EU's 21st Package Extends Crypto Sanctions to Third Countries

Key takeaways

• On July 23, 2026, the Council of the EU adopted its 21st sanctions package against Russia, extending transaction bans to 14 crypto-related service platforms and adding four designations tied to the A7 network. The package's 218 total listings are the largest batch in four years.
• For crypto compliance teams, the biggest change is a powerful new authority to ban crypto asset services from entire third countries when they facilitate Russian sanctions evasion.
• The designated platforms sit outside the EU in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus. The measures reach the infrastructure wherever it operates.
• The designations extend a wave of multilateral action against the Russia sanctions evasion network, following the UK's May 26, 2026 crypto designations of HTX, Exmo, Bitpapa, Rapira, and others.
• A designation names an entity; it does not reveal the wallets that entity controls today. Blockchain intelligence closes that gap by tracing a designated platform through wallet changes to the addresses it uses now.

‍

{{horizontal-line}}

The EU pushes its crypto sanctions past its own borders

The European Union adopted its 21st package of restrictive measures against Russia on July 23, 2026, targeting the energy, financial services, crypto, and trade sectors in a single round of 218 listings — 48 individuals and 170 entities, the largest batch in four years.

The change that matters most for crypto compliance teams is the package's reach beyond the bloc. Earlier rounds named platforms one at a time; this one extends transaction bans to platforms in third countries and creates a new power to ban crypto asset services from entire third countries when they facilitate Russian sanctions evasion. Russia's access to the international financial system now runs through a network of intermediaries built to survive the loss of any single node, and much of it operates well outside the EU.

What the Council adopted on July 23

The package expands EU action against Russia's financial and banking sector alongside its crypto measures. The Council imposed asset freezes and a prohibition on making funds available to 94 banks and major financial institutions, extended its transaction ban to 33 additional Russian credit and financial institutions, and added a transaction ban against a Kyrgyz bank connected to the SPFS financial messaging system plus three other non-Russian banks for circumventing sanctions.

On crypto, the package does two things. It adds four designations tied to the cross-border A7 network, including its new links to Africa. It also extends the EU's transaction ban to 14 crypto-related service platforms based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus.

Kaja Kallas, High Representative for Foreign Affairs and Security Policy and chair of the Foreign Affairs Council, tied the crypto measures to the broader effort: "With each round of sanctions, we squeeze Russia's economy and its capacity to prolong its illegal war. Our 21st package includes the highest number of listings in four years. We're hitting over a hundred banks and crypto operators, 40+ vessels in Russia's shadow fleet, and several oil refineries in Russia and Belarus."

The measures take effect under Council Regulation (EU) 2026/1844, which amends Regulation (EU) No 269/2014, alongside the accompanying decisions and Belarus-mirroring acts. The Council noted that the relevant legal acts will be published shortly in the Official Journal of the EU.

A country-level ban is a new kind of tool

Earlier crypto measures froze a named platform. The third-country provision works at a different level: it lets the EU cut off crypto asset services tied to an entire jurisdiction found to host platforms that serve Russia. The European Commission framed the intent as "a strong deterrent to countries hosting platforms that help Russia evade EU sanctions," and the provision would let the EU ban any transaction between an EU operator and a crypto provider used by Russia.

That puts the compliance burden on the jurisdiction that tolerates the infrastructure and on the firms that transact with providers based there. A country that hosts sanctions evasion platforms now carries the risk that its crypto sector loses access to the EU market.

The platforms the EU designated

The crypto designations target platforms tied to the A7 sanctions evasion network, and several of the named entities were already designated by the United Kingdom or the United States. TRM has identified the following platforms and entities connected to the crypto and A7 network measures:

• Rapira — also designated by the UK
• Aifory Pro (Sooty Ltd.) — also designated by the UK
• ABCeX (Nueva Cryptologia S.A.S DE C.V.) — also designated by the UK
• WhiteBird
• NoOnecrypto INC.
• Tradex (Brightum LLC)
• Monease Ltd
• BitPapa — also designated by the US and the UK
• Exnode / Exnode Pay (Arvix) — also designated by the UK
• HTX (Huobi Global SA) — also designated by the UK
• EXMO Ltd — also designated by the UK
• A7 Nigeria
• A7 Africa
• PilotFinance Ltd

The overlap with prior UK and US action is the through-line. These are not isolated targets, but nodes in the same network that allied jurisdictions have been designating in sequence.

