The EU's 21st sanctions package names 14 crypto platforms EU firms must cut ties with by August. The new third-country ban mechanism adds a fresh risk layer for routing and partnerships.
Alpha Score of 35 reflects weak overall profile with moderate momentum, poor value, weak quality. Based on 3 of 4 signals – score is capped at 90 until remaining data ingests.
The European Union adopted its 21st sanctions package against Russia on July 23. For the first time, the package carves out 14 crypto-related service platforms as a distinct category of restricted entities. EU persons and firms must stop transacting with them once the entry-into-force dates hit in August.
Regulation 2026/1848 is the legal basis, published in the Official Journal. The package adds 218 total listings, the Council of the EU said – 48 individuals and 170 entities. Six jurisdictions host the 14 crypto services: Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus. Compliance teams should work from the annex updates, which name each entry and its specific cutover date.
Direct transactions fall under the ban. Scope includes onboarding, payments, brokerage, market making, and API connectivity. Marketing arrangements that deliver a prohibited service also fall within scope. Indirect exposure through aggregators or routed orders is not exempt. If a firm relies on an aggregator that splits orders across multiple venues, it needs detailed venue disclosure. If the route cannot be validated, the order should not be sent. Sanctions breaches are strict liability in many cases.
A new legal lever stands above the individual listings. Brussels introduced a mechanism that allows it to impose a full third-country ban on crypto-asset services. No jurisdiction is named today. The switch now exists. If Brussels flips it, EU entities could be prohibited from providing or receiving crypto services to or from an entire jurisdiction. The existence of the tool changes the risk calculus for routing and partnerships involving non-EU hubs, compliance analysts said. Compliance teams should run a tabletop for a hypothetical country-level ban. Measure how many vendors, RPC endpoints, custody sub-custodians, and fiat PSPs would be lost by geography. Put specific replacement options on paper now.
The A7 cross-border payments network is also targeted through multiple asset-freeze designations. Freezes are stricter than transaction bans. They typically require immediate blocking of assets owned or controlled by listed parties, plus reporting to authorities. A clean beneficiary name does not clear the transfer. Control and ownership look-through is a separate test, compliance teams noted. The A7 designations raise the cost of routing experiments outside mainstream correspondent networks. Some fintechs will pause pilot corridors until there is legal clarity. That could slow niche cross-border flows while leaving large corridors mostly unchanged.
DeFi, OTC, and P2P activity is not exempt. The law applies to the person or company, not just the front end. An EU person operating a DEX front end must avoid facilitating prohibited transactions. Geofencing helps. It is not a shield by itself. For OTC desks, diligence on counterparties and their downstream settlement paths matters more this quarter. It is not enough to know the desk you face. You also need to ask where they clear and where they source. P2P platforms that provide escrow or enforce dispute resolution can be viewed as service providers rather than bulletin boards, legal experts said.
Liquidity tends to migrate rather than vanish in the short term. Market makers connected to named venues will rotate to compliant hubs. The rotation can widen spreads where order books thin and tighten where volume consolidates. Watch cross rates in retail-heavy pairs and stablecoin bridges that relied on the listed venues for off-hours liquidity. The shift could create temporary dislocations before volume finds new homes.
Editor's note: In Q1 and Q2 this year I spent a lot of time with European ops leads who were rationalizing venue lists even before this package landed. The red flags kept repeating: unclear ownership and aggregator routes that went dark after trade. We also saw banks ask for evidence of sanctions blocks on test withdrawals, not just policy PDFs. My own desk had to reroute a couple of liquidity lines out of smaller hubs in April. The practical edge is always in the runbooks. - Darnell Whitaker
Practical work for firms starts now. Update any vendor risk register entries that reference these brand names and their parent entities. Screening only legal names while missing the consumer-facing brand leaves exposure. For user balances that could be stranded, provide a window to reroute to compliant destinations. Cordon off any attempted transfers to listed platforms once the dates hit. Keep clear audit trails for every blocked attempt. The burden of proof in a sanctions breach often falls on the firm.
Retail flow will face more KYC friction. Users will try to withdraw to familiar platforms and hit blocks. Support queues rise. Completion rates dip. Some traders step away for a week or two. Operations teams should over-communicate and provide clear paths to vetted alternative venues.
How the third-country ban mechanism gets used is the bigger question. If evasion is observed through a specific jurisdiction, the lever is now available. The possibility alone will push many EU firms to reduce exposure to high-risk hubs preemptively.
The package was adopted July 23. Regulation 2026/1848 sets specific entry-into-force dates in August for the 14 crypto-related entries. Firms should respect the dates listed for each entity.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.