On 23 July 2026, the EU adopted the 21st Russia sanctions package. The Council says it extends transaction bans to 14 crypto-related service platforms based outside Russia and creates a new tool for third-country crypto-asset services used by Russia to evade EU sanctions.
What does the 20th sanctions package actually do?
The Council adopted the 20th package of Russia sanctions on April 23, 2026. For crypto compliance teams, the important legal acts are Council Regulation (EU) 2026/506, amending Regulation (EU) No 833/2014, and Council Decision (CFSP) 2026/508, amending Decision 2014/512/CFSP.
The measure is narrower than a general ban on every Russia-linked crypto transaction, but broader than ordinary name-list screening. It targets crypto-asset service providers and platforms established in Russia that facilitate the transfer or exchange of crypto-assets, including decentralized platforms. It also prohibits transactions involving RUBx and the digital rouble, and bars EU support for the development of the digital rouble.
Adopted: April 23, 2026 (Council of the EU)
Legal acts: Council Regulation (EU) 2026/506 and Council Decision (CFSP) 2026/508
Scope: Russia-established CASPs and platforms enabling crypto transfer or exchange, including decentralized platforms
RUBx and digital rouble: Listed in Annex LIII from May 24, 2026
Status: In force as of August 17, 2026; now supplemented by 21st-package third-country crypto-platform measures
The practical point for CASPs is simple: a counterparty can be prohibited because of where it is established and what platform function it performs, even when it is not individually designated on the EU Consolidated List.
What changed between February and July 2026?
The March version of this article treated the package as a pending measure. That is now stale. The Council adopted the package on April 23, 2026, and the relevant legal acts were published in the Official Journal. The RUBx and digital rouble entries in Annex LIII took effect on May 24, 2026, after the wind-down period.
As of July 10, 2026, this is not a "wait and see" issue. It is an active sanctions-control issue. The compliance question is whether your onboarding, counterparty due diligence and transaction monitoring can identify the new crypto categories now.
- Feb 6, 2026 Commission stage. Crypto measures entered negotiations as part of the 20th Russia sanctions package.
- Apr 23, 2026 Council adoption. Council Regulation (EU) 2026/506 and Council Decision (CFSP) 2026/508 form the legal basis for the sectoral crypto measures.
- May 24, 2026 Wind-down period expires. RUBx and the digital rouble apply as Annex LIII entries.
- Jul 10, 2026 Current status. CASPs should treat the relevant crypto restrictions as in force.
The practical implication: remove pending-package language from policies, training and controls. The package has been adopted.
Why is standard SDN screening not enough?
Most CASPs operating today have built their sanctions compliance around named-individual screening: check the customer's name and wallet address against the EU Consolidated List, OFAC SDN, UN, and UK OFSI. Flag matches, escalate, freeze. This is the correct baseline — EBA GL/2024/15 and CySEC C685 both require it.
The 20th package introduces a different obligation entirely. The prohibition is not "do not transact with Person X who happens to be in Russia." It is "do not engage with Russia-established crypto-asset service providers or crypto transfer and exchange platforms" as a category. An exchange or platform established in Russia can be off-limits even if it is not individually designated.
SDN screening asks: Is this specific entity on a named list?
Sectoral restriction asks: Is this a Russia-established CASP or crypto transfer/exchange platform, including a decentralized platform?
A passing SDN result does not clear a Russia-established exchange or platform under the adopted sectoral restriction.
The digital rouble prohibition adds a second layer of complexity. The digital rouble is not a crypto-asset in the MiCA sense — it is a CBDC issued by the Bank of Russia. Transaction monitoring systems built around blockchain analytics may not flag digital rouble flows by default. CASPs need to verify their transaction monitoring coverage explicitly includes Russian CBDC exposure and RUBx exposure.
What does the gap look like in practice?
Consider a typical small CASP scenario: an EU-licensed exchange with a B2B flow that includes a Russia-established OTC desk acting as a liquidity provider. The OTC desk is not on any sanctions list. It passes SDN screening cleanly. Before the 20th package, this relationship may have looked compliant.
Under the adopted 20th package, the same relationship can be prohibited. The OTC desk is a Russia-established crypto-asset service provider or transfer/exchange platform. The restriction applies regardless of whether it is individually listed, whether it has Russian government connections, or whether individual transactions appear low-risk.
The practical gap for CASPs is: current compliance infrastructure answers the wrong question. Sanctions screening APIs that check names and wallets against lists will return clean results for unlisted Russian counterparties. The 20th package requires a different data point entirely — counterparty place of establishment and platform function — which many screening workflows do not capture.
| Compliance layer | Covers existing Russia sanctions | Covers 20th package crypto restrictions |
|---|---|---|
| SDN / EU Consolidated List screening | Yes | No — only catches listed entities |
| Counterparty jurisdiction verification | Partial | Yes — catches Russia-established providers |
| Beneficial ownership / control check | Partial | Supportive — helps identify escalation and sanctions-control facts |
| Platform-function review | Partial | Yes — catches transfer/exchange platforms, including decentralized platforms |
| RUBx and digital rouble monitoring | N/A | Required — Annex LIII assets are explicitly restricted |
| Re-screening of existing B2B relationships | Partial | Required — existing Russia-nexus relationships must be re-evaluated |
What four things must CASPs do now?
