UNUM at the Crypto Legal Forum: How Crypto Businesses Can Prepare for New Regulations

On October 27, UNUM attended the Crypto Legal Forum at Moscow's Quattro Space. Participants discussed new cryptocurrency market regulations, requirements for exchanges and digital depositories, business preparation for 2027, banking operations, cross-border payments, and asset protection.

How the law changes market rules

Law No. 282-FZ came into effect on September 1, 2026. It regulates the circulation of digital currencies and digital rights, as well as the operations of exchanges, brokers, and digital depositories. Digital currency is not considered a digital financial asset. The forum discussed how crypto businesses can adapt to the new rules: choosing a status, preparing capital, team, and infrastructure.

New admission rules to the Bank of Russia's registers came into effect on October 5. The next day, the regulator announced the first five digital depositories and four exchanges in the registers.

From July 1, 2027, residents who do not organize the circulation of digital currencies themselves will generally be able to conduct transactions only through such market participants or with their involvement. The Bank of Russia also clarified that after this date, direct P2P transactions between individuals are not included in the list of permitted operations without an intermediary.

Within Russia, digital currency cannot be used for payments, but the law allows its use in foreign trade settlements. When purchasing digital currency, an individual needs a positive test result if the operation leads to a change of asset ownership.

What exchanges will need

To exchange digital currencies, a company must be a Russian business entity, have at least 15 million rubles of its own funds, and be included in the Bank of Russia's register. The Central Bank checks the business reputation and qualifications of managers and employees, the company's website, and its infrastructure. The main and backup software and hardware complexes must be located in Russia.

At the forum, Murat Mazukov, a digital lawyer from BestChange, outlined two practical guidelines: "You must have servers in Russia, both main and backup complexes". He advised submitting applications in advance: "Submit your application not on the first of June or even in May... but at least in March".

It should be noted that the Bank of Russia reviews an exchange's application within 30 working days after receiving the last document and may request supporting documents. Therefore, companies should check their document package, ownership structure, and team composition in advance.

The legal nature of the activities of an organization conducting digital currency exchanges is enshrined in Article 18 of Federal Law No. 282-FZ "On Digital Currencies and Digital Rights." According to part 1 of this article, such activity involves the systematic execution of digital currency purchase and sale transactions with clients in its own interest, on its own behalf, and at its own expense. Thus, an organization conducting digital currency exchanges acts as an independent party to the transaction, not as an intermediary acting on behalf of the client. This particularity was noted by Mikhail Iontsev, Head of Projects at the Legal Department of the Bank of Russia: "He does not perform any intermediary functions, he acts only in his own interests... he conducts transactions on his own behalf, at his own expense".

In the same discussion, the issue of a reserve for compensating client losses was raised. It should be distinguished from the requirement for own funds: the minimum of 15 million rubles should not be equated with a separate compensation fund.

Banks, stablecoins, and international transfers

The new rules affect not only access to registers. Companies need to consider bank requirements, the specifics of cross-border payments, and the legal status of stablecoins. Foreign stablecoins, depending on issuance conditions, may be classified as digital currencies or foreign digital instruments, but in both cases, the requirements of Law No. 282-FZ apply. The forum also discussed the digital ruble and banks' work with crypto companies.

Alexander Nam, Head of the DeFi and CFA Research Center at HSE University, explained banks' interest in the crypto market as an effort to retain clients: "The key idea of why banks are entering crypto is to retain their clients". He linked international transfers to the question: "how to make international transfers fast and cheap".

A fast blockchain transfer does not always mean a low total cost: one must consider the purchase and sale of stablecoins, conversion, and fund withdrawal.

Depositories need capital and asset protection

The digital depository accounts for digital currencies and rights, helps transfer them, and provides access to the addresses where they are accounted for. The minimum amount of own funds depends on the services and ranges from 50 million to 250 million rubles. The Bank of Russia may consider an application for inclusion in the register for up to 60 working days.

Alexander Nam compared the role of depositories to that of banks on the international stage: "Digital depositories in Russia are like financial policemen, similar to banks on the international stage." The main technical risk he identified was the loss of keys: "And the main risk is the risk of losing cryptographic keys."

Alexander Nam also estimated the investment in creating a depository at a minimum of 100 million rubles, with an average volume of 300–350 million. This is the speaker's estimate, not the regulatory minimum capital: the Bank of Russia's requirements for own funds range from 50 million to 250 million rubles, depending on the services.

Protecting crypto assets is not limited to storing keys: it is important to also control the signing and sending of transactions. Anton Redozubov, an independent cybersecurity expert, described this feature of the blockchain as follows: "That is, because it is blockchain, we have this feature, there, signing, storing keys, and transaction departure, they should be considered." Companies need to determine in advance who gets access to the keys, how operations are confirmed, and what to do in case of failure.

What the crypto business needs to do by July 1, 2027

Based on the presentations, it can be said that the crypto business needs to complete four steps:

1. Determine which category of market participants the company belongs to and what status it needs.

2. Check own funds, ownership structure, and the qualifications of managers and employees.

3. Prepare documents, primary and backup infrastructure in Russia, as well as procedures for controlling operations and data protection.

4. Review work with clients, banks, and foreign counterparties, including the storage of digital assets.

By July 1, 2027, these changes need to be integrated into daily operations. At the same time, according to Alexander Nam, head of the DeFi and CFA Research Center at HSE, the business model of digital depositories is still being formed: "The business model is still under development at many institutions." Companies will not only have to meet the requirements but also decide on which services their work in the new infrastructure will be based.