Import substitution of information technologies in banks

Among the missing solutions that Russian IT companies do not have time to create are firewalls, intrusion detection systems and firewalls. Large organizations use foreign solutions, since domestic analogues are less productive and cost more, the ADB notes.

In addition, according to the letter, the development and implementation of software on which the entire IT architecture of the bank is built lasts longer than the indicated time frame. And the responsibility for the timely transition to domestic software lies with banks that cannot affect the speed of vendors.

The Association asked the government to allow banks to point-use software from unfriendly countries in the absence of Russian analogues, extend the terms of import substitution, and support changes in legislation. In particular, the association asks to simplify the inclusion of software in the registers of the Ministry of Digital Development, including its own developments and open source software, etc.

The Ministry of Digital Development told the publication that the ministry does not support the initiative to extend the transition to domestic solutions for all subjects subject to the presidential decree.^[2]

2023

Russian banks want to postpone import substitution in the software sector

On September 8, 2023, it became known that several large credit institutions at a meeting of the Bank of Russia made a proposal to postpone the mandatory transition to domestic software.

According to the Kommersant newspaper, RSHB, Gazprombank, Promsvyazbank, VTB and Дом.РФ are taking the initiative. In the current geopolitical situation, the subjects of critical information infrastructure (CII) in Russia, which include financial institutions, telecom operators and other organizations, are ordered to stop using foreign software from January 1, 2025 . However, banks believe that domestic suppliers will not have time to adapt automated banking systems (ABS) to work with Russian database management systems (DMS). Therefore, the entry into force of the requirement for mandatory import substitution is proposed to be postponed for two years - until 2027.

Several large credit institutions proposed to postpone the mandatory transition to domestic software

Market participants emphasize that domestic ABS are adapted to work with a foreign system software - primarily with production DBMS. Oracle At the same time, optimization for domestic DBMS, for example, " Postgres will take a long time and will require large investments," since "in fact, ABS will need to be rewritten anew." The fact ABS is that development is a complex process that requires high technical expertise.

In this situation, as noted by Kommersant, VTB, RSHB and Дом.РФ are discussing the possibility of establishing a consortium that will prepare a new ABS for working with Russian DBMS in a few years. But there may be a problem finding technical specialists with the necessary knowledge. The Bank of Russia reported that they were discussing with market participants topical issues of import substitution.^[3]

ATMs based on Elbrus processors: Gazprombank and PSB begin transferring payment processing to an import-independent infrastructure

On June 15, 2023 , Gazprombank introduced a card payment processing system based on Russian components. The bank expects that the new technological stack will allow import substitution of a critical system in the banking sector - payment processing^[4]

The project was called the "Trusted Platform for Electronic Payments." Within the framework of it, together with partners, a system for processing card payments was developed: a hardware platform, system and application software, cryptographic equipment, and a Russian-made ATM.

Stack of Russian technologies used in the project (from Gazprombank materials)

The ATM, in the control module, uses the Russian Elbrus processor from the MCST, which controls the ATM and interacts with the bank circuit. The manufacturer of the ATM is the company "Banking and Financial Systems" (BFS). In the bank's systems, the project also uses servers based on Elbrus processors.

By 2025, according to the results of the pilots, we plan to transfer the software modules of the processing system to Elbrus microprocessors, we will use ALT Linux OS and Synergy DBMS. We will also switch to Russian cryptographic modules and ATMs. Such projects have not yet been implemented in Russia, so we have an important mission to develop and test new solutions that can ensure technological independence, Gazprombank quotes Deputy Chairman of the Board Dmitry Savers in his message.

On the same day , Promsvyazbank (PSB) concluded an agreement with the BFS on cooperation in the development of payment infrastructure using Russian equipment^[5]It provides for the expansion of cooperation on the development and use of new generation domestic ATMs, the implementation of joint programs for the integration of new equipment into PSB systems and includes, among other things, interaction on the use of a BFS ATM running on an Elbrus processor.

The agreement signed today will allow scaling up the introduction of Russian technologies into the payment infrastructure of PSB in compliance with all modern security standards and will launch new projects in the field of innovative payment instruments, "said PSB Chairman Pyotr Fradkov.

