A risk weight of 1,250% is not a constraint. It is a deletion.
Under the 8% minimum capital adequacy floor that every Basel-signatory jurisdiction runs on, a 1,250% risk weight converts into a capital charge equal to 100% of the exposure. Every ruble of crypto a Russian bank carries on its own book must be funded by a ruble of equity. There is no leverage, no carry, no structured note, no delta-hedged spread trade. There is only a balance sheet line a bank must pay full price to keep.
Set that figure beside the headline figure, because the two are doing different jobs. The 1% cap โ bank crypto exposure limited to 1% of own funds โ is the number that has travelled. The 1,250% weight is the number that will decide behavior. A ceiling you can never profitably reach is not a ceiling. It is a design choice wearing the costume of a limit.
The ledger bleeds where code is silent. Here the silent code is a percentage almost nobody quoted.
Context
Bank of Russia has released a draft prudential proposal governing how credit institutions capitalize crypto exposure. It is a consultation document, not law. Publication is targeted for the fourth quarter of 2026, with a ten-day activation window thereafter โ a timeline that tells you the central bank expects to finalize and enforce quickly once the text locks. Reporting obligations covering turnover and two new ratios begin in January 2027.
To read why this is not routine rulemaking, hold two facts at once. Russia has one of the most structurally motivated crypto user bases in the world: sanctions have severed much of the correspondent banking network, capital controls restrict movement, and households and corporates carry genuine cross-border settlement and store-of-value needs the ruble rail cannot fully serve. The central bank has simultaneously been among the most consistently hostile regulators in the G20, pushing payment prohibitions while accelerating its own digital ruble program. This proposal is the first time Bank of Russia has moved from prohibition rhetoric to a quantitative prudential framework. It is choosing to price crypto exposure inside the banking system rather than pretend the system has none.
The architecture rests on two ratios. N31 applies to the individual credit institution, with the institution's own funds as denominator. N32 applies to the bank group on a consolidated basis, with group capital as denominator. Alongside them, the draft formally recognizes a "digital depositary institution" role and, per reporting on the proposal, contemplates key custody arrangements involving state-owned banks.
That last detail deserves more scrutiny than it has received. I will come back to it. First, the mechanics.
The numerator is the actual engineering
Most coverage treats the exposure definition as boilerplate. It is not. Covered exposure is deliberately penetrative: direct coin holdings, direct and indirect investments, derivatives whose price links to crypto, and loans, bonds, guarantees, repos, and credit lines whose settlement or value depends on crypto. Foreign digital instruments are pulled into the same numerator.
This is anti-circumvention design, well executed. Anyone who has watched a regulated entity hunt for a structural route around a position limit knows the playbook. Replace spot with a total return swap. Replace the swap with a collateralized loan. Replace the loan with a guarantee. Each hop moves the economic exposure one step away from the line item the rule names. This draft closes those hops in a single paragraph.
I keep a habit from 2017, when I was seventeen and manually auditing ICO whitepapers in a personal Notion database โ cross-referencing code snippets against mathematical claims, flagging tokenomics that failed their own arithmetic. I found twelve projects with fatal internal inconsistencies in a sample of more than fifty. The lesson that survived that cycle was not that whitepapers lie. It was that the definition section is where the truth lives and the marketing section is where the truth gets buried. The same discipline applies here. The exposure definition is where Bank of Russia has committed, and it committed to a broad numerator.
Why the dual-ratio design matters
N31 and N32 look like duplication. They are not. Binding the denominator to the entity that actually bears the risk is a structural defense against capital arbitrage inside a banking group.
Consider the naive alternative: one consolidated cap. A group could house crypto exposure in the subsidiary with the thinnest capital base, or shift capital around the group to inflate the tolerance ceiling without changing underlying risk. The proportional structure removes that degree of freedom. The institution holding the position must carry capital for it, and the group must see it on a consolidated basis. Denominators are matched to risk bearers.
This is the detail that separates a rule which sounds strict from a rule which is strict. It also raises the operational bar. A group now needs continuous, auditable attribution of crypto exposure to legal entities, reconciled across two reporting perimeters with different capital definitions. That is a data infrastructure problem before it is a compliance problem, and most mid-sized Russian banks do not own that plumbing today.
The bifurcation: 50% versus 1,250%
The core innovation is a two-track risk weight. Custody positions where the bank does not absorb the customer's loss carry 50%. Proprietary exposure and customer positions where the bank does bear the loss carry 1,250%.
Run the arithmetic. At an 8% minimum capital adequacy ratio, a 50% weight produces a capital charge near 4% of exposure. A 1,250% weight produces a charge near 100%. The gap between the tracks is a factor of twenty-five.
The 50% choice is itself a statement. Cash and sovereign exposures sit at or near 0%. Had the regulator regarded crypto custody as operationally riskless bookkeeping, it would have assigned a token weight. It assigned a middle-tier weight, which says the central bank treats holding digital assets for clients as real operational and legal risk โ governance, key management, seizure, depositary counterparty โ without treating it as a speculative position. Custody is permitted, not blessed.
Which track applies is a legal question, not a quantitative one. The dividing line is who bears the loss when assets are seized, frozen, restricted, or otherwise rendered inaccessible. That single determination moves a position from a 4% capital charge to a 100% capital charge. A factor of twenty-five in capital requirement driven by contract language and insolvency law. Chaos is just unquantified variance, and this is a large, poorly quantified variance sitting at the center of the framework.
