Конец VPN на российском хостинге: что Минцифры спрятало в антифрод-законе?

Overview

The video discusses Russia’s third “anti-fraud” legislative package being prepared by the Ministry of Digital Development, Communications and Mass Media. The author argues that while some provisions may make fraud harder, they also significantly restrict privacy and access—especially for VPN/hosting and for ordinary users when dealing with phone/SIM registration.

Origin and legislative timeline

• First package reportedly took effect in September 2025; the second was signed in June.
• The third package is described as comprehensive:
  • contains ~20 initiatives
  • amends laws related to communications, information, personal data, consumer rights, and more.
• Public discussion ends Oct 15; submission is planned for the State Duma by the end of the year.
• Proposed entry into force: March 1, 2028

  The author stresses it’s still a draft and could change.

Key provisions highlighted by the author

1) SIM cards and subscriber identification

• Online contracting for mobile services / eSIM activation / virtual PBX connections will be limited to specific methods.
• New methods rely on biometrics:
  • Electronic signature via Gosuslugi, confirmed through a unified biometric system.
  • Submitting passport data via a service under Federal Law 156-FZ, but only after facial verification in the state biometric database (EBS).
• For eSIM/virtual PBX, contracts must include the device identifier, implying re-registration when devices or numbers change.
• Restrictions on SIM resale:
  • Individuals and sole proprietors cannot sell SIMs on operators’ behalf.
  • Reselling activated SIMs (including number transfer) is prohibited—only operators can sell through official channels.
  • Ads for “SIM boxes” (devices enabling mass calling with many SIMs) are blocked.
  • Top-up before signing the contract is prohibited.
• Operators must log and store the IP address and port used to sign the contract for 3 years.

2) Disabling numbers via an anti-fraud database (main concern)

• The bill creates/expands a government system (GIS Anti-Fraud / “state anti-fraud information system”) that collects data on numbers/accounts linked to scammers.
• The database is described broadly as including information on individuals involved in illegal activity through communications networks.
• Key mechanism:
  • If an operator receives information from the FSB or the Ministry of Internal Affairs that a number was used illegally, the operator must terminate or suspend services not only for that number, but also for all other numbers registered to the same subscriber with that operator.

• The author emphasizes a lack of clarity in the draft about:

  • appeal procedures
  • timelines
  • the role of courts

    The author alleges “court” does not appear in the bill.

• The author’s concern is that this could enable service-wide shutdowns without a clearly defined remedy path.

3) Registration for websites/services requiring authorization

• Sites/apps requiring login/authentication must allow registration via one of four methods:
  1. Phone number
  2. Gosuslugi
  3. Biometrics
  4. A Russian legal entity or a system controlled by dual citizens (as described in the video)
• Login/registration data must be stored for 3 years and provided to law enforcement.
• For Gosuslugi-based login, storage occurs on the government side, making it harder for foreign services to access/control.
• The author predicts in practice that some foreign services may:
  • require a phone number for all Russian users, or
  • leave the market.
• No exception is described for small communities/forums/projects; the author claims obligations apply broadly.

4) Hosting providers, VPN/proxies, and foreign IP/virtual telephony restrictions

• Hosting providers must:
  • identify the purpose and requested capacity,
  • check against the Roskomnadzor registry,
  • and only then provide server access.
• VPN/proxy “access tools” are said to be included in the registry; for one year, hosts may not rent resources to such clients (as interpreted by the author).

• Additional responsibility:

  • at the request of operational-investigative bodies / critical infrastructure security bodies, hosting must stop providing capacity to counter computer attacks.

    The author again notes there is no mention of court oversight.

• Virtual PBX access will be restricted to Russian IP addresses:

  • operators must refuse access from non-Russian IPs,
  • effectively ending business telephony via foreign VPN.
• A limited exemption is mentioned for certain corporate VPNs with a predefined user circle, but the author notes reporting/requirements may still be imposed via FSB/Roskomnadzor.

5) Personal data law improvements (seen as convenient and risky)

• A unified consent platform is planned on Gosuslugi:
  • users can see who processes their data,
  • revoke consent,
  • and file complaints to Roskomnadzor from within their personal account.
• Operators may not demand consent where the law doesn’t require it, and “silence/inaction” cannot be used to limit rights.
• Risks highlighted by the author:
  • consents and complaints become centralized,
  • logs related to Gosuslugi-based access may be stored in government systems,
  • biometrics, phone numbers, and government services effectively become a “single key” to identity.

Overall assessment and forecast

• The author argues there’s little discussion of fines/responsibility for mistakes; sanctions may come through later amendments.
• Predicted outcomes:
  • more identification requirements (phone/Gosuslugi),
  • reduced anonymous registration,
  • collapse of gray markets for SIM/number access,
  • scammers shifting to areas where enforcement is harder.
• Central criticism:

  The system is built on the GIS Anti-Fraud mechanism that can disconnect numbers based on signals from security bodies without clear court-based safeguards or clearly defined contestation mechanisms.

Call to action mentioned in the video

• The draft is open for comment until Oct 15 on portal.ru.

Presenters / contributors

• Video narrator/author (only an unnamed speaker appears in subtitles)
• Ministry of Digital Development, Communications and Mass Media (referenced as the drafter)
• FSB and Ministry of Internal Affairs (referenced as providing/triggering actions in GIS Anti-Fraud)
• Roskomnadzor (referenced as enforcing hosting/VPN-related compliance)
• Gosuslugi / EBS (Unified/State biometric system) (referenced as identity infrastructure)