FEDERAL LAW OF THE RUSSIAN FEDERATION

of November 2, 2026 No. 350-FZ

About modification of separate legal acts of the Russian Federation

Accepted by the State Duma on October 14, 2026

Approved by the Federation Council on October 28, 2026

Article 1

Bring in the Federal Law "About Banks and Banking Activity" (in edition of the Federal Law of February 3, 1996 No. 17-FZ) (Sheets of the Congress of People's Deputies of RSFSR and the Supreme Council of RSFSR, 1990, No. 27, Art. 357; Russian Federation Code, 1996, No. 6, Art. 492; 2012, No. 27, Art. 3588; No. 50, Art. 6954; No. 53, Art. 7605; 2013, No. 11, Art. 1076; No. 19, Art. 2329; No. 26, Art. 3207; No. 27, Art. 3438; No. 30, Art. 4084; No. 51, Art. 6699; 2014, No. 26, Art. 3395; No. 52, Art. 7543; 2015, No. 27, Art. 3950; No. 29, Art. 4357; 2017, No. 18, Art. 2661; 2018, No. 24, Art. 3400; No. 27, Art. 3950; No. 31, Art. 4852; No. 32, Art. 5100, 5115; 2019, No. 6, Art. 463; No. 49, Art. 6953; No. 52, Art. 7787; 2021, No. 27, Art. 5151; 2022, No. 1, Art. 40; No. 10, Art. 1401; No. 14, Art. 2190; No. 43, Art. 7271; No. 50, Art. 8792; 2023, No. 1, Art. 16; No. 25, Art. 4447; No. 31, Art. 5766, 5784; 2024, No. 31, Art. 4462; No. 33, Art. 4956, 4971; No. 48, Art. 7214; No. 53, Art. 8532; 2025, No. 7, Art. 541; No. 26, Art. 3493; No. 31, Art. 4633; No. 48, Art. 7236, 7242; 2026, No. 26, Art. 3464, 3469) following changes:

Article 26 to add 1) with parts of the sixty eighth - the seventieth the following content:

"Credit institution in cases and procedure which are stipulated in Article 30.2 presents of the Federal Law have the right to transfer the organizations, specified in part four of article 30.2 of this Federal Law (further - the attracted organization), the data containing bank secrecy. The attracted organization and its workers shall keep secret about transactions, about accounts and deposits of clients and correspondents of credit institution. For disclosure of the data which are bank secrecy, the attracted organization and its workers bear responsibility, including compensation of the caused damage, according to the procedure, established by the Federal Law.

Credit institution in cases and procedure which are stipulated in Article 30.3 presents of the Federal Law have the right to transfer to foreign bank of the data, containing bank secrecy.

The credit institution transferring to foreign bank of the data, containing bank secrecy, in cases and procedure which are stipulated in Article 30.3 presents of the Federal Law shall provide storage by such foreign bank and its workers of secret about transactions, about accounts and deposits of clients and correspondents of credit institution.";

To add 2) with Articles 30.2 and 30.3 of the following content:

"Article 30.2. The relations between the credit institution and the organization involved in information processing of limited access

The credit institution according to procedure and requirements which are established by the Bank of Russia based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" has the right to charge after 60 days following behind day of the direction of the notification in the Bank of Russia according to part two of this Article in the absence of the decision of the Bank of Russia made based on Item of 1 part three of article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "On the Central bank the Russian Federation (Bank of Russia)", the attracted organization taking into account the restrictions set by the legislation of the Russian Federation, implementation of collection, record, systematization, accumulating, storage, refining (updating, change), extraction, uses, transfers (distribution, provisions, access), removals, destructions of information of limited access (except for the data, carried to the state secret) with use of the information systems and their components belonging legally to the attracted organization and being in the territory of the Russian Federation based on concluded according to the civil legislation with the attracted organization of the agreement. The credit institution has the right to charge to the attracted organization implementation of collection, record, systematization, accumulating, storage, refining (updating, change), extraction, uses, transfers (distribution, provisions, access), removals, destructions of personal data according to this part without the consent of subjects of personal data on condition of compliance of the agreement provided by this part, to requirements of part 3 of article 6 of the Federal Law of July 27, 2006 No. 152-FZ "About personal data". The attracted organization which the credit institution charged to perform the actions specified in this part with information of limited access (except for the data carried to the state secret) performs with such information only those actions which correspond to the rights and obligations to the given credit institution when processing of such information.

The credit institution shall notify the Bank of Russia on intention to charge to the attracted organization implementation of the actions specified in part one of this Article concerning information of limited access (except for the data carried to the state secret) to such order.

