meta_id 3227652

On June 9, 2026, the Bank of Russia (CBR) published clarifications on new legislative measures against cybercrime and fraud contained in the "Anti-Fraud 2.0" law, which the State Duma adopted and will enter into force in 2027. Under the new legislation, credit institutions must reimburse customers for funds stolen by fraudsters through online banking breaches involving malware. To prevent such theft, credit institutions may check client devices for malware before processing transactions, with client consent. If malware is detected, the bank must reject the transaction, notify the customer, and offer to conduct it from a secure device or at a bank office. The law establishes retention periods for individuals included in a database of fraudulent transactions, which restricts remote banking services. First-time entries will be deleted after one year; subsequent entries will remain for three years. Early deletion occurs if law enforcement confirms termination of criminal prosecution for fraud. Individuals retain the right to contest inclusion in the database. The legislation limits each person to a maximum of 20 payment cards across all banks, preventing mass card issuance for fraud purposes. The law introduces financial liability for telecommunications operators who fail to meet anti-fraud requirements, mirroring the banking system model. Operators must identify fraudulent calls and protect citizens from them. When theft occurs, the party that failed to meet its obligations—either the operator or the bank—must compensate losses. The CBR will coordinate additional details on information exchange between banks and operators through the state "Anti-Fraud" information system. A separate Government decree, coordinated with the CBR, will establish the compensation mechanism for telecommunications operators.