State Duma approves outsourcing of bank customer-data processing

Russia’s State Duma passed a bill in its second and third readings on October 14 allowing financial organisations to outsource the processing of banking secrets and personal data without customers’ consent. The text sets requirements for contractors, system location and central bank oversight.

Banks will be able to use accredited IT companies and universal-licence banks in which more than half of voting rights are under Russian state control or controlled by Russian citizens without another nationality. Other financial organisations may use accredited IT companies and Russian-controlled financial-market participants.

Contractors’ information systems must be located in Russia. Before engaging a provider, a financial organisation must notify the Bank of Russia and submit an operational audit opinion. The auditor must hold a licence from the Federal Service for Technical and Export Control and/or the Federal Security Service.

A separate procedure covers Russian banks controlled by foreign banks. Outsourcing processing to a foreign bank requires approval from the central bank, the Federal Security Service and financial intelligence agency Rosfinmonitoring. The foreign bank must have operated for at least three years, and the central bank must have an information-sharing agreement with the relevant foreign regulator. The arrangement must not threaten Russian banking stability.

Contractors must protect the information they receive and are liable for disclosure. Removing the requirement for customer consent does not remove the obligation for provider contracts to comply with personal-data law.

Bill number 404786-8 was introduced in July 2023 and passed its first reading that November. The adopted text provides for the rules to take effect one year after official publication.