The risks of buying cryptocurrency: what is visible before the trade and what stays with the buyer

A buyer of cryptocurrency — the law calls it digital currency — is exposed in several places at once, and the law covers only some of them. The price is backed by nothing and guaranteed by nobody, there is no insurance scheme for an asset of this kind, and the requirement to trade through a licensed intermediary is being phased in. Below, each risk is examined in the same way: what can go wrong, and what sign reveals it before the trade.

The rules are set by Federal Law No. 282-FZ of 4 August 2026 "On Digital Currencies and Digital Rights", in force since 1 September 2026. The purchase procedure itself — who is entitled to buy and through whom — is described in the piece on how to buy cryptocurrency legally in Russia. This article is about something else: what stays with the buyer when the procedure has been followed, and what is added when it has not.

An intermediary on the register and an intermediary off it

Law No. 282-FZ recognises digital currency as property and routes residents' transactions through licensed intermediaries — the operators of the market. The categories of participant are named in the law itself: digital currency exchanges, brokers, asset managers, depositories and exchange services. The register is kept by the Bank of Russia. Hence the first sign available before the trade: whether the party through which it will pass appears on that register, and in which category.

The requirement to trade only through such intermediaries takes effect later than the basic provisions — under the law, from 1 July 2027. The transition period is precisely the source of regulatory risk: what was bought under certain rules will have to be held and sold under different ones. What consequences the law attaches to a trade that bypasses an intermediary after that date, and how a party to such a trade is protected before it, this article does not assert. The question is settled by the provision and by the practice of applying it, and the wording to check is the version in force on the day of the trade. What the new law changed compared with the previous regulation is covered in the piece on the legal status of cryptocurrency.

There is also a risk that does not depend on the choice of intermediary. Using digital currency in Russia as a means of payment or as consideration for goods, work and services is prohibited, and Law No. 282-FZ has kept that ban. A purchase made "in order to pay with it" runs into the ban whatever the intermediary, and the sign is visible earlier than the trade itself — it is the purpose of the trade.

Whose record and whose key

The next risk is counterparty risk: the intermediary may fail to deliver what it promised even if the asset has lost nothing in price. In the securities market, the recording of rights is separated from trading and entrusted to a depository; how this works is described in the piece "The depository: where your securities are really kept". Law No. 282-FZ also names depositories among the participants, but it is too early to carry the habits of the equity market over to digital currency: how an intermediary records a client's assets, whether it segregates them from its own and what happens to them when it ceases operations is determined by the law, by Bank of Russia regulations and by the agreement with the intermediary.

So the sign here is the agreement itself. In it, the buyer looks for answers to simple questions: in whose name the record of the asset is kept, how and within what time the asset can be withdrawn, and who is liable for a failure. The last of these already belongs to operational risk — a loss caused not by a move in price but by an error, a failure or the bad faith of a link in the chain through which the trade passes. The absence of an answer in the agreement is also a sign, and it is visible before any money is transferred.

Custody without an intermediary removes the intermediary from the chain and adds a different risk. A record in a distributed ledger is, as a rule, controlled by whoever holds the access key, and there is nobody who can restore a lost key on application, the way access to an account is restored. How the current version of the law treats self-custody by a resident is not asserted here: that is a matter of the legal provision, not of the technology.

No fund and no insured event

There is no insurance scheme for digital currency, and Law No. 282-FZ does not create any. A bank deposit carries insurance compensation — RUB 1.4m. For the IIS-3, a guarantee scheme has been in operation since 1 January 2026: if a broker or asset manager that participates in it goes bankrupt, the fund pays out up to RUB 1.4m, though participation is voluntary and a fall in the price of the securities is not a guarantee event. Digital currency has neither: a default by the intermediary is not covered, and a decline in price still less so.

The sign before the trade here lies in the wording. The words "insured", "with a guaranteed refund" or "protected by a fund" in an offer to buy digital currency do not rest on any scheme established by law. Behind them there can only be the promise of a particular person, and it is worth exactly as much as the person who gave it is able to deliver.

A price with no debtor behind it

Market risk in digital currency is simpler in structure than in a bond. It has no obligor — nobody who owes the holder a payment or a repayment — and the price remains nothing more than the amount the next buyer is willing to pay.

How sharply it has moved is shown in the coins section: price, market capitalisation and history for each coin, for example on the bitcoin page. The section is for reference; no trades are executed through it. The history is used to assess the drawdown — the depth of the fall from the previous peak — and the length of time the price spent below that peak. The history does not, however, describe what lies ahead — that is the subject of the piece "Why past returns promise nothing".

A separate case is coins whose rate is designed to be pegged to a currency. The peg is a feature of the coin's design, not a guarantee given by law; whether the organisation that issued such a coin is an obligor towards its holder, this article does not assert. Whether the peg has held can be seen from the history on the Tether page.

The purchase limit does not remove price risk. A non-qualified investor gains access after passing a test, and only to a restricted list of the most liquid digital currencies, which is determined by the Bank of Russia, within RUB 300,000 a year with one intermediary. This figure is taken from the draft Bank of Russia directive published on 11 August 2026, and the version in force needs to be checked. The limit caps the amount the buyer puts at risk, not the depth of the fall in what has been bought. The conditions of access are set out in the piece on buying cryptocurrency as a non-qualified investor.

The trail that remains after the trade

Tax risk is a matter of documents: under Federal Law No. 418-FZ of 29 November 2024, income from the sale of digital currency is subject to personal income tax, the cost of purchase reduces the tax base only if it is supported by documents, and the individual files the tax return personally if the tax was not withheld by an intermediary acting as tax agent; the calculation is in the piece on the tax on selling cryptocurrency. The sign before the trade is whether a document showing the purchase price will remain after it.

Where this list stops being accurate

What is set out here is tied to a date. The transition period runs until 1 July 2027, and the limit for the non-qualified investor is taken from a draft directive. Once the regulation has been adopted and once the transition is over, it is the text in force that should be read, not this article.

The list is written about a resident and about digital currency. It does not carry over to digital financial assets: there an obligor does exist, and the rules are different — the distinction is examined in the piece on how cryptocurrency differs from digital financial assets.

The status of qualified investor lifts the limit on the amount but changes nothing else: the price, the intermediary and the absence of insurance are the same for such an investor.

Our data contains nothing about intermediaries. We show the prices, market capitalisation and history of coins, but we see neither trades, nor agreements, nor the register of participants.

Finally, an asset with no debtor and no insurance sits poorly with money that will be needed by a known date or whose loss the owner could not withstand. In the glossary this is risk capacity, and it does not depend on the willingness to take risk. How to translate it into the size of a position is described in the piece "How to assess the risk of a position: step by step".

Before the trade, the answers to all of this are the buyer's own responsibility: whether the intermediary appears on the Bank of Russia register, what the agreement says about the recording and withdrawal of the asset, what stands behind the word "guarantee", and whether a document recording the purchase will be kept.