meta_id 3228207

On January 12, 2026, the Central Bank of Russia (CBR) published amendments to the Regulation of the Bank of Russia No. 802 of July 25, 2022. The amendments update Russia's information security requirements for participants of the National Payment System, the Faster Payment System (SBP) and other payment system participants. The overall aim is to strengthen cyber resilience and information security governance in response to evolving payment risks. The amendments introduced a three-tier model: Enhanced protection level for systemically important credit institutions, payment infrastructure operators of systemically important payment systems and banks considered to be significant. Standard protection level for other credit institutions and branches of foreign banks. Minimum protection level for other participants not falling within the above categories. Payer banks participating in the SBP must: Implement measures to prevent transactions without voluntary consent. Use transaction risk indicators. These amendments shall enter into force on October 1, 2026.