This is Basel, localized
The 1% cap and the 1,250% weight are not Russian inventions. They map onto the Basel Committee's 2022 prudential treatment of crypto assets, which splits exposure into Group 1 โ tokenized traditional assets meeting strict recognition and redemption conditions โ and Group 2, capturing everything else, Bitcoin included. Group 2 exposure is capped at 1% of Tier 1 capital. Group 2b carries a 1,250% risk weight. The convergence is close enough that policy intent is legible: implement the international prudential standard with local modifications.
The modifications are where the politics live. The customer custody exemption is broader than some jurisdictions allow. Inclusion of foreign digital instruments in the numerator carries a capital-control flavor, restricting how much bank exposure routes through offshore stablecoins or non-domestic digital assets.
Anyone surprised by the severity has not read the Basel text. Skepticism is the only viable alpha, and the skeptical read is that the harshness is imported, not invented. Bank of Russia did not design a uniquely punitive regime. It adopted the global conservative baseline and layered localization on top.
Netting is where the conservatism concentrates
The draft permits netting only within qualifying lower-risk categories, subject to conditions on underlying asset, settlement mechanics, maturity, and freeze and liquidity risk. Direct holdings and higher-risk exposures cannot be fully offset by hedges.
Compare Canada, whose 2027 capital rules provide relief for positions hedged across exchanges. Russia's version is materially tighter. A Russian bank holding spot crypto against a short futures position does not book a small net number. It books a large gross number, and the gross number is what the 1,250% weight multiplies.
This matters because hedging is the standard supervisory accommodation granted to institutions running exposure with controlled risk. By restricting netting, the draft removes the economic rationale for hedging โ and with it the rationale for proprietary positioning. A hedge that does not reduce capital requirement is not a hedge. It is a cost.
The economics as designed
Run the business case. A bank with, say, RUB 500 billion in equity can hold at most RUB 5 billion in covered crypto exposure under the 1% cap. If that exposure is proprietary or loss-liable, it consumes roughly RUB 5 billion of capital โ the entire permitted notional. Capital productivity is zero. No treasurer and no risk committee signs off on that.
The same bank can run custody against the same 1% ceiling at a 4% capital charge: roughly RUB 200 million of capital against RUB 5 billion of assets, and can price a fee against that. Custody is viable. Proprietary trading is arithmetically dead on arrival.
I spent 2022 with a 70% drawdown, cutting leverage to zero and rebuilding around basis trades, backtesting more than a hundred strategies and keeping only those with Sharpe ratios above 1.5. Survival is the ultimate performance metric, and this rule applies that standard to an entire banking system. It does not ban banks from touching crypto. It bans them from taking crypto risk with any capital efficiency. The signal is unambiguous: be a pipe, not a participant.
The qualitative bottleneck nobody is pricing
Here is the operational flaw. The framework pivots on a legal determination โ who bears loss on seizure, freeze, or restriction โ and in a sanctions environment that is not theoretical. It is the most contested question in the sector.
Every custody contract must answer it. Every digital depositary arrangement must be classified. If classifications are disputed, a position can be reclassified from 50% to 1,250%, and the bank's capital requirement moves by a factor of twenty-five on the strength of a legal interpretation rather than a market move.
In 2020, I found a reentrancy vulnerability in a lending pool days before a TVL spike and reported it through a GitHub issue rather than a chat message, because the audit trail determines whether a finding gets acted on. The disclosure channel matters as much as the finding. The Russian draft has not yet specified a dispute-resolution mechanism for loss-bearing classification. Until it does, the channel has a gap.
Manual audits save what algorithms miss. A supervisor running automated N31/N32 aggregation will catch arithmetic errors. It will not catch a custody contract whose indemnity clause quietly shifts loss liability to the bank while the operational paperwork still describes a non-liable position.
The contrarian read on "protects customer assets"
The framing that a harsh 1% cap protects bank customer assets is defensible, and I do not think it is wrong โ but it is conditional in a way the framing obscures.
Custody receives preferential capital treatment only when the bank does not bear the customer's loss and the depositary stays solvent. Protection is a downstream consequence of capital separation, not the objective function. The rule protects bank capital first. Customer assets are protected insofar as the custodian is sound and the liability boundary holds.
The state-owned bank key custody arrangement is what I would flag hardest. Concentrating key material in a small number of state institutions creates a single point of failure, and a single point of failure is not mitigated by the fact that the point is sovereign. Where are the insurance requirements, the key-sharding standards, the segregation audits? They are not in the draft as reported.
There is also a predictable second-order effect. A cap this tight, plus netting rules this restrictive, pushes activity toward gray and offshore channels rather than into the formal banking system. Compliance channels that are expensive relative to their utility do not get used. They get routed around. Russia's real crypto demand will not disappear because the banking channel was priced out of reach.
The protection is real. Its scope is narrower than the headline suggests.
What to watch
Four signals carry the information. The final text in the fourth quarter of 2026, which reveals whether the custody exemption survives consultation intact. The key custody legislation, which determines whether Russian crypto custody becomes a monitored state hub. The first N31 and N32 disclosures in January 2027, which show whether any bank actually builds a custody business at a 4% capital charge. And gray-channel volume, which measures the rule's real-world elasticity rather than its stated intent.
The interesting question is not whether Russia is harsh on bank crypto exposure. It plainly is, and it copied the global baseline to get there. The question is whether a jurisdiction with genuine, sanctions-driven demand can build a supervised channel that competes with the alternative it is trying to replace.
If it cannot, the 1,250% weight will have accomplished something no prohibition ever managed: it will have moved the activity somewhere the regulator cannot see it at all.
