115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements

Breaking down the obligations under 115-FZ starts with one question: is the business named among the law’s subjects at all. The law names three closed circles — organizations and entrepreneurs under Article 5, the “other persons” under Article 7.1, and the narrow circle under Article 7.1-1 — and their obligations differ, diverging further within a circle by type of activity. If the business falls into none of the circles, no special AML/CFT obligations arise: it remains a bank’s customer, not a subject of these regimes, although the law does place two obligations on it as well — knowing its own beneficial owners under Article 6.1 (for legal entities, except for the exceptions directly named in it) and disclosing information about itself to the bank under Article 7(14). There can therefore be no single checklist “for any business”: first the circle, then the regulator and the governing act, and only after that the specific obligations and deadlines.

Who 115-FZ Applies To

Circle One: Organizations Under Article 5

The list under Article 5 is closed. The grouping below is for the reader’s convenience, not from the text of the law: the provision gives a list with no subdivisions, no subject is excluded, and the conditions for applicability don’t change.

Financial organizations: credit institutions and branches of foreign banks; leasing companies; factoring companies; consumer credit cooperatives; microfinance organizations.

Insurance and investment: professional securities market participants, except those engaged solely in investment advisory services (they have a separate, third circle of obligations — see below); investment platform operators; insurance organizations, insurance brokers, and foreign insurance organizations, except for compulsory health insurance medical organizations; management companies of investment funds, mutual funds, and non-state pension funds; mutual insurance societies; non-state pension funds.

Property transactions: pawnshops; organizations buying and selling precious metals, precious stones, jewelry, and scrap of such items; intermediaries in real estate purchase and sale transactions; organizers of gambling.

Payments and digital assets: payment acceptance operators; operators of information systems used to issue digital financial assets; organizations that exchange digital currencies; digital depositories — the last two were added by Federal Law No. 283-FZ of 4 August 2026.

Other directly named subjects: federal postal service organizations; certain telecom operators; operators of lotteries and financial platforms.

When 115-FZ Applies to an Individual Entrepreneur

Under Article 5, only three categories of individual entrepreneurs become subjects of the law: insurance brokers; those who buy and sell precious metals, precious stones, jewelry, and scrap of such items; and those who provide intermediary services in real estate purchase and sale transactions. But that’s not the only basis: Article 7.1 describes its own circle by type of activity, regardless of legal form, and an entrepreneur can fall under it as someone providing legal or accounting services, as an individual auditor, or as someone engaged in mining — with a limited set of obligations and only once the conditions of that circle arise. Any other entrepreneur doesn’t become a subject of 115-FZ and remains a bank’s customer: their own obligation under the law is only to provide the bank with information under Article 7(14). An entrepreneur who is a carrier, runs a retail shop, or develops software isn’t a subject of 115-FZ, unless they engage in activity covered by Article 7.1.

Circle Two: “Other Persons” Under Article 7.1

The second circle is the “other persons” under Article 7.1 — eight entries across four subparagraphs of a single provision; the grouping is the same reader’s-convenience grouping as above.

Legal and audit services: attorneys; notaries; audit organizations and individual auditors; organizations and individual entrepreneurs providing legal or accounting services.

Trust management: trustees (managers) of a foreign structure without forming a legal entity; executive bodies of a personal fund, except an inheritance fund, including an international personal fund, except an international inheritance fund.

Digital currency mining: persons engaged in digital currency mining, including mining pool participants; persons organizing a mining pool’s activity.

The law lists the Article 7.1 obligations by clause number, as a closed list: it doesn’t include reporting on mandatory-control transactions, suspending transactions, refusing to carry out a transaction, or quarterly screening against lists.

For most of this circle, obligations arise only when preparing or carrying out, on behalf of or on the instructions of a customer, one of the eight operations and transactions directly named in the law — from real estate transactions and managing a customer’s property to creating or selling legal entities and mining. That’s why an attorney handling a criminal case and an attorney supporting a real estate transaction are different legal situations, and bookkeeping as such isn’t on this list at all. Auditors also have their own separate basis — the mere fact of providing audit services. For organizers of a mining pool, it’s the distribution of digital currency among participants.

