Only What Is Permitted: Inside Russia's 2026 Digital-Currency Law and the Walled-Off Crypto Market It Creates

On September 1, 2026, the Russian federal law "On Digital Currency and Digital Rights" entered into force, and the official narrative around it was reassuringly simple: the document finally makes buying cryptocurrency legal and gives investors a lawful way to trade it on Russian exchanges. The reality is more paradoxical. Buying bitcoin in Russia was never a crime: digital currency has been recognised as property since 2020, and only its use as a means of payment inside the country is prohibited. A citizen who bought coins on a foreign platform or from a private seller broke no law, provided the income was declared. What the new statute changes is not legality itself but its source: it converts what was lawful by default into what is lawful by permission. That single inversion, from "everything that is not forbidden is allowed" to "only what is permitted is allowed", is the key to the entire architecture of the new market, and the reason a law presented as liberalisation reads, clause by clause, like the blueprint of a walled garden. Yuri Brisov, a partner at Digital & Analogue Partners and a lawyer specialising in digital-asset regulation, unpacks this architecture in a longread for Forbes Russia, and his conclusion is uncomfortable for both regulators and holders: the law and the sanctions regime, acting from opposite shores, are jointly demolishing the uncontrolled crypto economy that sanctions themselves helped to build.

A law that legalised nothing

The first thing to understand about the statute is that it does not introduce lawful purchase of cryptocurrency, because lawful purchase already existed. The 2020 recognition of digital currency as property gave holders a civil-law status for their coins; the ban on domestic payments kept those coins out of the till but not out of the portfolio. Declarations and taxes did the rest. The new law adds no right. It adds a gate. From now on the legitimacy of a transaction will depend less on its substance than on the licence status of the intermediary through which it passes, and from July 1, 2027 the gate becomes a wall: any deal concluded outside a licensed intermediary will be a violation for both sides of the trade, the seller and the buyer alike.

This is a profound shift in legal philosophy. A permission-based regime forces every participant to prove that his specific action is on the list, and anything not yet listed defaults to prohibited. For a technology sector, where products and practices evolve faster than regulators can draft, such a regime acts as a permanent injunction against innovation: the safest business plan becomes waiting for the next instruction. Brisov's phrase for the transition is blunt — the law turned the lawful-by-default into the lawful-by-permission, and everything that follows from that sentence is a footnote.

The architecture of the licensed perimeter

The perimeter is assembled from several interlocking components, and each of them narrows the space of possible actions for an ordinary holder:

• Intermediation. Buying and selling digital currency will be possible only through licensed intermediaries from the Bank of Russia registry: exchangers, brokers and asset managers. The registry is both a whitelist and, in sanction terms, a ready-made address list.
• The listing filter. Organised exchange trading admits only assets with an average capitalisation above 5 trillion rubles over two years, an average daily trading volume above 1 trillion rubles and a five-year exchange history. Bitcoin and ether clear these thresholds comfortably; almost everything else does not.
• Custody. Coins admitted to the Russian market must be stored in a digital depositary. Withdrawal outside the national infrastructure is permitted only to an account at a licensed foreign organisation, and the central bank retains the right to restrict withdrawals up to a complete block of operations.
• Retail guardrails. Non-qualified investors face mandatory testing and an annual purchase limit. Crypto lending without a Russian intermediary is prohibited for all currency residents, no matter where the deal is booked.
• The enforcement ramp. From September 1, 2026 banks may block transfers to services named on the Rosfinmonitoring list. From July 1, 2027 the entire off-perimeter market becomes an offence.

Equally telling is what the text omits. There is no route for withdrawing coins to one's own non-custodial wallet. Self-custody is not outlawed in so many words — no direct prohibition exists — but the depositary may execute transfers only to organisations on the permitted list, and a personal wallet is not an organisation. The door is not locked; it simply is not built.

