For several years, it has been challenging to grant equity awards to employees in Russia. The tax treatment of options and ESPP is uncertain and it is possible that tax is due at grant and at exercise/purchase. The securities requirements are similarly unclear and there is a risk that equity awards are subject to an onerous securities registration requirement, unless all transactions related to the awards take place outside of Russia. And, since 2013, due to changes to the currency control laws, it has been questionable whether shares and cash payments related to equity awards could be issued into non-Russian accounts.
Notwithstanding, with appropriate structuring of grant terms and award administration, many companies have continued to grant equity awards in Russia.
Data Privacy Laws Add Another Level of Difficulty to Equity Awards in Russia
Now comes the latest threat from a somewhat unexpected corner: data privacy laws. On July 21, 2014, Russia enacted a new data privacy law which requires that companies process all personal data related to Russian nationals in Russia. This means that companies which collect and/or process the personal data of Russian nationals would have to ensure that the databases used for such purposes are located in Russia. The effective date of the law was September 1, 2016, but has since been accelerated to September 1, 2015.
It is thought that the goal of the new law is to ensure that data processing takes place on Russian servers which would enable the Russian authorities to better monitor the use of the data. The new law's main impact will thus be on companies with no actual presence in Russia that are collecting and processing the personal data of Russian nationals (e.g., non-Russian social media companies). However, it is likely that multinational companies with Russian subsidiaries will also be affected, because not all of their databases containing the personal data of Russian nationals are currently located in Russia. For example, many companies maintain their global employee HR database (which includes the personal data of the Russian employees) in a centralized location in a country outside of Russia. Similarly, most companies manage their employees' participation in their equity plans through a database located outside of Russia -- and in many cases a third-party plan administrator will also maintain a database including Russian nationals' personal data.
The Waters are Murky
It is not clear if the new law prohibits the establishment and maintenance of such databases outside of Russia or, put differently, if it requires that all operations involving personal data of Russian nationals be performed exclusively through the use of databases located in Russia. If that were the case, it would make the administration of equity grants awarded to Russian nationals very difficult, if not impossible, because it would conflict with the desire to maintain a centralized database. In addition, it is doubtful whether third-party plan administrators would establish databases in Russia, where they may not otherwise have operations. More likely, such plan administrators would refuse to administer the participation of Russian nationals in order to avoid violation of the new law.
That said, the new law does not prohibit or restrict the cross-border transfer of personal data from Russia to other countries and does not seem to require the deletion of databases including personal data of Russian nationals that have previously been established outside of Russia. Therefore, one possible interpretation of the new law is that it requires that a database containing Russian nationals' personal data be established and located in Russia, but that it is then possible to also transfer the personal data to a database abroad where it could be further processed. In this case, it would be necessary for companies to ensure that all of the personal data that is needed to administer the local employees' participation in an equity plan be kept in a database located in Russia, which may not currently be the case. But it may then be possible to continue to process the data through the use of databases in the company's home country and/or through the use of the plan administrator's database.
However, at this point, it is still very unclear what will and will not be permitted under the new law. Although databases maintained for equity plan administration are undoubtedly not the focus of the Russian authorities, the language of the law is very broad and the regulator has so far taken a restrictive view in the interpretation of the new law. In addition, if companies start establishing new databases in Russia to manage their Russian employees' participation in equity plans offered by the non-Russian parent company, it could have an impact of the tax treatment of such awards, as well as the securities law requirements. (As noted in the beginning, to avoid the securities registration requirement, it is necessary that all transactions regarding the awards take place outside of Russia.)
I expect that we will work closely with our Moscow office over the new few months to determine the impact of the new law on our clients. In the meantime, I would recommend that you check with your third-party plan administrators to see if they have already formulated an opinion on the new law and whether they may require companies to eliminate Russian nationals from their database. Otherwise, please stay tuned for more to come on this unpleasant new development.
P.S.: If you would like to read a more detailed article on the new law written by some of my colleagues specializing in data privacy matters, please click here.