1. Map all Russia-nexus counterparty relationships
Audit your B2B relationships: liquidity providers, OTC desks, payment processors, sub-custodians, API partners. For each, identify: where is the entity established? Does it provide crypto-asset services or operate a platform that facilitates crypto transfer or exchange? Is there Russian state or sanctioned-party ownership or control that creates a separate sanctions issue?
This audit cannot be delegated to your sanctions screening API. It requires direct counterparty due diligence — requesting corporate documents, beneficial ownership declarations, and jurisdiction of establishment. The Council vote has happened; stale "pending package" risk ratings should be updated.
2. Verify RUBx and digital rouble coverage in transaction monitoring
Contact your transaction monitoring provider and ask specifically: does your system flag RUBx and digital rouble exposure? If the answer is unclear or negative, you have a gap. The digital rouble uses a two-tier architecture via Russian commercial banks, which means exposure may not appear as direct blockchain transactions. Understand the exposure vector for your specific business model.
3. Update your sanctions policy documentation
Your AML/sanctions policy needs to explicitly describe the Russia sectoral crypto restriction as a distinct compliance obligation separate from named-list screening. Document the specific procedures for: (a) verifying counterparty establishment at onboarding; (b) identifying transfer and exchange platforms, including decentralized platforms; (c) handling RUBx and digital rouble detection. Regulators will want to see that your policy reflects the adopted law.
4. Prepare a counterparty termination workflow
If you still have Russia-established crypto service providers or transfer/exchange platforms in your B2B stack, you need a documented exit or legal assessment. Build the workflow: notice requirements, contract termination clauses, transition to alternative providers, documentation of the termination decision and its basis. Handling this as a routine vendor-management issue will understate the sanctions risk.
The 20th package is now adopted. The question is not whether this becomes law. The question is whether your compliance program can prove that it recognized the legal change and applied it to counterparties, platforms, RUBx and the digital rouble.
What will regulators look for during inspection?
When MiCA-era inspections examine Russia sanctions compliance after adoption, they will not only ask "did you screen against the list?" They will ask:
- Did your policy explicitly address the sectoral restriction on Russia-established CASPs and crypto platforms?
- How did you identify and terminate Russia-nexus B2B relationships?
- What documentation shows the termination decision was made promptly and for the right reasons?
- Does your transaction monitoring cover RUBx and digital rouble exposure?
- Were your existing customer and counterparty records re-screened when the adopted restriction entered into force?
These are not trick questions. They are the natural extension of EBA GL/2024/15's requirement that CASPs maintain policies calibrated to specific risk typologies — and a sectoral Russia crypto restriction is exactly the kind of categorical risk that policies must address explicitly.
The obligation is not merely to check names. CASPs need to understand where the counterparty or platform is established, what crypto function it performs, and whether RUBx or the digital rouble appears in the transaction chain.
— ChainScreen reading of Council Regulation (EU) 2026/506 and Council Decision (CFSP) 2026/508
Frequently asked questions
What does the EU 20th sanctions package say about crypto?
The Council adopted the 20th Russia sanctions package on April 23, 2026. Council Regulation (EU) 2026/506 and Council Decision (CFSP) 2026/508 restrict Russia-established crypto-asset service providers and platforms that facilitate crypto transfer or exchange, including decentralized platforms. They also prohibit transactions involving RUBx and the digital rouble, and support for development of the digital rouble.
When did the EU Russia crypto restrictions take effect?
The package was adopted on April 23, 2026. The RUBx and digital rouble Annex LIII entries apply from May 24, 2026. As of July 10, 2026, CASPs should treat the relevant crypto measures as in force.
How are the Russia crypto restrictions different from normal sanctions screening?
Standard sanctions screening checks counterparties against named-individual lists (EU Consolidated List, OFAC SDN, UN). The 20th package adds a sectoral restriction on Russia-established crypto-asset service providers and platforms that facilitate transfer or exchange of crypto-assets. A clean SDN check is not sufficient compliance. CASPs need to verify place of establishment and platform function.
What are the penalties for violating EU Russia sanctions?
EU Russia sanctions are enforced by member-state competent authorities under national penalty regimes, alongside the EU framework for criminalising sanctions violations. CASPs should treat breaches as inspection, enforcement and potential criminal-liability events, not as routine screening exceptions.
What must a CASP do to comply with the Russia crypto restrictions?
CASPs need four controls: (1) counterparty establishment screening for Russia-based CASPs and platforms; (2) platform-risk checks for decentralized platforms enabling crypto trading; (3) transaction monitoring and policy coverage for RUBx and digital rouble exposure; (4) re-screening and documented exits for existing Russia-nexus business relationships. Standard sanctions APIs that only check named lists will not be sufficient.
Sources
- Council of the EU — 21st package of Russia sanctions, including crypto (23 Jul 2026)
- European Commission — EU adopts 21st package of sanctions against Russia (23 Jul 2026)
- Council of the EU — 20th round of Russia sanctions, including crypto (23 Apr 2026)
- EUR-Lex — Council Regulation (EU) 2026/506 amending Regulation (EU) No 833/2014
- EUR-Lex — Council Decision (CFSP) 2026/508 amending Decision 2014/512/CFSP
- EUR-Lex — Council Regulation (EU) No 833/2014 (Russia sanctions framework, as amended)
- EBA — Final Guidelines on Restrictive Measures (GL/2024/15)
- EUR-Lex — MiCA Regulation 2023/1114
- CySEC — Crypto Asset Regulation, Circular C685