EU's 21st Russia Sanctions Package: What Crypto Firms Must Do Now
The European Union's 21st Russia sanctions package, agreed by the Council of the EU on July 23 and taking effect on August 23, represents the most significant expansion of crypto-specific sanctions measures since the invasion of Ukraine began. It designates 14 crypto asset service platforms across seven jurisdictions and, critically, creates a new legal authority that could eventually prohibit EU-regulated entities from transacting with any crypto platform in an entire country. For compliance teams, CFOs, and auditors relying on crypto accounting software to track counterparty exposure, the window to act is short.
The 14 Designated Crypto Platforms: Who They Are and Where
The package names crypto asset service platforms located in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, Belarus, and Nigeria. From August 23, EU-regulated VASPs and financial institutions are prohibited from engaging in any activity with these entities.
Overlap with existing UK designations
Several of the newly designated platforms, including HTX, Bitpapa, and EXMO, were already on the UK's sanctions list. For firms holding licences or operating in both jurisdictions, this alignment has a practical consequence: any screening or transaction-monitoring framework that was already blocking these entities for UK-law purposes now needs to be formally reflected in EU-law compliance documentation as well. A dual-listed designation is not simply a duplication; it carries separate legal obligations in each jurisdiction, each with its own enforcement authority.
The A7 network and the A7A5 stablecoin
Two of the newly designated entities, A7 Nigeria and A7 Africa, extend the EU's earlier sanctions action against the Kyrgyzstan-based A7 financial network. Russia has used this network for sanctions evasion, and the A7A5 ruble-denominated stablecoin sits at the heart of that infrastructure. Prior coordinated designations by the EU, US, and UK have already caused a sharp decline in A7A5 trading volumes, a concrete demonstration that targeted on-chain sanctions, when backed by blockchain analytics capabilities, can materially disrupt evasion channels. The addition of A7's African entities signals that authorities are continuing to follow the network's geographic expansion rather than treating earlier designations as the end of the matter.
The New Country-Ban Authority: A Structural Shift
Beyond the 14 named entities, the 21st package introduces something qualitatively different: a legal basis for the EU to prohibit all dealings with crypto asset service platforms located in a specific third country, where that country has been found to have "systematically and persistently failed to prevent the provision of crypto-asset services that frustrate" EU Russia sanctions.
What the authority does and does not do right now
At this stage, the package establishes the authority without activating it against any country. No country-level ban is in force on August 23. The EU has indicated it intends the new power to function primarily as a deterrent, with Kyrgyzstan cited as an example of the type of jurisdiction it has in mind. That deterrent logic only works, however, if regulated firms treat the possibility of a country-level ban as a real operational risk requiring preparation, not as an abstract policy signal to monitor from a distance.
Preparing before a designation lands
Compliance teams in EU-regulated entities should treat the absence of an immediate country designation as preparation time, not as grounds for inaction. A useful starting point is a structured review of all customer and counterparty relationships that have any nexus to the seven jurisdictions in which the 14 newly designated entities are located: Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, Belarus, and Nigeria. That exercise will surface both direct exposure and indirect exposure through correspondent or sub-custodian relationships. The findings should then be weighed against the firm's documented risk appetite, with relationships that fall outside tolerance either exited or subject to enhanced due diligence pending any further EU action.
Accounting and Audit Implications for B2B Teams
Sanctions exposure on the balance sheet
For CFOs and finance directors at VASPs or at corporates that hold digital assets, the August 23 effective date creates a potential impairment trigger. Any digital assets held at, or any receivables owed by, one of the 14 designated platforms cannot be realised through lawful channels once the designations are in force. Under both IFRS 9 and US GAAP, the inability to recover a financial asset due to a legal restriction is a recognised impairment indicator. Finance teams need to identify whether any balances, including stablecoin holdings or settlement amounts, sit with these entities and assess recoverability before the period-end that follows August 23.
Screening data in your crypto bookkeeping software
The quality of any impairment or exposure assessment depends on the underlying data. Crypto bookkeeping software that aggregates transaction data but does not tag counterparty entity metadata, including sanctions-list status, will leave finance teams working from incomplete information. The same applies to digital asset accounting software used by audit teams performing substantive testing on client crypto portfolios. Sanction screening should be embedded in the data pipeline, not applied as a manual overlay after ledger entries are already posted.
Disclosure and going-concern considerations
For smaller regulated entities with concentrated exposure to any of the named jurisdictions, the new country-ban authority, even in its currently dormant state, may constitute a material uncertainty worth disclosing in notes to financial statements. Auditors should probe management's assessment of this risk explicitly, particularly where client VASPs have material volumes routed through Georgia, the UAE, or Kyrgyzstan.
For further context on how the EU has been building out its digital-asset enforcement infrastructure, see our coverage of the EU regulation targeting terrorist financing through digital currencies, and for a parallel look at how country-level crypto sector sanctions operate in practice, our piece on US sanctions on Iran's digital assets sector is directly relevant.
The US CLARITY Act: Senate Stalemate Before the Recess
While the EU was finalising its 21st package, the United States Congress headed into its August recess with the Digital Asset Market Clarity Act still stuck in the Senate. The bill, which passed the House and cleared the Senate Banking Committee, was still awaiting a floor vote as of early August.