The BFS ATM at Elbrus was developed with the financial support of the Ministry of Industry and Trade as part of the implementation of the decree of the government of the Russian Federation.

In May 2023, the blog of Moscow Mayor Sergei Sobyanin reported that the serial production of Russian BFS ATMs based on Elbrus processors was established in the Rudnevo industrial park^[6]. At that time, BFS had already received pre-orders for 7 thousand ATMs. According to Sobyanin, the production capacity of the enterprise is up to 15 thousand ATMs per year and can be doubled.

The need for Russian ATMs increased after in 2022 the activities in Russia against the background of Western sanctions decided to suspend foreign leaders-manufacturers of ATMs - American companies Diebold Nixdorf and NCR.

The law on the obligation of banks to agree with the Central Bank on the purchase of domestic software was adopted by the State Duma

The State Duma in the third, final reading adopted a law that will oblige credit and non-bank financial institutions to coordinate with the Bank of Russia plans for the transition to the use of domestic software and IT equipment. Such a proposal was submitted to parliament in the summer of 2022 by deputies headed by the head of the Duma committee on the financial market Anatoly Aksakov and vice speaker of the Federation Council Nikolai Zhuravlev.

Initially, according to the explanatory note, the bill was developed in order to determine the powers of the Bank of Russia to control that financial institutions at critical information infrastructure facilities switch to the predominant use of Russian software. Also, the Central Bank must control the purchase of foreign software and services related to them.

The bill will allow the Bank of Russia to ensure the implementation of measures to ensure technological independence at significant facilities of the critical information infrastructure of credit and financial institutions, the authors of the bill noted in an explanatory note.

Later, in May 2023, the bill was finalized - a norm was added to it, which also involves the coordination of purchases of IT equipment - electronic products and telecommunications equipment. Now the law will enter into force 90 days after its official publication.

Earlier, in the spring of 2023, market representatives, together with the authorities, also raised the issue of creating a special infrastructure organization that would help financial organizations in the transition to domestic software. Then the fact of negotiations was confirmed in the State Duma and the Association of Banks of Russia (ADB). As the vice-president of ADB Alexei Voilukov explained, domestic developments could make it possible to form such an infrastructure platform through which small banks and other organizations could connect to software to save their funds. The discussion of this topic is connected with the ban on the use of foreign software by critical infrastructure facilities, which was previously introduced by President RFVladimir Putin. At the same time, as experts noted, for many organizations, the operational purchase of new domestic software may not be feasible in terms of costs. At the same time, the Ministry of Digital Development noted that they were ready to discuss the creation of an auxiliary organizational platform to support small financial organizations, which, unlike large ones, cannot yet fully build their infrastructure only on Russian technologies. Including such a platform could provide consulting and technological services, said Deputy Minister of the Ministry of Digital Development Maxim Parshin.

Most Russian banks, especially small and medium-sized banks, already use the application software of domestic developers, said Alexander Gentsis, a member of the board of directors of Diasoft, in a conversation with Vedomosti. In his opinion, it is important to understand whether all Russian vendors will be able to transfer their products to import-independent domestic technologies on time. Suppliers should start preparing programs that will help small banks make the transition in a short time and with minimal risks, the expert is sure.

If we are talking specifically about the financial sector, then, in my opinion, a single scheme for the planned transition to domestic software can be developed here. If earlier automation of processes in this sector was carried out separately, today it should be built so that, working in this direction, banks did not suffer large losses, but, on the contrary, were stimulated to do such work as soon as possible. Because this segment is the most priority in terms of import substitution, which is actively underway in our country. Why is it so important to transfer banks to domestic technology? First of all, this will help ensure their continuous and high-quality functioning regardless of how foreign vendors behave. In addition, the same step will help protect our financial organizations from endless hacker attacks, and, as a result, significant leaks of information about customers, "said Anton Nemkin, a member of the State Duma Committee on Information Policy, Information Technology and Communications.

