A hosting provider may give out computing capacity only after identifying the customer. NeuroVision is built into registration and billing: a passport without manual entry and with a forgery check, Liveness, company by INN, sanctions and lists — for the first order, GPU and large limits.
Russian software register No. 19972 · 152‑FZ
All three obligations are in one article of the Information Law. A provider that does not identify customers violates Part 5 of this article — and an uncorrected violation leads to removal from the register, without which it cannot operate.
149‑FZ, Art. 10.2‑1, Parts 1, 6, 8–11 (as amended by 406‑FZ of 31.07.2023).
149‑FZ, Art. 10.2‑1, Part 5; Rules approved by Government Resolution of 29.11.2023 No. 2011. In force since 1 December 2023.
149‑FZ, Art. 10.2‑1, Part 5.1 (law of 26.06.2026 No. 210‑FZ), Part 4.1 (law of 01.04.2025 No. 41‑FZ).
The law requires identification from everyone who provides computing capacity. But the depth of the check depends on what the customer receives: a site on a shared server, root access to a machine or hundreds of GPUs on deferred payment.
Rules No. 2011 permit ten methods, and a provider may combine several. Some establish identity, others confirm only the channel — a number or a card. For expensive and risky services, a weak method is worth strengthening with a document check.
Whichever method you choose, information about it is stored for each customer (para. 13 of the Rules). Customers identified no earlier than 1 January 2023 do not have to be re-verified (para. 14).
The customer signs in through Gosuslugi and can pass on their full name, date of birth, passport and registration address. Biometrics — through the Unified Biometric System under Law No. 572‑FZ. A foreigner without an account cannot use this method — they need another method from the Rules.
The customer sends data signed with a qualified electronic signature: an individual — full name and passport, a sole proprietor — also INN and OGRNIP, a company — name, OGRN and INN. Company by INN NeuroVision checks before the contract.
An individual — a passport or another document, a sole proprietor — also an entry in the Unified State Register of Individual Entrepreneurs, a company representative — a power of attorney and an entry in the Unified State Register of Legal Entities. A passport at an office or partner point is recognised without manual entry and checked for forgery.
A transfer from an account in a bank of Russia or the EAEU, a one-off card operation (except a prepaid card), a payment through the Faster Payments System. The provider stores the date, amount and operation number. It confirms the payer, not the person who works on the server.
A code by SMS or a call to the number of a Russian operator. The most widespread and the weakest method: a SIM card in a front person's name is easier to buy than a passport.
A personal account in the provider's own system, its group's system or the system of a Russian owner. The data set is determined by the system owner. NeuroVision's document and face check is built into your registration system through the Web SDK and API.
The basic method from the Rules — at registration, without extra steps for an honest customer. The document, Liveness and company check are enabled where risk grows: the first server, a new card, GPU, a large limit.
The customer registers through Gosuslugi, phone, card or the Faster Payments System — as configured by the provider. The method and the operation data are recorded in the customer card: para. 13 of the Rules requires this.
Before the first VPS, GPU access or a limit increase, the customer photographs the passport in the widget and goes through Liveness. Fields arrive without manual entry, and anti-fraud flags a photo of a screen and a printout. A company customer — a check by INN and a representative's session.
The provider sees the result of each check and decides itself whether to issue the resource. The passport number, INN and identification method are stored to respond to requests and to find repeat registrations.
An SMS code and a one-off card operation confirm that the customer has a number and a card. They do not show who will work on the server — which is why abuse comes from accounts that passed formal identification.
A “bank” or “marketplace” page lives on shared hosting for a few hours. When a complaint arrives, the account owner turns out to be a front and the payment came from someone else's card.
A VPS with a clean IP address sends spam and brute-forces passwords. The address ends up on blacklists, and honest customers from the same subnet suffer along with it.
Dozens of servers for a trial period are created by a batch of accounts from different numbers. A passport and Liveness make the “batch” expensive: every account needs a live person with a document.
A GPU is rented with a stolen card, and a month later a chargeback arrives. A document and sanctions list check before a GPU is issued weeds out such orders before the capacity is charged.
The order in which a provider verifies a new customer. Each line shows who performs the step: NeuroVision, the provider itself or a government system.
Risk. A foreign company or a foreign individual usually has no verified account — the simplest method from the Rules is unavailable to them.
NeuroVision. Recognises passports and ID cards from 195+ countries and territories, 16,000+ document types, without manual entry of Latin script.
Provider. Chooses another method from the Rules for foreigners and stores information about it.
Risk. A transfer and a card count only if the bank is Russian or from the EAEU; a payment from another country is not identification under the Rules.