The global transparency trend, and two ways to ride it

Embedding crypto into the regulated economy is not a Russian invention, and the motivations behind it are legitimate: anti-money-laundering, tax compliance and counter-terrorist financing. The Financial Action Task Force extended its standards to virtual assets back in 2018–2019. The Organisation for Economic Co-operation and Development adopted the CARF reporting standard for crypto-assets, joined by 76 jurisdictions, with the first automatic exchange of data scheduled for 2027. In the European Union the DAC8 directive has applied since January 1, 2026, obliging every platform to identify its European users and report their operations to tax authorities. Transparency, in short, is a global trend. The divergence lies in what regulators do with it.

The American three-tier model

The United States built its regime in three layers. The first is statute: the GENIUS Act, signed on July 18, 2025, became the first federal digital-asset law in American history and regulated exactly one instrument — payment stablecoins. Only licensed issuers, bank subsidiaries or licensed non-bank companies, may mint them; each token is backed one-to-one by dollars or short-term treasury obligations; the reserve composition is disclosed monthly; the holder may redeem at par; and paying interest on such tokens is forbidden. In exchange, payment stablecoins are removed from securities legislation. Congress tightly regulated the one instrument that touches the payment system and the status of the dollar, and left the rest of the ecosystem alone.

The second layer is executive order. The January 2025 order declared digital assets a national priority, barred federal agencies from creating a government digital currency and instructed regulators to draft comprehensible rules; the March order created a strategic bitcoin reserve, under which coins confiscated by the state are stored as a reserve asset instead of being auctioned off. The third layer is what lawyers call soft law: on March 17, 2026 the Securities and Exchange Commission and the Commodity Futures Trading Commission split tokens into five categories, from digital commodities to digital securities, assigning different assets to different supervisors. Enforcement, meanwhile, remains ferocious and runs on the principle of substance over form: prosecutors look at what actually happens, not at the label on the wrapper.

The world model is thus control of violations: crime is pursued, circulation stays free. The Russian edition is control of everything: outside the licensed form, the entire crypto circulation becomes unlawful. Both systems claim the same goals; they differ in the default state of a citizen's freedom.

The criminal vertical

Permission regimes need teeth, and the teeth arrived early. Since March 3, 2026 cryptocurrency can be arrested and seized in criminal proceedings: Federal Law No. 38-FZ recognised digital currency as property for the purposes of the criminal and criminal-procedure codes, and the new Article 164.2 of the Code of Criminal Procedure describes seizing the key-bearing medium and transferring the coins to a special state address identifier. The government then tabled a package covering the whole vertical of circulation: criminal liability for organising digital-currency circulation without a central-bank licence, under Article 171.7 of the Criminal Code with up to seven years of imprisonment and a fine of up to 1 million rubles; criminal liability for illegal mining under Article 171.6; and administrative liability for intermediaries dealing with non-qualified investors outside the rules. All of these provisions switch on together with the full off-perimeter ban on July 1, 2027.

Why such a design? In January 2022 the Bank of Russia published a report proposing to prohibit the issuance, circulation and mining of cryptocurrencies outright. Sanctions, the disconnection from SWIFT and the acute need for alternative settlement channels with foreign counterparties intervened, and the regulator's doctrine shifted from "destroy" to "subordinate". The final compromise written into the law shows who received what:

• The Bank of Russia obtained supervision: the registry, the filters, the limits and the right to block.
• The Ministry of Finance obtained a tax base.
• Investigators obtained a workable confiscation mechanism.
• Exporters, surprisingly, obtained the right to settle foreign-trade contracts in cryptocurrency without any special permits — on paper, the only unambiguously winning party.

In another era this would simply be a harsh law, harsher than the European one but in the same logic. Under sanctions it becomes destructive for the domestic market, because it exposes the entire crypto circulation — industrial miners, foreign-trade businesses, private savers and even the favoured exporters — to a double squeeze.

