Blocking Under 161-FZ for Companies and Individual Entrepreneurs: What the Bank Suspends, How the Bank of Russia Database Works, and How to Get Out of It

Under Federal Law No. 161-FZ “On the National Payment System,” a bank suspends a specific instrument — an electronic means of payment: a card, online banking, other ways of transmitting instructions remotely. The company’s account remains open, and the bank does not forcibly debit money from it. The ground for suspension is information about the customer or the customer’s electronic means of payment in the Bank of Russia database of cases and attempts of transfers without the customer’s voluntary consent (Article 9(11.6)–(11.7) of 161-FZ), or signs of such a transaction in a specific transfer (Article 8). Let’s look at what exactly is blocked, whom it concerns — a company, an individual entrepreneur (IP), or only an individual — and what will change in 2027.

Below — how a company ends up in the Bank of Russia database, what the bank is entitled and what it is required to do, how to get out of the database, what happens if the company itself is the recipient of a transfer made without consent, and what will change in 2027.

What Is Blocked Under 161-FZ: The Card and Online Banking — the Account Stays Open

An electronic means of payment (EMP) is a way of drawing up, certifying, and transmitting instructions to transfer money using information and communication technologies: a bank card, a bank’s mobile app, online banking, and other electronic media and devices (Article 3(19) of 161-FZ). Parts 11.6–11.11 of Article 9, which describe the suspension, do not contain the word “account” at all — they deal only with the EMP.

In practice, this means that the bank stops accepting instructions through the card and the online account, but the company’s account itself is not closed and its balance is not frozen. The law does not expressly describe, for companies and IPs, disposing of the account in any way other than the suspended EMP — for example, by a written order at a branch: this possibility is not established in Article 9(11.6)–(11.11). For individuals, the Bank of Russia states in its explanations that they can apply to a branch with a passport; the regulator has no similar explanation for legal entities and IPs.

161-FZ is not the only law under which a bank can restrict work with an account. If it is specifically account transactions that are restricted — debits, transfers via the Faster Payments System (SBP), cash withdrawals — there are two more grounds: blocking under Federal Law No. 115-FZ “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism” within the Bank of Russia’s Know Your Customer (ZSK) platform (the so-called “red zone”; we covered its mechanics in the article “The Bank of Russia’s Know Your Customer Platform: What a Risk Zone Means for a Company”) and suspension of transactions by the Federal Financial Monitoring Service (Rosfinmonitoring). These two are easy to confuse with each other: in both, the restriction looks like “transactions are frozen,” and the “what is restricted” row does not distinguish this pair at all. The reliable signs are who made the decision and where to go about that decision; they do not coincide anywhere between ZSK and Rosfinmonitoring:

Rosfinmonitoring is the federal financial monitoring body in the field of combating the legalization (laundering) of proceeds; we covered the general logic of this oversight in the article “Financial Monitoring and AML/CFT in Simple Terms”. Here it acts under a separate part of Article 8 of 115-FZ (parts 10–16, current version) — on a different ground than the signs of a transfer without the customer’s consent under 161-FZ. The provision contains neither the word “dropper” nor the word “fraud”: the ground is formulated through the legalization (laundering) of criminal proceeds.

The deadlines under 161-FZ do not boil down to one — there are three, and each is determined by its own ground:

• two days — suspension of the acceptance of an instruction or refusal of a transaction when signs of a transfer without consent are detected in a specific transfer (Article 8(3.4));
• for the period the information remains in the Bank of Russia database — suspension of the EMP itself (Article 9(11.6)–(11.7));
• up to five business days — a separate case where the company itself turns out to be the recipient of a transfer made without consent (covered in the section “If the Company Is the Recipient”).

This is not the same as the five business days of transaction suspension under 115-FZ — 115-FZ has its own closed list of grounds, its own procedure, and its own article: “115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements”.

Why a Company Ends Up in the Bank of Russia Database

The database of cases and attempts of transfers without the customer’s voluntary consent is formed and maintained by the Bank of Russia (Article 27(5) of 161-FZ). The Bank of Russia provides information from it to money transfer operators, payment system operators, payment infrastructure service operators, and electronic platform operators (Article 27(7)) — it is these organizations that check a customer against the database.

The law defines a transfer without the customer’s voluntary consent as a transfer made either without the customer’s consent at all, or with consent obtained under the influence of deception or through abuse of trust (Article 8(3.1)). The database currently includes:

• information on the cases and attempts of such transfers themselves;
• information on cash deposits made without the voluntary consent of the depositor, which the bank provides in accordance with the law on banking activities;
• information on consumer loan agreements concluded without the customer’s voluntary consent, which microfinance organizations provide;
• transfers in respect of which the Bank of Russia has received information from the Ministry of Internal Affairs (MVD) on unlawful acts committed (Article 27(8)).

