EU adopts 21st sanctions package against Russia, adding 33 financial institutions, 14 crypto platforms and new crypto-service restrictions

The Council of the European Union adopted its 21st sanctions package against Russia on 23 July, with fresh measures aimed at energy, financial services, crypto-assets and trade. For PSPs, acquirers and banks, the important part is straightforward: the package keeps pushing harder on third-country intermediaries, especially where Russia-connected flows can still be routed through payment and crypto infrastructure.

1. The package introduces transaction bans against 33 additional Russian credit and financial institutions. It also extends the transaction ban to a Kyrgyz bank after links to Russia’s SPFS financial messaging system were identified, and lists three additional third-country banks for supporting Russian companies operating in sanctioned sectors or facilitating sanctions circumvention.
2. Four further entities involved in the A7 network are now subject to transaction bans. A7 is a payment platform established in 2024 that enables sanctioned Russian entities to circumvent Western sanctions through cross-border payment processing, so this is not just a list update; it is a direct hit on a payment rail built for workaround activity.
3. Transaction bans now apply to 14 further crypto-asset service platforms established in Georgia, Panama, the United Arab Emirates, the Marshall Islands, Kyrgyzstan and Belarus. For the first time, the sanctions package also creates the legal framework for a comprehensive prohibition on crypto-asset services provided by third-country operators to EU-based entities.
4. On the energy side, the EU increased the number of sanctioned vessels in Russia’s shadow fleet to 673. The package also covers vessels supporting the shadow fleet through related services, as well as ships transporting military equipment for Russia or stolen Ukrainian grain. In addition to restrictions on the sale of oil tankers, the package now also limits the sale of LNG tankers to Russia.
5. The measures also target critical Russian and Belarusian infrastructure, including ports and airports, and add further natural persons to the sanctions regime for war crimes and the dissemination of propaganda. The package was preceded on 15 June by a separate listing package that supplemented the number of individuals and entities listed under the 20th sanctions package.

For high-risk payment businesses, the practical takeaway is that the EU is not just widening the sanctions list; it is tightening the perimeter around third-country banks, payment platforms and crypto-service providers that touch Russia-linked activity. If your compliance stack still treats those corridors as edge cases, the EU has been pretty clear that it does not.