Coping with Technology Sanctions in the Russian Financial Sector

The online version of this policy brief doesn't contain footnotes. To view the footnotes please download the PDF version here.

Following Russia’s invasion of Ukraine, a coalition of Western countries led by the European Union and the United States imposed a large array of sanctions. Since then, the Russian financial sector has taken a double hit, namely sanctions on the infrastructure, affecting financial transactions, and on the technology, like software and hardware, it needs to operate. Infrastructure sanctions restrict banks’ ability to make payments (disconnection from the SWIFT global payments system and overcompliance). Technology sanctions create hindrances to technical upgrades and innovation. Before the war in Ukraine, the Russian financial sector was a world leader: it was third in financial technology penetration, in the top 10 in digital banking development, and fourth in the transition to cashless payments during the pandemic. Since Russia’s invasion of Ukraine and the imposition of sanctions in 2022, it has lost this competitive position.  

The sanctions against Russia’s financial sector have largely isolated Russia from access to the global financial system. Inside Russia, however, only a small fraction of Russians have felt these restrictions. Russian payment infrastructure was and remains resilient primarily due to the financial messaging system (SPFS), the Russian equivalent of SWIFT, which was developed in 2014 and through which banks are required to exchange data within Russia. In 2022, traffic in the system increased by 22 percent. There are currently 469 participants, including 115 non-Russian banks from 14 countries. Among the foreign countries, banks in Belarus, Armenia, Kazakhstan, Kyrgyzstan and Switzerland are connected to the system. Due to the risk of new sanctions, Russia’s central bank does not disclose detailed statistics. Direct messaging channels allow for direct international transactions with those banks connected to the SPFS, including those bypassing SWIFT.

Minimizing the damage of sanctions that target Russia’s financial sector infrastructure is considerably more difficult. Former partners, even in friendly jurisdictions like some post-Soviet countries, have been slow to help Russia with system-level transactions. It will take considerable time to build new payment infrastructure channels, as the technological constraints are much more difficult. The lack of access to modern technology keeps banks’ IT systems in their current state and impedes fintech development and innovation.

Pain and Risk

About 85 percent of software used in the Russian financial sector is produced abroad. For hardware, the situation is even worse. Only large-scale assembly takes place in Russia. For this reason, the departure of companies that ensure the viability of the financial sector has been particularly painful for the financial sector - companies like Oracle, SAP, Cisco, IBM, Intel, AMD, Diebold Nixdorf and NCR (ATMs). Every second Russian company was left without technical support after the war began. For Russian banks, it was impossible to quickly switch to domestic solutions, as the right quality and scale were simply not available on the market.

Virtually all operations of a modern financial institution, from client services to internal operations, are heavily dependent on the smooth operation of software and equipment. This makes the financial system particularly vulnerable on the technological side. Banks and non-financial institutions may face operational risks due to the lack of servers and software. This could make systems more vulnerable to cyber-attacks, raise the risk of technical failures due to a shortage of equipment and maintenance specialists, and require failing equipment to be replaced with either used Western-made products or Chinese analogues. The Bank of Russia, which supervises the financial sector, pointed out these risks for the first time almost a year after the invasion.

Import Substitution Software

The withdrawal of foreign companies has left the Russian financial sector with a huge gap in software and services. Also, in October 2022, the government banned Russian banks from using foreign software, a rule that applies even if there are no domestic equivalents. This has forced critical information infrastructure facilities to urgently seek domestic solutions. The combination of these two factors has given a boost to software development in Russia. Thus, according to Ilya Sivtsev, CEO of Astra (developer of operating systems and PostgreSQL database management system (DBMS) based on open source code), the company’s revenue in 2022 doubled to over RUB 6.5 billion (USD 65 million) and the share of its revenues from the financial sector increased from 4 to 22 percent. Astra’s outlook for 2023 is for double-digit growth. 

Astra’s figures generally reflect the situation in the Russian IT market in 2022: there was rapid growth due to the departure of foreign competitors. As Deputy Prime Minister Dmitry Chernyshenko, who oversees the industry, reported, IT firms in 2022 grew revenues by 35 percent and earned RUB 2.38 trillion (USD 27 billion). Despite the reduced presence of foreign companies, turnover in the Russian IT market has grown.

Switching to Russian software instead of foreign software may not be the most significant challenge, but it is an expense that businesses could have invested in furthering business growth. With all the advantages of the Russian DBMS, migration from the US-made Oracle software may lead to performance degradation of 30-50 percent. This is a serious limitation for the financial sector, whose mission-critical core system (processing, the core of an automated banking system) requires high-speed interaction with databases. The banking applications must also be transferred to the new DBMS. In addition, information security risks that could jeopardize the stability of the financial system have increased. The massive migration to new IT solutions reduces the cybersecurity of the entire system.

The growth of the Russian software market is limited by two factors: the Russian government’s permission for companies to use unlicensed foreign software and the country’s own borders. Before the war, Russian IT companies were rather active on the markets of neighboring countries, providing various services (e.g. 1, 2, 3 )–from the integration of IT systems and products to the provision of services to companies and private customers. Russian solutions were often cheaper and technical support in Russian was an important advantage in the regional Commonwealth of Independent States (CIS) market. And while Russian companies were also looking to expand abroad before the war, they will now have to compete there with Western companies that have left the Russian market and whose technological development is not restricted by sanctions.

The relationship between customers and integrators running programs to implement products from different vendors has also changed. The customers say, “I want it like SAP, but faster and better,” while the integrators say, “My offer is limited, so take what I have or you will run out too.” In other words, customers have to accept a downgrade in software and hardware capacity for certain technologies.

