P2P Card Blocks Under 115-FZ and 161-FZ: Why They Happen and What to Do
You sold USDT on P2P, the money arrived on your card, and the next day your banking app says: "Operations restricted". Or worse: cards are blocked at several banks at once, and the message mentions "the Bank of Russia database". This is a familiar story for many P2P traders: in 2025–2026 Russian banks and the central bank got serious about money mules ("drops"), and ordinary crypto sellers are increasingly caught in the crossfire.
Let's look at how a block under Law 115-FZ differs from one under Law 161-FZ, what makes a bank see P2P as suspicious, how to lift restrictions, and how to trade crypto without risking your card.
Why banks block P2P traders' cards
On P2P you sell crypto to a stranger and receive rubles directly on your card. The bank doesn't see the deal on the exchange; it only sees a stream of transfers from different people. That's exactly what the activity of drops looks like: people whose cards scammers use to move stolen money.
The problem is that a P2P buyer may pay you with money stolen from someone else. According to Vadim Uvarov, head of the Bank of Russia's information security department, crypto sellers are often paid with stolen money. The best-known scheme is the "triangle", which we covered in detail in "Exchanger vs P2P: which is safer for buying and selling USDT".
115-FZ vs 161-FZ: the difference
115-FZ: the anti-money laundering law
Under this law the bank assesses your operations itself. If they look like laundering or cash-out, the bank may refuse an operation, request documents, restrict app access and eventually terminate the contract. Your bank makes the decision, and you lift the restrictions with your bank too.
161-FZ: the national payment system law
This law deals with transfers made without the client's consent, i.e. fraud. The Bank of Russia keeps a database of such cases, informally called the "drop database". If you were reported as a recipient of stolen money, you may end up in it. The consequences are set out in Article 9 of the law:
- if the data come only from banks, the bank may block your card and online banking or cap transfers at ₽100,000 a month;
- if there is police data, the bank must block the card and online banking;
- the bank must notify the client immediately and explain how to apply for removal from the database.
The ₽100,000 limit has applied since 15 May 2025 and doesn't cover utility bills, shop or marketplace purchases. In addition, since 25 July 2024 banks hold for two days transfers to recipients in this database.
How to tell which law you were blocked under
- Most likely 115-FZ if the bank sent a document request "under 115-FZ", refused a specific operation or cut app functions, but cards at other banks still work.
- Most likely 161-FZ if the notice mentions "an operation without the client's consent" or "the Bank of Russia database", cards are blocked at several banks at once, or a transfer limit appeared.
Sometimes it's both. For example, Kommersant described the case of a USDT seller on Bybit: she received ₽100,000 from a third party, refused to return it, and five banks blocked her cards at once. Access was restored only after she returned the money to the sender.
What makes a bank see P2P as suspicious
Back in 2021 the Bank of Russia issued methodological recommendations No. 16-MR listing signs of cards used for suspicious operations. Among them, according to Pravo.ru:
- more than 10 different individual counterparties a day or more than 50 a month;
- more than 30 credit and debit operations a day;
- transfers between individuals above ₽100,000 a day or ₽1 million a month;
- less than a minute between money arriving and leaving;
- all credits and debits within 12 hours;
- no ordinary spending: utilities, phone, purchases;
- an average balance below 10% of average daily turnover;
- the same device data used by different people.
A typical active P2P trader matches several signs at once. These are recommendations, not law: each bank sets its own rules and may react more strictly. And since 1 January 2026 an updated list of fraud signs has been in force, which banks use to check transfers.
How to lift a 115-FZ block
- Give the bank documents and explanations. For crypto operations, exchange statements and trade screenshots, P2P order history, wallet addresses, chats with buyers and an explanation of where the funds came from usually work.
- Wait for the bank's answer. Under clause 13.4 of Article 7 the bank must review the documents and, within seven business days, say whether the grounds for refusal have been removed.
- If the bank refuses, apply to the interdepartmental commission at the Bank of Russia. You can do this through the Bank of Russia's online reception. The commission requests the bank's reasoning, and the review may not exceed twenty business days.
How to get out of the 161-FZ drop database
- Apply for removal from the database, through your bank or directly via the Bank of Russia's online reception. The bank may also apply to the Bank of Russia itself if it considers the listing unjustified.
