EU 21st Sanctions Package: What Screening Desks Must Update

On 23 July 2026 the Council adopted the EU’s 21st sanctions package. The package-wide headline was 218 listings: 48 individuals and 170 entities. The Russia asset-freeze additions were made by Council Implementing Regulation (EU) 2026/1843, which added 48 persons and 168 entities to Annex I of Regulation (EU) No 269/2014 and entered into force on publication on 23 July. Separately, Council Implementing Regulation (EU) 2026/1817 added two legal persons under the Belarus regime. Regulation (EU) 2026/1848 amends the sectoral regime in Regulation (EU) No 833/2014, while Regulation (EU) 2026/1844 amends provisions of Regulation (EU) No 269/2014 but is not the act that made the 216 Russia-list additions.

The regulations are directly applicable and require no national transposition, but their operative dates are not uniform. The 216 additions to the Russia asset-freeze list took effect on 23 July 2026. Regulation (EU) 2026/1848 entered into force on 24 July, while several of its newly listed transaction-ban targets have later application dates, including 13 August and 23 August 2026, and the expanded crypto-governance restriction applies from 25 August 2026. Implementation therefore has to follow the application date of each measure rather than a single package-wide start date.

One framing point belongs at the top, because it decides where the reports go. The package changes restrictive-measures law and leaves anti-money-laundering law untouched; it creates no new AML return or template. The two regimes run on the same rails inside compliance functions, and the boundary between them is exactly where a required report goes missing.

Related reading: how Switzerland and Liechtenstein mirror EU Russia sanctions screening

The 21st package dates that drive screening work

Restrictive measures bite from entry into force, so the calendar is short and mostly immediate. A few later review points can widen or narrow scope, and those are the ones worth diarising.

• 23 July 2026: Council Implementing Regulation (EU) 2026/1843 entered into force on publication, adding 216 entries to the Russia asset-freeze list.
• 24 July 2026: Regulation (EU) 2026/1848 entered into force generally.
• 13 August 2026: the 33 new Annex XIV Russian credit and financial institutions, and specified new third-country Annex XLIV and XLV entries carrying that date, became subject to their respective transaction bans.
• 23 August 2026: the Annex XLV crypto-platform entries carrying that application date became subject to the transaction ban.
• 25 August 2026: the Russian crypto-governance restriction was extended to other MiCA crypto-asset services; Regulation (EU) 2026/1846 makes the corresponding change for Belarus.
• 25 October 2026: the Commission must report on whether the Kulevi Oil Refinery listing should be maintained, and the Council must review whether the contemplated LNG-tanker sale ban should enter into force.
• 15 January 2027: the Commission must calculate the specified 22-week average Russian crude-oil price and report it to the Council for review of the price cap.
• 25 January 2027: the transaction prohibition concerning Kulevi Oil Refinery applies.
• 15 July 2027: the automatic oil-price-cap adjustment procedure resumes unless the framework is amended before then.
• Russian combatant visa measures: the package establishes the legal basis, with the operative date dependent on the further Council measure.

The first line is the one that matters for a screening desk. The 23 July asset-freeze additions took effect on publication, while several sectoral transaction bans and the expanded crypto-governance restriction had later August application dates; the October 2026 and 2027 review points are separate diary items.

What the EU 21st sanctions package changed for banks

The package expands both asset-freeze listings involving banks and the sectoral transaction-ban lists. Regulation (EU) 2026/1848 adds 33 Russian credit and financial institutions to Annex XIV, with those entries applying from 13 August 2026, and also adds specified non-Russian financial and crypto-related entities to other transaction-ban annexes. Article 5h is now a transaction prohibition: it prohibits direct or indirect transactions with Annex XIV entities and with Russian entities more than 50 per cent owned by an Annex XIV entity, subject to the regulation’s exemptions and derogations.

Article 5h should not be described as the current specialised-financial-messaging or SWIFT prohibition. Regulation (EU) 2025/1494 replaced the former Article 5h rule with the present transaction ban. Restrictions concerning SPFS and equivalent specialised financial-messaging systems sit separately in Article 5ac. Controls for the new Annex XIV entries therefore need to implement the transaction prohibition rather than treating the measure as a SWIFT-only message block.

