RegRally Insights: Sanctions Regulation, August 2026

EU sanctions compliance continues to expand beyond traditional sanctions screening. Recent measures increasingly address indirect exposure, third-country circumvention, shipping and energy infrastructure, financial services and crypto-assets.

The latest FATF findings also highlight how virtual assets and decentralised finance are being used to move and obscure illicit funds, including in connection with sanctions evasion and the financing of the proliferation of weapons of mass destruction.

This month’s RegRally focuses on the developments most relevant to businesses exposed to Russia or Belarus, international trade, shipping, financial services, crypto-assets and higher-risk cross-border transactions.

This month at a glance

• Russia: The EU adopted its 21st sanctions package, introducing new restrictions targeting the energy sector, financial services, crypto operators, the Russian shadow fleet and sanctions circumvention. The package includes 218 new listings.
• Belarus: New measures extend restrictions affecting crypto-asset services, ownership and governance, exports and entities supporting the Belarusian or Russian defence and security sectors.
• Crypto and sanctions evasion: FATF identifies stablecoins, offshore VASPs, unhosted wallets and complex DeFi transaction structures as increasingly relevant channels for sanctions evasion and proliferation financing.
• Compliance focus: Effective sanctions compliance increasingly requires businesses to assess ownership, control, transaction flows, counterparties, geography and potential circumvention — not simply perform name screening.

EU adopts 21st sanctions package against Russia, expanding restrictions on energy, finance, crypto and the shadow fleet

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

The EU adopted its 21st package of sanctions against Russia, targeting the energy sector, financial services, crypto-assets, trade and Russia’s military-industrial complex.

The package introduces 218 new listings — 48 individuals and 170 entities — subject to asset freezes and, for individuals, travel restrictions. It also includes 51 additional anti-circumvention listings, including entities in third countries.

Key energy and shipping measures include:

• suspension of the oil price cap adjustment mechanism until July 2027, maintaining the cap at USD 44.10 per barrel;
• designation of 41 additional shadow fleet vessels;
• designation, for the first time, of vessels servicing designated shadow fleet vessels;
• transaction bans covering designated Russian ports, locks and airports;
• restrictions concerning a third-country refinery processing Russian oil;
• a notification obligation concerning the sale of LNG tankers to third countries.

The package also targets more than 100 banks and crypto operators and introduces further measures affecting Russia’s financial infrastructure.

In addition, the EU introduced legal protection measures intended to protect EU operators from certain retaliatory lawsuits connected with sanctions and requires Member States not to recognise or enforce certain Russian judgments linked to sanctions.

Why does it matter for businesses?

The new package significantly increases the number of entities, vessels and infrastructure points that businesses need to consider when assessing sanctions exposure.

Importantly, the package also targets third-country entities involved in circumvention. A counterparty, therefore, does not need to be Russian or directly listed to create sanctions risk.

For businesses involved in international trade, shipping, financial services or crypto-assets, sanctions controls increasingly need to extend beyond customer screening to transaction-level analysis and assessment of ownership, control and intermediary relationships.

Recommended actions

Businesses should:

• update sanctions screening lists without delay and rescreen existing customers, counterparties and relevant third parties;
• review exposure to newly designated banks, crypto operators, vessels, ports, refineries and other infrastructure;
• assess third-country counterparties and intermediaries for potential Russia-related circumvention risks;
• review payment and trade-finance flows involving higher-risk jurisdictions and counterparties;
• strengthen due diligence on shipping transactions involving shadow fleet vessels;
• review contractual arrangements with third-country counterparties in light of the new legal protection measures.

Businesses with material Russia-related exposure should combine automated screening with ownership/control analysis and transaction-level due diligence.

---

EU expands Belarus sanctions, including restrictions affecting crypto-asset services and exports

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

What happened?

Alongside the Russia measures, the EU adopted additional restrictive measures concerning Belarus, including trade-related provisions and measures intended to protect EU operators.

The package extends restrictions on crypto-asset service companies, including a prohibition on Belarusian nationals owning, controlling, or serving on the boards of companies providing crypto-asset services.

It also expands export restrictions on certain goods, including aviation-related products intended for UAVs, and designates four additional Belarusian entities that support the Belarusian or Russian defence and security sectors.

Why does it matter for businesses?

The measures create compliance implications beyond direct dealings with sanctioned Belarusian entities.

