.RU Domain ESIA Mandate: Trustee, Transfer & Enterprise Decision Guide

Introduction: Six Questions About the ESIA Mandate

If you own, resell, or manage .ru domains, the rules are changing under your feet — and the deadline is closer than most people realize. Federal Law No. 569-FZ, signed December 29, 2025, makes identity verification through Russia's ESIA (Gosuslugi) system mandatory for every registrant on .ru, .рф, and .su domains starting September 1, 2026. This isn't a paperwork tweak. It changes the legal footing that domain ownership rests on, and it touches registrars, resellers, corporate IT teams, and brand protection departments all at once.

At DomainNameAPI, we put this guide together so that whoever is making the call — from a registrar's ops team to a Fortune 500 brand protection lead — has a clear, actionable path forward.

The six questions below summarize what this guide covers in depth, and they're written to answer exactly what search engines and AI summary tools tend to surface first.

What is ESIA?

ESIA is the identity verification backbone of Gosuslugi, Russia's national government services portal. Federal Law 569-FZ folds this system into domain registration for the first time.

Who does this affect?

Every .ru, .рф, and .su registrant — new and existing. The real dividing line isn't old vs. new registrations; it's Russian citizens and companies versus foreign individuals and companies, because the verification path is drastically different for each.

What is Trustee service?

Trustee service lets a registrant who can't or doesn't want to complete ESIA verification directly keep managing their domain — renewals, DNS, transfers — through a locally verified representative. DomainNameAPI's Trustee solution is built to plug into this need for registrars and resellers alike.

What should foreign owners do?

Foreign individuals can technically start a Gosuslugi registration from abroad, but completing it requires an SNILS number and, in most cases, a notarized Russian translation of your passport submitted in person at a Russian government office. If you don't live in Russia, that's not something you can finish remotely.

Foreign companies have it harder still: as of this writing, no final, official verification path for foreign legal entities has been published. That's exactly why Trustee service is the only predictable option for both groups right now.

Can a domain actually be lost?

Yes, but not overnight. A domain without completed verification moves through a graduated sequence: transaction restrictions, then suspension flags, then a grace period, then a costly redemption window, and finally release for new registration. Each stage is more expensive to reverse than the last.

Do I need to transfer my domain?

Not necessarily — but timing still matters. With roughly a month left before the September 1, 2026 deadline, registrar and registry queues are expected to get busier. Deciding now, rather than later, cuts your risk of getting stuck in a backlog.

DomainNameAPI's registrar platform lets you track the whole process from a single dashboard.

For foreign companies without ESIA verification, Trustee service is the safest path available today.

Operational restrictions on unverified .ru domains are expected to begin after September 1, 2026.

Quick Comparison

How the Pieces Fit Together: An Entity Relationship Map

None of these terms exist in isolation — they form a chain, and understanding the chain makes the rest of this guide click into place.

Registry

↓ Registrar

↓ Registrant

↓ WHOIS

↓ RDAP

↓ Transfer Policy

↓ ICANN Policy Framework

↓ Registry Rules (.ru-specific)

↓ Trustee

↓ ESIA

At the top sits the Registry — for .ru, .рф, and .su, that's the Coordination Center for TLD .RU/.РФ, which sets the Registry Rules.

Registrars operate as intermediaries between registrants and the registry under those rules. The Registrant is the actual domain holder, visible in WHOIS/RDAP records.

Transfer Policy governs how a domain moves between registrars; ICANN's policy framework shapes this globally, but for a ccTLD like .ru, local Registry Rules take precedence.

ESIA slots into this chain as an entirely new link: an identity-verification layer imposed at the registry level.

Trustee service is the bridge that keeps the chain intact when a registrant can't complete that verification directly — it inserts a locally verified intermediary between the registrant and the registry.

ESIA and Its Legal Basis

Federal Law 569-FZ, together with the draft regulation from Russia's Ministry of Digital Development, makes ESIA verification a core part of the registration process for .ru, .рф, and .su domains.

