Friday, July 24, 2026
EU Crypto Sanctions on Russia: What the 21st Package Means for Compliance
Global News.png){kind=logo}
On 23 July 2026, the Council of the European Union adopted its 21st package of restrictive measures against Russia, responding to its ongoing war of aggression against Ukraine. Billed by the EU as hitting “Russian energy, financial services and crypto hard,” the package delivers the largest batch of individual listings in four years: 218 designations in total, comprising 48 individuals and 170 entities.
The headline count is not the interesting part. What matters, for anyone who traces crypto for a living, is the change in method. Earlier packages worked like a blacklist: name a wallet, a token or an exchange, and prohibit dealing with it. This one adds instruments that operate one level higher, at the level of platforms and even whole jurisdictions. That is a deliberate response to a pattern sanctions investigators have watched repeat for three years. Each time a specific entity is designated, a functionally identical successor tends to appear within weeks, often on the same chains and occasionally reusing the same wallet infrastructure.
The clearest illustration is the Garantex story. After the exchange was disrupted in early 2026, activity migrated to Grinex, a successor that carried on much of the same business. The rouble-pegged A7A5 stablecoin followed the same script: banned by name, then reissued and rerouted. High Representative Kaja Kallas framed the package plainly, noting the EU was “hitting over a hundred banks and crypto operators, 40+ vessels in Russia’s shadow fleet, and several oil refineries.” Read against that evasion playbook, the 21st package is the EU trying to get ahead of the next Grinex rather than react to the last one. The rest of this analysis focuses on where it succeeds at that, and where the burden quietly shifts onto compliance teams.
The headline figures give a sense of the package’s scale and where the EU is applying pressure:
The EU significantly expanded its action against Russia’s financial and banking sector, which it describes as “a vehicle of Russia’s war economy.” The Council imposed asset freezes and a prohibition on making funds available to 94 banks and major financial institutions, along with a prominent figure in Russia’s banking establishment. It also extended its transaction ban to 33 additional Russian credit and financial institutions.
Crucially, the reach now extends beyond Russia’s borders. The EU introduced a transaction ban against a Kyrgyz bank connected to the SPFS (Russia’s home-grown alternative to SWIFT), plus three other non-Russian banks accused of helping entities circumvent EU sanctions. The banking and crypto measures are the same story told on two rails. SPFS is Moscow’s workaround for SWIFT, and the Kyrgyz designation targets a node connecting that system to the outside world. Where messaging systems like SPFS cannot reach, crypto tends to bridge the gap, which is why the off-ramp, the point where a stablecoin becomes a bank balance, is usually where the trail becomes visible again. In practice the fiat and crypto legs of an evasion scheme are two halves of one flow, and working one without the other leaves half the picture.
The crypto provisions come in three distinct instruments, and they are not equivalent. One is a conventional listing exercise, one targets a specific network, and one is a structural tool that will outlast the current news cycle. Each lands differently on a compliance desk, so it is worth taking them one at a time.
The EU extended its transaction ban to 14 crypto-related service platforms based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus. These are not Russian-domiciled exchanges; they are providers in foreign jurisdictions that the EU says have enabled Russian-linked transfers. EU operators are now barred from dealing with any of them.
On paper this is simple: do not transact with the fourteen. The harder part is knowing when you already have. Platforms like these rarely sit behind a single, static set of addresses. They rotate deposit wallets, operate as nested services inside larger exchanges, and settle across several chains at once. A transaction ban is therefore only as enforceable as a firm’s ability to attribute on-chain activity back to the sanctioned operator, and that attribution does not come from the EU list. The list supplies a name; the wallet clusters and behavioural fingerprints that make the name actionable have to be built or sourced separately.
The choice of jurisdictions is not random either. Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus recur in evasion casework for familiar reasons: fast, low-friction company formation, and virtual-asset supervision that is either nascent or lightly enforced. For a compliance team the practical consequence is uncomfortable: a counterparty can look entirely ordinary at the KYC layer while its on-chain and corporate relationships tell a very different story.
The four A7 designations reward a close reading, because they document a network evolving rather than a new one being discovered. A7A5, the rouble-pegged stablecoin at the centre of it, was issued through a Kyrgyzstan vehicle and circulated on Tron and Ethereum, with reserves tied to a Russian state-linked bank. When the EU banned the token by name in an earlier package, the first time it had ever prohibited a specific crypto asset, the network did not shut down. It moved: reissuance, new venues, and now, according to this package, settlement links reaching into Africa.
That trajectory is the whole point. A rouble-pegged stablecoin is close to useless as a store of value; its utility is as a settlement rail between parties who can no longer touch correspondent banking. Following it is not a matter of screening one address. It means monitoring at the token-contract level across every chain the asset touches, and watching the bridges, OTC desks and off-ramps where it converts into something spendable. The Africa link is the detail to sit up for, because it suggests fresh settlement corridors opening precisely as older ones are shut.
This is the measure that will still matter in a year. Every crypto sanction to date has been reactive: identify the bad actor, add it to a list, repeat. The third-country mechanism is the first structural answer to the successor-entity problem. Rather than chase each new platform, the EU is reserving the right to cut off the jurisdiction that keeps producing them, banning any transaction between an EU operator and crypto providers used by Russia, up to and including a whole country’s sector. It is, in effect, the crypto equivalent of secondary sanctions.
