From blocking users to defunding infrastructure
On June 26, 2026, President Vladimir Putin signed Federal Law No. 210-FZ, "On Amendments to the Federal Law 'On Communications' and Certain Legislative Acts of the Russian Federation," known colloquially as Antifrod-2.0 after the State Duma passed it on June 9 and the Federation Council approved it on June 17 (publication.pravo.gov.ru). Buried inside a broader anti-fraud package covering SIM-card registration limits, a Gosuslugi "panic button" for scam reports, and mandatory labeling of international calls, the law adds a new Article 10.2-1 to the Communications Law that bars Russian hosting providers from supplying server or computing capacity to the owners of websites, apps, or information systems that give users access to content blocked in Russia — a category that functionally means VPN and proxy services (Kommersant).
This is a structurally different intervention than anything Roskomnadzor has tried before. Since 2019, the regulator has relied on TSPU deep-packet-inspection boxes installed at the ISP level to throttle or block VPN traffic protocol-by-protocol, and by February 2026 it had confirmed blocking 469 individual VPN services, according to Human Rights Watch (HRW). That approach treats VPNs as a whack-a-mole problem: block one protocol, another appears. Antifrod-2.0 instead reclassifies domestic hosting companies as compliance gatekeepers, requiring them to check clients against Roskomnadzor blacklists and cut off anyone found operating a circumvention tool, whether or not the VPN itself is based in Russia's jurisdiction. It is the logical extension of SORM — the decades-old System for Operative Investigative Activities that already obligates telecoms operators to give the FSB direct access to traffic — pushed one layer down the stack, from the pipes to the racks.
The case regulators will make
It is worth stating the strongest version of the government's argument, because it isn't purely pretextual. Antifrod-2.0 is bundled with genuinely popular consumer-protection measures: caps on how many bank cards or SIM cards one person can register, mandatory disclosure that a call originates abroad, and a fast-track reporting channel for phone and internet fraud victims. Russia, like many countries, has a real telecom-fraud problem, and grafting VPN restrictions onto a fraud bill lets the Kremlin argue it is closing a loophole scammers already exploit — foreign-hosted infrastructure that sits outside Roskomnadzor's normal blocking toolkit. Digital Development Minister Maksut Shadayev has separately framed the VPN push as a response to foreign platforms' unwillingness to negotiate legal compliance with Russian authorities, not censorship for its own sake (The Moscow Times). A government can reasonably want visibility into infrastructure used to commit fraud, and hosting providers already sit under KYC-style obligations in most jurisdictions.
That argument collapses on contact with how the law is actually built. It does not distinguish between a VPN operator laundering fraud proceeds and a VPN operator selling privacy tools to ordinary Russians who want to reach an independent news outlet or a foreign banking app. The trigger for a hosting ban is simply providing "access to information resources restricted in the Russian Federation" — a category Roskomnadzor itself controls and has expanded aggressively, from Telegram to WhatsApp to independent media. A fraud-prevention statute that defines its target by reference to the censor's blocklist is not a fraud-prevention statute; it is a censorship statute wearing a consumer-protection label.
Who actually pays
The compliance burden falls hardest on small and mid-size Russian hosting companies, not on VPN providers themselves, most of which are already headquartered abroad and beyond Moscow's direct reach. Industry executives told Kommersant that database-integration requirements with Roskomnadzor blacklists will raise hosting costs by 30% or more on top of price increases already driven by VAT hikes and existing SORM equipment mandates, and that smaller providers currently lack the detection tooling to comply at all (Kommersant). RUVDS chief executive Nikita Tsaplin was blunter still, predicting the rules will simply push costs onto ordinary customers. The law effectively deputizes a competitive, cost-sensitive industry into unpaid surveillance labor, with nonconforming firms risking exclusion from the legal hosting market altogether — a form of market consolidation that conveniently favors the largest, most state-adjacent providers who can absorb compliance costs.
The timing compounds the effect. Antifrod-2.0 lands on top of an already-aggressive 2026 crackdown: major platforms including Ozon and Kinopoisk began blocking VPN-enabled users in April at the Digital Development Ministry's direction, and Roskomnadzor has stated a goal of blocking 92% of VPN application traffic by 2030, backed by roughly 20 billion rubles a year in dedicated infrastructure spending (TechRadar). Layering an infrastructure-level hosting ban on top of protocol-level blocking and application-level restrictions is not a fraud fix — it's a third, mutually reinforcing front in a single campaign to make circumvention technically and commercially unsustainable inside Russia's borders.
The proportionality problem
A narrowly drawn rule requiring hosting providers to report infrastructure that a court has found is being used for fraud would be defensible consumer protection. What Antifrod-2.0 actually does is make ordinary encrypted-tunnel technology — used by millions of Russians simply to reach services blocked by executive fiat — legally indistinguishable from fraud infrastructure, and it forces private companies to make that determination on Roskomnadzor's say-so, with no judicial review specified in the statute. Effective dates are staggered through September 2027, giving the state room to phase in enforcement gradually while the hosting sector consolidates around whichever providers are most willing to comply. For a government insisting VPN use remains technically legal in Russia, criminalizing the infrastructure that makes VPNs work is a distinction without a difference.