A notary has two grounds: the same eight operations, plus, on top of them, four types of notarial acts — certifying transactions, accepting cash sums and securities on deposit, executive endorsements, and acts related to increasing an LLC’s charter capital under a convertible loan agreement. For the transactions subject to certification, a separate list is set by Rosfinmonitoring Order No. 333 of 23 December 2024: nine types, from the paid transfer of real estate to a participant’s application to withdraw from an LLC. Notifying Rosfinmonitoring of any grounds to believe a transaction is connected to money laundering or terrorist financing is an obligation of the whole circle in its own right, one that subjects under Article 5 don’t share in the same form. The law extends everything else to them from Article 7 — as a list the law doesn’t go beyond: from identification and internal control rules to responding to requests, retention, and freezing against lists; the full set is in the applicability matrix below.

Circle Three: Article 7.1-1 — Trade Organizers and Investment Advisors

The third circle is narrower than the first two and is closed by a separate provision: trade organizers, clearing organizations, central counterparties, and professional securities market participants engaged solely in investment advisory services — the very ones excluded from the Article 5 list above. They have exactly three obligations: providing information at the authorized body’s request (the Bank of Russia sets the procedure and scope in agreement with the authorized body), notifying when there are sufficient grounds to believe a transaction is connected to money laundering or terrorist financing, and not disclosing the fact that information has been passed on. The law provides for neither internal control rules, nor a designated compliance officer, nor customer identification, nor mandatory control for this circle.

Details for each circle are in the groups of obligations below; the basic AML/CFT concepts are covered in a separate article.

How to Determine the Applicable Requirements

Eight steps help walk through the path from determining the circle and regulator to retaining documents — the law itself doesn’t contain such an algorithm; it’s just a way of moving through its structure. Not every step is mandatory for every circle: persons under Article 7.1 have a narrower set than subjects under Article 5, and for the circle under Article 7.1-1, only the first three steps apply; in place of steps 4–8, it has three obligations of its own from the “Circle Three” section.

These steps define the special AML/CFT regime. The obligation for legal entities to know their own beneficial owners under Article 6.1 applies regardless of circle, and even outside all three — except for the categories directly named in paragraph 2 of that article.

Who Supervises Compliance With the Requirements

Which authority supervises an activity determines which act sets the requirements for internal control rules, training, and other obligations. The allocation is set by Article 9.1 of the law, and Rosfinmonitoring isn’t the universal supervisory authority in it: it acts only where there’s no industry regulator.

Article 9.1 names: industry-specific supervisory authorities — for most subjects under Article 5; the self-regulatory organization of auditors — for audit organizations and individual auditors who are its members; bar associations of the constituent entities of the Russian Federation — for attorneys; notary chambers of the constituent entities of the Russian Federation — for notaries; the Bank of Russia’s chief auditor — for the digital ruble platform operator. The criterion for Rosfinmonitoring is the absence of an industry supervisory authority for a subject under Article 5: such subjects are the ones required to register with it. This criterion is currently applied by Resolution No. 58 of 27 January 2014 to four positions: leasing companies; organizations and individual entrepreneurs acting as intermediaries in real estate transactions (counted separately); and factoring companies. For the other subjects under Article 5, supervision is allocated by industry, including: the Bank of Russia — credit institutions, branches of foreign banks, and non-bank financial organizations; Roskomnadzor — federal postal service organizations and telecom operators; the Assay Chamber — participants in the precious metals and stones market. The Bank of Russia supervises the circle under Article 7.1-1 — Article 9.1(5) names it directly. For the remaining persons under Article 7.1, the general rule applies: the industry-specific supervisory authority in the relevant field of activity supervises them.

Applicability Matrix

The table answers the question “which of these obligations applies to me personally”; details and the underlying provisions are in the section below. For persons under Article 7.1, a “yes” mark means applicability once the conditions of that circle arise — one of the eight operations, notarial acts under subparagraph 2, audit services, or distributing currency within a mining pool (see “Circle Two” above) — not unconditionally for any activity of theirs. The matrix gives the general obligations of subjects under Article 5; digital depositories and operators of information systems used to issue digital financial assets have their own additional provisions on top of these. These are Article 7.2-1, on transmitting information about the payer and recipient in transactions with digital currencies and rights, and Article 7(16), which prohibits transfers to address identifiers outside the perimeter of digital depositories in favor of persons on the lists.

Eleven Groups of Obligations

The law frames obligations by clause of each article, without cross-cutting groups; the groups below are for the reader’s convenience, and each is grounded in a specific provision. For persons under Article 7.1, the phrase “applies to persons under Article 7.1” below means applicability once the conditions of that circle arise — see “Circle Two” above — not unconditional application to any activity of theirs.

