Antifrod 2.0 and 3.0: What Has Already Been Adopted and What Is Being Discussed for Banks, Communications Operators, and Marketplaces

“Antifrod 2.0” and “Antifrod 3.0” are labels used by the media and by the Bank of Russia itself, not names from the law. Behind the first is the adopted and partly already effective Federal Law No. 210-FZ of 26 June 2026 — it amends the law “On Communications,” the national payment system law, the Consumer Protection Law, the GIS Antifrod law, and a number of other laws — here we look at the changes that matter for banks, communications operators, and aggregator owners. Behind the second is a bill of the Ministry of Digital Development (Mintsifry) that is still only being discussed. Let’s look at what of this is already mandatory, for whom exactly and from what date, and what so far exists only on the paper of the bill.

What Has Already Been Adopted: 210-FZ and Four Dates

210-FZ has no single date of entry into force — the provisions of the law are distributed across tranches (Article 11), and each of the three obligated circles has its own date:

The procedure for connecting to GIS Antifrod, its structure, and the scenarios for exchanging signals are covered in the article “How a Bank Connects to GIS Antifrod in 2026” and on the page “Connecting to GIS Antifrod and Processing Signals” — we do not repeat these topics here. Next — for each of the three obligated circles separately: what exactly changes and from what date.

Banks and Money Transfer Operators: Card Accounting and the Limit Are Two Different Requirements, Not One

The law separates them by date and by content, and “accounting” should not be confused with “the limit” — these are different obligations with different deadlines.

The Unified Payment Card Accounting System (ESUPK) is already in force from 1 September 2026 (Article 9.2 of Federal Law No. 161-FZ “On the National Payment System”): it is created for the purpose of accounting for cards used to make money transfers; the system’s operator is the operator of the national payment card system; its users are the Bank of Russia and money transfer operators. From that date, money transfer operators are already required to send to the ESUPK information on the numbers and types of cards issued to customers who are individuals, on their TINs, and on the number of cards provided to each customer (Article 9.2(5) and (7)); the Bank of Russia is entitled to request the same information from the ESUPK operator (Article 9.2(9)). So far this is only collection of data — there is no limit based on it yet.

The 20-card limit takes effect separately, on 1 September 2027 (Article 9(2.2) of 161-FZ): a customer who is an individual may be provided by money transfer operators, in total, with no more than twenty payment cards used to make money transfers. The Bank of Russia Board of Directors is entitled to establish cases in which a customer may be provided with more than twenty cards. From the same date, the operator is required to request information about the customer from the ESUPK before issuing a card (Article 9(2.3)) and is required to refuse to issue it if issuing would violate the limit (Article 9(2.4)) — that is, the ESUPK’s obligation to provide this information to operators for checking the limit also begins only on 1 September 2027 (Article 7(4), paragraphs 15 and 17), even though the system itself and the collection of data into it have been running for a year already.

Separately, from 1 March 2027, banks acquire obligations to protect the customer from malware on the device and new grounds for reimbursing stolen funds (Article 8(3.4-1), (3.13-1)–(3.13-7) of 161-FZ) — this block of the bank’s obligations is already covered in the article “How a Bank Connects to GIS Antifrod in 2026”, in the section “Liability and Reimbursement,” and we do not repeat it here. How a bank builds such a check into its own anti-fraud loop is on the page “Anti-Fraud System for Protection Against Fraud in Customer Verification”.

Communications Operators: Detecting Numbers and Reimbursement Under Seven Conditions at Once

210-FZ adds obligations for communications operators that did not exist before, under two laws at once — 41-FZ and Federal Law No. 126-FZ “On Communications” — and both groups take effect on one date, 1 March 2027.

Under 126-FZ (Article 1 of 210-FZ) — what works directly for anti-fraud:

• the operator is required to transmit to the subscriber a mark on a call initiated from the network of a foreign communications operator with foreign numbering; the time limits, procedure, content, and format of the mark will be established by the Government (new Article 46(9.2));
• an individual is entitled to prohibit in advance, for themselves, both the conclusion of new agreements for mobile communications services and the receipt of calls from foreign numbering; either of these prohibitions can be lifted only by applying in person (Article 45(7.1) and (7.2) as newly worded);
• an agreement for a new number can be terminated no earlier than 90 days after it was allocated; if the subscriber nevertheless applies earlier, the operator is required to immediately suspend services on the number and not charge for this (new Article 44(10) and (11));
• a database of equipment identifiers is created — a list of identifiers permitted and prohibited for use in mobile communications networks (new Article 53.2);
• mass calls made in violation of the requirements of the law are unlawful — with a closed list of exceptions (new wording of Article 44.1-1):
  • a credit institution is entitled to call its customer under an agreement concluded with that customer, if the right to such informing is separately established by a federal law or an act of the President, the Government, or the Bank of Russia — the law names preventing transfers without the customer’s consent only as one of the cases of such a right, not as a separate ground beyond it; the obligation to notify the subscriber that the calls are made on the basis of an agreement with the subscriber rests with the credit institution itself, not with the communications operator that lets them through;
  • two more grounds: calls by state bodies and their subordinate organizations, local self-government bodies and their subordinate organizations, other bodies and organizations on a list set by the Government; and calls for the purpose of informing, when this obligation is established by a law or an act of the President, the Government, or the Bank of Russia;
  • the operator is required to let all calls on these grounds through free of charge;
  • the federal communications authority is entitled to set the maximum fee for other informational call campaigns.