For the same purposes, a ban on the use of foreign messengers by banks and government agencies in their work was also previously introduced, - reminded Nemkin Anton. - Roskomnadzor insisted that nine foreign messengers be banned from sending personal information about customers, checks, and so on. Later, fines of up to 700 thousand rubles will also be introduced for violators of these rules, as of June 2023, the bill on them has already been adopted in the first reading. In fact, this is also a step in the direction of import substitution in the work of the financial sector, since domestic messengers are not prohibited from using them - moreover, individual organizations are already introducing, for example, the VK platform for these purposes.

2022

The bill on the right of the Central Bank to coordinate the purchase of foreign software for banks was adopted in the first reading

On November 16, 2022, the State Duma of the Russian Federation adopted in the first reading a bill (No. 164428-8^[7]which gives the Bank^[8] Russia the right to control the plans of financial institutions to switch to Russian software, as well as coordinate the purchase of foreign software.

Photo: business-gazeta.ru

In order to ensure the continuity of banking services, the Bank of Russia approves credit institutions "action plans for the transition to the preferential use of Russian software at significant critical information infrastructure facilities and credit institutions" applications for approval of purchases of foreign software and services, associated with it, at significant facilities of critical information infrastructure, in accordance with the procedure, established by the Government of the Russian Federation in agreement with the Bank of Russia, the bill says.

As specified in the explanatory note to the document, the bill will allow the Bank of Russia to ensure the implementation of measures to ensure technological independence at significant facilities of the critical information infrastructure of credit and financial institutions, as well as the implementation by these organizations of the provisions of Decree of the President of the Russian Federation of December 5, 2016 No. 646 No. "On Approval of the Doctrine of Information Security of the Russian Federation."

The document was submitted to parliament in July 2022 by deputies A.G. Aksakov, A.A. Getta, A.N. Svistunov and Senator of the Russian Federation N.A. Zhuravlev.

According to the authors of the document, the bill does not contradict the provisions of the Treaty on the Eurasian Economic Union, as well as the provisions of other international treaties of the Russian Federation.

If adopted, the Federal Law will enter into force from the date of its official publication.

The government approved the right of the Central Bank to coordinate the purchase of foreign software for banks

On October 31, 2022, it became known that the Government of the Russian Federation approved amendments on the right of the Central Bank of the Russian Federation to coordinate the purchase of foreign software for banks.

According to Interfax, citing an explanatory note to the project, the adoption of this law will allow the Central Bank "to ensure the implementation of measures to ensure technological independence at significant facilities of the critical information infrastructure of credit and financial institutions."

The government approved the right of the Central Bank to coordinate the purchase of foreign software for banks

The regulator will also be able to coordinate the action plans of credit institutions for the transition to the predominant use of Russian software and applications of credit institutions for the approval of purchases of foreign software and services related to it at significant facilities of critical information infrastructure in accordance with the procedure established by the government in agreement with the Bank of Russia.

Earlier Association of Banks of Russia (ADB) it indicated that it should be, and Central Bank of the Russian Federation not, to control the transition of the banking sector to domestic software. Ministry of Digital Development ADB's position is based on the fact that Ministry of Digital Development specialists do not have the proper competence, and also lack an understanding of the specifics of the special work ON in the banking sector, including the protection of data constituting bank secrets.

Earlier, the federal law "On the Security of Critical Information Infrastructure" came into force, according to which banks must import substitution of software and components. It was originally planned to replace the software by January 1, 2021, and the equipment by January 1, 2022. Banks wanted to extend the transition period for 6 years, since 85% of the software they use was created abroad. In the fall of 2020, a draft presidential decree appeared on the transition to domestic products in 2024-2025.^[9]

Government ban on the use of foreign software in banks

In October 2022, the Russian government banned Russian banks from using foreign software. The ban is valid even if there are no domestic analogues of imported software to perform certain tasks.

Digitalization under sanctions: 8 problems faced by the IT services of Russian banks

In March 2022, TAdviser spoke with the Chief information officers of Russian banks to find out in which areas they are most dependent on imports (more).

Russian banks are trying to abandon Oracle DBMS

Against the background of Western sanctions imposed on Russia due to a special operation in Ukraine, Russian banks are now developing strategies to abandon Oracle databases, TAdviser was told at the end of March in IT companies working with large banks. One of these companies says that decisions on full-fledged strategies for refusing financial institutions have not yet been made, because only a month has passed since the imposition of sanctions - this is very little, but they will gradually be adopted. This is especially typical for organizations that have fallen under sanctions.