Register With Rosfinmonitoring and Work Through the Personal Account

Registration. The governing provision is Resolution No. 58 of 27 January 2014 (current version of 12 June 2024), which applies the Article 9.1 criterion to four categories: leasing companies; organizations and individual entrepreneurs acting as intermediaries in real estate transactions (counted separately); and factoring companies. The registration card must be submitted within 30 calendar days of the date of state registration, amendments to the founding documents, or changes to the information in the Unified State Register of Legal Entities (EGRUL) or the Unified State Register of Individual Entrepreneurs (EGRIP) — but no later than the business day preceding the day the first contract for the relevant services is concluded: the thirty days aren’t a grace period, and if the contract is concluded earlier, registration must happen before it. The territorial authority makes the decision to register within no more than 8 business days of receiving the card. Deregistration follows the same resolution: an application in free form on the ground of “change of activity,” or a decision by the territorial authority on its own initiative upon learning of the cessation of activity; the decision period is the same, no more than 8 business days.

Personal account. This is a separate and broader obligation: Article 3 of the law directly names as personal-account users all organizations under Article 5 and all individual entrepreneurs under Article 5, Part 2 — which is broader than the four categories directly supervised by Rosfinmonitoring. Lists, decisions by the coordinating body, typologies, training courses, and part of the reporting are delivered through the account. Under Resolution No. 1020 of 18 August 2026, access to the account was included in the content of internal control rules — its absence can be classified as a violation of the internal control rules requirements. Persons under Articles 7.1 and 7.1-1 use the personal account in the cases provided for by federal laws and acts of the President, the Government, and the authorized body. For entities supervised by the Bank of Russia, information is delivered through its own personal accounts.

Risk: Article 15.27(1) of the Code of Administrative Offenses of the Russian Federation.

Develop and Maintain Internal Control Rules

The governing provision is Article 7(2): subjects under Article 5 and persons under Article 7.1 are required to develop internal control rules and appoint a designated compliance officer. The rules are approved by the organization’s head or by the individual entrepreneur themselves.

The content of the rules is set by three different acts — depending on the circle and regulator. Resolution No. 667 of 30 June 2012 has lost force: since 10 August 2025, the requirements for internal control rules for subjects under Article 5 outside Bank of Russia supervision have been set by Resolution No. 1157 of 2 August 2025 (current version of 18 August 2026). For credit institutions, branches of foreign banks, and non-bank financial organizations — the Bank of Russia, in particular through Regulation No. 860-P of 18 June 2025. For persons under Article 7.1 — a separate act, Resolution No. 1180 of 7 August 2025.

Internal control rules must be updated no later than a month after new AML/CFT acts take effect, unless those acts themselves establish otherwise, and this must be formalized as a new version of the rules. The rules can be kept as an electronic document signed with an enhanced qualified electronic signature (UKEP). For banking groups and holding companies, there are target internal control rules: the parent organization develops them, and a group member is entitled, but not required, to join them.

Risk: Article 15.27(1) of the Administrative Offenses Code; Article 15.27(1.1) for credit institutions.

Appoint a Designated Compliance Officer and Train Staff

The governing provision is the same Article 7(2). All subjects under Article 5 and all persons under Article 7.1 are required to appoint a designated compliance officer. Self-appointment as the compliance officer is possible in both circles, but under different acts: Resolution No. 1157 for an individual entrepreneur under Article 5; Resolution No. 1180 for persons under Article 7.1, where the list is closed and includes attorneys, notaries, individual auditors, and individual entrepreneurs in the field of legal, accounting, and mining services. The condition in both acts is the same and referential: compliance with the requirements of the legislation — which ones exactly, below. The law prohibits appointing to this position a person with an unexpunged conviction for crimes in the economic sphere or against state authority, and, for a number of organizations, a person who doesn’t meet the business-reputation requirements.

The qualification requirements are set by the Government of the Russian Federation — through Resolution No. 492 of 29 May 2014 — for organizations outside Bank of Russia supervision; for those under its supervision, the Bank of Russia itself sets them in agreement with the authorized body. There’s an asymmetry in qualifications too: the full set of requirements — a higher education degree in “Economics and Management” or “Jurisprudence,” or, failing that, at least two years of experience, plus training — applies only to organizations’ compliance officers. For individual entrepreneurs under Article 5, persons under Article 7.1, and their employees performing compliance-officer functions, Resolution No. 492 imposes only the training requirement: the education and experience requirements don’t apply to them.

