Russia's central bank has released draft rules that would cap banks' direct crypto and digital asset risk at 1 percent of capital, but exclude most client custody assets from the limit if banks are not liable for losses.
Russia's central bank is moving to sharply limit how much crypto risk banks can carry on their own balance sheets. Under draft rules published September 18, banks would face a 1 percent capital cap on both direct and indirect digital asset exposure. The rules would apply to individual banks and banking groups, using two new ratios-N31 and N32-to measure exposure against capital. This approach follows the regulator's earlier statements about setting a 1 percent ceiling for crypto-related risks, as confirmed by the Bank of Russia's banking regulation department in 2026.
The 1 percent cap would cover a bank's direct crypto holdings, indirect investments, and exposure through derivatives, loans, bonds, guarantees, repos, and credit lines where value or settlement depends on crypto or foreign digital assets. Both long and short positions are included, but only certain lower-risk hedges can be netted out, and only if they meet strict requirements for asset type, settlement, maturity, and liquidity. Higher-risk exposures, such as direct holdings, are measured more conservatively and cannot be fully offset by opposing positions. The calculation includes not just direct investments but also crypto derivatives and other digital asset-linked instruments, reflecting the regulator's intent to address all forms of exposure.
EgonCoin Research
The draft rules make a clear distinction between assets held for the bank's own account and those held in custody for clients. If a bank or its group's digital depository is liable for loss if assets are seized or transactions are restricted, those client positions count toward the 1 percent cap. If the bank is not liable, the client assets are excluded from the cap calculation, though they still receive a 50 percent risk weight in capital adequacy assessments. In contrast, direct bank exposure and client positions for which the bank is liable are assigned a much higher 1,250 percent risk weight.
Custody and risk treatment
This setup allows banks to offer crypto custody services without automatically treating all customer assets as their own risk-so long as the bank is not responsible for losses from seizure or restriction. The approach puts a hard limit on direct crypto risk but recognizes that not all custody arrangements expose the bank to the same level of loss. N31 applies to individual banks, while N32 covers banking groups, ensuring both are subject to the same percentage ceiling, with the relevant capital base used for each calculation. According to the official statement, these measures are meant to limit systemic risk from crypto investments while still letting banks provide digital asset services under defined conditions.
The draft regulation is part of a broader Russian effort to build a comprehensive crypto market framework, a process that is still ongoing. The central bank plans to publish the final rules in the fourth quarter of 2026, with requirements taking effect just 10 days later. Banks would begin reporting turnover and N31/N32 values in January 2027, though detailed reporting forms are still being developed. As CoinDesk has previously reported, Russia's evolving regulatory stance reflects growing concern over the use of stablecoins and digital assets as alternatives to the ruble, a trend highlighted in the central bank's financial market development strategy for 2027-2029.
CoinDesk
By tying the cap to capital rather than total assets, the Bank of Russia's proposal targets the core risk-bearing capacity of each institution. The 1 percent limit applies to a broad range of crypto-linked exposures, not just spot holdings, and the risk-weighting system creates a strong disincentive for banks to take on direct or liability-bearing positions. The exclusion of non-liable client custody assets from the cap, but not from prudential treatment, reflects a nuanced approach to custody risk that could influence how banks structure their digital asset services.
Under the draft, capital adequacy calculations would assign a 50 percent risk weight to client custody positions where the bank is not liable for loss, and a 1,250 percent risk weight to direct bank exposure and client positions where the bank is liable. The reporting and compliance timeline gives banks a narrow window to adapt once the rules are finalized, with the central bank's official publication expected in late 2026 and reporting requirements starting in early 2027.
Russia's draft rules do not specify any dollar or ruble figures for the cap, focusing instead on the percentage of capital. The approach is notable for its attempt to separate custody risk from direct exposure, a distinction that has been debated in other regulatory contexts but is rarely codified with such detail.
While the Bank of Russia's proposal is still in draft form, its structure signals a clear intent to limit systemic crypto risk in the banking sector while allowing for customer custody services under defined conditions. The high risk weights for direct and liability-bearing exposures, combined with the capital-based cap, are likely to make Russian banks cautious about expanding their own crypto activities, even as they continue to serve clients seeking digital asset custody.
Custody arrangements in the crypto sector often depend on who bears the risk if assets are frozen, seized, or otherwise restricted. In the Russian draft, this distinction is central: only when the bank or its group's depository is liable for loss do client assets count toward the 1 percent cap. This approach could shape how banks structure custody agreements and disclosures, and may influence regulatory thinking in other markets as well.
