In short: Starting July 1, 2027, Russia's Federal Tax Service (FNS) will be authorised to request IP addresses, MAC addresses, phone numbers, and SIM card data from the digital ruble platform operator during tax checks on specific transactions. The legal basis is three FNS orders issued August 19, 2026 under Article 86 of the Russian Tax Code. Data is provided only on targeted request — not automatically — posing no immediate risk to ordinary users. It is, however, a vivid illustration of how much technical footprint every digital payment leaves behind.
What happened
On September 9, 2026, Russian security publications SecurityLab, Anti-Malware.ru, and CNews reported the details of three FNS orders (№ ED-1-2/589@, ED-1-2/590@, ED-1-2/591@ dated August 19, 2026) defining the information exchange procedure between Russia's digital ruble platform operator and tax authorities. The orders implement Article 86 of the Russian Tax Code.
Under the new rules, the platform operator must provide — upon FNS request — the device technical identifiers used during a transaction: IP address, MAC address, phone number, SIM card data, or any other device identifier. Transaction amount, timestamp, and information about both parties are also included. The rules take effect no earlier than July 1, 2027, nine months after the orders were published.
Mechanism: targeted request, not mass surveillance
It is important to distinguish between mass surveillance and a targeted request. The FNS will not have automatic, background access to all digital wallet data. A request is only permitted on the same grounds as for a regular bank account: debt collection, an ongoing tax audit of a specific individual or legal entity, or with authorisation from a senior tax authority official.
Device identifiers are primarily used by the FNS to cross-reference multiple wallets: if several digital wallets were operated from the same device, this may indicate business structuring or use of nominees. An IP or MAC address alone is not evidence of a violation — multiple people, such as family members, may share the same network or device. The identifiers are considered alongside other information, not in isolation.
What is the digital ruble and who does this affect
The digital ruble is Russia's central bank digital currency (CBDC) — a third form of money alongside physical cash and non-cash bank funds. Unlike money held in a regular bank account, digital rubles exist as tokens on the Bank of Russia's platform, with consumer access provided through participating banks.
The pilot launched in 2023, and commercial rollout is actively expanding. Legislation adopted in 2023 requires large banks to offer digital wallet access from 2025, and mid-size banks from 2026. By 2026–2027, a significant share of online banking users will already have been offered a digital wallet.
What this means for your privacy
The FNS orders serve as a concrete reminder that every digital action leaves a technical trace. Your IP address is logged every time you connect to the internet; your MAC address is the unique hardware identifier of your device's network adapter; SIM card data links a transaction to a specific mobile subscriber account.
In ordinary circumstances, this data goes nowhere and concerns no one. But once you become subject to a tax audit, the technical history of your payments can become part of the evidentiary record. This is particularly relevant for freelancers, sole traders, and small business owners shifting to digital payment formats — we cover these privacy risks in more depth in the LiMP VPN privacy blog.
An additional concern: MAC addresses are sometimes transmitted without encryption and can be intercepted by third parties on public Wi-Fi networks — a risk from fraudsters, not only from regulators. Encrypting your traffic via a strong VPN protocol reduces the risk of technical identifiers being captured on public networks. That said, the IP address captured at the moment of a digital ruble transaction is logged by the platform operator itself; a VPN primarily protects your data in transit on the broader internet and complements other protective measures rather than replacing them entirely.
What to do right now
There is no reason to panic: the new rules take effect only from July 2027 and apply only upon targeted FNS request, not as background monitoring. That said, a few practical steps are worth taking now.
First, understand your digital footprint: which devices you use for financial operations and which networks they are connected to. Second, avoid conducting financial transactions over open public Wi-Fi without encrypting your traffic. The LiMP VPN app encrypts all network traffic and protects against data interception in cafés, airports, and other public access points. Third, enable two-factor authentication in your bank app for access to your digital wallet and keep your password up to date.
The digital ruble is a convenient tool, but like any digital technology it leaves a trace. Understanding that trace and taking sensible precautions is the best strategy as privacy becomes an increasingly valuable resource.
Sources
- Anti-Malware.ru — FNS will see which device was used for digital ruble transfers (09.09.2026)
- SecurityLab — FNS to get access to IP addresses and SIM card data of digital ruble owners (09.09.2026)
- CNews — Tax service to strengthen digital ruble surveillance (09.09.2026)
- Izvestia — FNS to gain the right to track devices of digital ruble owners (09.09.2026)