There are four forms of training: introductory, supplementary, and targeted briefings, plus knowledge-level upgrading — there are no “scheduled” and “unscheduled” forms in the act. Introductory briefing is conducted upon hiring and upon transfer to the relevant position. Supplementary briefing is conducted no less often than once a year, and also when acts or internal control rules change, or when an employee takes up new work. Targeted briefing is one-time: a future compliance officer receives it before starting work, while the head, chief accountant, and legal counsel receive it within a year of being assigned their duties. Knowledge-level upgrading is conducted no less often than once every three years, and no less often than once a year for the compliance officer of a financial-market organization.

Risk: Article 15.27(1) of the Administrative Offenses Code; Article 15.27(1.1) for credit institutions.

Identify the Customer, Representative, Beneficiary, and Beneficial Owner

The governing provision is Article 7(1)(1) and (1)(2). Identification of the customer, representative, and beneficiary (if they participate in the transaction) is carried out before the customer is accepted for service and applies to subjects under Article 5 and to persons under Article 7.1 — this obligation is on the Article 7.1 closed list. The exemptions are directly listed in the provision itself; a single general rule won’t cover it.

Identifying the beneficial owner is a separate obligation with its own standard: taking reasonable and available measures to establish them — without a guarantee of a result. It isn’t carried out for a closed list of customers: government authorities, state corporations and organizations with more than 50% state participation, international organizations and foreign states, religious organizations, public issuers, foreign organizations listed on an exchange from the Bank of Russia’s list, and foreign structures without forming a legal entity for which a beneficial owner isn’t provided for. If the beneficial owner isn’t identified, the customer’s sole executive body may be recognized as such; a separate article covers the beneficial owner in detail.

If identification hasn’t been carried out, or if information that’s mandatory when studying the customer hasn’t been established, the organization is required to refuse to accept the customer for service: unlike refusing to carry out a transaction, which remains a right, this is an obligation. It doesn’t apply when identification isn’t required by law; the refusal itself doesn’t give rise to civil liability toward the customer.

Risk: Article 15.27(1) of the Administrative Offenses Code; Article 15.27(2) if it resulted in a failure to submit information about transactions.

Separate from this group — the obligation to know one’s own beneficial owners. Article 6.1 places this on legal entities regardless of circle, and even outside all three; it doesn’t apply to individual entrepreneurs. The law extends the same rules to foreign legal entities and foreign structures without forming a legal entity that carry out their activity on the territory of the Russian Federation (Article 6.1(7.1)). A legal entity needs to have information about its own beneficial owners and take reasonable and available measures to establish them, update that information no less often than once a year or whenever it changes, document it, and retain it for at least five years from the day the information is received. The starting point here is different from retaining documents about a customer: there, the period runs from the day the relationship ends. Information is provided at the request of Rosfinmonitoring, the tax authorities, or the Ministry of Justice. Article 6.1(2) names the exemptions as a closed list: government authorities, state corporations and organizations with more than 50% state participation, international organizations and foreign states, religious organizations, public issuers, and foreign organizations listed on an exchange from the Bank of Russia’s list. The list of exemptions for identifying a customer’s beneficial owner is one entry wider — it also includes foreign structures without forming a legal entity, to which Article 6.1, by contrast, does apply.

Risk — a separate article of the Administrative Offenses Code, 14.25.1, not 15.27: ₽30,000–40,000 for officials, or disqualification for up to a year; ₽100,000–500,000 for legal entities.

Study the Customer and Update Information About Them

The governing provision is Article 7(1)(1.1) and (1)(3), applying to subjects under Article 5 and persons under Article 7.1. Studying the customer includes information about the purposes of establishing business relations and, on an ongoing basis, about the purposes of the customer’s financial and economic activity, financial position, and business reputation; the scope of the measures depends on the risk level. Establishing the customer’s source of funds is a right for the organization in the case of an ordinary customer; for foreign politically exposed persons, this is an obligation under Article 7.3, and for the other categories of PEPs, it applies only once the customer has been assigned a high risk level.

Updating information is tied to risk level and to reasonable doubts: no less often than once every three years for low-risk customers, no less often than once a year for the rest, and within seven business days of the doubts arising if there are doubts about the reliability of previously obtained information.