Import Substitution and Hardware

Because it was not profitable, the equipment needed for  assembly in Russia is not produced in the country. Until 2022, only large-scale assembly from imported components was carried out in Russia. And the financial sector is not the only one waiting for servers, storage systems, controllers and components – industry, the public sector and retailers are also in line.

In their search for equipment, Russian companies have turned to parallel imports, obtaining what they need from countries that have not imposed sanctions. They have also acquiesced to lower requirements for equipment quality and delivery deadlines. However, there are no systemic solutions or supply lines yet. Right at the beginning of the conflict, the US applied the Foreign Direct Product Rule (FDPR) mechanism to Russia. The FDPR prohibits exports to sanctioned countries of equipment that US companies were involved in developing or manufacturing – thus it affects companies outside the US in so-called third countries. This mechanism is primarily aimed at keeping the defense industry from importing technology. However, civilian products that can be classified as “dual-use” (military and civilian) are also largely subject to the restrictions – including the kinds of equipment needed by the financial sector. That has made systematic and large-scale purchases much more difficult. Third countries are willing to restrict technology exports to Russia, and the US is constantly updating its sanctions lists to include intermediaries. Nevertheless, loopholes in sanctions frameworks and delays in sanctions decisions allow Russia more room to adjust, finding new partners in Asia or new ways to bring hardware to Russia.

Chinese partners, for example, support Russian companies not only with equipment but also with chips. Shipments of microchips and other semiconductors from China to Russia  are 2.5 times higher than than pre-war level; China now accounts for more than 50 percent of semiconductor imports to Russia. By the end of 2022, China supplied 40 percent of Russia’s imports and purchased 30 percent of its exports, and the RMB had become the only (albeit less convenient due to its incomplete convertibility) alternative to the euro and dollar for Russia’s international payments. In 2022, trade turnover between the two countries reached an astronomical USD190 billion, and it is quite likely that within these imports are sanctioned goods that Russia desperately needs. Reports that China is helping Russia circumvent sanctions, especially in the technology sector, are mounting.

The Russian IT sector’s focus on Chinese suppliers and their products – from servers and data center equipment to bulk purchases of consumer electronics – reflects Moscow’s growing and asymmetrical dependence on Beijing. For second- and third-tier Chinese companies, this opens up opportunities to enter the Russian market. For example, Sber, Russia’s largest bank, is testing its own custom-made laptops. Sber’s partner, the Chinese company Shanghai IP3 Information Technology, is a contract manufacturer that takes orders for electronic devices and commissions them from Chinese production facilities. Whereas before the war Russian companies were free to choose their equipment and electronics suppliers, taking advantage of the wide supply on the market to obtain favorable prices, the choice has now narrowed to Chinese manufacturers. The lack of alternatives also forces them to accept less attractive terms.

Innovation Inhibited

The sanctions bottleneck in both hardware and software is shifting the focus of IT specialists in the Russian financial sector from creating innovations to ensuring technological security and supporting current operations. The most prominent example is the introduction of payment stickers for Russians who can no longer make contactless payments with their smartphones. A payment sticker has an embedded near-field communications (NFC) chip that exchanges data with a payment device. In other words, it is a bank card chip stuck onto an iPhone, as iPhone owners are considered to be the highest-paying target group, and banks have a vested interest in maintaining the usual number and volume of card transactions. Android smartphone owners will still have the option of making contactless payments via a MirPay wallet linked to their domestic payment system card.

Frank RG, the Russian financial information publication, estimates that 12 of Russia’s 25 largest banks already offer stickers to their customers. Tinkoff, the leader in innovative banking, plans to issue over 1 million stickers by July 2023. At state-owned Sberbank, over 100 000 people applied for stickers within three hours of their offering. Issuing stickers is more expensive for the bank than standard payment card issuance, bankers acknowledge.

Russian financial institutions have become so similar to IT companies that they are almost indistinguishable. Sberbank alone employs 38,000 IT specialists, Sberbank President Herman Gref reported to Vladimir Putin in March 2023. Besides the purely financial challenges, such as ensuring the sustainability of the payment infrastructure, the financial sector needs to work with the IT industry on providing non-sanctioned hardware and software, finding indigenous solutions to replace Western ones, and localizing instead of scaling up.

An important but not decisive obstacle to innovation is the mass exodus of IT professionals. Competition for the remaining specialists is fierce and will only increase. The government is making gigantic efforts to keep the remaining skilled workers in the country. The slowness in changing the taxation of departing Russians seems partly related to the fear that most foreign IT professionals who continue to work in Russia will no longer do so.

Prospects for the Financial Sector

The Russian financial sector’s resilience to sanctions on its financial infrastructure has been limited to Russian territory. The sanctions have largely isolated Russia from the international financial infrastructure. Russia’s demand to allow banks to use SWIFT (e.g. under the Grains Agreement) is a clear indication of this. Technological restrictions and the withdrawal of Western companies from the Russian market may seem less painful at first glance, but this is not the case. Their impact is longer-term: declining quality of hardware and software, forced investment at IT, cybersecurity, and operational risks. And while infrastructural constraints have had only a temporary impact on the ability of the financial sector to operate smoothly, technological constraints have significantly limited its potential for growth and development.

The Russian financial sector’s dependence on foreign, especially Western, software and hardware manufacturers is high. This poses a significant risk to Russia’s financial stability, especially if Western countries tighten sanctions against the Russian IT sector.