The Bank of Russia assigns every company and individual entrepreneur that is a client of a bank to one of three groups by risk of conducting suspicious transactions — low, medium, or high; on the Bank of Russia’s website they are called green, yellow, and red. The Bank of Russia’s public service shows only one thing: whether a company has been assigned to the high-risk group. The “red zone” on its own does not block an account — under the law, restrictions are imposed by the bank, and only when additional conditions are met; the way to challenge the decision depends on whether those restrictions have already been applied.
Below: how the level is assigned, who receives the Bank of Russia’s information from 1 September 2026, how to find out your own level or a counterparty’s, what exactly a high level means, how to challenge it, when it can lead to removal from the register, and what to do in advance.
What the ZSK Platform Is and Whom It Assesses
The Bank of Russia’s “Know Your Customer” platform (ZSK, from its Russian name, Znay Svoego Klienta) is the mechanism through which the Bank of Russia assigns every legal entity and every individual entrepreneur (IP) that is a client of a bank or of a branch of a foreign bank and is registered in Russia to one of three groups by risk of conducting suspicious transactions: low, medium, or high degree (level) of risk (Article 9.1(1) of Federal Law No. 86-FZ of 10 July 2002 “On the Central Bank of the Russian Federation,” hereinafter 86-FZ, version of 4 August 2026). The “green,” “yellow,” and “red” groups are terms from the Bank of Russia’s web page; the law itself does not use them.
The platform assesses only legal entities and IPs registered in Russia that are clients of banks and of branches of foreign banks. Credit institutions themselves, branches of foreign banks, government bodies, and local self-government bodies are expressly excluded from the assessment. The platform does not assess individuals; self-employed persons (samozanyatyy) without IP status are not assigned a risk level because they are not registered as IPs — this is how the Bank of Russia explains it.
The legal basis is Articles 7.6–7.8 of Federal Law No. 115-FZ of 7 August 2001 “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism” (hereinafter 115-FZ, version of 4 August 2026) and Article 9.1 of 86-FZ. These provisions were introduced by Federal Law No. 423-FZ of 21 December 2021 and have been in effect since 1 July 2022. Which transactions are considered suspicious and how financial monitoring works in general is covered in Financial Monitoring and AML/CFT in Simple Terms (AML/CFT: anti-money laundering and combating the financing of terrorism).
How the Bank of Russia Assigns a Risk Level
The criteria for assignment to risk groups are determined by the Bank of Russia in agreement with the Federal Financial Monitoring Service (Rosfinmonitoring) and approved by the Bank of Russia’s Board of Directors (Article 9.1(4) of 86-FZ). The criteria are based on the type and nature of the company’s activities, transactions on its accounts, transactions with digital currency and digital rights, its founders and managers, affiliation with companies that conduct suspicious transactions, the number of accounts, the results of the national and sectoral risk assessments, information from government bodies, and other information (Article 9.1(5)).
The published criteria are the decision of the Bank of Russia Board of Directors of 24 June 2022; it expressly states that indicators that do not directly characterize suspicious transactions do not become a standalone ground for assignment to the high-risk group. No newer version of the criteria has been published as of the article’s date; at the same time, no regulation anywhere records that the criteria have remained unchanged since 2022. The assessment itself is built on the principles of openness and availability of information on assignment to risk groups (Article 9.1(3)).
Who Receives the Bank of Russia’s Information and What Changed on 1 September 2026
Banks and branches of foreign banks submit to the Bank of Russia the names of all their legal-entity clients, the full names of all their IP clients, and their TINs (INN, the Russian taxpayer identification number) — so that the Bank of Russia can assign these clients to risk groups (Article 7.6(1) of 115-FZ). The Bank of Russia communicates the risk level to banks through their personal accounts, within the timeframes and to the extent that the Bank of Russia itself sets; the service page on the Bank of Russia’s website says “daily”; the law does not establish a frequency.
From the moment it receives the information, a bank, a branch of a foreign bank, or a digital depository is entitled to use it as an additional factor when assessing a client’s risk — the law frames this precisely as a right (Article 7.6(2)). The same organizations include in their internal control rules provisions on whether they use or do not use the Bank of Russia’s information (Article 7.7(1)) — in other words, the law expressly allows for both options.
