Russian President Vladimir Putin signed Federal Law No. 350-FZ, dated November 2, 2026. Subject to specific requirements, it allows banks and other financial institutions to outsource the processing of restricted-access information, including information protected by banking secrecy and personal data, without obtaining separate consent from customers.
For credit institutions, eligible contractors include accredited IT companies that meet the prescribed requirements, as well as certain banks with universal banking licenses and Russian control. The law does not permit financial institutions to give any contractor unrestricted access to such data.
Financial institutions must notify the Bank of Russia before engaging contractors. The legislation provides for inspections of contractors, requirements to host certain information systems in Russia, and the regulator's authority to prohibit the outsourcing of data processing to a particular organization in specified circumstances.
The main new provisions will take effect one year after the law's official publication. Existing contractor agreements must be brought into compliance within the following 180 days. The State Duma passed the law on October 14, and the Federation Council approved it on October 28.