The availability of work in this direction is confirmed, for example, by Otkritie Bank, one of the banks affected by Western sanctions.

Yes, given the risks of a long-term lack of support and updates to Oracle in terms of software and equipment, we are working on alternative solutions, "TAdviser told Otkritie Bank.

Sberbank is developing and developing its own version of the database based on PostgreSQL, taking into account the bank's special requirements for performance, reliability and cybersecurity, and plans to migrate to it from Oracle^[10] The bank has long collaborated with the Russian DBMS developer Postgres Professional.

Our solution is a target DBMS of Sberbank and is currently used in more than 400 automated systems, which is more than 6,000 active installations, - says the description of the vacancy of the administrator of the Sber Tech database, published on March 25[11].

Abandoning the Oracle database is very difficult

The Sberbank told TAdviser that for more than two years they have been successfully using their own development on the scale of the bank's infrastructure - Platform V Pangolin, an enterprise relational database management system. It is developed on the basis of the free DBMS PostgreSQL and is strengthened by critical improvements that allow you to meet the increased business requirements for the security of stored data, availability, reliability, and performance.

The product allows you to quickly deploy the DBMS and start working, store and index data of any complexity, as well as implement all the necessary functions. Platform V Pangolin participates in the software import substitution program and has already proven its effectiveness. From 2021, Platfrom V Pangolin is available for the external market. Sberbank also uses its own other assemblies based on open source solutions for working with big data, Sberbank explains.

As of March, Promsvyazbank also has a project for import substitution of infrastructure software, including DBMS . We are talking about the use of PostgreSQL/PostgresPro DBMS in high-load, clustered and fault-tolerant installations^[12]

VTB, in accordance with its strategy of technological transformation, long before the imposition of sanctions, began to work out and test options for replacing foreign equipment and software with Russian counterparts, including Oracle databases, the bank told TAdviser.

Measures to switch to the predominant use of domestic software and Russian databases are carried out at the bank as part of the implementation of directives of the Russian government in order to reduce the impact of the imposed sanctions restrictions and adapt to the new technological reality as soon as possible, VTB explains.

The use of PostgreSQL for some applications in banks is no longer uncommon. However, in terms of the most highly loaded, critical applications, there is a high dependence on Oracle. Alexander Glazkov, Managing Director, Chairman of the Board of Directors of Diasoft, in a conversation with TAdviser noted that it is very difficult to abandon the Oracle database, such projects can take several years, because this is a huge layer of work. Now banks should turn off updates and "mothball" to ensure stable operation of applications, and open projects for the transition.

It is not worth delaying the period of "conservation," Glazkov believes: there is an opinion on the market that when Oracle is disconnected from support for a couple of years, critical problems accumulate for some reason, and since the customer does not own the code, he cannot fix it.

Oracle in early March announced the suspension of all operations in Russia after the introduction of Western sanctions against Russia due to a special operation in Ukraine. Moreover, according to sources on the market, we are talking, among other things, about stopping updates and supporting solutions^[13].

Maria Shevchenko, Chairman of the Board of Directors of Kiwi Bank, who heads the import substitution working group under the State Duma Finance Committee, noted in an interview with TAdviser in 2021 that in terms of replacing imported technologies, the biggest problem in DBMS: "Many banks use Oracle - corporate DBMS No. 1 in the world. Are there Russian DBMSs of the same quality? No. Especially if the question concerns large banks with their transaction volumes and processing speed. "

The situation has not changed for the year. Thus, a survey of the Chief information officers of Russian banks in order to find out in which areas Russian companies are most dependent on imports, conducted by TAdviser, showed that the use of foreign-made DBMS, and in particular Oracle, is one of the main problems. Chief information officer confirm that the transition process will not be quick.

Ilya Sivtsev, general director of Astra Group, names the financial sector among those where there is now the greatest activity in the field of import substitution. Banking software developers have begun to more actively turn to domestic operating systems developers to ensure compatibility with them, he says. As an example, Astra cites the Center for Financial Technologies (CFT), which has shown interest in cooperation. The company also adapts the functionality of its banking applications implemented to work with Oracle DBMS to work with PostgreSQL.