NeuroVision. A document and Liveness show who is behind the account; sanctions lists and compliance screening — whether the customer is on any lists.
Provider. Decides which method from the Rules suits a foreigner and whether prepayment is needed.
Risk. If the rules are cut down to Gosuslugi, the Unified Biometric System and a visit, a foreigner will have only to come with a passport — to the provider's office or to a partner.
NeuroVision. The passport at the counter is recognised from a photo and checked for forgery, and the fields go into the contract without retyping.
Provider. Opens reception points or agrees with partners in the required countries.
Risk. A corporate customer from abroad — a representative with a passport and a power of attorney, the company is not in the Unified State Register of Legal Entities.
NeuroVision. The representative's session with a document and Liveness, OFAC, EU, UK and UN sanctions lists by company name and by individuals.
Provider. Requests the company's registration documents and confirmation of authority.
In July 2026 the Ministry of Digital Development discussed three methods with providers — Gosuslugi, the Unified Biometric System and a personal visit; no decision had been taken at the date of publication. Follow changes to Rules No. 2011 — we will update this page.
A SIM card bought “to order”
The account is confirmed by an SMS code, but the number is registered to an unrelated person. A passport and Liveness before the first server show who is actually ordering the resource.
A one-off operation with a stolen card
The identifying payment goes through, and a month later a chargeback arrives. The account owner's document and matching the full name with the payer's data — before GPUs and dedicated servers are issued.
A document from someone else's correspondence
The customer uploads a photo of someone else's passport or a doctored scan. Anti-fraud flags a photo of a screen, a printout, a pasted-in photo and traces of editing.
A company for a single contract
A corporate account is opened for a firm with a nominal director and blocked accounts. A check by INN shows this before an invoice with deferred payment.
Came back under a different number
The customer was blocked for mailings and registers again. The passport number and INN from the response match the old account — the provider sees this before the first server.
№ 2011
Method — before the server
Identification at registration is the minimum required by law. It is worth repeating the check when the cost of a mistake changes: the customer asks for more resources, is the subject of complaints or the account passes to another person.
The most expensive resources are most often taken with other people's data. A document, Liveness and sanctions lists — before the first GPU, even if the customer has long been on shared hosting.
The customer asks to raise a limit or switch to pay-as-you-go. A company — by INN, a representative — by passport, before you extend credit.
Phishing, a mailing or an attack from the customer's server. Re-checking the document shows whether the account owner exists — the data will be useful for responding to the regulator.
The account is handed over to another person or company. The new owner goes through identification again, and the method is recorded in the customer card.
Each check is enabled separately — by plan and risk. You pay for completed requests; a check for which there was not enough data is not charged. All database checks — in general catalogue.
Individual customer
Passport without manual entry, anti-fraud and live presence.
A Russian passport is recognised from a photo: the fields arrive as a JSON response to the platform.
from 16 ₽
Learn moreA foreign citizen's document is recognised from a photo; the name in Latin script is taken from the machine-readable zone.
from 16 ₽
Learn moreA check that a live person is in front of the camera, and matching their face against the photo in the document.
from 29 ₽ per session
Learn moreThe authenticity and validity of a Russian passport through the interagency interaction system. It catches expired, replaced, lost and invalid documents and verifies that the passport was issued to this particular person.
5 ₽ / check
Learn moreCompany customer and reseller
By INN: unambiguous, no namesakes.
Status in the state registers, signs of a shell company, court cases and debts, the director and shareholders — in a single request.
on request
Learn moreA flag that the person is listed as a nominee or serial company director.
5 ₽ / check
Learn moreTax authority decisions suspending account operations: the date, the decision number and the reason for the freeze.
5 ₽ / check
Learn moreA history of disputes from the commercial court case file, bankruptcy cases included. Matching is done by tax number, so namesakes never reach the results.
5 ₽ / check
Learn moreGPU, large limits and foreigners
Lists and sanctions by full name, date of birth and name.
Screening against the list of people involved in extremist activity or terrorism. A mandatory check under 115-FZ.
5 ₽ / check
Learn moreScreening against the consolidated lists of OFAC (USA), the European Union, the United Kingdom and the UN. Every match carries a similarity score and a flag if it was triggered by an alias.
5 ₽ / check
Learn moreA check against the Russian Ministry of Justice's foreign agents register. Its entries carry a date of birth and a tax number, so a match can be verified.
5 ₽ / check
Learn moreInternational screening against politically exposed persons and their associates, sanctions lists from more than 50 countries, regulatory actions and adverse media coverage. For Russian citizens it runs from the international passport or from the full name and date of birth.
36 ₽ / check
Learn moreRepeat registrations and risk
INN, wanted lists and foreigners in the Ministry of Internal Affairs register.
