Russia's Telecom Regulator Seeks to Lock Down M2M SIM Cards to Stop Fraud

Russia Takes Aim at SIM-Swapping Scammers via M2M Rules

Russia’s Ministry of Digital Development has put forward a regulatory overhaul that would drastically alter how companies use machine-to-machine (M2M) SIM cards. In a draft government decree published on 7 August, the ministry proposes to force all businesses and individual entrepreneurs to register every M2M SIM on the state services portal Gosuslugi, tying each card to the unique IMEI of the device it sits in. If a SIM is moved to an unregistered device, the telecom operator would be required to block the number immediately.

The proposal also introduces a blanket ban on M2M SIMs sending or receiving SMS and making voice calls, closing a loophole that is currently exploited by fraudsters. Because M2M SIMs are designed for meter readings, industrial sensors and other data-only devices, they are often issued without the same identity checks applied to consumer mobile subscriptions. Criminals have reportedly harvested these SIMs to run anonymous mass robocalls and phishing SMS campaigns, using the machine-to-machine channel as an untraceable cover.

The ministry stated that the new rules will oblige companies to keep their Gosuslugi records — including corporate and sole trader names, phone numbers assigned to M2M equipment and IMEI identifiers — up to date. The decree, still in draft, aims to eliminate the “anonymity” that currently shields illicit users of M2M SIMs, making it significantly harder for scammers to ply their trade through legitimate enterprise accounts.

What the Draft Decree Means for Russian Telecoms and IoT Operators

The State Portal Becomes a Gatekeeper

Mandating registration via Gosuslugi represents a significant centralisation of SIM management. For years, businesses could acquire M2M SIMs from operators with relatively light paperwork, often simply listing the corporate account. The new requirement means that every single sensor, smart meter or telematics unit must have its IMEI logged on a government platform, creating a digital audit trail that law enforcement can consult. While the ministry’s stated goal — cutting off fraud — is clear, the move also gives the state a near-real-time view of all non-human cellular endpoints operating in the country.

Operators Face a Blocking Obligation

Telecom operators will be the frontline enforcers. The draft demands they automatically suspend a number if it appears in a device whose IMEI does not match the Gosuslugi registry. For an industry already navigating a tight sanctions environment and struggling to import network equipment, this adds a fresh layer of technical complexity. Carriers will need to build or buy IMEI-checking systems, integrate them with the government portal and handle customer disputes when legitimate maintenance triggers a block. The obligation also shifts liability onto operators: a failure to disable a misused SIM could now carry regulatory penalties.

IoT Networks Get a Controlled Voice

The blanket ban on voice calls and SMS for M2M SIMs is the most operationally disruptive change. Many industrial applications, such as lift emergency lines or remote pump alarms, occasionally rely on a voice channel as a fallback. Under the proposal, those use cases would either need a separate consumer SIM — defeating cost efficiency — or a special authorisation from the ministry, which may slow deployment. The upshot is that legitimate IoT applications will have to be re-engineered to function solely over data, potentially raising network-design costs for energy, logistics and municipal infrastructure projects.

How Businesses Should Prepare for the New M2M SIM Regime

The draft decree is not yet law, but its direction is unmistakable. Companies that rely on M2M SIMs should begin preparing immediately:

• Audit your M2M fleet now. Compile an inventory of every active SIM, the device IMEI it resides in and the legal entity that holds the contract. This will be the minimum dataset required for Gosuslugi registration.
• Test data-only operation. Identify any M2M use cases that currently send SMS alerts or use circuit-switched fallback. Work with your network integrator to shift those functions to data-only protocols (e.g. MQTT or CoAP) so you are not caught out if the voice ban takes effect.
• Engage your telecom partner early. Ask your operator what IMEI-binding mechanisms they plan to implement and whether they will offer bulk registration tools. Early discussions will smooth the migration and help avoid mass SIM blocks when the rules come into force.
• Monitor the decree’s progress. Track official announcements from the Ministry of Digital Development for the final text and an implementation timeline. The draft may be amended; understanding the detail will be critical for budget planning and compliance.