Decrees (incl. No. 618) imposing Government Commission approval on transactions involving 'unfriendly-country' persons. Registration is administered by the Federal Tax Service (FNS).

On paper, greenfield company formation in Russia is fast and open: a foreigner can own 100% of a limited liability company (OOO), minimum charter capital is just RUB 10,000, no residence or work permit is required, and the FNS registers a new entity within three business days. In practice, since 2022 investors from countries Russia designates 'unfriendly' (which includes the US, EU, UK and most Western states) face a special regime requiring case-by-case Government Commission approval for acquisitions and many corporate transactions, alongside strategic-sector ownership caps, capital controls, sanctions friction and documented forced seizures of foreign assets. The overall environment for most Western foreigners is therefore heavily restricted, even though formation mechanics for friendly-country nationals remain straightforward.