Three markets inside one country

From the outside the Russian crypto market looks mature. By estimates of the Ministry of Finance and the central bank, around 20 million Russians use cryptocurrencies, and a deputy finance minister put the turnover in February at roughly 50 billion rubles a day — more than 10 trillion rubles a year, in his own words, "outside the regulated zone". Look closer, and one market resolves into three, with different participants and different stakes.

The industrial market

Russia holds second place in the world for mining after the United States: about 16 percent of global hashrate, some 26,000 bitcoins mined in 2025 worth around 2.2 billion dollars, installed capacity of 2.3 to 2.7 gigawatts, roughly one and a half percent of national electricity consumption. Yet by industry estimates only a third of miners are entered in the state registry. The remaining two thirds are precisely the audience of the draft Article 171.6 on illegal mining.

The settlement market

Since 2022 companies have used cryptocurrency to pay foreign counterparties, and since September 2024 experimental legal regimes let participants not only pay but also receive crypto inside the country, something the law on digital financial assets otherwise forbids. For an economy cut off from dollar correspondent accounts, this is the only payment channel that reliably works.

The savings market

The mass market is the savings one. Chainalysis, in its geography-of-crypto report, calls Russia the largest crypto market in Europe, with 376.3 billion dollars of turnover from July 2024 to June 2025, up 48 percent year on year; the United Kingdom ranks second with 273.2 billion dollars. This is not a creature of the sanctions era: as early as January 2022, Bloomberg sources inside the Russian government estimated citizens' crypto holdings at 214 billion dollars. Sanctions merely explained to everyone why it was needed. Cryptocurrency remained the only major asset beyond the reach of both Western and Russian infrastructure — an island of relative financial independence.

That island has a specific technical property. An ordinary wallet executes no court orders; it executes cryptography. It cannot be frozen remotely, disconnected from SWIFT, redenominated or debited by direct collection. Brisov compares it to the treasure of Abbe Faria in "The Count of Monte Cristo": the abbot himself can be held in the Chateau d'If for life, but his treasure stays intact and may yet reach Edmond Dantes. Exactly this property made crypto a splinter in the regulator's eye, and exactly this property explains the statistics of the past two years: Chainalysis records an eightfold rise in Russians' decentralised operations in early 2025, while the central bank watches outflows from centralised venues such as Bybit and OKX. People move to where there is no intermediary that can be closed, hacked or sanctioned.

How grey rails dragged sanctions onto an entire sector

The freedom of self-custody had an unsightly side. The same infrastructure that preserved private savings was used to circumvent sanctions, and eventually pulled sanctions onto the whole market. The Moscow-based exchange Garantex was sanctioned by the United States back in 2022 and forcibly shut down by American law enforcement in March 2025. Its place was instantly taken by Grinex, registered in Kyrgyzstan, the main venue for the ruble stablecoin A7A5 backed by deposits at the sanctioned Promsvyazbank. According to Chainalysis, about 120 billion dollars passed through this pair; A7A5 became the largest non-dollar stablecoin in the world and, by its project head's account, carries around 10 percent of Russian foreign-trade settlements. Since August 2025 A7A5 and related companies sit under American, British and European sanctions. Russian banks began planting friendly or controlled structures in neighbouring jurisdictions, including Belarus and Kyrgyzstan, where sanction pressure arrives with a lag.

Then Brussels stopped aiming at individual companies. The EU's 20th sanctions package, adopted in spring 2026, introduced a sectoral prohibition: from May 24, European persons are barred from any direct or indirect operations with crypto services incorporated in Russia, explicitly including ruble stablecoins and the digital ruble. On June 9 the European Commission presented the 21st package, proposing to list about a dozen crypto platforms, including ones from third countries, and introducing for the first time a mechanism for a full ban on crypto services of third-country platforms that help evade sanctions. The outcome is disproportionate to the cause: grey schemes of a few infrastructures produced restrictions against the entire Russian crypto sector, and the bill will be paid also by investors who never held A7A5 in their lives.