For crypto-asset service providers, sanctions compliance now requires closer attention to nationality, ownership and governance structures. For exporters, the expanded restrictions require businesses to consider not only the classification of goods but also their intended end use and end user.

The measures also reinforce the importance of checking ownership and control rather than relying exclusively on sanctions-list screening.

Recommended actions

Businesses should:

• review ownership and governance structures of Belarus-related counterparties;
• for crypto-asset service providers, verify whether Belarusian nationals hold relevant ownership, control or board positions;
• update export-control screening for newly restricted aviation and UAV-related goods;
• strengthen end-use and end-user checks for relevant exports;
• rescreen counterparties against the newly designated Belarusian entities;
• assess transactions involving Belarus for potential indirect exposure or sanctions circumvention.

---

FATF highlights virtual assets as an increasing channel for sanctions evasion and proliferation financing

Date: 16 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF’s Seventh Targeted Update on implementation of Recommendation 15 highlights the increasing complexity of illicit finance involving virtual assets. The report identifies sanctions evasion and proliferation-financing risks associated with stablecoins, offshore VASPs, unhosted wallets, and more complex DeFi transaction structures.

FATF highlights techniques such as chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation, which can be used to layer or obscure illicit funds within legitimate financial flows.

The report also highlights significant DPRK-linked activity. According to FATF, two major DeFi attacks attributed to the DPRK in April 2026 accounted for approximately 76% of annual virtual-asset hacking losses identified in the report, with combined proceeds exceeding USD 570 million.

Why does it matter for businesses?

For businesses dealing with crypto-assets, sanctions risk can arise even when a transaction does not directly match a sanctions list.

The risk may instead stem from the transaction path, an intermediary VASP, wallet exposure, rapid cross-chain movement, interaction with mixers or decentralised exchanges, or links to sanctioned jurisdictions or actors.

This means that sanctions compliance for CASPs and financial institutions increasingly needs to combine traditional screening with blockchain analytics and transaction-level risk assessment.

Recommended actions

CASPs and financial institutions exposed to virtual assets should:

• incorporate stablecoin-related sanctions-evasion typologies into transaction-monitoring scenarios;
• assess exposure to offshore VASPs and higher-risk P2P transactions;
• apply risk-based controls to transactions involving unhosted wallets;
• monitor for chain-hopping, cross-chain bridges, mixers and decentralised exchanges;
• ensure sanctions-risk indicators identified through blockchain analytics trigger appropriate escalation and investigation;
• assess whether existing blockchain analytics tools can identify indirect exposure, rather than only direct wallet matches.

Sanctions-evasion indicators should also feed into the wider customer and transaction risk assessment.

---

What businesses should take from this month’s developments

The latest developments reinforce a fundamental shift in sanctions compliance:

Screening names are necessary, but they are no longer sufficient.

The EU’s 21st Russia sanctions package demonstrates the increasing importance of ownership, control, shipping, financial flows, third-country intermediaries and anti-circumvention analysis. Belarusian measures similarly show that nationality and governance can become relevant factors in sanctions control.

FATF’s latest findings add another dimension for businesses dealing with virtual assets: sanctions evasion can occur through complex transaction structures that may not yield a straightforward sanctions-list match.

Businesses with international operations should therefore consider whether their sanctions framework can identify:

• indirect exposure to sanctioned persons and entities;
• ownership and control risks;
• higher-risk third-country intermediaries;
• shadow fleet and shipping exposure;
• sanctions-evasion patterns in payment and trade flows;
• crypto-asset transactions involving higher-risk wallets, VASPs or jurisdictions.

The practical test is whether the organisation can identify and investigate a potentially evasive transaction before it becomes a sanctions breach, rather than simply demonstrate that its screening system is operating.

---

Need assistance?

ECOVIS ProventusLaw advises businesses on EU sanctions and restrictive measures, including:

• sanctions compliance frameworks and risk assessments;
• sanctions screening and internal controls;
• ownership and control analysis;
• Russia and Belarus sanctions;
• sanctions circumvention and third-country exposure;
• crypto-asset sanctions compliance and blockchain-related risks;
• trade and export-control restrictions;
• sanctions investigations and regulatory response;
• sanctions policies, procedures and employee training.

If your business has exposure to Russia, Belarus, international trade, shipping, financial services or crypto-assets, our team can help assess whether your sanctions controls address both direct restrictions and circumvention risks.