The conclusion and (or) the report of the organization which has the licenses of the federal executive body authorized in the field of counteraction to technical investigations and technical information security, and (or) the federal executive body authorized in the field of safety, received according to the procedure, stipulated by the legislation the Russian Federation and conforms to the requirements established based on Item 3 parts one of article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" are attached to the notification specified in part one of this Article and also according to the requirements established based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" books operational audit of the attracted organization, including assessment of conformity of the attracted organization No. 86-FZ established based on Item of 1 part one of article 57.5-3 of the Federal Law of July 10, 2002 "About the Central bank the Russian Federation (Bank of Russia)" to requirements to ensuring information security and requirements to operational reliability (further for the purposes of this Article - the checking organization). The specified notification goes in electronic form, is signed by the strengthened qualified digital signature of the authorized person and shall contain the following data:

1) name, address of credit institution;

2) surnames, names, middle names (in the presence), numbers of contact telephone numbers, e-mail addresses of employees of the attracted organization which perform functions on ensuring information security of the attracted organization, and also the special officials of the attracted organization responsible for ensuring safety of information of limited access;

3) the name of the attracted organization to which is planned to charge implementation of the actions specified in part one of this Article concerning information of limited access (except for the data carried to the state secret);

4) the data confirming compliance to the attracted organization to the requirements established by this Article and compliance to the requirements established based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" checking the organizations.

The attracted organizations are understood as the organizations performing activities in the field of information technologies, accredited according to the procedure, established by the legislation of the Russian Federation, and also banks with the universal license which are under control of the Russian Federation, and (or) the subject of the Russian Federation, and (or) the municipality, and (or) the citizen of the Russian Federation who does not have nationality of other state and (or) persons controlled by them jointly or separately. For the purposes of this Article control is understood as opportunity to determine the decisions made by the banks with the universal license which are under control of the Russian Federation, and (or) the subject of the Russian Federation, and (or) the municipality, and (or) the citizen of the Russian Federation who does not have nationality of other state and (or) persons controlled by them jointly or separately specified in this part owing to right availability to dispose directly or indirectly of more than 50 percent of total quantity of the voices falling on voting shares (shares) constituting the authorized capital of data of the banks with the universal license which are under control of the Russian Federation, and (or) the subject of the Russian Federation, and (or) the municipality, and (or) the citizen of the Russian Federation who does not have nationality of other state and (or) persons controlled by them jointly or separately.

The attracted organization and its workers according to procedure and requirements which are established by the Bank of Russia based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" shall provide protection received from credit institution according to this Federal Law and other Federal Laws of information of limited access (except for the data carried to the state secret), including control of lack of the fact of unauthorized access to the specified information of limited access (except for the data carried to the state secret), and in case of its disclosure bear responsibility in accordance with the legislation of the Russian Federation and the agreement signed according to the civil legislation between the attracted organization and credit institution.

The attracted organization according to the requirements established based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" exercises internal control and annually books operational audit, including assessment of conformity of the attracted organization No. 86-FZ established based on Item of 1 part one of article 57.5-3 of the Federal Law of July 10, 2002 "About the Central bank the Russian Federation (Bank of Russia)" to requirements to ensuring information security and requirements to operational reliability, with involvement of the checking organization. The conclusion and (or) the report of the checking organization prepared by results of carrying out operational audit of the attracted organization go to credit institution which charged to the attracted organization according to part one of this Article implementation of actions concerning information of limited access (except for the data carried to the state secret), the attracted organization, and also in the Bank of Russia.

The attracted organization shall notify credit institution which charged to the attracted organization according to part one of this Article implementation of actions concerning information of limited access (except for the data carried to the state secret), on intention to terminate the agreement provided by part one of this Article no later than six months before expected date of termination of this agreement and to ensure safety of such information of limited access (except for the data carried to the state secret) until its transfer to the specified credit institution. The credit institution which according to part one of this Article charged to the attracted organization implementation of actions concerning information of limited access (except for the data carried to the state secret) before expected date of the agreement cancelation provided by part one of this Article shall accept from the attracted organization information of limited access which is earlier transferred to it by the specified credit institution (except for the data carried to the state secret).

