An analysis of how the EU's 21st sanctions package extends crypto sanctions to third countries and produces divergent compliance outcomes for exchanges designated on the same date.
On 23 July 2026, the Council of the European Union adopted its 21st package of sanctions against Russia.[1] It includes the largest batch of individual listings in four years: 218 in total, comprising 48 individuals and 170 entities. Council Regulation (EU) 2026/1848 amends Regulation (EU) No 833/2014, while Council Regulation (EU) 2026/1846 introduces corresponding changes to the Belarus sanctions regime under Regulation (EC) No 765/2006.[2]
This package builds directly on the 20th package, covered in our earlier analysis.[3] The 20th package introduced a sectoral ban covering every crypto-asset service provider established in Russia and Belarus, extending beyond individually designated entities to cover the sector as a whole.
The 21st package adds 14 crypto-related service platforms to its transaction-ban annexes. Article 5bc also allows the Council to prohibit transactions with crypto-asset service providers and crypto platforms established in a listed third country. The Council may list a country that has systematically and persistently failed to prevent services that frustrate Regulation (EU) No 833/2014 or Regulation (EU) No 269/2014.
This article uses the term CASP when referring to EU regulatory terminology and VASP when referring to FATF terminology or broader international frameworks.
On 26 May 2026, the UK designated 18 individuals and entities under its Russia sanctions regime, including EXMO Exchange Limited and Huobi Global S.A., the entity behind HTX.[4] Both became subject to an asset freeze, correspondent-banking and payment-processing restrictions, and restrictions on access to their internet services in the UK. By 29 July 2026, the two exchanges had taken different operational paths.
The exchange has stopped new registrations and deposits, restricted trading to the closing of existing positions, and begun distributing its remaining client assets. EXMO reports a 29.4 per cent shortfall against its obligations to users, which it attributes to sanctions-related freezes imposed by third-party custodians and banking providers, together with unrecovered losses from a 2020 hack. The uncovered portion of each client's balance has been replaced with USDRecover, which EXMO describes as a non-tradable and non-withdrawable debt claim entitling holders to a proportional distribution of any assets recovered in future.[5]
According to TRM Labs, the exchange rebuilt parts of its on-chain wallet infrastructure after the UK designation, rotating hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain and Solana and retiring some addresses within hours.[6] An HTX spokesperson has denied that this amounts to sanctions evasion, describing the wallet changes as routine security operations common across the crypto industry.[7]
On 23 July, the EU added Huobi Global S.A. to the transaction-ban annex of its 21st package, effective 23 August 2026.[8] The EU measure prohibits covered transactions with the company. The UK designation also imposes an asset freeze. A sanctions listing records an entity's legal status under a particular regime. Operational evidence shows whether the entity has closed, adapted its infrastructure or continued operating. Compliance teams should assess both forms of information. Before its UK designation, HTX was already included on the FCA Warning List and was subject to FCA proceedings concerning allegedly unlawful financial promotions to UK consumers.[9]
The Council extended its transaction ban to 14 crypto-related service platforms established in Georgia, Panama, the United Arab Emirates, the Marshall Islands, Kyrgyzstan and Belarus.[10] According to the Council, the platforms have been used by Russian entities to circumvent existing restrictions.
For 11 of the newly listed platforms, the transaction ban takes effect on 23 August 2026:
.png)
Figure 1. Eleven platforms carrying a transaction ban effective 23 August 2026. Source: Council Regulation (EU) 2026/1848, Annexes.
For the remaining three crypto-related platforms, the transaction ban takes effect on 13 August 2026:
.png)
Figure 2. Three platforms carrying a transaction ban effective 13 August 2026. Source: Council Regulation (EU) 2026/1848, Annexes.
The same 13 August tranche also adds Chinggis Khaan Bank, Sberbank India and VTB India to the wider banking measures in this package.[11] These three financial institutions fall under the package's wider banking measures. The package counts the 14 crypto-related service platforms separately.
The UK had already designated seven of the 11 platforms subject to the 23 August transaction ban:
The United States had also designated BitPapa. This reflects the pattern of sequential action across allied jurisdictions previously seen in relation to Garantex, Grinex and the migration to A7A5.[13]
ABCeX remains registered in El Salvador following its UK designation and inclusion in the EU transaction-ban annex. Its status illustrates how a CASP can retain a registration in one jurisdiction while sanctions measures apply in others. Jurisdiction-of-establishment data identifies this type of regulatory divergence.