This extends the multilateral squeeze on the A7 network

The EU's crypto designations build on recent multilateral action against the A7 network. The clearest precedent is the United Kingdom's May 26, 2026 action, which designated 18 entities and individuals — including Huobi Global (HTX), Exmo, Bitpapa, and Rapira — for their role in Russian sanctions evasion, and marked the first time the UK applied Regulation 17A of the Russia (Sanctions) (EU Exit) Regulations 2019 to a crypto exchange.

The pattern is by now familiar. When the United States and allies took down Garantex in March 2025, the flows it carried moved to successor infrastructure rather than stopping, and the A7 network — a set of entities, exchanges, and a ruble-pegged stablecoin tied to sanctioned Russian interests — absorbed much of that activity. Each designation cycle pushes flows toward the next node, which is why coordinated action across the UK, the US, and now the EU reaches more of the network than any single body can on its own.

Designations name entities, wallets rotate

The HTX case shows what happens after a major designation. Following the UK action, HTX kept operating under the same brand and rebuilt its on-chain plumbing, rotating deposit and hot wallets on regular cycles across TRON, Ethereum, BNB Smart Chain, and Solana. TRM analysis found the exchange retiring hot wallets and funding addresses within hours — a moving target that a static block list cannot keep pace with.

That behavior is why a designation, on its own, does not tell a compliance team which wallets an entity controls today. Every wallet rotation, new deposit address, and transfer to a downstream service is visible and traceable, so a designated platform can be followed through its wallet changes to the addresses it is using now — not the ones it used on the day of the designation.

What this means for compliance teams

Screen the updated EU list now, and treat entity names as the starting point rather than the finish line. Funds one or two hops from a designated platform can still carry sanctions risk, and successor infrastructure absorbs flows as soon as a node is named — so monitoring for wallet rotation and downstream exposure matters as much as matching the list itself.

The third-country provision is a new kind of tool. When the EU can act against a jurisdiction's entire crypto sector, firms will need to understand their exposure not only to the platforms named today, but to the jurisdictions that host them. Screening that layers behavioral signals on top of static list matching is what catches successor-flow patterns before the next designation cycle.

‍

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What does the EU's 21st sanctions package do on crypto?

It extends EU transaction bans to 14 crypto-related service platforms based in third countries — Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus — that service sanctioned Russian entities or help circumvent EU measures, adds four designations tied to the A7 network, and introduces a first-ever power to ban crypto asset services from a third country that hosts such platforms.

2. What is the third-country crypto ban?

It is a new power that lets the EU cut off crypto asset services tied to a jurisdiction found to host platforms that help Russia evade sanctions, rather than designating those platforms individually. The Commission framed it as a deterrent to the countries that host such infrastructure, and it would let the EU ban any transaction between an EU operator and a crypto provider used by Russia.

3. Which platforms were designated?

The named platforms include HTX (Huobi Global), EXMO, BitPapa, Rapira, Exnode, Aifory Pro, ABCeX, and others, alongside A7 Nigeria and A7 Africa. Many were previously designated by the UK or the US, reflecting the multilateral effort against the same network.

4. How does this connect to the A7 network and the UK's HTX designation?

The EU designations extend multilateral pressure on the A7 sanctions evasion network. The UK designated HTX and 17 other entities on May 26, 2026 for the same nexus, and the US takedown of Garantex in March 2025 set off the successor flow pattern the network was built to absorb.

5. What should compliance teams do now?

Screen the updated EU list, map indirect counterparty exposure within one to two hops of the designated platforms and the A7 network, and monitor for wallet rotation and successor infrastructure rather than relying on static entity matching alone.

‍

{{horizontal-line}}

Methodology

TRM attributes entities and addresses to real-world actors using on-chain analysis combined with open-source and proprietary intelligence. Flow figures, where cited, reflect direct on-chain transfers unless otherwise noted, and are reported in adjusted USD at the time of transaction. TRM's attribution database is being updated to reflect today's designations; TRM will continue to investigate and add any additional addresses as they are found.