Shall be provided by the agreement specified in part one of this Article:

1) procedure for the direction the attracted organization in credit institution on quarterly basis of information on observance of target indicators of rendering services by the attracted organization regarding ensuring information security and operational reliability, and also structure of such information;

2) forms and procedure for the direction the attracted organization in credit institution of information on the incidents connected with violation of requirements to ensuring information security, the incidents connected with violation of requirements to operational reliability which occurred during activities of the attracted organization performed based on the specified agreement within two hours from the moment of their identification by the attracted organization;

3) responsibility of the attracted organization and its workers for disclosure received from credit institution according to this Federal Law and other Federal Laws of information of limited access (except for the data carried to the state secret);

4) procedure for the direction of the notification provided by part seven of this Article.

The attracted organization shall conform to the following requirements:

1) concerning the attracted organization the liquidation procedure of the legal entity is not carried out, the decision on its exception of the Unified State Register of Legal Entities in accordance with the legislation of the Russian Federation is not made on state registration of legal entities, there is no decision (determination) of Arbitration Court on introduction of insolvency proceeding in accordance with the legislation of the Russian Federation about insolvency (bankruptcy), and also within the last two years measures according to part of the twenty second article 74 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)" were not taken;

2) in staff of the attracted organization there are workers who perform functions on ensuring information security of the attracted organization, and also the special officials responsible for ensuring safety of information of limited access (except for the data carried to the state secret) specified in part one of this Article;

3) the head of the attracted organization has no not removed or unspent conviction for crime execution in the field of economy or crime in the field of computer information;

4) involvement of the attracted organization and interaction with it are performed according to the procedure established based on part one of article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)";

5) the attracted organization exercises internal control and annually books operational audit, including assessment of conformity of the attracted organization to requirements to ensuring information security and the requirements to operational reliability established based on Item of 1 part one of article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)", with involvement of the checking organization;

6) the attracted organization, person performing functions of sole executive body of the attracted organization are absent in the list of the organizations and physical persons concerning which there are data on their participation in extremist activities or terrorism, or in the powers constituted within realization provided by Chapter VII of the Charter of the UN, the UN Security Council or bodies which are specially created by decisions of the UN Security Council, lists of the organizations and physical persons connected with the terrorist organizations and terrorists or distribution of weapons of mass destruction;

7) concerning the attracted organization, there is no person performing functions of sole executive body of the attracted organization the accepted interdepartmental coordinating body performing functions on counteraction to financing of terrorism and extremist activities, the decision on freezing (blocking) of money or other property of person according to article 7.4 of the Federal Law of August 7, 2001 No. 115-FZ "About counteraction of legalization (washing) of income gained in the criminal way and to terrorism financing";

8) the attracted organization, person performing functions of sole executive body of the attracted organization are not the blocked faces according to part 2.1 of article 3 of the Federal Law of December 30, 2006 No. 281-FZ "About special economic measures and enforcement powers";

9) the attracted organization, person performing functions of sole executive body of the attracted organization are not the faces performing activities in the territory of the Russian Federation without the license obtained in accordance with the established procedure if the legislation of the Russian Federation concerning such activities provides its availability, or persons rendering services with use of the website in the Internet if domain name of this website, the index of the page of this website contain in the Unified register of domain names, indexes of pages of the websites on the Internet and the network addresses allowing to identify the websites on the Internet containing information which distribution in the Russian Federation is forbidden;

10) person performing functions of sole executive body of the attracted organization is not included in the register of controlled persons, stipulated by the legislation about legal status of foreign citizens in the Russian Federation;

11) the attracted organization is not carried by the Bank of Russia to high degree (level) of risk of making of suspicious transactions according to article 9.1 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)";

12) the attracted organization conforms to other requirements established by the Bank of Russia based on article 57.5-3 of the Federal Law of July 10, 2002 No. 86-FZ "About the Central bank the Russian Federation (Bank of Russia)".

In case of disclosure by the attracted organization and (or) its workers of information of limited access (except for the data carried to the state secret) received from credit institution according to this Federal Law and other Federal Laws the credit institution and the attracted organization bear responsibility in accordance with the legislation of the Russian Federation.

The credit institution shall store with use of information systems and their components of the data on the transactions (transactions) made by clients at least five years from the moment of their making.

Action of provisions of parts one - the tenth this Article does not extend to the relations of credit institution with bank payment agents, operators of services of information exchange, suppliers of payment applications, the operational centers and payment clearing centers following from agreements, and also to cases of implementation of cross-border transfer of money and cases of information transfer for consideration of the applications of clients of the members of payment service provider concerning use of electronic instruments of payment without the voluntary consent of clients according to the Federal Law of June 27, 2011 No. 161-FZ "About national payment system".

Article 30.3. Features of interaction of the bank with the universal license which is under control of foreign bank, and the foreign bank involved in information processing of limited access

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info