Under 41-FZ, a communications operator is required (Article 1(10)):

• to detect, according to criteria set by the Government, subscriber numbers from which or to which calls and text messages with signs of unlawful acts are made, and to report them to GIS Antifrod;
• to suspend communications services on a number about which such information has been received — and not only on it: the suspension extends to all other numbers allocated by the same operator to the same individual, for a period determined by the Government in agreement with the Federal Security Service (FSB).

A separate provision concerns reimbursement. A communications operator reimburses an individual for the amount of a transfer made without the individual’s consent if seven conditions are met simultaneously (Article 1(11) of 41-FZ):

1. in the agreement with the money transfer operator, the customer specified a subscriber number that belongs specifically to the communications operator that then reimburses the money — one of three cases:
   • the number was allocated to the customer under an agreement with this communications operator;
   • the number was transferred to the customer for use by a subscriber of the same communications operator — a legal entity or an individual entrepreneur;
   • the number was transferred to the customer, as a family member, close relative, or another person on a list set by the Government, by a subscriber of the same communications operator who is an individual (Article 45(10) of 126-FZ);
2. the transfer without consent occurred as a result of a call or text message from a number already identified as suspicious;
3. the transfer took place because the communications operator failed to fulfill one of its requirements — did not transmit information to the GIS, did not suspend services on an already identified number, did not suspend the passage of a call at the moment it was being set up when it matched the risk criteria, or did not suspend the communications services themselves for a call within one network;
4. the money transfer operator, for its part, fulfilled the requirements properly;
5. at the time of the transfer, the database of cases of transfers without the customer’s consent did not yet contain information about this customer;
6. the customer sent the money transfer operator a request for reimbursement no later than 10 business days from the day of the transfer without consent itself or from the day of receiving the operator’s notice of this transfer;
7. at the time of reimbursement, the customer has a decision to open a criminal case on the fact of theft.

Omitting any of the conditions means turning a conditional provision into an unconditional promise to return the money, and that is not the case: without all seven, the communications operator is not required to reimburse.

At the same time, the money is not paid to the customer by the communications operator directly at the customer’s request: the customer applies with their request to the money transfer operator, and it is that operator — if condition 4 is met and the GIS contains no information under Article 1(10), items 2 and/or 3, of 41-FZ — that forwards the request to the communications operator; only after such a request, and if the customer has a decision to open a criminal case, does the communications operator make the reimbursement (Article 1(13) and (14) of 41-FZ).

The criteria for the third condition (items (v) and (g)) must also include cases where a call needs to be interrupted at the moment it is being set up within the operator’s own network — that is, not only reporting a suspicious number after the fact, but also blocking a call already in progress if the number matched the criteria (Article 1(12) of 41-FZ). If neither the money transfer operator nor the communications operator has made the reimbursement, the individual is entitled to recover it through the courts (Article 1(16) of 41-FZ).

Aggregator Owners: The Obligation Exists, the Procedure Does Not Yet

The word “marketplace” does not appear in the text of 210-FZ even once. The law speaks of the “aggregator owner” (Article 3(2), new Article 41(3) of the Consumer Protection Law): from 1 March 2027, the aggregator owner is required to interact with the state information system for countering offenses in the cases and in the procedure established by the Government of the Russian Federation.

This is the entire provision — the obligation itself is named, but the cases and procedure of interaction have not yet been established by a Government resolution as of 8 November 2026. Whether a specific platform falls under the definition of “aggregator owner” is a question of legal qualification, not the subject of this article.

“Antifrod 3.0”: What Is Being Discussed and What Cannot Be Claimed

Everything in this section is a draft, not a law. None of its provisions is in force, and it is not known in what form (and whether) it will become law. The draft was posted by Mintsifry on the regulation.gov.ru portal (No. 171465) on 30 September 2026; as of 8 November 2026, it is at the stage of summarizing the results of public discussion. The names “antifrod 3.0” and “package” do not appear in the text of the draft even once — this is a label from the media.