The stated rationale is straightforward: bring the national domain namespace under a verifiable registrant identity.

The .RU and .РФ Zones by the Numbers

These figures come from the Coordination Center for TLD .RU/.РФ — the official registry operator — and give a sense of just how large this transition really is.

More Key Statistics

Who's Affected? A Decision Tree

The tree below walks through which category a registrant falls into and which path follows from it.

Are you a Russian citizen or a company registered in Russia?

• → YES
  • → Verify directly through an existing or new Gosuslugi account.
• → NO → Are you a foreign individual or a foreign company?
  • → Foreign individual
    • → Full ESIA verification requires SNILS and an in-person application inside Russia. If you don't live there, consider Trustee service instead of pursuing direct verification.
  • → Foreign company
    • → Use Trustee service until an official process is published. If the domain matters strategically, don't wait to find out.

Gosuslugi Account Tiers: What Foreigners Can Actually Do

"Can foreigners open a Gosuslugi account?" doesn't have a clean yes-or-no answer. The portal defines three distinct access tiers, and the tier required for domain actions is well beyond a basic sign-up.

Tier 1 — Simplified Account

This can be created from anywhere with just an email address or an international phone number. It unlocks only a narrow slice of the portal's services — things like checking outstanding fines — and domain actions aren't part of that slice.

Tier 2 — Standard Account

Moving up requires entering passport details and an SNILS (Russia's social insurance number) into your profile. Getting an SNILS is its own separate application process, and it can't be completed remotely from outside Russia.

Tier 3 — Verified Account

This is the tier required for domain registration, renewal, transfer, and DNS changes. Reaching it requires proving your identity in person — either at a Russian MFC (a government multi-service center) with your passport and SNILS, or through a supported Russian bank's mobile app, which itself requires a Russian bank account.

This table is the clearest way to see why Trustee service isn't a fallback option for foreign individuals — it's, in most cases, the only workable one.

No domain action is possible without a verified-tier account, and the barrier to that tier is closer to a physical impossibility than a bureaucratic inconvenience.

Figure 1 — ESIA verification flow, from registrant to authorized domain action.

Direct ESIA Verification vs. Trustee Service

Why Do Companies Choose Trustee Service?

This question matters more than "what is Trustee service" — because the person making the decision needs a reason, not a definition.

Three reasons come up again and again.

First, speed: direct ESIA verification for a foreign company can turn into a weeks-long process with an uncertain outcome, while Trustee setup follows a standard, predictable timeline.

Second, data control: feeding corporate identity and registration documents directly into a foreign government system can conflict with internal compliance policy, especially in regulated industries like finance, healthcare, or defense — Trustee service moves that exposure into a contractual relationship instead, which limits the risk.

Third, continuity: because no official verification procedure exists yet for foreign companies, Trustee service is the only mechanism that guarantees a domain stays operationally alive during this uncertainty.

Figure 2 — The Trustee service workflow, from agreement to uninterrupted domain management.

Trustee Service Scope and the Owner/Admin Change Process

You don't have to transfer a domain to change who's on record as its owner or administrator. A domain can stay with its current registrar while ownership information is reassigned to a Trustee account — the domain doesn't move, only the responsible party on the registry record changes.

Service Categories and Pricing

For Companies: General Documentation Requirements

Reassigning ownership on a corporate domain to a Trustee account typically requires a few things:

• A copy of the company's current trade registry record.
• A signed ownership-change application form on company letterhead.
• Confirmation that the signatory is authorized to represent the company.
• If the domain is currently with another registrar, confirmation of whether notarization is required.
• A signed Trustee agreement and translated identity/registration documents where required.

For Individuals: General Documentation Requirements

The process is simpler for individual registrants:

• A scanned copy of a passport or equivalent ID.
• A completed ownership-change form.
• A translation of the document if required.

