The State Duma has adopted a bill in its second and third readings that allows Russian banks to outsource the processing of client data, including banking secrecy and personal information, to external IT contractors and cloud providers without obtaining separate client consent.
Under the new rules, banks may engage only accredited IT companies and banks with a universal license that satisfy requirements for Russian control. All servers must be located within Russia. Financial institutions are required to notify the Central Bank of Russia in advance about any planned engagement of such contractors.
Contractors themselves must pass an audit conducted by organizations holding licenses from FSTEC or FSB Russia. The legislation establishes liability for the protection of received information and for any unauthorized disclosure.
A separate procedure applies to Russian banks under foreign control. Such institutions may transfer data processing to foreign banks only after obtaining approvals from the Central Bank, FSB, and Rosfinmonitoring and after meeting additional conditions.
The core principle for clients remains unchanged: explicit consent for outsourcing is not required. Banking secrecy continues to apply, yet additional authorized participants may now handle the data under regulated safeguards.
