Russia's Crypto Cap Isn't 1%. It's 1,250%. Read the Risk Weight.

The headline reads "1% cap." The arithmetic reads "prohibition." When the Bank of Russia published its draft capital framework for crypto exposure, every wire led with the same number — a 1% ceiling on bank exposure, framed as cautious and negotiable. It is neither cautious nor the binding constraint. The constraint sits one column to the right, where a single line assigns a 1,250% risk weight to proprietary crypto exposure. Under an 8% minimum capital adequacy ratio, that coefficient demands one hundred cents of capital for every dollar of exposure. In economic substance, it is a full deduction from capital. In plain terms, it is a ban wearing a ratio's clothing. Alpha isn't the number everyone quotes. It's leverage — the leverage to read the column no one reads. Context first. In late October, the Bank of Russia circulated a consultation draft establishing two new prudential ratios. N31 applies to individual credit institutions, denominated against an institution's own funds. N32 applies to banking groups on a consolidated basis, denominated against group capital. The split is not cosmetic. By binding the denominator to the entity that actually carries the risk, the regulator closes the internal capital-shuffling loophole — the one that lets a group inflate exposure tolerance by borrowing headroom from a sister entity. The draft is not law. Publication is targeted for Q4 2026, with a ten-day activation window, and reporting obligations beginning January 2027. That timeline matters. It gives the market roughly two years to price the final text — and two years for the text to change. Russia is a sanctioned economy. Its central bank writes prudential rules under geopolitical duress, prioritizing financial stability and monetary sovereignty over market development. Anyone modeling Russian crypto flows off the draft is modeling a moving target. The framework does not emerge from a vacuum. It maps almost line-for-line onto the Basel Committee's 2022 prudential treatment of crypto assets. Under BCBS, crypto splits into Group 1 — tokenized traditional assets meeting strict classification conditions — and Group 2, everything else, Bitcoin included. Group 2 carries a hard exposure cap of 1% of Tier 1 capital. Group 2b carries a 1,250% risk weight. Russia's proposal mirrors both. The localization sits in the carve-outs: client-custody relief and the inclusion of foreign digital instruments inside the exposure numerator. This is not innovation. It is high-fidelity implementation with a domestic accent. Strip the label off and the mechanism is simple. Be precise about what is measured. The covered exposure numerator is not a spot-holding tally. It captures direct and indirect investments, derivatives whose price is linked to crypto, and loans, bonds, guarantees, repos, and credit lines whose settlement or value depends on crypto. That is a penetration mandate. It defeats the oldest trick in regulatory arbitrage: acquiring exposure through a credit wrapper instead of a token. After the spot ETF approvals in 2024, I structured cross-border arbitrage into the Latin American premium, and I learned the same lesson every time — based on my audit experience, the wrapper is always cheaper than the asset, until the regulator prices the wrapper correctly. Russia just priced the wrapper. Now examine the netting regime, because this is where the design earns its precision. Long and short positions can offset only within qualifying lower-risk categories. The offset is conditioned on asset quality, settlement terms, maturity alignment, and — critically — the risk of freezing or illiquidity. Direct holdings cannot be fully hedged out. High-risk exposure cannot be fully hedged out. In practice, a bank cannot manufacture a riskless book by pairing long spot against a short perpetual and calling it flat. The regulator has recognized that in a sanctionable jurisdiction, the hedge itself is a liability. A counterparty can be frozen. A settlement rail can be severed. A hedge that cannot settle is not a hedge; it is a second exposure. Then comes the double-track risk weight, and the whole policy reveals itself. Client positions where the bank does not bear liability — pure custody, where the customer owns the loss — receive a 50% risk weight. Proprietary exposure, plus client positions where the bank does bear the loss, receives 1,250%. Run the arithmetic. At an 8% capital floor, 50% weight costs four points of capital per hundred of exposure — a modest, priced-in cost of doing custody business. The 1,250% weight costs one hundred points per hundred. There is no business there. You cannot lend against it, structure around it, or warehouse it. The ratio does not discourage proprietary crypto trading. It forecloses it. We do not chase pumps; we engineer the squeeze — and this regulator has pre-engineered the squeeze directly into the capital stack. Read the two numbers together and the intent is unambiguous. The Bank of Russia is telling its banking system: be a pipe, not a punter. Provide custody. Provide settlement. Do not take price risk with depositor capital. That single sentence is the entire policy. I have spent enough time inside liquidation cascades to respect the logic. In 2022, after Terra, I watched undercollateralized structures propagate losses through institutions that believed their hedges were clean. They were not. Counterparty freeze risk is the variable every stress test underestimates, and a regulator that has lived through sanction shocks will price that risk at par. The 1,250% weight is not paranoia. It is the correct response to a world where the hedge can vanish with the counterparty. But precision cuts both ways, and the custody track deserves scrutiny. A 50% risk weight is not neutral. Cash and sovereign debt sit at zero. By assigning digital-asset safekeeping a 50% weight, the regulator officially classifies crypto custody as medium-risk business — not a