Russia's Unified Payment Card Registry: What Changes on September 1, 2026
Introduction
Starting September 1, 2026, every bank card in Russia — including previously issued Visa and Mastercard cards — will be entered into a new federal registry. The National Payment Card System (NSPK) will operate the system, and cardholder data will flow into it in real time. According to a clarification from the Bank of Russia's press service to "RBC Investments," the registry is being created as one of the tools for combating drop-card schemes and financial fraud, not for tax control or the collection of data on specific transactions. The main question on cardholders' minds is what exactly changes on September 1 and what is postponed until 2027. Below is a breakdown of the new law, the timeline for the limits taking effect, and how the tightened oversight ripples into adjacent areas, including buying cryptocurrency.
What Is the Unified Payment Card Registry and Why Does It Exist
The unified payment card registry is a state database that will record every card issued by Russian banks, regardless of payment network. According to the Bank of Russia's press service, the registry will store information about each card's type, including Visa and Mastercard cards, as well as the total number of cards issued to a given person.
The official goal of the initiative is to counter so-called drop-card schemes — arrangements in which fraudsters use other people's identity documents to open large numbers of cards and then withdraw stolen funds. As Alexey Kuzmin, chairman of the board of the "National Savings Bank," explained, a sweeping amendment to the national payment system law takes effect on September 1, 2026, and the creation of the unified card registry is the central element of this reform.
It's important to distinguish the card registry from the separate database of fraudulent transactions. That second database is compiled independently by the Bank of Russia, based on theft reports that victims file with their banks and with the police. It contains unique identifiers, details of completed transactions, and information about fund recipients, and it is this database that banks rely on to block transfers to suspicious clients.
The legal basis for the reform is Federal Law No. 210-FZ, "On Amendments to the Federal Law 'On Communications' and Certain Legislative Acts of the Russian Federation." This is the law that requires banks to submit card numbers and types, along with holders' taxpayer identification numbers (INN), to the unified registry — including data on cards whose servicing has already been discontinued. Criminal liability specifically for drop-card operators has been in force in Russia since July 2025, and according to Rosfinmonitoring, it is already producing results.
How Effective Is the Fight Against Drop-Card Schemes So Far
The number of drop cases in the first half of 2026 fell by 15% compared with the same period in 2025, while the volume of suspicious transactions involving them dropped by a full 60%. Rosfinmonitoring released these figures in July 2026 while commenting on the new measures under Law No. 210-FZ, of which the unified card registry launching on September 1 is a part.
The trend is especially pronounced among underage drop operators. According to the Bank of Russia, the number of such cases in 2026 fell by more than threefold compared with the average monthly figures for the first half of 2025 — a shift the regulator attributes to a combination of blocked electronic payment instruments and improved bank antifraud systems.
At the same time, overall damage from cyberfraud remains substantial: in the first quarter of 2026 alone, criminals stole roughly 7.4 billion rubles from Russians, and bank clients reported nearly 500,000 suspicious transactions through the dedicated in-app reporting button. It is precisely this kind of damage the unified card registry is designed to reduce — the harder it becomes for fraudsters to find new drop operators and open dozens of cards in their names, the less profitable cash-out schemes become.
Which Cards Will Be Entered Into the Registry on September 1, 2026
The database will include absolutely all active cards issued by Russian banks, not just new issuances. Yulia Suvorova, legal affairs director at the service "Sravni," clarified that every payment card will be counted regardless of payment network — meaning previously issued Visa and Mastercard cards will also be included in the registry.
Expired cards deserve special mention. If a bank continues to service such a card — for example, still processes internal operations on it or keeps it linked to online services — it will also be recorded in the system. This applies to both foreign-currency and multi-currency cards, whose servicing individual banks have already begun winding down.
Banks will be required to submit information to the registry on every card issued and every card blocked, along with the holder's INN. Rosfinmonitoring will be able to obtain part of this information directly through NSPK, which should speed up data exchange between the agency and credit institutions and make monitoring of suspicious activity nearly instantaneous.
