The State Duma of the Russian Federation has passed bill No. 404786-8, which introduces updated regulations for IT outsourcing and cloud services within the financial sector. The legislation, spanning 159 pages, permits banks to delegate the processing of restricted information, including banking secrets and personal client data, to third-party contractors.
Under the new rules, banks can authorize vendors to perform tasks such as data collection, systematization, updating, and transmission. In specific cases defined by the law, individual client consent for these operations will not be required. However, the law explicitly excludes information classified as state secrets from these outsourcing provisions.
The legislation imposes strict criteria for potential contractors. Eligible partners are limited to accredited Russian IT firms and banks holding a universal license. Furthermore, companies must satisfy specific ownership requirements: over 50% of voting rights must be controlled by the state, municipalities, or Russian citizens who do not hold dual citizenship.
The law also mandates that all information systems and technical components utilized for processing the outsourced data must be physically located within the territory of the Russian Federation.