HTX and EXMO provide the clearest examples on this list of how differently entities designated on the same date can respond in practice.
The package also introduces a route out for EU, EEA and Swiss nationals and residents holding funds at a newly designated entity. Competent authorities may authorise the withdrawal of funds or the closing of accounts held at entities added to the relevant Annexes on or after 24 July 2026, where the transaction is strictly necessary to terminate the relationship with that entity. The authorisation must be requested within three months of the entity's listing date and, once granted, is valid for a maximum of three months. The funds must be transferred to a credit or financial institution incorporated under the law of a Member State, or to an institution owned or controlled by such an institution.[14]
The derogation applies to transactions strictly necessary to terminate an existing relationship. A withdrawal requires prior authorisation from the competent authority and compliance with every condition attached to that authorisation.
The EU listed individual third-country platforms before the 21st package. Article 5bc now allows the Council to prohibit transactions with crypto-asset service providers and crypto platforms established throughout a listed third country.[15] The 20th package introduced sector-wide prohibitions for Russia and Belarus.[16] The 21st package creates a corresponding mechanism for other third countries. Annex LVII contained no listed country on 29 July 2026.[17]
The legal trigger is the jurisdiction in which the crypto provider or platform is established. A CASP may therefore fall within the prohibition through a later listing of its country of establishment in Annex LVII, regardless of its individual listing status. Compliance teams should record and monitor each platform's place of establishment. The domicile of associated entities, controllers and owners informs broader ownership and circumvention-risk assessments. Article 5bc uses the provider's or platform's country of establishment as its jurisdictional trigger.
Two of the 14 newly listed platforms, WhiteBird and Tradex (Brightum LLC), are established in Belarus. Belarus-established CASPs were already covered by the sectoral transaction ban introduced in the 20th package through Article 1zf of Regulation (EC) No 765/2006.[18] Their individual inclusion in the new transaction-ban annex therefore overlaps with an existing jurisdiction-wide prohibition. For EU operators, the sectoral ban was already the relevant baseline restriction before these listings took effect.
Under the Russia regime, the existing prohibition prevents Russian nationals and natural persons residing in Russia from directly or indirectly owning or controlling, or holding posts on the governing bodies of, Member State-incorporated entities providing crypto-asset wallet, account or custody services. From 25 August 2026, the prohibition extends to entities providing other crypto-asset services as defined in MiCA (Regulation (EU) 2023/1114), including exchanges and trading platforms. Corresponding provisions apply under the Belarus sanctions regime.[19][20]
Firms should treat this primarily as a governance, ownership and board-composition review trigger. Transaction screening alone will not identify restricted ownership, control or board participation. Corporate registry data, beneficial ownership records and board-composition data should therefore form part of the review.
The package adds listings linked to the cross-border A7 network's expansion into Africa, including A7 Nigeria and A7 Africa, alongside PilotFinance Ltd.[21] The A7 network includes the A7A5 rouble-backed token, which became subject to restrictions under the 20th package, and associated exchange infrastructure.[22]
The listings identify A7-linked entities in Nigeria and elsewhere in Africa. Compliance teams should assess whether a counterparty has a documented connection to A7 Nigeria, A7 Africa, A7A5 or related infrastructure. Any assessment of regulatory coverage or supervisory capacity should rely on evidence from the specific jurisdiction involved.
Add all 14 newly listed platforms to applicable transaction-screening controls, distinguishing between the 13 August and 23 August 2026 effective dates. Preserve the legal-entity names and aliases used in the Annexes, since several platforms trade under different brand names from their listed entity, EXMO, ABCeX, Exnode and HTX among them.
Review shareholders, controllers and board composition for MiCA-authorised counterparties ahead of the 25 August extension. From 25 August 2026, the restriction reaches entities providing the crypto-asset services defined under MiCA. The previous wording covered wallet, account and custody services.
The third-country mechanism makes a platform's country of establishment a potential sanctions trigger. Record and monitor that jurisdiction throughout the relationship. Continue collecting information on associated entities, controllers and owners for ownership and circumvention-risk analysis. Record the platform's country of establishment separately as the legal trigger under Article 5bc.
