Is a 1,250% risk weight a special one-off case, or is this a common practice in bank supervision generally?
A high risk weight itself is not a uniquely Russian invention, international bank supervision frameworks, like the Basel Accords, have always assigned different risk weights to assets based on how risky they are considered, typically landing somewhere between 0% and 150%, used to determine how much capital buffer a bank must set aside for holding that asset. But 1,250% is a figure far outside the normal range for most asset categories, a weight at this level in traditional bank supervision language usually shows up only for a small handful of asset types regulators consider something the banking system should essentially be excluded from entirely, such as certain highly speculative securitized products regulators believe banks simply should not be touching at all.
Placing crypto assets at this tier is effectively the regulator making an explicit statement: even while allowing crypto assets to circulate legally through regulated retail investment channels, a bank's balance sheet should still be treated as an entirely separate domain, one requiring the strictest possible standard to wall off risk. This is not the mild attitude of crypto is somewhat riskier so let's hold a bit more capital, it is the much firmer stance that banks, as a matter of principle, should not really be holding this kind of asset at all, just expressed through a capital requirement rather than an outright ban.
If banks can't touch crypto assets, what channel do Russian retail investors actually use to buy and sell? Is it entirely disconnected from banks?
Under the new law that took effect September 1, ordinary citizens buy and sell crypto assets through a licensed intermediary, and these intermediaries themselves need to obtain a separate license and meet minimum capital requirements, they are not the same thing as an ordinary commercial bank. In other words, the architecture Russia has designed deliberately separates retail access to cryptocurrency from the banking system's access to cryptocurrency into two distinct licensing and supervisory tracks, money retail investors use to buy crypto assets theoretically flows to these specialized intermediaries, not directly onto a commercial bank's balance sheet.
That said, this does not mean the two are entirely disconnected, banks could still form indirect links to the crypto market by providing settlement services, or by becoming shareholders in or partners of these intermediaries. What this draft restricts is specifically the bank's own direct exposure on its own balance sheet, not any interaction whatsoever between banks and the crypto industry. The intent behind this kind of separation is clear: even if an intermediary itself carries higher risk because it operates a crypto business, that risk should stay contained to that specific entity, and should not be allowed to transmit through equity or debt relationships into the broader banking system, where it could threaten depositors' funds.
What are the concrete consequences if a bank breaches the 1% cap for several days in a row? Does the central bank just issue a fine directly?
Under the draft, the threshold for noncompliance is breaching the cap on six or more days within any 30 consecutive operating days, once that threshold is triggered, the draft grants the central bank authority to take measures against the noncompliant institution, but publicly available information does not spell out the specific consequences, such as fine amounts or the scope of business restrictions, that detail will likely be spelled out further in the officially published implementing rules and currently remains a matter of regulatory discretion.
It is worth noting that this rule is designed around cumulative breach days within a rolling period, rather than treating a single day's breach as an immediate violation, meaning the regulator is allowing banks to briefly exceed the cap during moments of sharp market price swings. After all, crypto exposure risk largely moves with market prices, a single day's sharp price spike could push an otherwise compliant position over the cap instantly, and that is not something a bank can fully control. But if the breach persists rather than being a one-off event, it signals the bank is not actively managing its position back into compliance, and at that point the regulator has a much stronger case for stepping in. This kind of design logic is fairly common in bank supervision rules, the intent is to distinguish a temporary, technical breach caused by market volatility from a persistent breach caused by a bank's passive inaction.
Does this open-retail, tight-banks regulatory pattern show up in other countries too?
Separating retail investment channels from banks' own exposure, and restricting bank crypto holdings with capital requirements far above those for typical assets, is not a uniquely Russian approach. The Basel Committee on Banking Supervision, under the Bank for International Settlements (BIS), laid out a similarly spirited rule framework for bank crypto holdings years ago, one that also recommends an extremely high risk weight for crypto assets lacking hedging mechanisms and prone to sharp price swings, like Bitcoin, with the same intent of limiting how much of these assets can sit on a bank's balance sheet. Banking supervisors across several major jurisdictions have broadly followed a similar logic when drafting crypto-related rules: let ordinary investors access cryptocurrency through regulated, specialized intermediaries, but discourage, or in practice substantially restrict, banks from incorporating crypto assets into their core balance sheets.