Since 1 September 2026, in addition to banks and branches of foreign banks, the platform’s information is also received by digital depositories; operators of information systems in which digital financial assets are issued; professional securities market participants engaged in brokerage or trust management; management companies of investment funds, unit investment funds, and non-state pension funds; and organizations engaged in digital currency exchange (Federal Law No. 283-FZ of 4 August 2026). The expansion of the circle of participants, and the point that the platform does not replace an organization’s own risk assessment, are covered in detail in 115-FZ: What Businesses Are Required to Do.
What’s new compared with that article: since 1 September 2026, digital depositories are subject not only to receiving the information but also to the measures and review regime of Articles 7.7–7.8 of 115-FZ — if a depository uses the Bank of Russia’s information and the levels match, it does not execute the client’s orders for transactions with digital currency or digital rights. The other new participants — operators of information systems with digital financial assets, brokers and trust managers, fund management companies, and digital currency exchange organizations — only receive the information and are entitled to take it into account as an additional factor; the measures of Article 7.7 do not apply to them, and they do not submit information about their clients to the Bank of Russia.
How to Find Out the Risk Level of a Company or Counterparty
The Bank of Russia is entitled to post information on its website about the assignment of legal entities and IPs to risk groups; this information is for reference only (Article 9.1(6) of 86-FZ). The composition of this information and the procedure for accessing it are established by Bank of Russia Ordinance No. 6473-U of 28 June 2023.
The TIN check service on the Bank of Russia’s website is public: access is provided to an unlimited number of persons, with no registration and no personal account (Ordinance No. 6473-U, clause 4). You can check both yourself and any other company or IP — the request is made using the TIN, the requester’s category (one of the options offered by the service page itself: the entity itself, a counterparty, a potential counterparty, not a counterparty, or “other”), an optional free-form purpose of the request, and a security code (Ordinance No. 6473-U, clause 3).
That said, the service shows only one thing: the TIN and information on whether or not the entity has been assigned to the high degree (level) of risk group (Ordinance No. 6473-U, clause 1). The service does not disclose low or medium levels, and the law provides no public way to find them out — nor is there a guaranteed way to “find out your medium level from the bank,” since the law does not establish an obligation to inform the client of an intermediate level. On the service page, the Bank of Russia separately warns that if a company or IP has been assigned to the high-risk group, dealing with such a counterparty is unsafe from the standpoint of anti-money laundering legislation — this is the Bank of Russia’s position; the law does not separately establish any legal consequence for the counterparty.
The bank’s own assessment may differ from the ZSK platform’s assessment — the bank forms it according to its own internal control rules. The risk group check service itself is located on the Bank of Russia website (in Russian).
What the “Red Zone” Means
Measures under 115-FZ apply only if three conditions are met simultaneously: the bank uses the Bank of Russia’s information (this is recorded in its internal control rules), and the client has been assigned to the high-risk group both by the bank and by the Bank of Russia (Article 7.7(5), paragraph 1). As the Bank of Russia itself answers the question about automatic blocking, nothing happens automatically. A high level at the Bank of Russia is not, on its own, a ground for restrictions.
If all three conditions coincide, the bank: does not carry out debits from the account, transfers via the Faster Payments System, or cash withdrawals (except for the permitted list below), and does not carry out transactions with the client’s other property; upon termination of the contract, does not pay out or transfer the remaining balance (except for certain exceptions); and terminates the ability to use an electronic means of payment (Article 7.7(5), paragraphs 2–4). For a digital depository that uses the Bank of Russia’s information, a separate rule applies when the same levels coincide: it does not execute the client’s orders for transactions with digital currency or digital rights.
No later than 5 business days after applying the measures, the bank is required to notify the Bank of Russia, and to notify the client of the measures, of the assignment to the high-risk group with reference to the criteria, and of the right to apply to the interdepartmental commission (Article 7.7(8)). The notification is deemed received on the next day if sent electronically, and on the sixth day from the date of dispatch if sent by registered mail; the deadline for applying is counted from that date. While the coinciding high levels remain in effect, the bank is not entitled to lower the client’s level on its own — only a decision of the interdepartmental commission can change it (Article 7.7(7)).