For Belarus-established CASPs, the sectoral ban from the 20th package remains the operative restriction. Treat the individual listings of WhiteBird and Tradex as overlapping measures: the Belarus sectoral ban was already the operative baseline restriction.
Apply enhanced review where a counterparty has a documented connection to A7 Nigeria, A7 Africa, A7A5 or related infrastructure, consistent with the approach applied to A7-linked infrastructure following the 20th package.[23] Activity in an African jurisdiction, standing alone, provides insufficient evidence of such a connection.
Customers seeking to exit relationships with newly listed entities may apply to the relevant competent authority for permission to withdraw funds or close their accounts. The application must be submitted within three months of the entity's listing date. The transaction may proceed after the competent authority grants authorisation and the applicant satisfies its conditions.
The 21st package expands the jurisdictional reach of EU crypto sanctions. Article 5bc allows the Council to prohibit transactions with crypto-asset service providers and crypto platforms established in a listed third country. CASPs, banks and payment providers should therefore screen individual counterparties and record their countries of establishment.
The package also gives governance data a direct sanctions function. From 25 August 2026, the restrictions on Russian ownership, control and board participation extend across the crypto-asset services defined under MiCA. Corresponding provisions apply under the Belarus sanctions regime. Transaction screening can identify listed counterparties. Corporate registry data, beneficial ownership records and board-composition data are also required to identify restricted ownership, control and board participation.
VASPnet tracks the regulatory status and country of establishment of CASPs affected by this package, together with their associated entities, controllers, owners, group relationships and governance data.
For access to more comprehensive data on the world's regulated VASPs, please write to us at contact@vaspnet.com.
[1] Council of the European Union, "21st package of sanctions: EU hits Russian energy, financial services and crypto hard," press release, 23 July 2026.
[2] Council Regulation (EU) 2026/1848 of 23 July 2026 amending Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine, OJ L 2026/1848, 23.7.2026; Council Regulation (EU) 2026/1846 of 23 July 2026 amending Regulation (EC) No 765/2006 concerning restrictive measures in view of the situation in Belarus, OJ L 2026/1846, 23.7.2026.
[3] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
[4] UK Foreign, Commonwealth & Development Office, Sanctions Notice: Russia, 26 May 2026.
[5] EXMO, "EXMO.com is closing," EXMO Info Hub, 14 July 2026.
[6] TRM Labs, "Screening HTX Beyond the UK Designation: Why Blockchain Intelligence Matters," 21 July 2026.
[7] SC Media, "HTX accused of rotating wallets to evade sanctions," 22 July 2026, citing Coin Central.
[8] Council Regulation (EU) 2026/1848 of 23 July 2026, recitals 23–24.
[9] Financial Conduct Authority, "FCA takes action against HTX to stop illegal financial promotions," press release, 10 February 2026.
[10] Council of the European Union, "21st package of sanctions: EU hits Russian energy, financial services and crypto hard," press release, 23 July 2026.
[11] Council of the European Union, "21st package of sanctions: EU hits Russian energy, financial services and crypto hard," press release, 23 July 2026.
[12] UK Foreign, Commonwealth & Development Office, Sanctions Notice: Russia, 26 May 2026.
[13] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
[14] Council Regulation (EU) 2026/1848 of 23 July 2026, recital 26, and Article 1(14)–(15), inserting paragraphs into Articles 5ac and 5ad of Regulation (EU) No 833/2014.
[15] Council Regulation (EU) 2026/1848 of 23 July 2026, recitals 23–24.
[16] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
[17] Council Regulation (EU) 2026/1848 of 23 July 2026, recitals 23–24.
[18] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
[19] Council Regulation (EU) 2026/1848 of 23 July 2026, recital 22 and Article 1(18), replacing Article 5b(2a) of Regulation (EU) No 833/2014; Council Regulation (EU) 2026/1846 of 23 July 2026, corresponding amendments to Regulation (EC) No 765/2006.
[20] Mayer Brown, "European Union Adopts 21st Package against Russia," 24 July 2026, citing Article 5b of Regulation 833/2014 for the 25 August 2026 effective date.
[21] Council of the European Union, "21st package of sanctions: EU hits Russian energy, financial services and crypto hard," press release, 23 July 2026.
[22] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
[23] VASPnet, "What the EU's 20th package of sanctions against Russia means for crypto compliance teams," 21 May 2026.
