What the EU’s 21st Russia sanctions package means for crypto compliance

On July 23, 2026, the EU adopted its 21st sanctions package against Russia. For crypto compliance teams, the direction set in the 20th package now accelerates. The EU has extended its transaction ban to 14 more crypto-related platforms across six jurisdictions, hit 94 banks with asset freezes, and created an entirely new power: a full third-country ban for crypto-asset services. 

This package carries the largest batch of individual listings in four years – 218 in total, 48 individuals and 170 entities. If your organization transacts with, provides services to, or holds exposure near Russian-linked crypto or banking activity, the measures in this package require immediate review. 

Key points 

• The EU extended its transaction ban to 14 more crypto-related service platforms, based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus. 

• For the first time, the EU created the power to impose a full third-country ban on crypto-asset services, letting it block any transaction between an EU operator and a crypto provider used by Russia. 

• Four new designations target the cross-border A7 network, including its new links to Africa. 

• Asset freezes now apply to 94 banks and major financial institutions, and the transaction ban extends to 33 more Russian credit and financial institutions. 

• A Kyrgyz bank connected to the System for Transfer of Financial Messages (SPFS) financial-messaging system for international payments, plus three other non-Russian banks, now face a transaction ban for sanctions circumvention. 

• Measures imposed on Belarus continue mirroring those on Russia, focusing on the financial flows associated with cross-border trade (including military-relevant exports), and legal protections. 

• This is the largest batch of individual listings in four years: 218 total, covering 48 individuals and 170 entities. 

• Board & ownership restrictions extended: Russian nationals are now explicitly prohibited from owning, controlling, or serving on the boards/management bodies of crypto-asset service providers. 

Which crypto platforms are now banned? 

The EU extended its transaction ban to 14 additional crypto-related service platforms. These platforms are based in six jurisdictions: Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus. 

This continues the shift that began in the 20th package. Enforcement no longer stops at Russian-established platforms. It now follows the third-country channels that Russian entities and individuals use to keep crypto flowing after earlier bans closed domestic routes. 

Any relationship your organization holds with these platforms, or with wallets linked to them, must be screened and terminated. Because the designated platforms sit outside Russia, a counterparty’s registration country is no longer a reliable risk signal on its own. 

What is the new third-country ban for crypto services? 

The most significant structural change is a new power, not a single listing. For the first time, the EU can impose a full third-country ban on crypto-asset services. 

The measure works as a deterrent aimed at countries that host platforms helping Russia evade EU sanctions. Once applied, it lets the EU ban any transaction between an EU operator and any crypto provider used by Russia in that jurisdiction. 

For compliance teams, this raises the stakes on jurisdiction risk. A platform that is compliant today could fall within scope if its host country is later named. Your risk models should treat exposure to high-circumvention jurisdictions as a live variable, not a fixed rating. Furthermore, under Markets in Crypto-Assets (MiCA) rules, EU-regulated Crypto-Asset Service Providers (CASPs) must factor these dynamic third-country risks directly into their formal country-risk assessment frameworks and regulatory reporting. 

Why does the A7 network matter? 

The package adds four designations tied to the cross-border A7 network, including its new links to Africa. A7 is the network behind the A7A5 stablecoin, which the EU targeted in the 20th package. 

The 20th package prohibited A7A5 and designated Meer Exchange for trading it. This package follows the money as the network adapts and expands into new regions. The Africa link signals that A7-related activity is moving into jurisdictions with less mature crypto supervision. 

If your customer base or counterparty network touches African crypto corridors, review it for A7 exposure. The network’s cross-border design is built to bridge sanctioned Russian value into the global financial system, and it moves quickly between venues. Because A7 capital frequently routes through decentralized finance (DeFi) protocols and unhosted wallets to obfuscate trails, transaction monitoring must look beyond centralized venues to trace liquidity pools, cross-chain bridges, and smart contract interactions linked to the network 

How does the banking crackdown affect crypto firms? 

The EU is imposing asset freezes and a ban on making funds available to 94 banks and major financial institutions. It is also extending its transaction ban to 33 more Russian credit and financial institutions. 