Ownership and control is the second place banks lose names. Article 5h extends to entities established in Russia that are more than fifty per cent owned by a listed bank. For Regulation (EU) No 269/2014, Article 1 now defines ‘owning’ as possession of 50 per cent or more of the proprietary rights or a majority interest, and gives a non-exhaustive control test covering, among other things, appointment or removal rights, majority voting rights, contractual or de facto dominant influence, rights over assets, unified management and shared or guaranteed liabilities. The Commission’s 6 May 2026 asset-freeze FAQ states that where a listed person is deemed to own or control an unlisted entity, the freeze and availability restrictions are presumed to extend to it, but that presumption can be rebutted case by case.

Listings, asset freezes and the report that actually has a deadline

The 216 Russia asset-freeze additions are made under Regulation (EU) No 269/2014 via Council Implementing Regulation (EU) 2026/1843. Two obligations follow from Article 2 of that regulation. All funds and economic resources belonging to, owned, held or controlled by a listed person are frozen. And no funds or economic resources may be made available, directly or indirectly, to or for the benefit of a listed person. Both limbs apply at once, but Article 7 contains specific rules for credits to frozen accounts. A financial or credit institution may credit a listed person’s frozen account with third-party transfers provided the additions are also frozen and the competent authority is informed without delay; interest or other earnings and certain pre-listing or judicial payments may also be credited where the additions remain frozen. Outgoing payments and other dealings still require analysis under Article 2 and any applicable derogation or authorisation.

The reporting obligation has both an immediacy requirement and an outside limit. Article 8 of Regulation (EU) No 269/2014 requires natural and legal persons, entities and bodies to supply the national competent authority immediately with information that facilitates implementation. For the specified information on frozen or relevant unfrozen assets, and on assets moved, transferred, altered, used, accessed or dealt with in the two weeks preceding listing, Article 8 also sets an outside limit of two weeks from acquiring the information.

For each of the 216 new Russia listings, the Article 8 lookback is relevant where the reporting person or entity holds information that the listed party’s funds or economic resources within Union territory were moved, transferred, altered, used, accessed or dealt with during the two weeks preceding listing.

The larger operational risk sits in the existing book rather than the new names. A designation added on 23 July 2026 can match a customer onboarded years earlier, a beneficial owner behind a corporate account, or a counterparty on a live derivative. Screening the incoming payment flow catches new business. Only a full re-screen of the standing customer base against the updated list catches the relationship that was already there.

The crypto front the package opens

The 21st package adds transaction bans for named third-country crypto-related service platforms and creates a separate mechanism in Article 5bc of Regulation (EU) No 833/2014 under which the Council can list a third country in Annex LVII and thereby prohibit transactions with crypto-service providers and exchange or transfer platforms established there. Annex LVII was created without a country entry, so Article 5bc establishes a mechanism for a future country-level ban rather than an immediately operative blanket third-country crypto ban.

The named Annex XLV entities are different: the entries added by Regulation (EU) 2026/1848 carry specified application dates and are subject to the transaction-ban regime applicable to that Annex. Regulation (EU) 2023/1113 separately governs information accompanying certain crypto-asset transfers; the sanctions regulations do not prescribe wallet-address screening as a universal statutory screening method.

Article 5b(2a) applies to legal persons, entities or bodies incorporated or constituted under the law of a Member State. Subject to Article 5b(3), it prohibits Russian nationals and natural persons residing in Russia from directly or indirectly owning or controlling such providers, or holding posts in their governing bodies. Article 5b(3) excludes nationals of an EU Member State, an EEA country or Switzerland, and natural persons holding a temporary or permanent residence permit in the EU, EEA or Switzerland. From 25 August 2026 Article 5b(2a) extends beyond wallet, account and custody services to any other crypto-asset service defined in MiCA. Regulation (EU) 2026/1846 makes the corresponding extension for Belarus, subject to the equivalent exemption in Article 1u(4) of Regulation (EC) No 765/2006. For the wider MiCAR obligations that sit on top of this, see our MiCAR token classification and reporting guide.