Determining the tax number from the passport data. It unlocks the checks that need precise identification of the person — with no namesakes.
5 ₽ / check
Learn moreA search of the federal database of people wanted by the police. Filtered by the full date of birth — results with no namesakes.
5 ₽ / check
Learn moreA check on a foreign national against the register of controlled persons that the police have kept since February 2025: people who have lost the legal grounds to stay in Russia. Russian citizens do not need the check — by law they are not in the register.
5 ₽ / check
Learn moreA search of the federal bankruptcy register: personal bankruptcy cases filed and completed. By tax number the result is unambiguous.
5 ₽ / check
Learn moreA fixed price per check, no subscription fee. A mass-market shared hosting plan and a GPU cloud are checked differently — you pay only for the steps you enable.
from 16 ₽ per session
A Russian passport or a foreigner's document without manual entry, anti-fraud: a photo of a screen, a printout, a pasted-in photo, editing. An additional document in the same session — 10 ₽.
Everything in “Document”, plus Liveness and matching the face against the photo in the document. For VPS, dedicated servers and GPU.
5 ₽ per check
Nominal head, blocked accounts, the Rosfinmonitoring list and sanctions — 5 ₽ each. Company by INN — by calculation, compliance screening — 36 ₽.
One session — one person: the company representative goes through their own. The session price falls with volume: at 10,000 checks a year — 18 ₽ by the calculator. A check for which there was not enough data is not charged. Calculator on the pricing page.
The check is built in where the customer already works: registration, the personal account and server ordering. Steps are enabled by scenario rules — a document for the first server, Liveness for GPU.
Payment for completed checks, the data retention period is set in the scenario, support through a ticket system.
A provider needs a check that does not drop the conversion of mass-market plans and holds back abuse on expensive resources — and that can be shown to the regulator.
The passport is recognised without manual entry and checked for forgery, Liveness tells a live person from a photo and a screen, and the company is checked by INN. Steps are enabled by risk — an honest customer completes registration without extra screens.
There is no need to assemble a solution from several vendors and reconcile their responses.
A short guide to the concepts found in the law on hosting providers and in the Identification Rules.
The Unified Biometric System, risk-based checks, foreign customers and company checks — in our blog.
Yes. Under Part 5 of Art. 10.2-1 of the Information Law, computing capacity may be provided only after the customer is identified and/or authenticated. The procedure is set by the Rules approved by Government Resolution of 29.11.2023 No. 2011; they have been in force since 1 December 2023.
Ten: Gosuslugi, the Unified Biometric System, a qualified electronic signature, documents in a personal visit, a transfer from an account in a bank of Russia or the EAEU, the information system of the provider or of a Russian company, a payment card (except a prepaid one), a subscriber number and the Faster Payments System. Several can be combined.
Roskomnadzor will send a requirement to correct the violation within up to 10 working days. If it is not corrected, the provider may be removed from the register, and operating outside the register is not allowed.
For formal compliance with the Rules — these are permitted methods. But they confirm a number and a card, not a person: for VPS, GPU and large limits, providers add a passport and Liveness check.
Foreigners usually have no Gosuslugi account, and a payment counts only from a bank of Russia or the EAEU. The provider chooses a suitable method from the Rules; NeuroVision recognises documents from 195+ countries and territories and checks the customer against sanctions lists.
NeuroVision works on top of a method from the Rules and strengthens it. How to classify a NeuroVision check under the Rules is for your lawyer to decide.
By INN — status, signs of a shell company, courts, debts, nominal head and blocked accounts. The representative goes through their own check with a passport and confirms authority with a power of attorney.
If the customer was identified by one of the methods of the Rules no earlier than 1 January 2023 — no. Re-verification is still justified for GPU access, limit growth and an abuse complaint.
The Web SDK for the website and personal account works in a mobile browser and in a WebView inside the app; for server-side integration there is the REST API. You can also send the customer a unique verification link.
The retention period is set in the scenario settings, and data can be deleted. Where the servers are located and how personal data is processed is defined by the contract. The provider stores the information about the identification method itself.
No, these are different rules. Here — hosting providers and Art. 10.2‑1; administrators of .ru and .рф domains are identified by registrars under their own rules.
A passport with anti-fraud — from 16 ₽ per session, with Liveness — from 29 ₽, database and sanctions list checks — 5 ₽ each, a company check by INN — by calculation. No subscription fee. A test is available in the test scenario of the personal account.
Tell us which services you sell, how many customers register per month, which methods from the Rules you already use and whether you have foreign customers. We will propose a scenario by risk and set up test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a callThe company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