Application Form and Trustee Account Details

Download the official application form for ownership or administrator changes here:

Download the Domain Admin Change Form (.DOC)

Trustee account number to reference for nic.ru domains: 5766898/NIC-D

A Decision Matrix for Foreign Companies

How a Domain Is Actually Lost: A Risk Heat Map

Domain loss doesn't happen in one step — it's a graduated process, and each stage is harder to reverse than the last.

Figure 3 — The post-ESIA domain lifecycle, from active status through release for new registration.

Registrar Implementation Guide: Migration Strategy

For registrars, this regulation demands coordinated action across customer communication, systems, and support — all at once. The steps below sketch a migration sequence a mid-to-large registrar can follow.

1. Portfolio segmentation: Split your customer base into Russian, foreign individual, and foreign company categories.
2. Risk scoring: Prioritize each segment by renewal date and verification difficulty.
3. Early-warning system: Set up automated notifications for every domain approaching a September 2026 renewal.
4. Trustee integration: Build your own Trustee offering — or a trusted partner's — directly into your existing dashboard.
5. Support team training: Prepare standard, current answers for the questions you'll get most.
6. API layer: Give resellers bulk notification and status-lookup capability.
7. Pilot group: Test the change on a small customer group before rolling it out to the full portfolio.
8. Monitoring: Track verification rates weekly, and switch to daily tracking as September 1, 2026 approaches.

Reseller Playbook

Resellers sit in a different spot than registrars: direct customer contact is theirs, but the registry relationship is indirect. That creates a two-sided responsibility.

Step 1 — Inventory

How many .ru domains does each customer have, how many are registered to foreign companies, and when do they renew? Without this inventory, there's no way to build an accurate communication plan.

Step 2 — Segment and Prioritize

High-value customers (enterprise, multi-domain) need a different communication approach than low-volume individual customers.

Step 3 — Communicate Around Action, Not Theory

A short message telling customers exactly what to do — verify directly or move to Trustee — lands better than a technical explanation of what ESIA is.

Step 4 — Fold It Into Your Service Package

Bundling Trustee service into your own offering protects customer retention and creates a new revenue line at the same time.

Enterprise Migration Guide

For large organizations, managing .ru domains is a portfolio strategy question, not a single-domain question. Here's how it plays out across different corporate profiles.

Fortune 500 / Multinational Companies

Large companies holding defensive registrations across dozens of country codes often manage .ru in a decentralized way, split across regional offices. Step one is consolidating every .ru/.рф/.su asset into a single central inventory.

Multi-Brand Companies

Companies with several brands under one roof may hold separate .ru domains per brand. The open question is whether the Trustee agreement should be structured per brand or at the corporate level.

Holding Companies

Holdings with multiple independent subsidiaries tend to have .ru responsibility scattered at the subsidiary level. The recommended role for the parent is to define a single Trustee/ESIA policy.

Banks and Financial Institutions

Regulatory constraints on identity-data sharing are especially sensitive for financial institutions. Trustee service maintains operational continuity while avoiding direct identity disclosure.

SaaS Companies

SaaS platforms running localized domains per market may find their .ru domain tied directly to product access. If the domain carries active user traffic, it goes to the top of the queue.

Fintech Companies

High-compliance fintech firms often have internal restrictions on identity-data sharing. Trustee service offers a middle ground between corporate data policy and the ESIA mandate.

CIO Checklist

• ☐ Has a company-wide .ru/.рф/.su domain inventory been consolidated into one central record?
• ☐ Has each domain been classified by business criticality (critical / moderate / low)?
• ☐ Has budget been approved for the ESIA/Trustee decision?
• ☐ Has coordination happened with legal and brand protection teams?
• ☐ Is regular status reporting to senior leadership in place?
• ☐ Has a third-party Trustee provider been evaluated and selected?