Sanctions compliance and AML are not the same report

Because this package sits in an AML Reporting context, the distinction has to be explicit. Restrictive measures are adopted under Article 215 of the Treaty and applied through the Council regulations. Anti-money-laundering obligations flow from a separate body of law: today the Anti-Money Laundering Directive framework, and from 10 July 2027 the directly applicable AML Regulation (EU) 2024/1624, alongside the sixth AML Directive (EU) 2024/1640 and the Anti-Money Laundering Authority established under Regulation (EU) 2024/1620. The sanctions package amends neither.

Sanctions reporting and suspicious-transaction reporting arise under different legal bases, but firms should not assume that every case necessarily requires two duplicate submissions to two separate authorities. Article 8 of Regulation (EU) No 269/2014 requires information facilitating implementation to be supplied immediately, with the specified categories in Article 8(1)(a) also subject to an outside limit of two weeks from acquiring the information. Separately, obliged entities must report suspicious transactions linked to suspected criminal activity involving violations of Union restrictive measures to the FIU where the AML reporting conditions are met. Recital 6 to Regulation (EU) 2025/390 states that, to avoid double reporting, Member States can decide that the same information need not also be reported to competent authorities other than FIUs. That statement is recital language rather than a standalone operative derogation in Article 8, so the submission route must be checked against the relevant Member State’s national arrangements. In Luxembourg, STRs to the CRF are submitted through goAML.

The incoming AML Regulation tightens the link rather than blurring it: obliged entities will have to build compliance with targeted financial sanctions into their internal policies and controls. For now, the sanctions screening duty stands on the restrictive-measures regulations themselves, which apply to every person under EU jurisdiction regardless of whether they are a supervised AML obliged entity.

What the screening desk actually has to do

The regulations require operators to comply with the applicable asset freezes, availability prohibitions, transaction bans and ownership rules, but they do not generally prescribe one universal screening tool, matching method or full-book re-screening frequency. Controls therefore need to be capable of identifying existing relationships that become subject to newly applicable measures and of applying the relevant ownership and control tests. For PSPs offering instant credit transfers, Article 5d of Regulation (EU) No 260/2012 is a specific prescriptive rule: PSUs must be checked immediately after new or amended targeted financial restrictive measures enter into force and at least once every calendar day.

The package also adds 51 entities to Annex IV of Regulation (EU) No 833/2014 for tighter restrictions concerning dual-use goods and technologies, including entities established outside Russia. Those entries are not, by that fact alone, asset-freeze designations or blanket transaction-ban targets. They should be mapped to the relevant export-control and trade-finance restrictions, while asset-freeze and transaction-ban screening is applied against the separate lists that govern those prohibitions.

One screening obligation is often mislabelled as optional. Under the Instant Payments Regulation (EU) 2024/886, payment service providers offering instant credit transfers in euro must verify, at least daily, whether their clients are persons or entities subject to targeted financial restrictive measures, in place of screening each individual instant transaction. A new package changes the list those daily checks run against, and the regulation allows penalties to reach the senior management or management body of a PSP as well as the firm. The interaction with the wider instant-payments duties is set out in our guide to the SEPA instant payments regime.

The consequences of a breach reach beyond supervisory action. Directive (EU) 2024/1226, which participating Member States were required to transpose by 20 May 2025, requires specified violations of Union restrictive measures to be criminal offences. It does not establish a general imprisonment range of one to five years: depending on the offence and applicable thresholds, Member States must provide for maximum terms of imprisonment of at least one, three or five years. For legal persons, the Directive requires specified maximum fine levels that may be based on 1 per cent or 5 per cent of total worldwide turnover, or on corresponding fixed amounts.

The screening desk’s next move on the 21st package

The package requires several different implementation changes on different dates. The Russia asset-freeze list received 216 additions under Implementing Regulation (EU) 2026/1843, while two additional legal persons were listed under the Belarus regime. Firms should update controls for the relevant asset-freeze and transaction-ban lists, apply ownership and control rules, and map the applicable national reporting route. Article 8 requires reportable information to be supplied immediately, with the specified Article 8(1)(a) categories also subject to an outside limit of two weeks from acquisition; the legal trigger is not merely the generation of an unresolved screening match. Relevant diary dates include 25 October 2026 for the Kulevi assessment and LNG-tanker review, 15 January 2027 for the price-cap assessment, 25 January 2027 for application of the Kulevi transaction ban and 15 July 2027 for resumption of the automatic price-cap adjustment procedure.

