Adversary Intelligence — 2026-11-05

Russia's FSB to Gain Round-the-Clock SORM Access to All Crypto Exchange Customer Data Including Wallet Keys and Correspondence Starting March 2027

BLUFCustodial key access, if retained in the final regulation, would give the FSB the ability to seize rather than merely surveil client crypto assets, driving security-conscious users off licensed Russian platforms entirely.

Russia's Central Bank rejected industry requests to limit FSB access, according to its comments on the federal law "On Digital Currencies and Digital Rights," which Roskomsvoboda co-founder Sarkis Darbinyan flagged on November 3 123. From March 1, 2027, exchanges and exchangers must give the FSB round-the-clock SORM access to customer names, passport and tax numbers, wallet addresses, IP logins and platform correspondence, stored on Russian servers 23. The Association of Banks of Russia asked that private keys and transaction-signing tools be excluded; the Central Bank refused, saying the approach was agreed with the FSB 23. Crypto Economy reports the access extends to custodial wallet keys and that a 2028 delay request was also refused 4. Operators get 45 days to notify the FSB, 45 more for a plan, and up to 15 months to commission equipment; The Insider adds that non-compliant firms may be removed from the registry 23.

Analysis
The Central Bank's refusal to narrow SORM scope means Russian exchanges must build FSB-readable infrastructure before they can hold a license under the July 2027 intermediary-only regime, and small operators get no simplified track. Russia has thus extended the telecom SORM identity-resolution model to crypto, and the Central Bank appears to treat the FSB's terms as fixed, so the March 1 date is the next signal to watch. If final text confirms custodial wallet-key access, the FSB could move or freeze client assets, not just observe them, removing any reason to hold balances on licensed platforms. Confidence is low: iStories is the only original report, the other outlets amplify it, and the Central Bank has not published the final document. Only Crypto Economy reports the key-access and 2028 delay details, and the key language may simply refuse a carve-out, leaving the FSB's real reach to implementing text.

5 sources