The Council of the European Union adopted its 21st package of sanctions against Russia on July 23, 2026. At 218 individual listings it is the largest batch in four years.
When it comes to cryptoassets, the package designates 14 entities providing cryptoasset-related services, all located outside Russia. It also provides the EU with the power to prohibit EU operators from transacting with every cryptoasset service established in a named third country.
No country has been named under that authority yet. At this point, it acts as a deterrent for providers to help facilitate Russian sanctions evasion.
What takes effect when?
The cryptoasset-related measures arrive on three dates:
- August 13, 2026. Transaction bans take effect against three entities in the A7 network and payment ecosystem: A7 Nigeria, A7 Africa and PilotFinance Ltd.
- August 23, 2026. Transaction bans take effect against 11 named cryptoasset platforms: Rapira, Aifory Pro (Sooty Ltd.), ABCeX (Nueva Cryptologia S.A.S DE C.V.), WhiteBird, NoOnecrypto INC., Tradex (Brightum LLC), Monease Ltd, BitPapa, Exnode and Exnode Pay (Arvix), HTX (HUOBI GLOBAL SA) and EXMO Ltd.
- August 25, 2026. The existing prohibition on Russian nationals and Russian residents owning, controlling or holding posts in the governing bodies of EU firms widens. It has applied since January 2024 to firms providing cryptoasset wallet, account or custody services. It now applies to any EU entity providing any cryptoasset service as defined under MiCA. The same extension covers Belarusian nationals under the Belarus regime.
The EU is doubling down
For most EU VASPs and financial institutions, the technical requirements here will be recognizable. These are targeted designations of the kind that compliance teams have handled through previous EU, UK and US rounds, with underlying obligations to prevent transfers and freeze assets unchanged.
What is notable is where the targets sit. Every one of the 14 is based outside of Russia. The EU has designated non-Russian entities for Russian sanctions evasion before, including parts of the A7 network in Kyrgyzstan. This package reinforces that approach and widens the net already cast by the EU’s 20th package, which banned dealings with any cryptoasset service provider established in Russia or Belarus.
Several of the 14 will already be familiar for another reason. The UK designated a number of the aforementioned exchanges, including HTX, ahead of the EU. These are not new sanctions targets internationally, but they are new EU sanctions targets.
A7 has moved into Africa
The A7 network is a Russian-backed financial and business network that operates largely through third countries. Most of its sanctions evasion runs through the banking sector rather than through cryptoassets.
But over the past two years, it has turned to cryptoassets, primarily through USDT but also through its ruble-backed stablecoin A7A5, which it launched to let Russian entities and sanctioned financial institutions move value without the freeze risk that dollar-denominated stablecoins carry. The network built exchanges around it, including Grinex and Meer.
Sanctions against that structure appear to have had an impact. Elliptic's on-chain research shows A7A5 monthly transaction volumes climbing steeply through the first half of 2025 to a peak, then falling once the US and UK designated the token and its network in August 2025, with the EU following in October under the 19th package. The decline accelerated sharply in April 2026 when Grinex went offline. The token's transaction volumes are now at a small fraction of its peak.
The designation of A7 Nigeria and A7 Africa is the response to another A7A5 remittance corridor. The EU is closing that corridor before it fully establishes. For institutions that have screened A7 exposure on the assumption it sits in Russia, Kyrgyzstan and the Gulf, that assumption no longer holds.
HTX is the largest designation
HTX is the listing most likely to create work. It has been among the largest exchanges in the world, and when the UK designated it in late May 2026 under an authority broader than the EU's, companies in the UK and elsewhere found substantial exposure to HTX-related flows, both direct and indirect. The same will happen across the EU from August 23.
Elliptic has two ways to help its customers manage exposure to HTX:
- Configurable risk rules let compliance teams triage by whether exposure is direct or indirect and by how many hops away it sits, so alerting reflects the scenarios that actually carry obligations.