Operators are required to report to the Bank of Russia all cases and attempts of transfers without the customer’s consent, and the Bank of Russia is entitled to request additional information from them (Article 27(6)). According to the Bank of Russia’s explanation, a recipient’s details enter the database after an additional check, including in cooperation with banks — the procedure of such a check itself is not described in the text of the law.

The period during which information remains in the database is currently not established by law. The law introduces fixed retention periods only from 1 March 2027 — they are covered below, in the section on the 2027 changes.

Separately from the database, the bank checks every transfer for signs that it is being made without the customer’s consent — before money is debited in card transactions, transfers of electronic money, or via the Faster Payments System, or upon accepting the instruction in other cases (Article 8(3.1)). The signs are established by the Bank of Russia and posted on its website (Article 8(3.3)); from 1 January 2026, their list was expanded from 6 to 12 (Bank of Russia Order OD-2506 of 5 November 2025, according to the regulator’s website). We will not retell the content of the order — the list may be updated, and the current version is always on the Bank of Russia website.

What the Bank Is Entitled and What It Is Required to Do

The bank’s rights and obligations when there is information in the database and when signs are detected differ not only by ground but also by whom they concern. The table shows this separately for a company, an IP, and an individual — each row has its own provision and its own limits of application:

On the ₽100,000 limit for IPs, the law gives no direct answer either way: the provision is addressed to a “customer who is an individual,” and IP status is not mentioned in it separately. We will not present an exact figure for IPs as established.

After a suspension or refusal of a specific transaction under Article 8, the customer may disagree with the bank’s decision: confirm the instruction no later than the day following the day of suspension, or — if the bank refused a transaction by card, electronic money, or SBP — repeat it with the same details and amount (Article 8(3.6) and (3.8)). This right belongs to all customers regardless of status. If, after such confirmation, the bank nevertheless receives information about the recipient from the Bank of Russia database, it is entitled to suspend execution for another two days or refuse the repeated transaction, but once this period expires it is required to execute the instruction if there are no other lawful grounds for refusal (Article 8(3.10)–(3.11)).

How to Get Out of the Database

The procedure in the law itself is the same for all customers. After a suspension under Article 9(11.6) or (11.7), the bank is required to notify the customer immediately and inform them of the right to submit an application to the Bank of Russia for the removal of the information from the database — including through the bank itself (Article 9(11.8)). The bank is entitled to submit such an application on its own, without the customer, if it considers the inclusion unfounded (Article 9(11.9)). The Bank of Russia considers the application and makes a reasoned decision within 15 business days at the latest; a refusal can be challenged in court (Article 9(11.10)). After the information is removed from the database, the bank is required to resume the use of the EMP immediately and notify the customer — but only if there are no other grounds for suspension under the law or the agreement (Article 9(11.11)): if blocking under 115-FZ is in effect in parallel, removal from this database does not lift it.

The law does not describe the details of the procedure for a company or an IP — they exist only in the Bank of Russia’s explanations. According to the regulator, a legal entity, an individual entrepreneur, and a person engaged in private practice submit an application in one of two ways: through any bank where they are serviced (the bank is required to forward the application to the Bank of Russia no later than the next business day), or directly through the Bank of Russia’s online reception. An individual entrepreneur’s application must state the identity document, the TIN, and the numbers of accounts, cards, or e-wallets; a legal entity’s application — the TIN and the same details of accounts, cards, or wallets. These are requirements for the content of the data according to the Bank of Russia’s explanation, not provisions of the law.

Separately, according to industry legal news citing the Bank of Russia press service, an updated procedure for considering applications has been in effect since 2 May 2026 (Bank of Russia Ordinance No. 7287-U of 19 January 2026, amending Ordinance No. 6748-U of 13 June 2024): before making a decision, the regulator contacts the bank, and the bank contacts the customer at whose request the information was entered into the database — to clarify whether that customer still considers the transaction fraudulent. An application by a representative acting under a power of attorney is submitted through the bank that services the customer. We did not obtain the text of the Ordinance itself: the description above is a retelling of the news and of the press service’s statement, without quoting the document.

If the Company Is the Recipient

A separate mechanism concerns the situation in which the company itself is the recipient of a transfer made without consent. It is triggered in only one case: the paying customer — a legal entity — notified its bank of a transfer without consent after the funds were debited. In this situation, the payer’s bank is required to immediately send the recipient’s bank a notice of the need to suspend the crediting (Article 9(11.1)). If the payer is an individual, Article 9(11.1) does not trigger this mechanism.