It reframes the compliance question in a precise way. Screening a counterparty against a list tells you whether that entity is designated today. It says nothing about whether the jurisdiction it operates from is one Council decision away from becoming unusable. Firms that screen only at the wallet and entity level are blind to that exposure. The teams that will absorb this without disruption are the ones already treating counterparty-VASP jurisdiction as a first-class risk input, sitting alongside the on-chain data rather than bolted on afterwards.
There is a second-order effect worth naming honestly. A tool this broad invites over-correction. Faced with the threat of a sudden jurisdiction-wide ban, some EU firms will pre-emptively exit legitimate businesses in the named countries, the familiar de-risking dynamic that has trailed sanctions in traditional finance for years. The better answer is precision rather than retreat: knowing exactly which counterparties and flows carry real exposure, so that legitimate activity is not discarded alongside the illicit.
Revenue generation remained a core target. The package pauses the automatic adjustment of the oil price cap until 15 July 2027 to keep Russian oil profits contained despite market volatility linked to the closure of the Strait of Hormuz, with an interim review built in. The EU listed 41 more shadow-fleet vessels (bringing the total to 673) and, for the first time, sanctioned a crewing agency supporting the fleet.
On refining, the EU designated 18 entities and one individual in the oil sector, including three Russian refineries and a major Belarusian refinery, and created the power to prohibit transactions with listed refineries in Russia and third countries that process Russian crude. A transaction ban was imposed on a Georgian refinery in Kulevi (entering force in six months). The EU also targeted gold (7 major actors), a leading diamond company, and mining and metallurgy entities, and introduced new controls on the sale of LNG tankers.
To constrain Russia’s ability to wage war, the package added 56 listings tied to the military-industrial complex, 37 of them directly linked to long-range drone production and supply chains. A further 51 entities, several of them in China (including Hong Kong), India, Kazakhstan, Kyrgyzstan, Türkiye and the UAE, were added to tighter dual-use export controls for enabling circumvention on microelectronics, CNC machine tools and semiconductor equipment.
The EU also expanded export bans (nickel and beryllium powders, aerospace films, UAV-specific items such as jamming systems and flight-termination systems) and import bans on revenue-generating goods worth over €60 million (copper, nickel and lead ores, unwrought zinc, glassware, car parts and more). Belarus faces mirrored trade measures. Rounding out the package: a visa-ban basis for Russian combatants, designations of 8 propaganda actors and a war-criminal Major General, and strengthened legal protection for EU operators against Russian court rulings.
Each successive package has treated digital assets with more of the precision once reserved for fiat, and the reason is practical rather than ideological. As correspondent banking closes, sanctioned actors reach for the tools that still move value across borders: stablecoins, offshore exchanges and cross-border settlement networks. A7A5 became the archetype not because it was technically sophisticated but because it was fit for purpose, a rouble claim that could be moved and settled beyond the reach of Western banks. Ban the token and the function survives in the next instrument.
That is why the enforcement posture is shifting from naming things to mapping behaviour. A programme built around static, name-based lists will always trail an adversary that can spin up a new entity, token or platform faster than any list is updated. The defensible position is the opposite of a list: continuous monitoring, cluster attribution that survives a rebrand, and risk scoring that propagates through fund flows instead of stopping at the first hop.
Stripped to specifics, here is what the 21st package actually asks of a compliance function, in the order we would prioritise it:
Scorechain’s blockchain analytics and AML platform is built for exactly this environment, giving compliance and digital-asset teams the tools to act on sanctions changes in real time across 21+ blockchains:
When the EU banned the A7A5 stablecoin, the associated token contract and related exchange clusters were already flagged in Scorechain’s risk monitoring system ahead of the official listing. That is the kind of proactive detection that keeps institutions ahead of fast-moving sanctions regimes.
It is the 21st round of EU restrictive measures against Russia, adopted on 23 July 2026 in response to Russia’s war against Ukraine. It targets energy, financial services and crypto, and includes 218 new listings (48 individuals and 170 entities), the largest batch in four years.
The EU extended its transaction ban to 14 crypto-related service platforms in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus, added four designations against the A7 network (including new links to Africa), and, for the first time, created a mechanism for a full third-country ban on crypto-asset services.
It is a new EU instrument allowing it to prohibit any transaction between an EU operator and a crypto provider used by Russia, up to and including cutting off an entire jurisdiction whose platforms help Russia evade sanctions. It is designed as a deterrent to countries hosting evasion infrastructure.
The 14 newly banned crypto platforms are based in Georgia, Panama, the United Arab Emirates, the Marshall Islands, Kyrgyzstan and Belarus.
The package hits 94 banks and major financial institutions with asset freezes and fund-availability bans, and extends transaction bans to 33 additional Russian credit and financial institutions plus several non-Russian banks accused of circumvention.
Update screening lists with the new designations, add a jurisdictional-risk layer, trace indirect exposure through fund-flow analysis, monitor stablecoins across chains, strengthen Travel Rule and counterparty due diligence, and keep auditable records of every risk decision.
