Duma approves rules for outsourcing bank customer data processing
Russia's State Duma approved bill 404786-8 in its second and third readings on October 14, setting rules for outsourcing financial information processing, including banking secrets and customers' personal data.
The bill permits transmission without separate customer consent, but the contractor agreement must comply with personal-data legislation. It concerns delegated processing rather than unrestricted disclosure.
Banks may use accredited IT companies and universal-licence banks under Russian control. More than half the voting rights must be controlled directly or indirectly by public authorities or Russian citizens without another nationality. Eligible contractors for nonbank financial organisations depend on the customer's activity.
As a general rule, contractor information systems must be in Russia. The customer must notify the Bank of Russia in advance and submit an operational audit performed by an organisation licensed by FSTEC and/or the FSB. Processing can begin after sixty days if the regulator has not prohibited the contractor's involvement.
A separate arrangement applies to Russian universal-licence banks controlled by foreign banks. Processing through the foreign bank's systems requires approval from the Bank of Russia, FSB and Rosfinmonitoring. The foreign bank must have operated for at least three years, and its regulator must have an information-exchange agreement with Russia's central bank.
Contractors must undergo annual operational audits and provide the results to customers and the regulator. They must notify customers of identified security incidents within two hours. They need designated security personnel, and their chief must have no unspent conviction for economic or computer crimes.
Neither the contractor nor its chief may be a blocked person under Russia's special economic measures law. The central bank may prohibit processing through a noncompliant contractor's systems for up to six months. The rules cover banks, insurers, pension funds, microfinance institutions and other specified financial organisations.
The law would take effect one year after official publication. Existing agreements must be brought into compliance within one hundred and eighty days after commencement, while contractors have a year to perform an audit. Duma approval does not make the rules immediately effective.