Separately from these measures, the bank has its own right: if the client has a medium or high level according to the bank’s own assessment, the bank is entitled to refuse to open an account, to terminate the contract after two or more refusals to carry out transactions within a year, or to refuse a specific transaction — this right applies regardless of whether the bank uses the Bank of Russia’s information (115-FZ, Article 7.7(3)–(4); Article 7(5.2), paragraphs 2–3, and Article 7(11)). For a medium level assigned by the Bank of Russia, the law provides no special measures — how the bank works with such a client is determined by its own internal control rules.
Which Transactions Remain Available
Even when the measures under Article 7.7(5) have been applied, a number of transactions are permitted (Article 7.7(6)): payment of taxes, fees, insurance contributions, and other mandatory payments; payment of wages to employees who were receiving them before the client was assigned to the high-risk group, in an amount not exceeding the payment for the previous month; payments under the guarantees and compensations of the Labor Code of the Russian Federation (except compensation for travel and housing rental), pensions, scholarships, alimony, and compensation for harm to life or health; payments on credit obligations that arose before the measures were applied; for an IP — transactions to support the livelihood of the IP and of family members living with the IP who have no independent source of income, not exceeding ₽30,000 per calendar month for the IP and for each such family member; transactions in bankruptcy proceedings; liquidation expenses and settlements with creditors; debits under enforcement documents and payments to participants after removal from the Unified State Register of Legal Entities (EGRUL) or the Unified State Register of Individual Entrepreneurs (EGRIP).
This availability is not absolute: the bank is entitled to refuse even the listed transactions if, as a result of internal control, suspicions arise that the transaction is being carried out for the purpose of laundering proceeds or financing terrorism.
What a Low Level Provides
A low risk level protects against some of the restrictions. The bank is not entitled to refuse to carry out a funds transfer for a low-level client if the recipient is also low-risk — at the same bank, this means the bank’s own assessment; at another bank, the Bank of Russia’s assessment (Article 7.7(2)). The right to refuse to open an account and the right to terminate the contract after repeated refusals (Article 7(5.2)) do not extend to a client whom the bank itself, under its internal control rules, has assigned to the low level. Exception: if it has suspicions, the bank may refuse a specific transfer, but it is then required to raise the client’s risk level no later than the next business day.
Your own check of a counterparty before a deal — founders, manager, beneficial owners, and history in open registers — works as a standalone KYB (Know Your Business) check, independently of the ZSK platform.
How to Challenge a High Risk Level
The appeal route depends on whether the bank has applied the measures under Article 7.7(5) (Article 7.8(3)).
| The bank has not applied measures; the high level exists only at the Bank of Russia | Measures applied (the bank’s and the Bank of Russia’s levels coincided) | |
|---|---|---|
| Where to apply | Bank of Russia — application for review of the risk level | Interdepartmental commission under the Bank of Russia — application stating that there are no grounds |
| Filing deadline | Not separately established by law | 6 months from the day following the day the bank’s notification was received |
| Application requirements | Under Bank of Russia rules; information per Bank of Russia Ordinance No. 6853-U | Under Bank of Russia Regulation No. 842-P (Appendix 3) |
| Response time | No later than 15 business days | No more than 20 business days |
| If refused | Interdepartmental commission — within 6 months from the day following the day the Bank of Russia’s decision was received, or court (115-FZ does not name a deadline for going to court) | Court |
| If not appealed | The EGRUL removal provision does not apply | Removal from EGRUL or EGRIP is possible |
If the bank has not applied measures and the high level has been assigned only by the Bank of Russia, the application for review is filed with the Bank of Russia — with documents and information if necessary (Article 7.8(1.1)). The Bank of Russia is required to consider the application and communicate its decision within 15 business days at the latest; if a decision to change the level is made, the Bank of Russia changes it within 1 business day at the latest. If the Bank of Russia refuses, the decision can be challenged in court, or the applicant can apply to the interdepartmental commission — within 6 months from the day following the day the Bank of Russia’s decision was received (Article 7.8(1.2)). The application is prepared according to the requirements of Ordinance No. 6853-U: it must state the date the check service was accessed, a reasoned justification of disagreement, and information about the company, its premises, financial reporting indicators, turnover, largest counterparties, and actual types of activity.
