Russia (RU)

Russia's payment market is governed by the Federal Law 'On the National Payment System' (161-FZ), which defines money transfer operators, e-money operators, payment system operators and payment infrastructure service operators. The Bank of Russia licenses credit institutions and non-bank credit organisations that provide funds-transfer services; MinFin and the CBR jointly regulate non-bank PSPs, creating jurisdictional overlap. NSPK, wholly owned by the CBR, operates the Mir card scheme (est. under a May 2017 law) and clears domestic transactions for foreign card schemes.

Consumer/conduct supervision sits with the Bank of Russia's Service for Consumer Protection and Financial Inclusion, which handles reactive complaint-driven supervision and proactive identification of unfair market practices (mis-selling, misinformation on fees/yields). Enforcement is intensifying: the CBR is developing a bill to raise fines for consumer-rights violations (proposed at 0.1-1% of a credit institution's capital) and has publicly pressed banks over slow complaint handling and inadequate explanations for blocked transactions.

The digital ruble is Russia's CBDC, piloted since August 2023 and mandated for mass rollout from 1 September 2026 for systemically important banks and large retailers, with staged deadlines out to 2028 for smaller institutions. It is designed as a third form of the national currency alongside cash and non-cash rubles, delivered via a universal NPCS-operated QR code. Separately, the 2020 Digital Financial Assets law (259-FZ) legalises crypto-asset circulation but bars crypto as domestic payment; a 2024 amendment and subsequent experimental legal regimes permit crypto use in cross-border trade settlement under CBR/Rosfinmonitoring supervision, a policy directly linked to sanctions evasion.

Financial-sector operational resilience sits within Russia's Critical Information Infrastructure (CII) regime under Federal Law 187-FZ (2017, in force since Jan 2018), which lists banking and other financial-market areas among protected CII sectors. Compliance is enforced through GosSOPKA, the FSB-run detection/prevention system coordinated via the National Computer Incident Coordination Center (NKTsKI/FinCERT for the financial sector), with new administrative fines (up to ₽500,000) introduced in March 2026 and an expanded, ~400-item industry CII object list approved in February 2026.

Mir, operated by CBR-owned NSPK, is the mandated domestic card scheme for budget employees, pensioners and (since October 2022) mobilised servicemen, and now underpins the great majority of domestic card volume following Visa/Mastercard's 2022 withdrawal. A single, NPCS-operated 'universal QR code' is being legislated as the sole non-card QR standard (draft law 811008-8), displacing a rival bank-led consortium (Sberbank/Alfa-Bank/TBank's 'Fintech Platform') that had proposed its own unified QR solution.

Russia's principal cross-border rails are SPFS (CBR's SWIFT-message alternative), a growing dependence on China's CIPS/UnionPay for RMB-denominated trade, and BRICS Pay as a nascent multilateral project still in pilot stage. Corridors are increasingly constrained by secondary-sanctions risk: Chinese banks have progressively restricted RMB processing for sanctioned Russian counterparties, and OFAC has formally flagged SPFS membership as a sanctions-designation risk for foreign banks. Mir's own international acceptance remains narrow (Armenia and breakaway Georgian territories in full; partial in Turkey, Kyrgyzstan, Uzbekistan and Kazakhstan via VTB).

The Russian payments/banking market is highly concentrated around Sberbank, VTB and TBank (Tinkoff), which dominate both card issuance/acquiring and increasingly cooperate on shared infrastructure (e.g. the Fintech Platform LLC QR joint venture). The independent electronic-payment-systems and aggregator segment (excluding NSPK/SBP) is itself concentrated, with the top five firms holding over 90% share, and continues to grow at a roughly 25% CAGR.

Bank-license revocation remains the CBR's primary enforcement tool against payments-adjacent misconduct (AML/CFT breaches, technical/shell-company exposure), exercised under the Banking Legislation framework (Bank of Russia Law, Insolvency Law 40-FZ/127-FZ) with DIA-administered temporary administration and depositor payout. In parallel, the US Treasury/OFAC has progressively designated Russian banks (including Gazprombank and 50+ internationally-connected banks) and flagged SPFS membership as a sanctions-risk vector, materially shaping the correspondent-banking and litigation-exposure landscape facing Russian payment institutions.

Merchant acquiring is concentrated among Sberbank, VTB, Alfa-Bank and TBank, with Sberbank ranked among Europe's largest acquirers by transaction volume. Interchange-driven commission compression has pushed internet-acquiring rates toward ~1% at major banks, while marketplace-driven e-wallet volumes and QR/biometric payment volumes are both growing rapidly, reflecting a shift of acquiring risk and volume toward digital/marketplace rails.

Product development is centred on the digital ruble/universal-QR-code rollout, the mature Faster Payments System (SBP), and rapid growth in embedded/BNPL credit and marketplace-linked loyalty-payment products (e.g. Orange Pay). A Tatarstan regional pilot has tested CBDC smart-contract functionality for conditional public-fund disbursement, indicating a programmability use case beyond simple retail payments.

Under Article 8(3.13) of the NPS Law (161-FZ), banks are financially liable to individual clients for improperly implemented anti-fraud measures where payment details match the CBR's authorised-fraud database, though the law's direct reimbursement impact remains small relative to bank-initiated voluntary reimbursements. Fraud volumes are large and rising (telecom/social-engineering scams causing tens of thousands of daily victims), prompting a 2025-2026 legislative package (state anti-fraud information system, SIM-card controls, marketing-call limits) and CBR pressure on banks over complaint-handling delays and transaction-blocking transparency.

Sentinel.gi payments-context position: Rosfinmonitoring (FSFM) remains Russia's central AML/CFT authority under Federal Law 115-FZ, reporting directly to the President and retaining recognition within the Eurasian Group (EAG) despite its FATF and Egmont Group membership being suspended in 2023. FATF has specifically flagged Russia's virtual-asset/crypto-intermediary regulation as a compliance gap (Recommendation 15 downgraded to 'Partially Compliant'), and domestic AML enforcement has already produced a payments-relevant licence revocation (Qiwi Bank, Feb 2024) tied to crypto-exchange and illegal-gambling transfers.

Correspondent-banking access for Russian institutions has been progressively curtailed by Western sanctions (Gazprombank and 50+ banks designated by OFAC in Nov 2024) and by de-risking behaviour among Chinese banks, which have restricted RMB settlement for sanctioned Russian counterparties over secondary-sanctions exposure. SPFS remains the domestic financial-messaging alternative to SWIFT but has limited genuine international reach, with OFAC formally warning that foreign-bank membership itself now carries designation risk -- pushing Russian banks like VTB toward direct bilateral trade-finance arrangements with 'friendly' jurisdictions.

Within the trailing 12 months, Russian payments commercial activity has centred on bank-led infrastructure joint ventures and marketplace/loyalty-payment product launches rather than conventional M&A or external venture funding, reflecting the isolation of the domestic fintech investment market from global capital flows (overall Russian startup funding fell sharply year-on-year through early 2026).