A bridge built into a sanctions wall

Sanctions and the new Russian crypto law now operate simultaneously, and their interaction is the cruelest part of the design. The law drives all circulation into the licensed perimeter of Russian intermediaries; sanctions make those intermediaries toxic at the moment of creation, because a licensed exchanger from the central-bank registry is, in European sanction law, a "crypto service incorporated in Russia", operations with which are prohibited. The national registry of licensed platforms is a ready-made target list for future designations by OFAC and Brussels. The law permits withdrawal only to a "licensed foreign organisation", which immediately finds itself in the crosshairs. The bridge that Russian legislation builds outward is demolished by sanctions from the opposite bank.

For a private holder everything reduces to the question of which door not to enter. Buying bitcoin for rubles through a licensed intermediary will be possible even inside a major bank's app; the question is where to put the coin afterwards. The statute offers two rooms: a Russian depositary, or an account at a licensed foreign organisation. The result is a third isolated market in the country, after the equity market, where the Moscow Exchange has been cut off from global capital since 2022 and prices live their own life, and the currency market, where the rate is assembled from cross-rates through the yuan. With one difference: for stocks and currency, isolation removed efficiency; for cryptocurrency, isolation removes meaning. The only point of crypto is decentralisation and borderlessness. A crypto asset stripped of self-custody, free withdrawal and global liquidity becomes a bad security, just as a kickboxer forbidden to kick becomes a bad boxer.

The picture that emerges was planned by neither side as a joint work, yet that is what it is. The EU and the Russian central bank, without collusion, produce one result: the disappearance of uncontrolled Russian crypto circulation. The motives are opposite — Brussels and Washington close access from outside so that money does not flow past sanctions; Moscow locks it from inside so that money does not flow past the state — but for the holder the outcome is identical. The space in which cryptocurrency remained an asset of full personal control shrinks like shagreen leather. Sanction regulation cuts off global infrastructure; national law takes away the personal wallet. Ownership without intermediaries is still not prohibited, yet its holders remain outside legal protection and outside infrastructure, becoming something like crypto-Robinsons on an island that has turned uninhabited.

The purgatory of the transition period

Until July 1, 2027 purchases remain in a transitional mode. Peer-to-peer deals and foreign platforms are formally not prohibited, but the space compresses from both sides: from within, by Rosfinmonitoring lists and bank blockings; from without, by sanctions under which European services have been barred from serving Russian residents since October 2022. From September 1, 2026 the regulated channel opens — bitcoin and ether through a registry intermediary, with testing and limits for non-qualified investors — and derivatives already exist: in summer 2025 the Moscow Exchange launched a bitcoin futures contract, followed by an ether one. After July 1, 2027 the choice hardens into a binary: a licensed intermediary, or a violation.

None of this structural engineering protects a bitcoin owner from bitcoin's ability to lose half its price in a quarter; inside the central-bank registry the coin will do this as diligently as on any offshore venue. Nor does it protect against theft — rather the opposite, since the new architecture concentrates the assets of millions in a depositary and a handful of intermediaries. Sanction risk becomes personal: a single transaction with a tainted counterparty is enough to close a wallet's access to global liquidity. And legal certainty, the main product any licence is supposed to sell, is not on offer yet: the rules change in motion, and an operation lawful in 2026 becomes an offence in 2027.

The choice of custody form thus becomes a choice of position. Licensed infrastructure does bring protection of rights, inheritance — the law for the first time describes how cryptocurrency passes to heirs through intermediaries — and tax transparency. The price is that rights to cryptocurrency turn into claims against an intermediary, with all its limits and potential blocks. Returning to the allegory of "The Count of Monte Cristo", the state proposes to hand the map of the treasure island to a depositary: inventoried, with a visit quota, and with the keeper entitled to close the island to you personally. Whether such a treasure is worth having is a question each holder now answers alone.