Russian banks will have to connect to operational-search surveillance systems and retain client correspondence in banking apps, RBC reported, citing sources. According to the outlet, credit institutions have been told to install SORM by 2027 — hardware and software systems that allow security agencies to remotely access data on users’ calls, SMS messages, and internet traffic.
RBC says the demand is tied to the legal status of an organizer of information dissemination. Under current rules, such services must keep metadata on message transmissions and user details for one year, and the contents of correspondence, audio, video, and files for six months, providing that information to the FSB upon request. From 2026, the mandatory retention period is set to increase to three years.
RBC did not specify which banks received the order. At the same time, the register of such entities has previously included Sberbank Online, T-Bank resources, and Moscow Credit Bank. According to RBC, the security services’ letter requires banks to develop procedures for interaction with the FSB, appoint a responsible official, and install equipment with remote-access capability.
“After banks, this rule will spread to all remaining platforms that are not yet connected to the FSB system,” cyber lawyer Sarkis Darbinyan told Novaya Gazeta Europe.
In his view, the measure will make it easier for the security service to obtain data in real time, although banks already hand over information in response to separate requests. Lawyer Anastasia Burakova told the publication she sees no fundamentally new element in the measure and links it to the authorities’ attempts to combat phone fraud.
Darbinyan also warned that metadata and messages in bank chats could give the FSB an additional real-time picture of user interactions without a court request, even though account details formally remain protected by banking secrecy. He said major bloggers and content creators using the Russian banking system should be particularly cautious.
The expert believes banks may try to delay implementation. However, a law adopted in Russia in July increased penalties for failing to install SORM by ten times: companies now face turnover-based fines of 0.001–0.003% of annual revenue, but no less than 1 million rubles, as well as possible suspension of operations for up to 90 days.