The three unresolved sticking points
Three distinct issues are blocking the bill's progress. The first, and most politically significant, is ethics language. Democratic senators, including members who have generally supported crypto legislation, have insisted that the bill must include provisions addressing President Trump's personal and family financial interests in the crypto sector. The White House proposed its own ethics language; that proposal was rejected by Senate Democrats and by Republican Senator Thom Tillis. A workable compromise had not emerged before the recess window closed.
The second sticking point is stablecoin yield. The Senate Banking Committee reached an agreement that allowed the bill to pass out of committee, but several senators subsequently indicated that the existing compromise language poses risks for community banks, which have been lobbying against the current provisions.
The third issue is DeFi and law enforcement access. A number of Democratic senators have argued that the bill's provisions covering decentralised finance do not give law enforcement adequate investigative tools. Whether the bill's sponsors can satisfy those concerns without losing other votes remains unclear.
Procedural path and timeline risk
For the CLARITY Act to become law, it needs 60 votes to clear a Senate cloture motion, a simple majority of 50 for final passage in the Senate, and then a fresh House vote on the amended version, since the bill has changed since the House passed its own version. Republican Senate leadership floated the possibility of a cloture vote before the August recess began, but key Democrats indicated they would not support cloture without further changes. A cloture vote was reported as pending with only 72 hours remaining before the recess, and it was far from certain that vote would succeed. With mid-term elections in November, the political calendar after the recess is compressed, and observers have noted that failure to advance the bill before the recess materially reduces its chances of enactment in this Congress.
What the stalemate means for compliance planning
For firms with US operations, the practical consequence of the CLARITY Act's delay is continued jurisdictional ambiguity between the SEC and the CFTC over which digital assets are securities and which are commodities. That ambiguity affects how firms classify assets on their books, which regulatory reporting obligations apply, and which examination standards their auditors must consider. Teams relying on digital asset accounting software to produce regulatory reports should not assume a single classification framework will apply in the near term; scenario-based reporting that accommodates both SEC and CFTC treatment remains the more defensible approach.
Immediate Action Checklist for Compliance and Finance Teams
Given the simultaneous pressure from the EU's August 23 effective date and the US legislative uncertainty, the following steps are worth prioritising before the end of August:
For EU and UK-regulated VASPs and financial institutions
First, run a full sanctions-list screen against the 14 newly designated entities and document the results. Second, map all counterparty and customer relationships with nexus to Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, Belarus, and Nigeria, and assess whether any fall outside your documented risk appetite. Third, review whether your transaction-monitoring rules are configured to catch indirect exposure, including flows that pass through intermediaries in those jurisdictions. Fourth, assess whether any digital asset balances or receivables linked to the designated entities require impairment assessment before your next reporting period.
For US-regulated entities
Maintain dual-classification readiness for digital assets where SEC or CFTC jurisdiction remains contested. Track the CLARITY Act's progress after the August recess and be prepared for either enactment or a further period of regulatory ambiguity extending into 2027. Ensure your crypto accounting software can produce asset-level reports that support either classification without requiring a manual rework of the underlying ledger.
Source: Elliptic
Frequently Asked Questions
When do the EU's 21st Russia sanctions package designations take effect for crypto firms?
The designations of the 14 named crypto asset service platforms take effect on August 23. From that date, EU-regulated VASPs and financial institutions are prohibited from engaging in any transaction or business activity with those platforms.
Does the new country-ban authority in the 21st package immediately prohibit dealings with any specific country?
No. The current package establishes the legal basis for a country-level ban but does not activate it against any jurisdiction. The EU has signalled that the authority is intended first as a deterrent. Any future country designation would require a separate decision, and firms would receive notice before any such ban took effect.
How should auditors treat digital asset balances held at one of the 14 designated platforms?
Once the designations are in force on August 23, assets held at or receivables owed by any of the designated entities cannot be lawfully recovered through normal channels. Under both IFRS 9 and US GAAP, this constitutes a recognised impairment indicator. Auditors should require management to quantify and assess any such exposure and to reflect it appropriately in the financial statements for the period that includes or follows the effective date.
What is the current status of the US CLARITY Act, and when might it pass?
As of early August, the CLARITY Act passed the House and the Senate Banking Committee but had not reached a full Senate floor vote. Failure to advance before the August recess, combined with the approaching November mid-terms, has led many observers to question whether it can pass in this Congress. A timeline extending into 2027 or beyond is plausible if the current session concludes without final passage.
How does the A7A5 stablecoin feature in these sanctions, and why does it matter for compliance teams?
The A7A5 is a ruble-denominated stablecoin used within the A7 financial network, which Russia has exploited for sanctions evasion. The EU, US, and UK have each imposed sanctions on entities associated with this network, and the evidence so far suggests those designations have significantly reduced A7A5 trading volumes. The addition of A7 Nigeria and A7 Africa in the 21st package shows authorities are tracking the network's geographic spread. Compliance teams should ensure their screening tools are configured to flag any direct or indirect exposure to A7-related entities and their on-chain addresses.