Risk: Article 15.27(1) of the Administrative Offenses Code.

Assess the Risk Level and Manage It

The governing provision is Article 7(1)(3.1) and (1)(3.2), applying to subjects under Article 5 and persons under Article 7.1. The organization is required to assess the customer’s risk level both when accepting them for service and in the course of further servicing, taking into account the national risk assessment, the nature of the activity, and the products used, and to assign the customer to a risk group.

Dividing customers into three groups — low, medium, and high — is an obligation only for credit institutions and branches of foreign banks; a scale isn’t prescribed for the rest, but one group still has to be singled out — Resolution No. 1157 requires heightened attention to the transactions of customers classified in the high-risk group. Based on the results of the assessment, the organization is required to take measures to mitigate the identified risks under its own internal control rules.

The “Know Your Customer” platform operates separately: the Bank of Russia assigns legal entities and individual entrepreneurs to risk groups and communicates this to participants through personal accounts. It applies to credit institutions and branches of foreign banks, and, from 1 September 2026, also to digital depositories, operators of information systems used to issue digital financial assets, brokers, trust managers, fund management companies, and organizations that exchange digital currencies. For the new categories, participation is one-sided: only credit institutions and branches of foreign banks submit customer information to the Bank of Russia; the rest receive the information and are entitled to take it into account as an additional factor in their risk assessment. The platform informs, but doesn’t replace the organization’s own risk assessment: the obligation under Article 7 remains and isn’t shifted onto anyone else.

Risk: Article 15.27(1) of the Administrative Offenses Code.

Identify Politically Exposed Persons

The governing provision is Article 7.3, applying to subjects under Article 5; partially to persons under Article 7.1 (subparagraphs 1, 3, 4, 5 of paragraph 1, and paragraphs 3, 4 of Article 7.3). The law distinguishes three categories — foreign, international, and Russian officials — with a different threshold for the measures becoming mandatory. A separate article covers the regimes in detail; how screening against PEP lists works technically after the customer has been identified is covered in the article “How Sanctions Screening, PEP Checks, and Risk Profiling Work”.

Risk: Article 15.27(1) of the Administrative Offenses Code; Article 15.27(2) for a failure to submit information about transactions.

Screen Customers Against Lists, Freeze Funds, and Reconcile the Database

The governing provision is Article 7(1)(6), (1)(6.1), and (1)(7), and Articles 7.4 and 7.5, applying to subjects under Article 5; to persons under Article 7.1 — to the extent of Article 7(1)(6) and (1)(6.1), and Article 7.5(2).

There are several lists, and they’re not synonyms for “blacklists”: the list of persons involved in extremism or terrorism; the list of persons involved in the proliferation of weapons of mass destruction; decisions of the interagency coordinating body on freezing; and lists under UN Security Council decisions. The sanctions regimes of the United States, the European Union, and the United Kingdom aren’t part of this group.

The freezing deadlines don’t match: immediately, no later than twenty-four hours from the day the information is posted, for the national list and the coordinating body’s decisions; immediately, no later than twenty hours from the moment the notification is received, for the UN lists (the full breakdown is in the table below). Subjects under Article 5 are required to reconcile their database against the lists no less often than once every three months; this doesn’t apply to persons under Article 7.1.

There are two exemptions: auditors are exempt from the freezing requirements when providing audit services; notaries apply them only in connection with one notarial act — accepting cash sums and securities on deposit (Article 35, Part 1, Clause 12 of the Fundamentals of the Legislation on Notaries).

Screening against lists inevitably also produces false positives; for how to reduce them without losing onboarding conversion, see the article “False Positives in AML Screening”.

Risk: Article 15.27(2.1) of the Administrative Offenses Code — the fines are higher than under the general offense.

Identify and Report Mandatory-Control Transactions

The governing provision is Article 6 and Article 7(1)(4), applying only to subjects under Article 5 — it doesn’t apply to persons under Article 7.1 at all; this subparagraph isn’t on their closed list.