IT Administrator Checklist

• ☐ Are nameserver and DNS records documented per domain?
• ☐ Is registrant information (WHOIS/RDAP) accurate and current?
• ☐ Are auth codes stored securely?
• ☐ Have auto-renewal settings been checked?
• ☐ Is dashboard monitoring in place for Trustee/ESIA status?
• ☐ Are post-transfer verification tests (DNS resolution, email flow) planned?

Legal & Brand Protection Perspective

For companies with trademark registrations valid in Russia, losing a domain isn't just an operational problem — it carries legal weight too.

A domain released after redemption can be re-registered by a third party in a way that trades on brand confusion, which opens the door to trademark disputes, reputational harm, and added legal cost.

• Does the Trustee agreement clearly define a transfer-back mechanism?
• Is the governing law and dispute forum specified?
• Does brand monitoring already cover .ru/.рф/.su zones?
• Is there an action plan for a post-redemption third-party registration scenario?

Common Mistakes and Best Practices

Common Mistakes

Best Practices

Timeline and Roadmap

The roadmap below lays out every step chronologically, from portfolio analysis through ongoing monitoring.

Today: Awareness and ownership assignment

↓ Portfolio Analysis: Inventory and segmentation

↓ Risk Analysis: Criticality scoring and prioritization

↓ Decision: Direct ESIA or Trustee?

↓ Trustee Setup / ESIA Application

↓ Transfer (if needed)

↓ Verification Check: DNS, WHOIS, registrant data confirmation

↓ Monitoring: Verification status and renewal tracking (ongoing past September 2026)

Real-World Case Studies

Case 1 — A Registrar with 1,000+ Domains

A mid-sized registrar found itself with over 1,000 .ru domains in its portfolio. Manual tracking simply doesn't scale at that level, so the fix was a reporting layer that automatically segments domains by renewal date and registrant type.

Once segmented, the data showed roughly 30% of the portfolio registered to foreign companies — none of it yet in the verification pipeline. Prioritizing that segment for Trustee outreach brought the bulk of the risk under control within six months.

Case 2 — A Startup with 50 Domains

A startup entering the Russian market held around 50 domains total, only one of them .ru — but that one sat at the center of its market-entry plan.

Because it registered as a foreign legal entity, it went straight to Trustee service and finished the process in under a week. For small but strategically important portfolios, speed comes down to decision clarity, not inventory size.

Case 3 — A Holding Company Operating in 10 Countries

A holding company operating across ten countries discovered that each subsidiary was running its own independent domain process.

Its .ru domains turned out to be managed by three separate subsidiaries through three separate registrars. Corporate headquarters set a single Trustee policy and rolled it out as a standard procedure across every subsidiary — turning scattered management into something trackable from one dashboard.

Looking Ahead: Scenarios for 2027 and Beyond

The registry has indicated it's working on a separate verification path for foreign legal entities, but no final announcement has been made as of this writing. A few scenarios are plausible from here:

• An official verification mechanism for foreign companies gets published, and Trustee service becomes optional rather than necessary.
• The current Trustee model becomes a permanent standard, and registrars keep offering it as a core product.
• Verification requirements tighten over time, with additional documentation demands.

Frequently Overlooked Issues

• Subdomains or sub-brand domains registered separately and left out of the main inventory.
• Domains technically registered to former employees but functionally owned by the company.
• Auto-renewal settings that appear active but silently fail due to an expired payment method.
• Domains purchased through a reseller where the actual brand owner has no direct access.

Expert Recommendations

Industry Perspective

The points below reflect recurring themes among teams working in domain management and brand protection — not quotes attributed to any specific individual, but a summary of shared observations across the industry.

• In enterprise portfolios, the bigger risk isn't the actively used domains — it's the forgotten defensive registrations, because nobody starts a verification process for a record they aren't watching.
• The quality of a Trustee decision comes down to the clarity of the handover clause, not the price tag — an untested transfer-back mechanism is worth about as much as having none.
• For resellers, the real risk isn't technical — it's communication. Customer loss usually traces back to silence, not bad information.
• Registrars that skip automation investment risk support ticket volume in August–September that outpaces what existing teams can handle.
• For foreign companies, the real uncertainty isn't ESIA itself — it's when and how an official corporate verification path will open. Until that's resolved, Trustee service is a prudent choice, not a guess.

