The Federal Security Service (FSB) has ordered T-Bank and Raiffeisenbank to install SORM-3, a surveillance system that stores the content of communications and technical user data, and can cross-reference IP addresses, logins, and payment information. The agency is to receive round-the-clock access to the database.
Raiffeisenbank received the FSB notice in May 2024, covering its internet bank and the Raiffeisen Media website. The bank challenged the Roskomnadzor directive in court, arguing that permanent agency access could lead to unlawful disclosure of banking secrecy, and that such data should only be handed over by court order. The court sided with the FSB.
T-Bank received a similar demand in March 2023 over its Gorod service. In court, bank representatives said implementation of SORM had already begun, plans had been coordinated with the FSB, and the project was to be completed in the fourth quarter of 2026. The bank also plans to connect its main website, T-ID, and T-Investments to the system.
The FSB's demands apply to banks whose apps and websites allow clients to exchange messages. Under Russia's Yarovaya law, such services are classified as organizers of information dissemination. The registry currently includes Sberbank, T-Bank, Yandex Bank, Promsvyazbank, and Moscow Credit Bank.
In both court cases, the courts sided with the FSB, so the banks are obliged to comply with the agency's demands.