What is distinctive about Russia's draft is less about any innovation in the regulatory logic itself, and more about how stark the contrast becomes when it is placed alongside Russia's own newly effective law that is relatively open toward retail investors. The same regulator, within roughly two weeks, both substantially widened the retail channel and imposed capital requirements on banks approaching some of the strictest standards seen internationally, that combined speed and force on both fronts stands out as a comparatively decisive case among current regulatory developments worldwide, and makes this draft a useful concrete example for observing the broader question of how regulators handle access and risk isolation at the same time.
On September 18, the Bank of Russia published a new draft rule requiring commercial banks to limit their exposure to crypto assets and foreign digital financial instruments to within 1% of the bank's own capital. At first glance this reads like a purely technical piece of prudential regulation news, but placed in the wider context something interesting emerges: just over two weeks earlier, Russia had formally made it legal for ordinary citizens to buy and sell cryptocurrency. The central bank is opening the door wider for retail investors on one hand, while shutting it tighter on banks' own balance sheets on the other, and that asymmetric loosen-retail, tighten-banks design is really what this story is worth unpacking.
The draft introduces two new ratios: N31 applies to individual credit institutions, while N32 applies to a banking group's consolidated capital; both carry the same 1% ceiling, but the benchmark being measured against is the bank's own capital, not its total assets. The scope covered is fairly broad, including crypto assets banks hold directly, derivatives linked to cryptocurrency prices, loans, bonds, and repurchase agreements whose settlement or valuation depends on crypto assets. On risk weighting, the draft splits crypto-related exposure into different tiers: a bank's own positions and client positions for which the bank bears liability for losses carry a steep 1,250% risk weight; client custody assets for which the bank does not bear loss liability are excluded from the 1% cap calculation but still carry a 50% risk weight. Banks must stay within this ceiling on every single operating day, and a breach on six or more days within any 30 consecutive operating days counts as noncompliance, giving the central bank authority to take action against the institution. The rule remains in draft form for now, with official publication planned for the fourth quarter of 2026, taking effect 10 days after publication, and banks expected to begin reporting the relevant data from January 2027.
Understanding the weight of this draft requires seeing exactly when it landed. Russian President Vladimir Putin signed the country's first comprehensive cryptocurrency regulatory law on August 4, with most provisions formally taking effect September 1, opening regulated channels for ordinary citizens and institutions to legally buy and sell cryptocurrency through licensed intermediaries. Under that law, non-qualified retail investors can purchase up to 300,000 rubles, roughly $3,800, worth of crypto assets per year through a single intermediary, after passing a suitability test; qualified investors face no such cap and can freely trade any crypto asset. In other words, Russian regulators are effectively doing two opposite things at once: opening a legal channel for millions of ordinary citizens to access cryptocurrency for the first time, while setting a ceiling on how much commercial banks themselves can touch crypto assets that is far stricter than typical prudential rules.
The 1% figure sounds low on its own, but understanding why it landed there requires reading it alongside the 1,250% risk-weight figure. In common bank-supervision language, a risk weight typically reflects how risky an asset is considered, the higher the number, the more dangerous the regulator views that asset, and the larger the capital buffer a bank must set aside for it. A 1,250% weight is an extreme, top-of-the-scale figure, effectively placing crypto assets at the very peak of the risk spectrum. The intent is direct: even though Russia has decided to let ordinary citizens legally hold cryptocurrency, the central bank still does not want that volatility, and cryptocurrency's own market risk, to seep into the broader traditional financial system through bank balance sheets, if the crypto market were ever to suffer a severe crash, banks should not fail alongside it simply because they were carrying too large a crypto position, which would in turn threaten depositors' funds. The timing of this draft is also worth noting, it landed shortly after the European Union imposed a fresh round of sanctions targeting Russia-linked crypto firms, and the Bank of Russia has recently been accelerating work on a range of supporting rules, including capital requirements for digital custodians.
If you are a retail investor inside Russia, this draft does not directly affect how much crypto you can buy or sell, that is governed by the new law already in effect since September 1 and the 300,000-ruble cap, this draft targets the banking system's own balance sheet, not retail investment accounts. But what this rule indirectly reveals carries reference value for investors anywhere: when a regulator simultaneously widens retail access while sharply tightening banks' own exposure, it usually signals the regulator treats giving the public a legal channel and letting crypto risk seep into the banking system in a way that could threaten financial stability as two entirely separate problems requiring separate handling. That logic is worth watching for anyone thinking through where regulatory policy is headed in their own jurisdiction, because it hints at a supervisory philosophy that could become an international trend: open up access, while walling systemic risk off from traditional financial institutions.