utility, not a settlement function, but a risky line item that consumes capital. That matters for economics. A custodian must charge fees sufficient to clear a four-point capital cost plus operational overhead. If the fee exceeds what users will pay to stay inside the perimeter, the perimeter stays empty. A rule can be technically flawless and commercially inert at once. There is a second structural feature worth isolating. The numerator explicitly captures exposure to foreign digital instruments. Read that as capital-control architecture, not prudential housekeeping. By pulling offshore stablecoins and foreign-issued digital rights into measured exposure, the rule prevents a Russian bank from routing crypto exposure through a foreign vehicle and booking it as a foreign asset. Exposure stays domestic on the balance sheet, therefore it stays countable, therefore it stays capped. This is a jurisdiction that has learned to distrust the offshore rail precisely because sanctions taught it to. Follow the incentive gradient and the framework's priorities become legible. A bank earns its margin on spread and fees. The 1,250% weight zeroes out the spread business entirely — there is no risk-adjusted return left to capture once capital costs double the notional. The 50% weight leaves a narrow custody fee on the table, but only if the bank stays liability-free. That is a deliberate funnel. The rules do not treat crypto as an asset class to be traded. They treat it as a service to be administered. Yield is not free. Someone is paying the risk — and here, the framework's answer is that the customer pays it, in full, outside the bank's capital stack. Compare this to the emerging global pattern. Canada's 2027 capital rules provide cross-exchange hedge relief, allowing institutions to net exposure across venues under defined conditions. Russia allows netting only inside qualifying low-risk categories, with freeze and liquidity conditions attached. That is a materially more conservative posture. The difference is not philosophical — it is a function of counterparty jurisdiction. Canadian banks can rely on venues that will settle. Russian banks cannot assume the same, because the rail itself is sanctionable. The conservatism is structural, not ideological. Read it that way and the framework stops looking like hostility toward crypto and starts looking like a jurisdiction pricing its own isolation. The transition timeline deserves the same cold eye. A Q4 2026 publication with a ten-day activation window is a strange pairing: long consultation, short implementation. The message — argue now, comply immediately. Two years of drafting suggests the regulator expects the text to move. A ten-day fuse suggests it does not intend the market to react after the fact. And the January 2027 reporting of N31/N32 alongside turnover data tells you the central bank wants to observe behavior before it finalizes enforcement posture. This is a pilot with teeth. The question I keep returning to: who actually bears the loss? The entire two-track structure hinges on a legal determination, not a technical one. If the bank bears the risk of seizure or restriction on a client's custodied position, that position moves from the 50% column to the 1,250% column. That is not a rounding difference. It is the difference between a viable business and an impossible one. The draft creates a new category — the digital depository institution — and makes its liability terms the fulcrum of the framework. Expect years of contractual argument over that clause alone. Here is where the popular narrative and I part ways. The framing that "harsh rules protect bank customer assets" is not wrong. It is incomplete. Yes, isolating crypto volatility from bank capital protects depositors and the deposit-insurance backstop. Yes, forbidding proprietary crypto trading removes the failure mode that broke banks holding unbuffered digital exposure. That part is defensible, and the arithmetic supports it. But protection here is conditional, not guaranteed. The logic runs: protect bank capital, protect the banking system, thereby protect the customer. Break any link and the customer absorbs the residual. If the designated digital depository — and the reporting strongly implies state-linked banks will hold the keys — suffers an operational or governance failure, the 50% weight buys the client nothing. A single custodian holding concentrated keys is a single point of failure. That is not risk isolation. It is risk concentration with a friendly label. Watch the demand side, not just the supply side. Russia has real, sanction-driven demand for crypto settlement and store of value. A framework that shuts banks out of proprietary exposure while channeling custody through state-linked institutions does not eliminate that demand. It redirects it. If the compliant rail is expensive, slow, or surveilled, activity migrates to offshore venues and peer-to-peer corridors — exactly where capital controls cannot see it. The rule may succeed at protecting bank capital while failing to bring crypto activity inside the banking system at all. Protection and prohibition are not the same product, even when they share a headline. The number to track is not the 1%. It is the final text's definition of who bears the loss, and the key-management arrangements for state-linked depositories. If keys concentrate in one or two institutions, expect a monitored hub with a cold perimeter and a lively gray market outside it. Watch three data points: the final risk-weight text, the custody liability clause, and the January 2027 N31/N32 disclosures that will reveal whether banks actually want this business. The Bank of Russia is building a controlled on-ramp, not an open market — a deliberate choice that tells you where the regime thinks crypto belongs: inside the state's field of view. Whether institutions find it profitable to stand at that gate is a different question. Capital rules can mandate the pipe. They cannot compel the flow.