The draft affects nine laws; the following relate to the topics of this article:

• sub-dealers are restricted: only a legal entity under a written agency agreement will be able to conclude agreements for mobile communications services on behalf of a communications operator and accept payment for them, and only through employees under an employment contract with that legal entity; such agreements cannot be concluded with individual entrepreneurs and individuals, and subdelegation of powers under them is not permitted. The draft obliges the communications operator itself to verify the accuracy of information about such an employee;
• the sale of SIM cards through aggregators is restricted: a SIM card may not be sold by a person who is not a mobile network operator if the very opportunity to view the offer to buy it was provided by an aggregator owner. The draft also introduces the same prohibition into Federal Law No. 289-FZ (the Platform Economy Law) — Article 7(2) receives a separate item on cases of such a prohibited sale of a SIM card, that is, the requirement is addressed to the aggregator owner from this side as well;
• for banks — an exception in 115-FZ: the rule on using Bank of Russia information on risk groups in simplified identification does not apply if a customer who is an individual is provided with an electronic means of payment;
• for GIS Antifrod — a new wording of Article 1(5) of 41-FZ: the current provision stores information on persons “who committed” unlawful acts; the draft changes the wording to persons “involved in committing” them — the circle is described more broadly. It also adds a category that does not exist in the current version at all: information needed to register or authorize a user of an online service in order to access its functions, including cases where access to this information was provided unlawfully. Whether this changes the amount of data the GIS actually stores does not follow from the text of the draft;
• for communications operators — an expansion of an already adopted provision, not a new obligation: currently, having identified a suspicious number, the operator suspends services on it and on all numbers that the same operator has allocated to the individual who uses this number. The draft changes the subject from “individual” to “subscriber” in general — a broader circle — and gives the operator the right not only to suspend but also to terminate services, with exceptions to be established by the Government.

Entry into force — expected from 1 March 2028 (Article 10 of the draft).

Where the Name “Antifrod 2.0” Comes From

The Bank of Russia, in its press release of 9 June 2026, calls the adopted law “Antifrod 2.0,” but the release does not give the law’s number — that it refers specifically to 210-FZ follows from the coincidence of content and dates, not from a direct statement by the regulator.

The same release also contains a discrepancy with the provision that deserves attention: the Bank of Russia writes that one person may have no more than 20 payment cards opened in total across all banks, whereas the provision (Article 9(2.2) of 161-FZ) says otherwise — the circle of persons required to observe the limit is money transfer operators, not “all banks,” and only cards used to make transfers are counted. In this article, the facts are given according to the provision, not according to the regulator’s retelling.

FAQ

What Is “Antifrod 2.0” in Simple Terms?

The everyday name of Federal Law No. 210-FZ of 26 June 2026 — the law itself does not use this name. It amends the law “On Communications,” the national payment system law, the Consumer Protection Law, the GIS Antifrod law, and a number of other laws, and adds anti-fraud obligations for banks, communications operators, and aggregator owners, with four dates of entry into force: 1 September 2026, 1 March 2027, 1 September 2027, and 1 January 2028 (the last — for a separate provision of 63-FZ).

When Does the 20-Card Limit Take Effect and Whom Does It Cover?

From 1 September 2027. The limit concerns customers who are individuals and money transfer operators: a customer may not be provided, in total, with more than twenty payment cards used to make transfers. Before issuing a card, the operator is required to request information in the unified payment card accounting system and to refuse if issuing would violate the limit.

When Is a Communications Operator Required to Return Money Stolen by Fraudsters?

Only if all seven conditions are met simultaneously: the number was specified by the customer in the agreement with the money transfer operator, the transfer occurred because of a call or text message from exactly this number, the communications operator failed to fulfill one of its requirements regarding this number, the money transfer operator for its part fulfilled the requirements, the database of cases of transfers without the customer's consent did not yet contain information, the customer sent a request no later than 10 business days from the day of the transfer or from the day of receiving notice of it, and the customer has a decision to open a criminal case.

Are Marketplaces Already Required to Connect to GIS Antifrod?

The obligation for the “aggregator owner” takes effect on 1 March 2027, but the cases and procedure of interaction must be established by the Government, and as of 8 November 2026 it has not yet done so. The word “marketplace” does not appear in the law itself.

Is “Antifrod 3.0” Already an Adopted Law?

No, it is a Mintsifry bill that, as of 8 November 2026, is undergoing public discussion; entry into force is indicated in the text of the draft as expected from 1 March 2028.