Rosfinmonitoring Denies Mass Bank Account Blocks Over Partial Data Matches with Sanctions Lists
Rosfinmonitoring has refuted media claims suggesting that new rules could trigger a wave of bank account blocks for Russian citizens whose data partially matches entries on asset-freeze lists.
The agency emphasized that the draft legislation is designed to prevent ordinary people, including those sharing surnames or having minor transliteration differences in names, from becoming victims of overly broad anti-fraud measures.
According to Rosfinmonitoring, specific criteria for partial data matches remain undefined. They will be introduced through a dedicated order only after the federal law takes effect and practical cases have been reviewed.
Most issues arise from variations in name spelling during transliteration rather than any shared financial history between unrelated individuals.
The regulator separately noted that the proposed rules allow only temporary suspension of a transaction. There will be no automatic rejection of operations or indefinite blocking of entire accounts.
Earlier coverage in Izvestia had raised concerns that vague partial-match standards could produce many false positives, potentially restricting access to banking services for law-abiding clients.
Related articles
Hacker Attacks as Force Majeure: Russian and International Courts Diverge on Liability for Cyber Incidents
In November 2026, Russian hosting provider Beget suffered a major cyber attack that disrupted websites, virtual servers, email, DNS, and control panels for thousands of clients. Beget notified customers of circumstances resembling force majeure under Article 401 of the Russian Civil Code but stopped short of claiming automatic court recognition. Russian courts have reached inconsistent rulings on whether DDoS attacks and ransomware qualify as extraordinary and unavoidable events, examining factors such as attack scale, provider preparedness, and contractual obligations. International cases from France, Norway, the United States, and the Netherlands further illustrate that outcomes depend on evidence of prior security measures, backup integrity, and specific contractual language rather than the mere occurrence of an attack. Key precedents include disputes involving Timeweb, Expeditors, and Nordlo Haugesund where liability was limited or denied despite confirmed incidents. The analysis shows that even when force majeure is rejected, clients often struggle to recover full losses due to liability caps and proof requirements. Businesses are advised to maintain independent backups, review service agreements, and document incidents thoroughly to protect against financial exposure.
US Mandates Removal of Acronis from Federal Systems by January 2027 Over Russian Ties
US federal civilian agencies have been ordered to remove all Acronis products from their information systems by January 27, 2027, with new purchases also prohibited. The directive from the Department of Homeland Security, signed on July 31 and published in the Federal Register on October 30, covers Acronis AG along with Acronis Inc. and Acronis SCS. A nearly decade-long review examined whether Russian developers still access the code and whether supply chain risks have been sufficiently reduced, though no specific evidence of backdoors was reported by sources. After 2022, Acronis suspended operations in Russia and relocated specialists, while in 2025 Swedish firm EQT acquired a controlling stake with approval from the US CFIUS committee. Despite over 75 percent of shares now held by Western investors, these measures proved insufficient for continued access to federal systems. The ban does not extend to the private US market.
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.