Russia’s Federation Council approved a law on October 28 setting conditions for banks and other financial institutions to transfer confidential customer information, including banking secrets, to outside IT service providers. The draft was substantially tightened before passage: only specified categories of accredited companies and financial organizations will be eligible.
Banks will be allowed to use accredited IT companies and banks holding universal licenses that meet Russian-control requirements. More than half the voting rights in eligible providers must be controlled directly or indirectly by the state, Russian local authorities or Russian citizens who hold no second citizenship. Different eligibility rules apply to nonbank financial institutions.
Contractors’ information systems must be located in Russia. Financial institutions will have to notify the Bank of Russia in advance and submit an operational audit report from an organization licensed by the relevant technical-security or security authorities. They may begin outsourcing the processing after 60 days unless the central bank has prohibited it.
The law establishes further cybersecurity duties. Contractors must undergo annual operational audits, appoint staff responsible for information security and inform their customer institution of a discovered security incident within two hours. The central bank will be able to prohibit use of a contractor’s systems for up to six months for certain violations.
In the cases covered by the law, customer consent to the transfer of personal data is not required, although outsourcing contracts must comply with personal-data legislation. Banks controlled by foreign lenders will have a separate route to use a foreign parent bank’s systems, subject to authorization by the Bank of Russia, the FSB and Rosfinmonitoring.
The law applies beyond banks to insurers, private pension funds, microfinance firms and other financial institutions. It is scheduled to take effect one year after official publication. Institutions with existing outsourcing arrangements will then have 180 days to bring their contracts into compliance.