Additional Tables

Transfer Steps

Domain Lifecycle (Post-ESIA)

Additional Checklists

Before Transfer

• ☐ Has the auth (transfer) code been obtained?
• ☐ Is registrant information accurate and current?
• ☐ Has the verification path (ESIA/Trustee) been settled before initiating transfer?
• ☐ Are nameserver details recorded?
• ☐ Is a post-transfer test plan ready?

After Transfer

• ☐ Does the domain appear in the new registrar's dashboard?
• ☐ Are DNS records resolving correctly?
• ☐ Has ESIA/Trustee status been confirmed in the dashboard?
• ☐ Have renewal date and auto-renewal settings been checked?
• ☐ Have relevant stakeholders (legal, brand, IT) received a status update?

Ten Use-Case Scenarios

International Brand

A brand holding defensive registrations across dozens of country codes treats .ru as part of its dormant portfolio. Inventory review reveals the domain is registered to a foreign entity with verification never started.

The fix: fast Trustee activation, then country-code-specific risk tagging across the wider portfolio.

Domain Investor

An investor holding dozens of .ru domains faces real time and cost to re-verify each one. Priority goes to high-value domains first, with conscious abandonment considered for low-value ones.

Hosting Company

A hosting provider serving customers on .ru domains needs to anticipate that a customer's suspended domain disrupts its own service too. Early warning is critical here.

Registrar

A registrar holding thousands of .ru domains needs automated segmentation and notification rather than manual tracking.

Reseller (Agency Model)

A digital agency managing .ru domains on behalf of clients realizes most of them are unaware of the mandate. A proactive email and dashboard campaign protects trust.

Startup (New Market Entry)

A startup entering the Russian market takes the Trustee route from day one, given its foreign-entity status makes it the more predictable path.

Fintech Company

A fintech firm with high compliance requirements uses Trustee service to balance internal data policy against the ESIA mandate.

SaaS Company

A SaaS platform with a .ru domain tied directly to product access treats a suspended domain as a direct revenue risk, prioritizing it accordingly.

Enterprise IT Team

An IT team responsible for hundreds of domains puts .ru/.рф/.su on a dedicated high-priority list with regular reporting to leadership.

Legal / Brand Protection Team

A legal team at a company with trademark rights in Russia evaluates how third-party re-registration risk could escalate into a trademark dispute, and secures the Trustee decision early.

Frequently Asked Questions

What is ESIA, and why was it made mandatory for .ru domains?

ESIA is the identity-verification backbone of Russia's Gosuslugi government services portal. Federal Law 569-FZ folds it into domain registration to make registrant identities verifiable at the registry level.

When does the mandate take effect?

September 1, 2026. From that date, renewal, transfer, and DNS changes on unverified .ru, .рф, and .su domains can be restricted.

Does this only affect new domains, or existing ones too?

Both — every existing and new registration falls within scope.

How can a foreign company verify a .ru domain?

As of this writing, no final official verification procedure exists for foreign legal entities. The registry has said it's working on an alternative process, but the most reliable option currently available is Trustee service.

What problem does Trustee service actually solve?

It lets registrants who can't or won't complete ESIA verification directly keep managing domain operations without interruption, through a locally verified representative.

If I use Trustee service, who legally owns the domain?

The registrant record at the registry may show the representative; the agreement between the brand owner and the representative governs actual control and transfer rights.

I'm a Russian citizen or a company registered in Russia — what do I need to do?

Verifying through an existing or new Gosuslugi account is enough; the process is comparatively simple.

If I skip verification, is my domain gone immediately?

