Russia’s first comprehensive crypto-market statute — Law No. 1194918-8, “On Digital Currency and Digital Rights” — takes effect on September 1, 2026, and the Bank of Russia’s July 28 draft rules for “organised trading” turn a four-year prohibition posture into a licensed exchange-and-depository regime, while keeping the domestic-payments ban fully intact.

The State Duma passed the law in its second and third readings on July 21, 2026, the Federation Council approved it on July 24, and the central bank published implementing draft regulations four days later, per The Block and CoinDesk. The timing is not incidental: the drafts landed four days after the EU’s 21st sanctions package designated 14 crypto firms, including the A7 stablecoin network. This analysis walks through what the law and the draft rules actually require, how the regime compares with the EU, US and UK frameworks, what the Garantex prosecution means for the sanctions overlay, and what compliant firms should be watching before September 1.

Methodology and sources

This analysis draws on reporting of the primary texts — Law No. 1194918-8 as passed on July 21, 2026 and the Bank of Russia’s July 28 draft regulations on organised trading and digital depositories — via The Block, CoinDesk and Crypto.News, together with the US Department of Justice’s Garantex indictment (Eastern District of Virginia, unsealed March 2025) and statements on the record from State Duma Financial Markets Committee Chair Anatoly Aksakov and Bank of Russia Governor Elvira Nabiullina. The window is July 20–30, 2026; jurisdictional scope covers Russia, the EU, the US and the UK. Caveat: the central bank’s drafts remain in public assessment and can change before adoption; ruble conversions are at late-July 2026 rates.

What the law and the draft rules actually say

The statute does three structural things. First, it recognises digital currency and digital rights as property, giving holders standing in bankruptcy, divorce and inheritance cases — a prerequisite for any custody or exchange business that must book client assets. Second, it creates a legal category of regulated retail crypto trading through authorised venues, with a two-tier investor regime: non-qualified investors face a 300,000-ruble annual purchase cap and a 100,000-ruble overseas transfer limit, while qualified investors receive ceilings of 3 million and 1 million rubles respectively. Third, it preserves the flat prohibition on using cryptocurrency for domestic payments, salaries or commercial settlement inside Russia, while explicitly permitting digital assets in cross-border trade through regulated channels — the continuation of the sanctions-era experimental legal regime for external settlement.

The Bank of Russia’s July 28 drafts supply the market infrastructure. Exchanges must adopt internal trading rulebooks and calculate market prices and weighted-average prices for listed digital assets, extending the methodology used for securities. A new licence class of “digital depositories” — record-keepers for cryptocurrency and digital rights operating on securities-depository principles, entered in a central bank register — carries tiered equity requirements: 250 million rubles for depositories providing post-trade settlement, 100 million for firms that control crypto addresses directly or hold assets with foreign custodians, and 50 million for the rest, with capital required to be liquid and of central-bank-grade credit quality. Electronic platform operators settling through nominal accounts face similar thresholds. The package, in short, imports the architecture of Russia’s securities market — venue rulebooks, depositories, registers, disclosure — onto crypto rails.

How four jurisdictions now compare

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Penalty / sanction
Russia (Bank of Russia)	September 1, 2026 (Law No. 1194918-8)	Exchanges, digital depositories, platform operators, retail investors	Venue rulebooks and price calculation; depository capital of 50–250m rubles; retail caps of 300,000 rubles/year (non-qualified)	Domestic crypto payments prohibited; unlicensed operation outside the register
EU (ESMA / national authorities under MiCA)	Full application December 30, 2024 (Regulation (EU) 2023/1114)	CASPs, ART/EMT issuers across 27 member states	CASP authorisation (Article 59); stablecoin issuer authorisation; non-compliant stablecoins delisted from licensed venues	Member-state maximum fines of no less than €5 million, rising to 12.5% of turnover for issuer breaches (Article 111)
US (DOJ / OFAC / FinCEN)	Enforcement-led; IEEPA and BSA in force	Exchanges touching US persons or dollar rails, wherever located	OFAC sanctions compliance; money-services-business licensing; KYC under the BSA	Garantex case: money-laundering conspiracy (20 years max), IEEPA conspiracy (20 years), unlicensed MSB (5 years)
UK (FCA)	Financial promotions regime from October 8, 2023	Any firm promoting cryptoassets to UK consumers	Registration under the Money Laundering Regulations; promotions approved under s21 FSMA	Illegal promotion is a criminal offence carrying up to two years’ imprisonment

Sources: The Block and CoinDesk (Russia, July 28, 2026); Regulation (EU) 2023/1114; US DOJ Garantex indictment (E.D. Va., March 2025); FCA PS23/6. Last updated July 30, 2026.

The divergence is architectural. The EU regulates the instrument and the service provider through MiCA authorisation, and its licensed-venue perimeter is already reshaping behaviour — Binance reports 70% of its EU users moved to self-custody after MiCA took hold. The US regulates the dollar and the sanctions perimeter, reaching any venue that touches US persons regardless of domicile. The UK regulates the marketing channel. Russia’s new regime regulates the market infrastructure itself — venues, depositories, registers — while walling crypto off from the domestic payments system entirely. The regulatory-arbitrage risk is equally structural: a Russian-licensed venue that is simultaneously sanctioned by the EU or US is a legal entity in one system and a designated target in the other, and the A7 designation four days before the central bank’s drafts shows both regimes expanding toward the same infrastructure from opposite directions.

“And tomorrow, July 21, we will adopt the law in the second and third readings, aimed at creating legal conditions for the functioning of cryptocurrencies in our country.”