There will be no automatic forced closure of active cards when the system launches. Alexey Kuzmin, chairman of the board of the "National Savings Bank," emphasized that all cards currently held by clients will keep working as usual — at this initial stage, the registry simply records the existing picture.
How the 20-Card Limit Will Work and When It Takes Effect
The limit on the number of cards will not take effect immediately — it applies only from September 1, 2027, exactly one year after the registry itself launches. Anatoly Aksakov, chairman of the State Duma Committee on the Financial Market, noted that holders of large numbers of cards will have a full year to decide which ones to keep active.
The mechanism works as follows: whenever a client tries to open a new card, the bank will query the unified registry to check how many cards that client already has. If, as of September 1, 2027, a person holds more than 20 active cards, they will not be able to open an additional card at any bank — regardless of which bank they approach.
A key nuance that often gets overlooked: the 20-card limit restricts only the issuance of new cards, not the number of accounts a person can hold. The law does not regulate how many bank accounts a citizen may have; the restriction applies exclusively to physical payment cards. Below is a table of the reform's key dates.
| Date | What Happens |
| March 1, 2026 | Launch of the "Antifraud" state information system for data exchange between banks, government agencies, and telecom operators |
| September 1, 2026 | Launch of the unified payment card registry, operated by NSPK |
| March 1, 2027 | Banks must protect apps and websites from malware; device checks introduced before transactions |
| September 1, 2027 | The limit of no more than 20 cards per person takes effect |
Does the New System Affect Privacy and Tax Oversight
The registry does not centralize transaction details and does not change the existing level of protection for clients' financial data. The system receives information about the fact that a card was issued, its type, and its holder — but not the history of specific payments and transfers, which remain the domain of other, already-existing bank monitoring mechanisms.
The system's direct purpose is fighting fraud, not tax oversight of transfers between relatives and acquaintances. The Federal Tax Service already has the legal right to request account information from banks even without the new registry, so the appearance of a unified card database does not by itself expand its powers. The registry's main task is to give the Central Bank and NSPK a real-time monitoring tool, not to create a channel for assessing additional taxes on everyday transfers between family members.
That said, it can't be denied that transparency of card data for the regulator genuinely increases: banks will be required to promptly report issued and blocked cards, and Rosfinmonitoring will receive part of this information directly through NSPK. This speeds up the response to suspicious activity, but it does not change the basic principle — the system targets networks of drop operators who use other people's documents to open dozens of cards, not the everyday transfers of ordinary users.
What Other Measures Does the "Antifraud 2.0" Package Include
The card registry is only one part of a broader package of anti-cyberfraud measures being phased in during 2026-2027. Starting March 1, 2027, banks will be required to protect their mobile apps and websites from malware and, with the client's consent, check devices for signs of compromise before processing a transaction.
If signs of device compromise are found, the bank must suspend the operation for six hours and notify the sender of the transfer. Additionally, credit institutions will be required to check the phone number used for a transaction against the "Antifraud" state information system: if a number has previously appeared in calls or texts showing signs of fraud, the bank will refuse to process the operation.
Liability for stolen funds under the new scheme is distributed among the parties involved. According to the Association of Russian Banks, a credit institution must reimburse stolen funds if it processed a transfer despite having technical information that the client's device was compromised, or if it ignored "Antifraud" system data about fraudulent calls to the client's number. If, however, the bank met all its obligations and it was the telecom operator that failed to report or block a fraudulent number, financial liability in the event of a criminal case falls on the operator.
The "Antifraud" state information system itself is already operating: it went live on March 1, 2026, and allows banks, government agencies, and telecom operators to exchange data on signs of illegal activity in near real time.
How Tighter Card Controls Affect Buying Crypto on KuCoin
Tighter bank oversight increases the value of working through a vetted, fully compliant platform for cryptocurrency transactions. Since the registry tracks how many cards a person holds and strengthens scrutiny of suspicious operations, users should consolidate their financial activity on one reliable card and one verified account ahead of time, rather than spreading transactions across dozens of cards and P2P channels — that kind of scattered behavior is exactly what antifraud systems flag most often.