- Time-bound exposure to HTX and Huobi Global by default, introduced when the UK designated them in May. That distinguishes exposure that predates the designation from exposure that follows it, which is the difference between a perceived risk and a reportable breach.
The new third country authority
The most consequential change of this latest sanctions package is a new article permitting the Council to prohibit transactions between EU operators and any entity providing cryptoasset services, or any platform enabling the exchange or transfer of cryptoassets, established in a third country the EU has listed.
The listing test is that the country has “systematically and persistently failed to prevent the provision of cryptoasset services or to prevent platforms exchanging or transferring cryptoassets, in frustration” of EU restrictive measures on Russia.
The country annex (Annex XXX) has been created and is empty. Adding a country requires a Council decision and no further legislative step. The only carve-out protects nationals of a member state who were already resident in a listed country before the date the annex specifies.
This is different from anything in the EU’s previous 20 sanctions packages, because it targets entire jurisdictions beyond Russia and Belarus, and not just individual entities located in third countries. A designation under this authority would capture every cryptoasset service in the targeted country, even those providers with no Russian nexus, sound AML controls and no adverse findings against them. Legitimacy is not a defense against a measure that applies to a designated location.
And it requires no new legislation to deploy. The mechanism is now built and ready to use. For now, the list remains empty, suggesting that the EU hopes to use the threat of designation as a deterrent. The EU appears to want to establish whether the threat alone will push jurisdictions into shutting down the services Russia exploits.
That reading should not be mistaken for an expectation that the authority will sit unused for long. If the EU does not see the results it wants, it will likely use the authority against at least one third country. The jurisdictions where it has just designated individual platforms are likely the first it will consider.
What to do next
Map your jurisdictional exposure. Identify what exposure you carry to jurisdictions that present Russian sanctions evasion risk and could plausibly be listed. Kyrgyzstan, Georgia and the Marshall Islands are reasonable starting points.
Look across customers, transactions and counterparties, and look backwards as well as forwards: historical transactions, KYC files, and which jurisdictions customers log in from. The question to answer is what a whole-jurisdiction designation would do to your book.
Check whether your counterparties carry exposure. A counterparty VASP may hold significant exposure to a jurisdiction of concern or serve customers based there. That creates indirect exposure of the kind familiar from correspondent banking. Reviewing your counterparty VASP relationships against their own sanctions exposure is the way to find it.
Decide your risk appetite explicitly. Define the conditions under which you will continue dealing with providers in higher-risk jurisdictions and the conditions under which you will not, with thresholds specific enough to act on. For example, at present you may be comfortable maintaining a relationship with a Georgian provider whose AML controls you have assessed and are satisfied with, but uncomfortable interacting with one carrying significant Russian sanctions exposure of its own.
That remains a defensible position for now, but your business would also need to be prepared for the possibility of having to terminate those relationships in any jurisdiction the EU may target in the future. Clearly articulating where your risk appetite rests is vital for navigating the range of contingencies that may arise.
Align screening configuration to that appetite. Reassess wallet and transaction screening so geographic risk is captured in thresholds and severities rather than handled by exception. Set per-jurisdiction parameters, layer direct and indirect exposure factors on top and test configurations before deploying them.
Train the staff who will apply it. Sanctions compliance teams and the wider business both need the pre-existing EU obligations, the new obligations, any resulting policy or configuration changes and the underlying evasion typologies.
Companies needs jurisdiction-level visibility
Twice now the EU has concluded that designating platforms one at a time cannot keep pace with how quickly they reappear somewhere else. The 20th package prohibited dealings with all cryptoasset services based in Russia in an effort to combat sanctions evasion more aggressively. The 21st extends that logic to third countries.
Elliptic's Global Policy and Regulatory Group helps companies parse through sanctions regulation, so they can stay compliant at all times. Our research on A7A5, Grinex and the wider A7 network has also tracked sanctions evasion architecture across jurisdictions for two years. To talk through what the 21st package means for your exposure, get in touch today.