— Anatoly Aksakov, Chair, State Duma Committee on Financial Markets
(Crypto.News)

Enforcement context: the Garantex precedent

The case that frames every compliance decision about the new Russian venues is United States v. Besciokov, unsealed in the Eastern District of Virginia in March 2025. Prosecutors charged Garantex administrators Aleksej Besciokov and Aleksandr Mira Serda over an exchange that processed at least $96 billion in cryptocurrency transactions from April 2019, allegedly laundering proceeds of hacking, ransomware and terrorism, per TechCrunch. The charges — money-laundering conspiracy (20-year maximum), conspiracy to violate the International Emergency Economic Powers Act (20 years) and operating an unlicensed money-transmitting business (five years) — arrived alongside a coordinated takedown in which the US Secret Service seized Garantex’s infrastructure, roughly $26.2 million was frozen, and Tether blocked wallets holding over $28 million. Besciokov was arrested in India on March 13, 2025, with the US seeking extradition. Within weeks, investigators reported the same operators standing up a successor platform, Grinex — the recurring pattern the new Russian register will be tested against: designation, seizure, rebrand, repeat.

What this means for brokers, exchanges, custodians and compliance teams

For exchanges and would-be venue operators, the September 1 date starts a licensing race with a hard capital floor: a settlement-capable depository needs 250 million rubles of qualifying equity before it opens, and the central bank register — not self-declaration — determines who may operate. For brokers and platform operators, the two-tier investor regime creates an onboarding obligation Russian retail crypto has never had: venues must classify clients as qualified or non-qualified and enforce the 300,000-ruble annual cap, which implies transaction monitoring wired into the venue rulebook. For custodians and foreign firms, the 100-million-ruble tier for entities using foreign custodians is a deliberate tax on offshore custody chains — and any Western-linked custodian must weigh that business against the EU and US designation risk the Garantex and A7 actions demonstrate. For compliance teams outside Russia, the practical question is screening: Russian-licensed venues will be lawful counterparties under Russian law and, in some cases, sanctioned entities under EU or US law simultaneously. The register solves the identification problem while sharpening the sanctions one — the same split that is fragmenting stablecoin oversight, where the US GENIUS Act deadline left foreign issuers in limbo.

“Non-qualified investors have fewer opportunities because the government, through legislation, tries to protect them to avoid them embracing the risks that they don’t understand.”

— Elvira Nabiullina, Governor, Bank of Russia
(News.Bitcoin.com)

What’s next: the forward view

Three tracks run in parallel between now and autumn. First, the central bank’s drafts sit in regulatory impact assessment with public consultation shaping the final texts before the September 1 entry into force; the depository capital tiers and the pricing-methodology rules are the provisions most likely to move. Second, the sanctions overlay keeps expanding: the EU’s 21st package is being transposed by member states through August, and the US Treasury has already renewed and extended Garantex-related designations to its successor Grinex — meaning the first cohort of Russian-licensed venues may be born designated. Third, the unresolved design question is the cross-border settlement channel: the law permits digital assets in foreign-trade settlement through regulated channels, but which venues get that mandate, and whether the central bank routes it through the digital ruble instead, remains genuinely contested inside the Russian policy establishment. The answer will determine whether the framework is a domestic investor-protection regime or the legal chassis for sanctions-resistant trade settlement — and it is the question every Western compliance desk should track into the fall rollout.

FAQ

Is cryptocurrency now legal in Russia?

Trading and holding will be legal in a regulated form from September 1, 2026, under Law No. 1194918-8, which recognises digital assets as property and creates licensed venues and depositories. Using cryptocurrency to pay for goods, services or salaries inside Russia remains prohibited. The regime legalises the market, not the currency function.

What are Russia’s new crypto investment limits?

Non-qualified retail investors face a 300,000-ruble (~$3,800) annual purchase cap and a 100,000-ruble limit on overseas transfers. Qualified investors receive ceilings of 3 million rubles and 1 million rubles respectively. Bank of Russia Governor Elvira Nabiullina has defended the caps as protection for investors taking risks “they don’t understand.”

What is a digital depository under the Bank of Russia’s draft rules?

A licensed record-keeper for cryptocurrency and digital rights operating on securities-depository principles and entered in a central bank register. Capital requirements are tiered: 250 million rubles for settlement depositories, 100 million for firms controlling crypto addresses or using foreign custodians, and 50 million for others, with capital held in liquid, high-credit-quality form, per CoinDesk.

Can Russians use crypto for cross-border payments?

Yes, within limits: the law permits digital assets in cross-border trade settlement through regulated channels, continuing the experimental legal regime Russia built under sanctions. Domestic payments remain banned. Which venues receive the cross-border mandate — and whether the digital ruble absorbs part of that role — is still being decided ahead of the autumn rollout.

How does Russia’s framework differ from the EU’s MiCA?

MiCA regulates service providers and token issuers through authorisation, with member-state fines of no less than €5 million and non-compliant stablecoins removed from licensed venues. Russia’s regime regulates market infrastructure — venues, depositories, registers — and caps retail participation, while banning the payment function outright. MiCA polices what may be offered; Russia’s law polices where and how much.

Why does the Garantex case matter for the new Russian exchanges?

United States v. Besciokov shows US enforcement reaches Russian venues regardless of local legality: charges carrying up to 20 years, $26.2 million frozen, infrastructure seized and an arrest in India. A venue licensed under the new Russian register can simultaneously be a designated entity in the US or EU — the compliance status Western counterparties must now screen for.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.