Frequently Asked Questions

Does the 21st package create a new AML report or template we have to build?

No. The package changes EU restrictive-measures instruments and does not itself create a new AML return or template. The same facts may separately meet the conditions for suspicious-transaction reporting under AML law.

A customer is more than fifty per cent owned by a newly listed entity but is not itself on the list. Is it frozen?

Ownership and control of an unlisted entity must be assessed under the asset-freeze rules and Commission guidance. Where an entity is owned or controlled by a listed person, its funds and economic resources can fall within the freeze and prohibition on making funds or economic resources available. Any applicable derogation or competent-authority authorisation must also be considered.

We already cleared these customers at onboarding. Do we really need to re-screen them?

Existing relationships need controls capable of identifying newly applicable sanctions, but Regulation (EU) No 269/2014 and Regulation (EU) No 833/2014 do not prescribe a universal full-book re-screening frequency or matching method for every operator. PSPs offering instant credit transfers are subject to the specific Article 5d requirement to verify PSUs immediately after new or amended targeted financial restrictive measures enter into force and at least once every calendar day.

The financial-messaging ban only affects SWIFT, doesn’t it?

The new Annex XIV bank entries are subject to the Article 5h transaction ban, not an Article 5h SWIFT-only prohibition. Since the 18th package, Article 5h prohibits direct or indirect transactions with Annex XIV entities and qualifying Russian entities more than fifty per cent owned by them, subject to the regulation’s exceptions and derogations. Separate restrictions relating to SPFS and equivalent financial-messaging systems are contained in Article 5ac.

We are a crypto-asset service provider with no Russian clients. Are we affected?

Potentially, depending on the firm’s counterparties and structure. The package adds named third-country crypto-related platforms to transaction-ban lists. It also creates Article 5bc, under which the Council can list a third country in Annex LVII and prohibit transactions with relevant crypto providers there; Annex LVII was created without a country entry. Separately, from 25 August 2026 Article 5b(2a) extends the governance restriction for Russian nationals and persons residing in Russia to EU-incorporated entities providing any MiCA crypto-asset service, subject to the exemption in Article 5b(3) for EU, EEA and Swiss nationals and qualifying residence-permit holders. The Belarus regime contains the corresponding extension and exemption in Article 1u(3) and (4).

Is there a deadline to report frozen funds to the authorities?

Article 8 of Regulation (EU) No 269/2014 requires information facilitating implementation to be supplied immediately and, for the specified categories in Article 8(1)(a), within two weeks of acquiring it, including information on relevant assets moved, transferred, altered, used, accessed or dealt with during the two weeks preceding listing. Whether the same facts also require an FIU report depends on AML law and the facts; Member States may provide arrangements that avoid duplicate reporting of the same information.

Are Belarus-linked parties in scope of this package?

The accompanying Belarus measures are separate instruments. Council Implementing Regulation (EU) 2026/1817 added two legal persons to the Belarus asset-freeze list. Separately, additional entities were added to the Belarus list subject to restrictions concerning authorisations for dual-use and military or security-related goods and technology. Regulation (EU) 2026/1846 also extends the crypto-governance restriction from 25 August 2026. These lists and prohibitions should not be treated as one interchangeable screening list.

Related Articles

• FINMA Russia Sanctions Screening in Switzerland and Liechtenstein: how non-EU financial centres implement the equivalent Russia measures through SECO, and why the instrument differs.
• The SEPA Instant Payments Regulation: the daily sanctions-list verification duty for PSPs offering instant credit transfers in euro.
• MiCAR Token Classification and Reporting Obligations: how crypto-asset services are classified and what CASPs must report.
• The goAML Reporting Workflow in Luxembourg: how a suspicious transaction report reaches the Cellule de Renseignement Financier.
• AMLA Central Contact Point Survey for PSPs and EMIs: how the incoming EU AML framework is taking shape for payment firms.
• Luxembourg AML Law and CRF Reporting: the national AML obligations that sit alongside sanctions compliance.