If the bank’s and the Bank of Russia’s levels have coincided and measures have already been applied, the appeal goes through the interdepartmental commission — the application stating that there are no grounds is filed within 6 months from the day following the day the bank’s notification of the measures was received (Article 7.8(1)). The commission’s review period is no more than 20 business days from the date of application. If the commission decides there are no grounds for the measures, the bank is required to lift the measures and change the level no later than 1 business day after receiving the decision, and the Bank of Russia is required to change the level within the same period. If the commission confirms the grounds for the measures, the decision can be challenged only in court. The commission includes representatives of the Bank of Russia and Rosfinmonitoring, and applications are considered with the participation of the customs service; the business ombudsman, all-Russian associations, and associations of credit institutions are entitled to participate by joining the multilateral cooperation agreement.
The Bank of Russia is entitled to leave an application without consideration — for example, if measures have already been applied to the applicant, if there is already a Bank of Russia decision on the same matter, if the level has already been changed as of the date of application, or if inaccurate information is found in the application.
When a Company Faces Removal From EGRUL
The law links removal from EGRUL or EGRIP only to the branch where the bank’s measures have already been applied — this provision has no bearing on a high Bank of Russia level without measures applied by the bank. Removal is possible if the applicant did not apply to the interdepartmental commission within 6 months after the bank’s notification, or the commission confirmed the grounds for the measures and the decision was not challenged in court, or the court dismissed the claim (Article 7.8(4)).
The Bank of Russia sends the information to the registration authority: no later than 10 business days after the six-month period expires or after the court ruling enters into force, or between 30 and 40 business days after the commission’s decision if it has not been challenged. The registration authority then enters the removal record under the rules of the law on state registration of legal entities and individual entrepreneurs.
What to Do in Advance
The list of information that Ordinance No. 6853-U requires for an application for review essentially shows what the Bank of Russia looks at during its review: the business model, premises, financial reporting indicators, tax burden, account turnover, largest counterparties by credits and debits, and the number of insured persons. Keeping this data up to date in advance is a practical measure, but not a guarantee: the law does not establish a link between the accuracy of this information and the actual criteria for assignment to a risk group.
A separate measure is your own check of counterparties before a deal — not only by ZSK risk level, but also against open registers, beneficial owners, and company history: the detailed procedure for such a check is in How to Vet a Company and Its Beneficial Owners Before a Deal (KYB).
Timeline 2022–2026
| Date | What changed |
|---|---|
| 1 July 2022 | The ZSK platform launched: Articles 7.6–7.8 of 115-FZ and Article 9.1 of 86-FZ entered into force |
| 1 October 2022 | The provisions on removal from EGRUL and EGRIP took effect |
| 1 September 2024 | Branches of foreign banks were added to banks within the platform’s perimeter |
| 1 October 2024 | Review of a high level directly by the Bank of Russia was introduced (without applying to the commission) |
| 1 October 2024 | The date from which the Bank of Russia announced the availability of the public TIN check service (announcement of 20 September 2024) |
| 1 July 2025 | The procedure for filing applications with the interdepartmental commission changed — with documents according to an established list |
| 1 September 2026 | The platform’s information is received by digital depositories, operators of information systems with digital financial assets, professional securities market participants engaged in brokerage or trust management, fund management companies, and digital currency exchange organizations; digital depositories are additionally made subject to the measures and review regime |
This article is current as of 26 October 2026. Provisions are given as of that date: 115-FZ — version of 4 August 2026; 86-FZ — version of 4 August 2026; Bank of Russia Regulation No. 842-P — version of 25 June 2026; Bank of Russia Ordinance No. 6473-U of 28 June 2023; Ordinance No. 6853-U of 23 September 2024.
The ZSK platform divides companies and IPs into three risk groups but publicly discloses only one of them — high — and only as the fact of assignment, without details. For a bank, and for the new participants from 1 September 2026, using this information is a right: they may use it or not, and each of them forms its own assessment of the client.
A high level at the Bank of Russia starts to change anything only when the bank’s own assessment is the same and the bank uses the Bank of Russia’s information in its work — then a specific and limited list of measures is triggered, and some transactions remain available in any case. The route for challenging the level and the risk of removal from the register depend on the same fork: whether measures have been applied or not.
You can look into a counterparty’s status through the open check on the Bank of Russia’s website without contacting a bank, but it answers only one question — whether there is a high level. Everything else — what the bank’s assessment will be, which conditions will coincide, and what to do if refused — is decided by the provisions of the law; the service screen will not show it.
FAQ