KuCoin offers users in Russia convenient, transparent ways to buy cryptocurrency, including a P2P marketplace with a wide selection of vetted counterparties and payment methods, plus a built-in verification procedure (KYC) that confirms the legality of transactions upfront and reduces the risk of a bank blocking a transfer. Registering on KuCoin takes just a few minutes, and completed verification lets you carry out transactions without extra questions from your bank — unlike scattered transfers spread across many different cards.
Before making crypto transactions by card or through P2P, it's worth confirming that the card you're using isn't close to the new limits and that the transaction runs through a legal, regulated service. You can create a KuCoin account and set up secure digital-asset purchases today — a step that matters even more given the tightened card controls taking effect on September 1, 2026.
An added benefit of working through a large platform is predictability. Unlike transfers through unfamiliar counterparties or many different cards — which are highly likely to draw close attention from bank antifraud systems once the unified registry launches — transactions through a verified KuCoin account look transparent and explainable to a bank. That lowers the risk of the two-day transfer freeze now applied to operations showing signs of involvement in suspicious schemes.
Join KuCoin 9th Anniversary Trading Campaign
KuCoin is celebrating its 9th anniversary with a special platform campaign filled with exclusive rewards, trading activities, and limited-time offers. Don’t miss the chance to participate and enjoy the benefits as the exchange marks nine years of growth and innovation. Visit the official campaign page now:
Conclusion
Starting September 1, 2026, Russia is launching a unified payment card registry — a federal database that will include every card issued by Russian banks, including previously issued Visa and Mastercard cards and expired cards that banks continue to service. NSPK will operate the system, and its official goal is combating drop-card schemes and fraud, not tax oversight of transfers between citizens.
The 20-card-per-person limit will not take effect until September 1, 2027, and applies only to the issuance of new cards: already-open cards will keep working with no forced closures, and the law does not limit the number of bank accounts a person may hold. Alongside the card registry, the "Antifraud 2.0" package is being rolled out in stages — protection for banking apps, checks on devices and phone numbers, and a clear division of liability for stolen funds between banks and telecom operators.
The registry does not centralize data on specific transactions and does not change clients' level of financial protection, but it does increase transparency for the regulator. Holders of large numbers of cards should start planning now which ones to keep active before the limit arrives in 2027.
Frequently Asked Questions
1. Do cardholders need to do anything on September 1, 2026?
No — for ordinary cardholders, the registry's launch requires no action at all. The system simply records existing cards, and cards keep working normally with no forced closures.
2. What happens if someone already has more than 20 cards?
Until September 1, 2027, all existing cards can keep being used without restriction, but after that date, anyone holding 20 or more active cards will not be able to open a new one at any bank.
3. Will the registry include cards that haven't been used in a long time?
Yes — if a bank formally continues to service a card, even one that's expired or inactive, it will be recorded in the unified registry on the same basis as actively used cards.
4. Can information from the card registry be used to assess additional taxes?
The registry's direct purpose is fighting fraud, not tax oversight; the Federal Tax Service already has legal access to bank data without this system, so the registry's existence alone does not create a new mechanism for scrutinizing everyday transfers.
5. How does the unified card registry relate to the "Antifraud" state information system?
They are two complementary pieces of the same reform package: the "Antifraud" system, launched March 1, 2026, exchanges data on fraudulent phone numbers and devices, while the card registry, launching September 1, 2026, tracks the number and status of the payment cards themselves. Separately, the Bank of Russia is developing a centralized "Antidrop" platform for sending banks information about individuals' suspicious transactions, with a launch planned for 2027 — alongside the card limit taking effect.
Disclaimer : This material is provided for informational purposes only and does not constitute financial, investment, legal, or tax advice. Transactions involving cryptocurrencies and tokenized assets carry substantial risks — including price volatility, limited liquidity, counterparty exposure, and the potential for total loss of invested capital. Readers should conduct their own research and, where appropriate, consult a qualified professional before making any financial decisions.