Diasoft says they have been preparing their banking applications to switch from Oracle to PostgreSQL for years and have invested in it. However, banking landscapes include dozens, hundreds of different products, and not all of them carried out similar work.

It should be noted that against the background of sanctions and demarche of Western technology companies from Russia or restrictions on their activities, the risks are not only the use of proprietary imported software in critical applications. Alexander Glazkov from Diasoft says that banks are already facing problems related to the use of open source in their solutions. Various bookmarks and problems "actively began to penetrate through this code. According to him, a couple of very large Diasoft clients have already laid something through open source that has erased the base.

Now you need to fix the downloaded open source code, and it is desirable that someone in Russia take responsibility for its support and development by analogy with the way Red Hat did, Glazkov said. And it is very not recommended to download the new code now. Bookmarks have already gone, and you can do a lot of damage through them.

Bankers told what will happen with the transition to domestic software after the departure of foreign vendors

Leaving the market of foreign suppliers means that banks they are left without vendor support and will have to count on their own competencies: mechanisms for replacing failed nodes no longer work, there are problems with the import of equipment into, Russia some projects have been suspended; the greatest risk is the operability of data networks (the main vendor was); Cisco however, now it makes no sense to accelerate import substitution, since the market is overheated, manufacturers do not accept orders, and the implementation of new projects is unlikely, so it is better to wait until the market calms down, because in a hurry you can make mistakes in the infrastructure and architecture of solutions, and these are serious risks for the bank, write "," Sheets referring to the director of the digital technology department of Sinara Bank (earlier SKB-Bank) Denis Kuznetsov^[14]

Some banks have encountered the inability to obtain updates to their software or renew their license for some foreign-made software products; there was an additional burden on employees of the Department of Information Technologies and Information Security, said Vadim Zhilin, head of the information technology department of Derzhava Bank, adding that a complete transition is possible on the horizon of three to five years.

Banking leaders of IT departments look at the situation as a whole positively, noting that banks have been preparing for such a scenario for a long time and have a margin of safety, so the current situation will not affect the availability of banking services for customers in any way: Renaissance Credit Bank has the largest amount of changes due to the revision of already developed technological solutions in favor of choosing an alternative to players who left the market; Ak Bars Bank faced a significant increase in the tasks of replacing a number of systems, but despite this, it is actively implementing the replacement of foreign software and equipment; the Center-Invest Bank provides reserve capacity and retains various options for receiving timely support; in Post Bank, most partners and suppliers have created a stock of spare parts, as well as have the necessary competencies for servicing and maintaining IT equipment and software.

A number of banks in their systems have long used domestic software and equipment, proprietary programs or open source software: VTB has long focused mainly on open source development and their registration in the register of domestic software; Absolut Bank also uses software mainly from Russian manufacturers or open source in the development of its IT landscape and the development of new services (this makes it possible not to depend on the vendor); about half of the software in the Russian-made Post Bank, as well as the support and maintenance of a significant part of the banking software, is carried out not by foreign vendors themselves, but by their official Russian partners.

But not everyone is satisfied with the quality of domestic analogues: according to bankers, the capabilities of domestic software analogues, such as virtualization tools, are limited, they sometimes lack performance, and the reliability of domestic equipment is also doubtful at times, and not for every replaced software or equipment can be found an analogue comparable in terms of performance and functionality, and, if the situation is better in terms of software, then in terms of equipment it can be difficult or even impossible to find a replacement; the issue of the transition price also remains open: adaptation to new conditions will inevitably lead to a significant increase in banks' costs for maintaining and developing IT infrastructure.

TAdviser interview: Vyacheslav Yashkin, Ak Bars Bank - on the successful migration of QCD in the interior of import substitution

The modern bank is always in a state of constant development. Thus, Ak Bars Bank has reached a new level of interaction with clients, which is based on high-quality client analytics and new technical capabilities of the bank. The next stage of development is met by a new strategy for the development of the banking business, including, among other things, the task of import substitution. Vyacheslav Yashkin, Director of Information Security and Data Management at Ak Bars Bank, spoke about how Ak Bars Bank migrated corporate data storage amid the active implementation of the digital transformation strategy. Read more here.