One measure matters especially for crypto: a transaction ban on a Kyrgyz bank connected to the SPFS financial-messaging system, plus three other non-Russian banks named for circumventing sanctions. SPFS is Russia’s alternative to SWIFT, and banks linked to it are common fiat off-ramps for crypto flows. 

VASPs, OTC desks, and payment processors should map their fiat banking relationships against the newly listed institutions. A crypto transaction can be clean on-chain while its fiat settlement leg touches a sanctioned bank. 

How should compliance teams treat Belarus? 

The package again includes Belarus measures designed to mirror those imposed on Russia, particularly on trade and protection for EU companies from Belarussian legal claims stemming from their compliance with sanctions. This continues the alignment set out in the 20th package, where Belarus-established platforms and the Belarusian digital ruble entered the prohibited scope. 

Two of the 14 newly banned crypto platforms are based in Belarus. If your program still applies a lower risk tier to Belarus than to Russia, that gap needs to close. Belarus-linked platforms, wallets, and payment infrastructure belong in your highest-risk controls. 

What should compliance teams do now? 

This package deepens the move from named-entity screening toward infrastructure and jurisdiction risk. Your exposure extends to any part of your business that touches banned platforms, circumvention banks, or high-risk host countries. 

Update your sanctions screening lists to include the 14 newly banned crypto platforms across Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus, along with the four A7 network designations and the newly listed banks. 

Review African crypto corridors for exposure to the A7 network, given its new regional links. 

Map your fiat banking relationships against the 94 frozen institutions, the 33 added to the transaction ban, and the SPFS-linked Kyrgyz bank. 

Treat jurisdiction risk as dynamic. The new third-country ban power means a host country can move a compliant platform into scope with little warning. 

Elevate Belarus to a Russia-equivalent risk across your crypto and financial flow controls. 

Screen executive governance & UBOs: Review corporate governance structures and ultimate beneficial ownership (UBO) records to ensure no Russian nationals hold board seats or controlling ownership in affiliated crypto entities. 

Frequently asked questions 

Does this package affect crypto firms outside the EU? 

The measures apply directly to EU persons and EU-connected entities. If any leg of a transaction touches an EU person or EU-regulated entity, the prohibition comes into scope, even when your own operations sit elsewhere. 

What is the third-country ban, and is it active yet? 

It is a new power that lets the EU ban all transactions between EU operators and crypto providers used by Russia in a named country. It is a deterrent tool. Its effect on any specific jurisdiction depends on future EU decisions, so treat it as a forward-looking risk. 

Are all crypto platforms in these six countries now banned? 

No. The transaction ban targets 14 specific named platforms, not every platform in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, or Belarus. Legitimate business with non-designated platforms remains permissible, subject to enhanced due diligence given the elevated jurisdiction risk. 

What legal protection exists if a designated counterparty sues for breach of contract? 

The 21st package strengthens the EU’s “No Claims” protection clause. This explicitly shields EU operators and crypto businesses from legal liability or arbitration claims brought by Russian or Belarusian entities when contracts are terminated or assets frozen to comply with EU sanctions. 

What is the A7 network? 

A7 is the cross-border network behind the A7A5 stablecoin, designed to move value for sanctioned Russian actors. The 20th package prohibited A7A5 and designated Meer Exchange. This package adds four designations and flags the network’s expansion into Africa. 

Why does the SPFS bank listing matter for crypto? 

SPFS is Russia’s alternative to the SWIFT messaging system. Banks connected to it often serve as fiat off-ramps for crypto flows. A transaction that looks clean on-chain can still settle through a sanctioned SPFS-linked bank, which creates exposure. 

Conclusion 

The EU’s 21st sanctions package builds directly on the structural shift of the 20th. The focus is on infrastructure, third-country channels, and the banking rails that connect crypto to fiat. Several measures, including the new third-country banning power, change how you should score jurisdiction risk. 

Disclaimer: This article is prepared by Crystal Intelligence for informational and analytical purposes only. It does not constitute formal legal counsel, regulatory advice, or an official legal opinion. Compliance teams and financial institutions should consult qualified legal counsel to evaluate their specific obligations under EU sanctions regulations.