The basic threshold is ₽1 million, and it applies only to the types of transactions under Article 6(1). Other transactions have their own thresholds, from ₽50,000 to ₽10 million, down to no threshold at all for non-profit organizations: the law sets them individually in Article 6(1.2)–(1.12), with no single scale. The threshold for real estate transactions is no longer fixed in the law: it’s set by a Rosfinmonitoring order, with a floor of no less than ₽5 million and the right to differentiate by type of organization. Order No. 13 of 26 January 2026 set a ₽5 million threshold for real estate intermediaries, effective 1 April 2026; for credit institutions, the amount is higher. A transaction is subject to control regardless of the amount if one of its parties is a person on the list of those involved in extremism or terrorism.

The set of reportable transactions is different for each category: Article 6(4) specifies exactly which subparagraphs each category reports under — which is why there can be no single list for every subject.

Risk: Article 15.27(2) of the Administrative Offenses Code — the sanction is stricter than under the general offense in Part 1.

Identify Suspicious Transactions, Refuse to Carry Them Out, Suspend Transactions, and Report This

The governing provision is Article 7(3), (10), (11), and (13), applying to subjects under Article 5. These provisions don’t apply to persons under Article 7.1: instead, they have their own, narrower obligation to notify Rosfinmonitoring whenever there are any grounds to believe a transaction is connected to money laundering or terrorist financing, while the circle under Article 7.1-1 has a third, separate threshold: sufficient grounds to believe. The three formulations within one law aren’t synonyms and relate to different circles.

The law uses four independent mechanisms:

• Identifying and reporting suspicious transactions — no later than three business days from the day of identification, regardless of whether the transaction is also subject to mandatory control. The law doesn’t contain a closed list of indicators — suspicion is formed on the basis of the internal control rules; “transit character,” “structuring,” and “profile mismatch” are industry indicators.
• Refusing to carry out a transaction — a right of the organization when staff develop suspicions, not an obligation. The decision is made by the head or a person authorized by them.
• Suspension — for five business days from the day the transaction was due to be carried out, on a closed list of grounds; credits to an account aren’t suspended.
• Reporting on refusals — no later than the business day following the decision.

Risk: Article 15.27(2) of the Administrative Offenses Code for suspicious transactions; Article 15.27(2.1) for suspension; Article 15.27(2.2) for refusals.

Document Transactions, Retain Documents, Respond to Requests, and Assess New Services

Three obligations are grouped together here — all three concern the organization’s internal discipline.

Documentation and retention. The governing provision is Article 7(2) and (4), applying to subjects under Article 5 and persons under Article 7.1. The grounds for documentation are named in the law: a transaction’s confusing nature with no economic substance, a transaction’s inconsistency with the purposes of activity under the founding documents, a customer’s refusal of a transaction that raised suspicions, and a customer’s decision to terminate the relationship for the same reason. Documents and information used for identification must be retained for at least five years from the day the relationship with the customer ends — this is a floor; the rule is limited to these documents and doesn’t extend to the entire archive.

Responding to a request from the authorized body. The governing provision is Article 7(1)(5), applying to subjects under Article 5 and, with an exemption for attorney-client privilege, to persons under Article 7.1. The Government of the Russian Federation sets the scope and procedure; for credit institutions, the Bank of Russia does. The authorized body isn’t entitled to request documents on transactions predating the law’s entry into force, except in cases under an international treaty. For notaries, this requirement is narrowed twice: it applies only to executive endorsements and the certification of mediation agreements, and only if the request was made in connection with checking transactions for a connection to money laundering or terrorist financing.

Assessing new services. The governing provision is Article 7(5.14), applying to subjects under Article 5 and persons under Article 7.1. Before rolling out a new service or software and hardware tool, the organization is required to assess the risk of its use for money laundering or terrorist financing and reduce it.

Separately, there’s a prohibition on disclosing to customers and other persons the fact that information has been passed to the authorized body; an equivalent prohibition applies to persons under Article 7.1 and Article 7.1-1.

Risk: Article 15.27(2.3) of the Administrative Offenses Code for requests; Article 15.27(1) for documentation and retention.

Deadlines for Reporting to Rosfinmonitoring

The common assumption that “everything is reported within three business days” is incorrect. There are at least six different deadlines, and several of them share the same length but differ in their starting point: for mandatory control, the period runs from the day the transaction is carried out, while for suspicious transactions, it runs from the day they’re identified.

Separately: notification of inclusion on a UN list arrives through the personal account no later than four hours from the moment it’s posted. The deadlines for persons under Article 7.1 aren’t set by Article 7.1 itself — they’re set by the rules approved by Resolution No. 131 of 11 February 2025, which replaced the repealed Resolution No. 569.

