Russia's cryptocurrency market has operated for years in a gray zone: legal to hold as property since 2020, illegal to use for domestic payments, and rampant as an informal channel for moving money around Western sanctions. On September 1, 2026, that gray zone acquired a licensing regime. Federal Law No. 282-FZ, "On Digital Currencies and Digital Rights," signed by President Putin on August 4, 2026 after passing the State Duma on July 21 and the Federation Council on July 24, puts the Bank of Russia in charge of a new registry of licensed exchanges, brokers, and "digital depositories." Only registry members may legally custody, trade, or settle crypto transactions; existing platforms have until July 1, 2027 to obtain a license.
What the Law Actually Does
The headline restriction is retail-facing: non-qualified investors — the overwhelming majority of Russian crypto users — may buy no more than 300,000 rubles (roughly $3,800–$3,840) worth of cryptocurrency per year through any single licensed intermediary, and only after passing a mandatory knowledge test, according to the Bank of Russia's own announcement. The cap is per-intermediary, not aggregate, so a determined retail investor could in principle spread purchases across several licensed brokers to exceed it in practice. Qualified investors face no ceiling at all.
The Central Bank has also confined retail trading to a short list of assets — initially bitcoin, ether, and USDT — selected against explicit market-cap and liquidity thresholds (Bank of Russia figures cited by the Moscow Times require roughly 5 trillion rubles in market capitalization and 1 trillion rubles in average daily volume), with the Central Bank's board empowered to add others later. Self-custody is tightly gated: individual investors must route withdrawals through foreign custodial accounts, while only companies conducting foreign trade may transfer directly to self-hosted wallets.
The more consequential provision, and the one least covered in initial reporting, sits outside the retail rules entirely. The law gives Russian companies explicit legal authority to use cryptocurrency for cross-border settlement with no equivalent cap — a carve-out that a Russian lawmaker has described plainly as letting firms pay foreign partners while routing around sanctions restrictions, as reported by crypto.news. Domestic crypto payments remain banned outright.
The Case for the Registry
There is a real regulatory logic here, and it deserves to be stated on its own terms before it is criticized. Unregulated crypto exchanges are a documented vector for fraud, and Russia's own retail investor base has limited experience with a notoriously volatile asset class — a mandatory competency test before allowing leveraged exposure is not obviously unreasonable, and several G20 jurisdictions (including the EU under MiCA) now require some form of investor qualification or disclosure before retail crypto access. A licensing registry supervised by a central bank, rather than an outright ban of the kind China imposed in 2021, also keeps a legitimate onshore industry — exchanges, custodians, tax-compliant traders — inside a system regulators can actually see and audit, rather than pushing all activity underground or offshore. Bringing mining, digital-rights issuance, and custody under one statute, as 282-FZ does, is a genuine simplification of what had been a patchwork of ad hoc rulings.
Where the Design Breaks Down
The steelman only extends so far, because the law's asymmetry gives away its actual purpose. A $3,800 annual cap, enforced per-intermediary with a competency test attached, does more to slow ordinary Russians' ability to move savings into a globally liquid, censorship-resistant asset than it does to protect them from fraud — foreign-transfer limits under the same framework run closer to $1,300 a year, per crypto.news' review of the rules. Meanwhile, the same statute hands exporters and importers unlimited, explicitly legal access to the identical asset class for the identical purpose — moving value across a border the ruble increasingly cannot cross cleanly because of sanctions. That is not investor protection; it is a capital-control valve dressed in the language of consumer safety, applied asymmetrically to whichever actor the state finds it convenient to restrict.
The innovation cost is real too. A licensing deadline of July 1, 2027 sounds generous, but a Central Bank that gets to hand-pick which three assets qualify for retail trading — and add more only at its own board's discretion — is not building an open market; it is building a curated one where the regulator, not price discovery or user demand, decides which projects get liquidity. Compare this to jurisdictions like the UAE or Singapore, which license intermediaries without dictating which specific coins citizens may hold. Proportionate regulation targets fraud and systemic risk without also deciding, asset-by-asset, what an adult may buy with their own after-tax money.
The Bottom Line
Russia has not banned crypto; it has nationalized the on-ramp. That is a more sophisticated policy than a blanket prohibition, and it will likely reduce outright fraud on licensed platforms. But a regime that caps citizens at under $4,000 a year while freeing corporations to use the same asset without limit for sanctions-adjacent trade is not primarily protecting retail investors — it is rationing a capital-flight valve while keeping the state's own valve wide open. Regulators elsewhere weighing retail crypto caps should note the difference between a rule that treats all users the same and one that treats the state's counterparties as a separate, unrestricted class.