The EU has greatly expanded its sanctions regime against Russia and Belarus with the adoption of its 21st sanctions package, introducing the largest wave of new designations since the invasion of Ukraine began.
The package, adopted on 23 July 2026, adds 218 new sanctions listings, including 48 individuals and 170 entities, while significantly broadening restrictions across banking, crypto-assets, energy, shipping, exports and global supply chains. It significantly marks a strategic shift in how sanctions are enforced, moving beyond targeting individual companies and transactions to tackling the wider networks, jurisdictions and service providers that enable sanctions evasion.
This means regulators now expect organisations to understand not only who they are dealing with, but how money, goods and services move through increasingly complex global supply chains.
A broader approach to sanctions enforcement
While previous sanctions packages largely focused on freezing assets and prohibiting dealings with designated individuals or organisations, the latest measures take aim at the infrastructure supporting Russia’s economy.
The package significantly expands restrictions across financial services, energy, trade and the military-industrial complex. More than 100 Russian banks are now subject to transaction bans, while 94 banks and financial institutions have been designated for asset freezes. The EU has also expanded export controls, import bans and restrictions on sectors that continue generating revenue for Russia’s war effort.
The changes also extend beyond Russia.
Financial institutions, refineries, logistics providers and other organisations in countries including China, Hong Kong, India, Kazakhstan, Kyrgyzstan, Turkey, the UAE and Georgia are now directly affected where the EU believes they facilitate sanctions circumvention.
This growing willingness to target third-country actors demonstrates that sanctions enforcement is becoming more global in scope.
Crypto moves firmly into the sanctions spotlight
Perhaps the most significant development is the EU’s expansion of sanctions into the crypto asset sector.
Fourteen crypto platforms operating across multiple jurisdictions have been brought within the scope of transaction bans, while the package introduces an entirely new legal mechanism allowing the EU to impose broad restrictions on crypto providers operating in third countries if they are used to facilitate Russian sanctions evasion.
This represents a major change in regulatory thinking. Rather than continually adding individual exchanges or wallets to sanctions lists, the EU is creating the legal framework to restrict entire categories of crypto providers where they are considered part of an evasion ecosystem.
For crypto businesses, virtual asset service providers (VASPs) and financial institutions, compliance can no longer rely solely on screening named entities. Firms will need to assess jurisdictional exposure, monitor transaction patterns and identify indirect relationships that may signal sanctions risk.
Shadow fleets and hidden supply chains under pressure
The package also tightens restrictions on Russia’s energy sector by expanding measures against the so-called shadow fleet used to transport Russian oil.
Forty-one additional vessels have been sanctioned, but more importantly, the EU has widened its focus to include the businesses supporting those vessels.
For the first time, a Russian crewing agency has been designated, alongside companies operating on behalf of major Russian oil producers. Restrictions have also been extended to vessels providing bunkering and other support services to sanctioned ships.
This increases compliance expectations for organisations throughout the maritime supply chain. Any business involved in vessel nomination now faces greater scrutiny over beneficial ownership, routing arrangements and indirect exposure to sanctioned activities.
Supply chains face growing regulatory scrutiny
The latest package continues the EU’s increasing focus on sanctions circumvention through global supply chains.
Fifty-one additional entities across several third countries have been subjected to tighter dual-use export controls, while new export restrictions cover aerospace materials, drone technologies, advanced alloys and components with military applications. New import bans also target products that continue generating significant revenue for Russia.
These measures reinforce a broader trend that has emerged over successive sanctions packages. Businesses can no longer assume that sourcing products through intermediaries or third countries removes sanctions risk. Organisations need to understand where products originate, who ultimately controls suppliers and whether goods may be diverted to sanctioned destinations.
Sanctions compliance now
Sanctions compliance is moving beyond simple name screening towards continuous, intelligence-led risk management. Regulators expect businesses to identify indirect exposure, monitor changing ownership structures, assess geographical risk, understand complex supply chains and detect potential sanctions circumvention before it occurs.
This means organisations should review sanctions screening systems to ensure they capture newly designated individuals and entities while also considering wider exposure across banking relationships, logistics providers, shipping partners, crypto platforms and supply chains.
Businesses operating internationally should also revisit their risk assessments for third-country jurisdictions that have become increasingly associated with sanctions evasion, particularly where suppliers, distributors or financial intermediaries operate in regions now receiving heightened regulatory attention.
Continuous monitoring has also become increasingly important. A customer or supplier that presented little sanctions risk six months ago may now fall within a newly designated sector or jurisdiction, making periodic screening alone insufficient.
Organisations should also ensure they maintain robust evidence of their sanctions controls. Regulators increasingly expect firms to demonstrate not only that they screened counterparties, but also how they assessed indirect risks, investigated potential matches, monitored ongoing relationships and documented compliance decisions.
Looking ahead
The EU is now targeting the mechanisms that enable sanctions evasion rather than merely reacting to individual bad actors. That means enforcement is becoming more proactive, more data-driven and more focused on the wider networks supporting prohibited activity.
At the same time, geopolitical tensions continue to evolve. Within 24 hours of the package’s adoption, China responded by placing 14 EU organisations on its Export Control List, highlighting the growing potential for reciprocal trade restrictions that could further complicate international supply chains.
For businesses, sanctions compliance is no longer a standalone legal exercise confined to screening lists. It has become a strategic risk management function that spans procurement, finance, logistics, technology, customer onboarding and third-party oversight.