2021

How much does IT import substitution cost in banks and why is it difficult? TAdviser interview with head of Kiwi Bank Maria Shevchenko

In February 2021, a working group was created under the State Duma Committee on the Financial Market on the transition of financial organizations to domestic software and equipment, headed by Maria Shevchenko, Chairman of the Board of Directors of Kiwi Bank. In an interview with TAdviser, she spoke about the current level of dependence of Russian banks on imported technologies and the "pitfalls" of import substitution in this industry. Read more here.

VTB will spend 9.3 billion rubles on servers with processors on open architecture

In early September 2021, it became known about VTB's intentions to spend 9.3 billion rubles on servers using processors with open RISC-V architecture. We are talking about one of the end-to-end projects that are planned to be launched jointly by the government and business for the development of the electronic industry. VTB said that "the introduction of an open source architecture will help solve the bank's strategic objectives, as well as increase import independence." Read more here.

2020

TAdviser interview: PSB Chief Information Officer Sergey Pegasov - about the difficulties of import substitution and the development of its own software

Chief information officer PSBSergey Pegasov told TAdviser about the difficulties that arise in the import substitution process, why it is not always possible to use Russian solutions and what are the prospects for the bank's own developments . Read more here.

Banks asked to transfer control over the transition to Russian software to the Central Bank

At the end of November 2020, it became known about the position of the Association of Banks of Russia (ADB) regarding control over the transition of credit institutions to domestic software. According to the organization, the Central Bank of the Russian Federation should oversee this issue, not the Ministry of Digital Development of the Russian Federation, since the department does not understand the specifics of the banking industry. Read more here.

Central Bank: banks' transition to Russian software should be postponed until 2025

On August 12, 2020, it became known that the Central Bank of the Russian Federation agreed with Russian banks about the postponement of the transition of the financial sector to Russian software. While the initiative of the Ministry of Telecom and Mass Communications involves the transition to domestic software from 2021, to equipment - from 2022.

The Bank of Russia has considered the appeal of the Association of Banks of Russia on the issue of the planned transition to the priority use of Russian software and IT equipment at critical information infrastructure facilities and plans to send proposals to the Government of the Russian Federation and the Presidential Administration of the Russian Federation to postpone this transition by 4 years to 01.01.2025, the Association of Banks of Russia (ADB) said in a statement.

Read more here.

The transition of the banking sector to Russian software is estimated at 700 billion rubles

On July 24, 2020, it became known that the transition of the banking sector to Russian software could cost it more than 700 billion rubles. And the costs of individual banks, depending on their size and the scale of updating systems, can range from 90 million to 150 billion rubles. This assessment, together with IT companies, was made by the Association of Banks of Russia (ADB). The document was sent to the State Duma Committee on the Financial Market. Read more here.

The financial sector opposed the transition to Russian software

On June 8, 2020, it became known that the Association of Electronic Money and Money Transfer Market Participants (AED) sent a letter to the Ministry of Communications, in which it opposed the transfer of financial organizations to Russian software. The AED believes that financial organizations will have to allocate 30% or more of their own funds for migration to domestic software, which includes expenses for licenses and equipment, employee training and integration costs. And this will negatively affect the strength of the banking sector in the face of falling profits. Read more here.

2015: CIO VTB24 optimistic about possible sanctions

Answering a question from TAdviser about the risks associated with possible restrictions on American supplies ON Russia due to the political situation, the director of the banking department information technology VTB 24 Sergey Rusanov said in February 2015 that his bank regards them as minimal.

We are optimistic and think that after all the situation will develop in an optimistic way, since it has already gone far enough. Therefore, we consider such risks as minimal, "he said.

In 2014, VTB24 completed the construction of all elements of the base target platform, which is based on various Oracle products . The automated banking system, unlike many Russian banks, VTB24 also uses imported ones. According to Sergei Rusanov, in the event of tough sanctions, a collapse in the bank's work will not happen: it will be able to continue supporting existing systems. Problems may arise with the development of systems and with new projects requiring new software and updates, he believes.

Read more here.

Notes