No — it's a graduated process: transaction restriction, then a suspension flag, then a grace period, then redemption, and finally release for new registration.

When should I start a transfer?

As early as possible. Registrar and registry queues are expected to get busier as September 1, 2026 approaches, so starting now rather than waiting reduces delay risk.

Should transfer and ESIA verification happen at the same time?

Generally, settle the verification path (ESIA or Trustee) first, then plan the transfer around that decision.

As a reseller, how should I notify my customers?

A short, action-focused message — telling customers exactly what to do — works better than a technical explanation of ESIA.

As a registrar, what should I prioritize in my systems?

Customer segmentation, automated notification flows, and dashboard-level Trustee integration.

Are .рф and .su domains under the same mandate?

Yes, Federal Law 569-FZ covers all three TLDs.

I have a .ru domain that's no longer strategically important — what should I do?

Assess brand risk before deciding to abandon it; third-party re-registration is a real consideration for brand reputation.

Does ESIA verification require sharing my personal data with Russian authorities?

Direct verification requires entering identity information into the Gosuslugi system. Trustee service is the alternative for registrants who'd rather not do that.

What should I look for in a Trustee provider?

Operational reliability, clear contract terms, a functioning emergency handover mechanism, and relevant industry experience.

What documents does the verification process require?

Russian citizens can use an existing Gosuslugi account. Foreign individuals need SNILS and an in-person application at a Russian government office. For foreign companies, no official procedure has been published yet.

Can I open a Gosuslugi account as a foreign individual?

Registration is theoretically possible, but full verification requires SNILS, and getting SNILS requires an in-person visit to a Russian government office. If you don't live in Russia, that's not something you can finish remotely — Trustee service is the practical alternative.

How many domains justify using Trustee service?

Strategic importance matters more than domain count — even a single critical domain can justify it.

Will the ESIA mandate affect domain prices?

No direct price increase is expected, though additional services like Trustee naturally carry their own cost.

Could this regulation change in the future?

The registry has said it's working on a separate process for foreign legal entities; developments should be monitored closely and decisions revisited as needed.

How does DomainNameAPI support this process?

Through portfolio analysis, Trustee guidance, and bulk-notification infrastructure for reseller and registrar customers.

Is one Trustee agreement enough for a holding company or multi-brand business?

Usually not — structuring separate agreements by brand or subsidiary avoids confusion during future brand splits or sales.

How many domains are registered in the .RU zone, and how many belong to foreigners?

Per the Coordination Center for TLD .RU/.РФ, .RU had 6,040,551 registered domains at the end of 2025, with roughly 11.4% belonging to non-Russian registrants.

How many Gosuslugi account tiers are there, and which one do I need for domain actions?

Three: simplified, standard, and verified. Domain registration, renewal, transfer, and DNS changes require the verified tier only.

What is SNILS, and why is it needed?

SNILS is Russia's social insurance number, required as a mandatory identity element to move a Gosuslugi account to the standard and verified tiers.

What is an MFC?

An MFC (multi-service center) is a Russian government facility where in-person identity verification, among other services, can be completed — it's one of the venues for verified Gosuslugi status.

Can Trustee service be cancelled later?

Generally yes; the transfer-back clause in the agreement governs returning the domain to direct registrant control when needed. The clarity of that clause is a critical factor in choosing a provider.

Can I change ownership information while the domain stays with my current registrar?

Yes — a domain can be reassigned to a Trustee account without being transferred, while it stays with its current registrar. Some registrars require notarization for this, so it's worth checking in advance.

Can multiple domains be covered in one Trustee application?

Domains under the same owner can often be combined into a single application, subject to confirmation with the relevant registrar.

Does a verified domain need to be re-verified later?

The regulation is designed for verification to be persistent, but a change in registrant or ownership information may require re-verification.

Does Trustee service make financial sense for a small business?

Domain count matters less than how dependent the business is on that domain — even a single domain generating revenue can make Trustee worthwhile for continuity alone.