Liability

Article 15.27 of the Administrative Offenses Code has a note that makes most fine tables misleading: as a general rule, this article doesn’t apply to credit institutions — the Bank of Russia applies measures to them instead, with the only exceptions being Parts 1.1 and 4. And one more thing: an individual entrepreneur is liable under this article as a legal entity, under the upper scale of fines.

In addition to the Administrative Offenses Code, 115-FZ itself, in Article 13, provides for its own consequences, including the revocation or cancellation of a license.

What’s Changing in 2025–2026

Over the past year and a half, several values have changed that are most often cited in outdated form.

The takeaway is simple: check any value without a version date again.

How This Is Automated

Part of the processes under 115-FZ lends itself well to automation: collecting and recognizing data, screening against lists, monitoring changes. The substantive part is harder to automate: risk assessment, working through a match, and the final decision — refuse, suspend, report, or continue servicing. These decisions and the responsibility for them remain with the organization — the service only helps prepare them; how to build an automation architecture is the topic of the article “Fintech Compliance Under Federal Law 115-FZ”.

115-FZ Screening at NeuroVision

NeuroVision automates specific processes within the organization’s own perimeter: document recognition during identification, screening against lists and PEP lists, continuous monitoring of changes with notifications, and keeping a history of checks for regulator requests. The service doesn’t make or replace decisions on assigning a risk group, suspending a transaction, or refusing service — these remain the responsibility of the subject of the law.

FAQ

Is an Individual Entrepreneur Required to Comply With 115-FZ?

Under Article 5 — only if they fall into one of three categories: an insurance broker; someone who buys and sells precious metals, precious stones, jewelry, and scrap of such items; or an intermediary in real estate purchase and sale transactions. But an entrepreneur can also fall under Article 7.1 — if they provide legal or accounting services, are an individual auditor, or engage in mining, with a limited set of obligations. For everyone else, 115-FZ is a matter of their bank's own rules; their own obligation is only to provide the bank with information under Article 7(14).

Is Registration With Rosfinmonitoring Required?

Only if the organization or individual entrepreneur falls into one of four categories directly supervised by Rosfinmonitoring: leasing companies, organizations and individual entrepreneurs acting as intermediaries in real estate transactions (counted separately), and factoring companies. The other subjects under Article 5 have their own industry supervisory authorities — for example, the Bank of Russia, Roskomnadzor, or the Assay Chamber.

How Often Must Customer Information Be Updated?

It depends on the assigned risk level: no less often than once every three years for low-risk customers, no less often than once a year for the rest. If doubts arise about the reliability of previously obtained information, the information must be updated within seven business days of the doubts arising.

How Long Must Documents Be Retained Under 115-FZ?

At least five years from the day the relationship with the customer ends. This is a floor, not an exact period; the rule is limited to the documents and information named in Article 7 and doesn't extend to the organization's entire archive.

How Does Refusing a Transaction Differ From Suspension or Freezing?

These are three different mechanisms. Refusing a transaction is the organization's right when suspicions arise. Suspension is a mandatory procedure for five business days, on a closed list of grounds. Freezing is applied based on lists and the coordinating body's decisions without assessing the specific transaction, with deadlines of twenty-four or twenty hours — depending on the list.

Is It True That All Deadlines Under 115-FZ Are Three Business Days?

No. Three business days is the most common deadline: it applies to reports on mandatory control, on suspicious transactions, to notifications by persons under Article 7.1, and to a notary's refusal of a notarial act, but their starting points don't always match. There are other deadlines too: from a few hours for freezing to five business days for a person under Article 7.1 to respond to a request, and once a quarter for database screening — the full breakdown is in the deadlines table.

Does the "Know Your Customer" Platform Replace an Organization's Own Risk Assessment?

No. The Bank of Russia assigns customers to risk groups and communicates this to the platform's participants, but the organization's obligation to independently assess customer risk remains and isn't shifted onto anyone else.

What Are the Penalties for Violating 115-FZ?

It depends on the specific violation and who's liable. Administrative liability under Article 15.27 of the Administrative Offenses Code ranges from a warning to a fine of ₽1 million or suspension of activity for up to 90 days, depending on the part of the article. As a general rule, this article doesn't apply to credit institutions — the Bank of Russia applies measures to them instead. An individual entrepreneur is liable as a legal entity.