- Wait for the decision. The Bank of Russia reviews the application within 15 business days. If it refuses, the decision can be challenged in court.
- If someone else's money landed on your card, return it. In practice it's the fastest route: as in the Kommersant case, access is often restored after the money goes back to the sender.
Many people are trying to get out of the database: according to Vadim Uvarov, in Q1 2026 alone the Bank of Russia received almost 70,000 removal applications. And by September 2025 the database itself had grown to 1.2 million records.
Is there criminal liability
Since 5 July 2025, Article 187 of the Russian Criminal Code has separate parts for drops: up to three years for handing over your card or access to it for a reward and for operations on someone else's instructions, and up to six years for buying and passing on other people's cards. By the end of 2025, 222 cases had been opened under these articles.
An honest crypto seller who runs their own deals isn't covered by these articles. But if stolen money landed on your card, you'll be part of an inquiry and will most likely have to explain yourself to the police and return the money to the victim. So keep all evidence of your deals.
How not to lose your card to P2P
- Accept payment only from the person you made the deal with. The payer's name must match the counterparty's name on the exchange. Money from a third party is the main sign of a "triangle".
- Don't turn your card into a "transit" card. Dozens of deals a day from different people and instant withdrawals are exactly what banks treat as signs of a drop.
- Keep evidence: order history, chats, screenshots, statements. It's the first thing the bank will ask for.
- If someone else's money arrives, return it without releasing the crypto.
- Remember about taxes. Income from selling crypto is subject to personal income tax, and declared income is easier to explain to a bank.
- Exchange through an exchanger, not strangers. At an exchanger you receive rubles from one service, not a random person, so the risk of a "triangle" is much lower.
The AntiSwap catalog has star exchangers "★ No AML/KYC": they don't block crypto on AML pretexts, and if they can't exchange it, they return it. Each has posted an insurance deposit of at least $1,000. Turn on the "Only without AML/KYC" filter, for example on the USDT TRC20 → Sberbank RUB direction. If you're unsure whether your coins are clean, read "Dirty crypto: what it is, how to check it and what to do".
FAQ
Can a card be blocked over a single P2P deal?
Yes. If a buyer paid you with stolen money and the victim complained to the bank, you can be added to the Bank of Russia database even after a single deal. Under 115-FZ banks more often react to regular activity, but that also depends on the specific bank's rules.
So accept payment only from the counterparty and keep evidence of every operation.
How long does a block last?
Under 115-FZ the bank must answer your documents within seven business days, and the Bank of Russia's interdepartmental commission within twenty. Under 161-FZ the Bank of Russia reviews a removal application within 15 business days.
But if you don't submit documents and an application, the restrictions can last indefinitely.
What if cards are blocked at several banks at once?
Most likely you were added to the Bank of Russia database under 161-FZ. Apply for removal through any of the banks or directly via the Bank of Russia's online reception.
If you received money from someone who wasn't your counterparty in the deal, it's better to return it to the sender: in practice that's when access comes back fastest.
Can you trade on P2P safely at all?
Not completely: you always receive money from a stranger. You can reduce the risk by accepting payment only from the counterparty, trading with verified sellers, not running dozens of deals a day on one card and keeping all evidence.
But it's more reliable to exchange crypto through an exchanger with good reviews and a deposit: then the rubles come from one service, not random people.
What changes in 2027?
From 1 March 2027 banks will be allowed to hold suspicious transfers for up to six hours. And Law No. 282-FZ on digital currencies moves crypto exchange to licensed intermediaries, with a transition period running into 2027.
Analysts expect classic P2P with transfers to strangers' cards to gradually leave the market. We'll keep track of the changes.
Bottom line
A P2P trader's card can be blocked under two different laws. Under 115-FZ your bank makes the decision, and you lift it with documents and, if needed, through the Bank of Russia's interdepartmental commission. Under 161-FZ you're added to the Bank of Russia drop database, and you get out through a removal application, and often by returning someone else's money. To avoid this, accept payment only from the counterparty, don't turn your card into a "transit" card, and exchange crypto through verified star exchangers in the AntiSwap catalog. And share this article with anyone else who trades on P2P.