Key Takeaways

• Implement the 216 Russia asset-freeze additions made by Council Implementing Regulation (EU) 2026/1843, effective 23 July 2026; the package-wide headline of 218 also includes two legal persons added under the Belarus regime.
• Apply the measure-specific dates rather than a single package date: relevant new transaction-ban entries apply on 13 or 23 August 2026, and the expanded crypto-governance restriction applies from 25 August 2026.
• Article 5h of Regulation (EU) No 833/2014 is a transaction ban on Annex XIV entities and qualifying Russian entities more than fifty per cent owned by them; it is no longer the specialised-financial-messaging or SWIFT provision.
• For Article 8 reporting under Regulation (EU) No 269/2014, information that facilitates implementation must be supplied immediately; the specified Article 8(1)(a) categories are also subject to an outside limit of two weeks from acquisition. Check the Member State reporting architecture before assuming that identical information must always be submitted separately to both a sanctions authority and the FIU.
• Distinguish the named third-country crypto-platform transaction bans from Article 5bc’s mechanism for a future country-level crypto restriction. The Article 5b governance restriction applies to EU-incorporated providers and covers Russian nationals and persons residing in Russia subject to the Article 5b(3) exemption for EU, EEA and Swiss nationals and qualifying residence-permit holders; the Belarus regime contains the corresponding extension and exemption.
• Do not treat the 51 Annex IV entities subject to tighter dual-use export restrictions as asset-freeze or blanket transaction-ban designations merely because they appear in the package.
• For PSPs offering instant credit transfers, Article 5d of Regulation (EU) No 260/2012 requires PSU verification immediately after new or amended targeted financial restrictive measures enter into force and at least once every calendar day.
• Diarise 25 October 2026 for the Kulevi and LNG-tanker reviews, 15 January 2027 for the price-cap assessment, 25 January 2027 for application of the Kulevi transaction ban and 15 July 2027 for resumption of the automatic price-cap adjustment procedure.
• Directive (EU) 2024/1226 requires Member States to criminalise specified violations of Union restrictive measures and sets minimum requirements for national maximum penalties; this is separate from the Instant Payments Regulation’s provisions concerning penalties applicable to PSP management.

Sources and References

• European Commission, “EU adopts 21st package of sanctions against Russia” (23 July 2026): finance.ec.europa.eu
• Council Implementing Regulation (EU) 2026/1843 of 23 July 2026 implementing Regulation (EU) No 269/2014 (the act making the 216 Russia asset-freeze additions): EUR-Lex
• Council Regulation (EU) 2026/1844 of 23 July 2026 amending Regulation (EU) No 269/2014, read with its 6 August 2026 corrigendum: EUR-Lex
• Council Regulation (EU) 2026/1848 of 23 July 2026 amending Regulation (EU) No 833/2014: EUR-Lex
• Official Journal, L series of 23 July 2026 (21st package acts): EUR-Lex daily view
• Council Regulation (EU) No 833/2014 (sectoral measures), consolidated: EUR-Lex
• Council Regulation (EU) No 269/2014 (asset freezes), consolidated (post-21st-package version): EUR-Lex
• European Commission, FAQs on asset freezes and the prohibition to make funds and economic resources available: finance.ec.europa.eu (PDF)
• Regulation (EU) 2024/886 (Instant Payments Regulation), targeted-sanctions verification duty: EUR-Lex
• Regulation (EU) 2023/1113 (information accompanying transfers of funds and certain crypto-assets): EUR-Lex
• Directive (EU) 2024/1226 on criminal offences and penalties for the violation of Union restrictive measures: EUR-Lex
• Regulation (EU) 2024/1624 (AML Regulation), applicable 10 July 2027: EUR-Lex
• Directive (EU) 2024/1640 (sixth AML Directive): EUR-Lex
• EU Sanctions Map and consolidated list of financial sanctions: sanctionsmap.eu

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.