Having received such a notice before the crediting, the recipient’s bank suspends the crediting for up to five business days and notifies the recipient of the need to submit documents confirming that the receipt of the funds is justified (Article 9(11.2)–(11.3)). The recipient may be a company, an IP, or an individual — the provision contains no restrictions by the recipient’s status. If the documents are submitted, the bank credits the money; if not, once five business days have expired, the recipient’s bank is required to return the funds to the payer’s bank no later than two business days, and the payer’s bank credits the refund to the customer no later than two business days after that (Article 9(11.4)). If the money has already been credited to the recipient’s account by the time the notice is received, the recipient’s bank reports that suspension is impossible (Article 9(11.5)).

The five business days under Article 9(11.2)–(11.4) are a stand-alone period, separate both from the two days under Article 8 and from the five business days of suspension under 115-FZ: the law gives the same number, but the circumstances differ.

What Will Change in 2027

The Bank of Russia database will remain one and the same — new rules are added to it at different times:

Two different changes from different laws fall on 1 September 2027. 283-FZ changes the Bank of Russia database — that is the table row above. Separately from the database, 210-FZ introduces a limit on payment cards from the same date: one customer who is an individual may have no more than twenty payment cards from which transfers are made (new Article 9(2.2)–(2.4) of 161-FZ). This change has nothing to do with the Bank of Russia database, EMP suspension, or removal from the database, and it does not concern companies or IPs.

Connecting banks to the state information system “Antifrod” is a separate topic and a separate law; we covered how a bank connects to it in the article “How a Bank Connects to GIS Antifrod in 2026”. Whether the new retention periods apply to information already in the database before 1 March 2027, the law does not say directly — there is no transitional provision on this.

From 1 September 2027, the same database also becomes a source for digital currency exchangers and digital depositories: under the digital currency law, they will be required to check against it when carrying out customers’ transactions. Companies’ and individual entrepreneurs’ own deals with exchangers and digital depositories will not be affected by this check — the law expressly takes such deals out of its scope; for a company this matters only if it turns out to be the recipient of a transfer from an individual. We cover the details of this regime in the article on the digital currency law 282-FZ.

EMP suspension and the check against the Bank of Russia database are what the bank itself does with its customers; only transfer operators, payment system operators, and payment infrastructure operators are connected to the database. An independent look at a counterparty before a payment is a separate task, unrelated to this check.

FAQ

The Bank Blocked an IP's Card Under 161-FZ — Is That an Account Block?

<p>No. What is suspended is the electronic means of payment — the card or access to online banking; the account is not blocked (Article 9(11.6)–(11.11) of 161-FZ, statutory provision).</p>

How Can I Tell Whether I Have a Suspension Under 161-FZ, a Block Under 115-FZ, or a Rosfinmonitoring Decision?

<p>If a specific channel is restricted — the card, online banking — it is most likely 161-FZ. If account transactions as a whole are restricted, there are two options, and what distinguishes them is who made the decision: the bank — then it is usually 115-FZ and the Know Your Customer platform (a detailed breakdown is in the article on the ZSK platform); Rosfinmonitoring — then the grounds will be communicated upon application within three business days (Article 8(16) of 115-FZ) (statutory provision).</p>

Can Cash Be Withdrawn at the Cash Desk If the EMP Is Suspended?

<p>The law does not separately describe such a possibility for companies and IPs: Article 9(11.6)–(11.11) deals only with the suspension of the EMP, and the provision does not mention other ways of disposing of the account. The Bank of Russia, in its explanations, speaks of applying to a branch with a passport with regard to individuals; the regulator has no similar explanation for legal entities and IPs (statutory provision + Bank of Russia explanation, partially).</p>

What Limit Applies to Transfers If the EMP Is Not Suspended?

<p>₽100,000 per month — only for transfers by a customer who is an individual to other individuals. This restriction does not extend to companies; the law gives no direct answer for IPs (Article 9(11.6), statutory provision).</p>

How Can an LLC or an IP Apply for Removal From the Bank of Russia Database?

<p>Through any bank that services it — the bank is required to forward the application to the Bank of Russia no later than the next business day — or directly through the Bank of Russia's online reception. The application must state the TIN and the details of accounts, cards, or wallets; for an IP — additionally, the identity document (statutory provision — the right to apply and the consideration period; the content of the documents — Bank of Russia explanation).</p>

From 2027, Will Digital Currency Exchangers Also Check Companies Against This Database?

<p>No. The law expressly takes deals of legal entities and individual entrepreneurs with exchangers and digital depositories out of the scope of this check. It will concern a company only if it turns out to be the recipient of a transfer from an individual (statutory provision).</p>

If the Bank Unlawfully Executed an Instruction Without the Customer's Consent, Will the Company Receive Compensation?

<p>No. The provision on reimbursement of the transfer amount when the bank violates the requirements of Article 8 concerns only a customer who is an individual; it does not extend to companies or IPs (Article 8(3.13), statutory provision).</p>