Russia Sanctions: EU's 20th Package and What It Means for Crypto

On April 23, 2026, the Council of the European Union adopted the 20th package of sanctions against Russia, described as the largest measures in two years. For crypto asset businesses and compliance officers, one question matters: does your AML programme cover what's now prohibited before it becomes a regulatory problem?

This article covers what the 20th Russia sanctions package changed, why the Garantex–Grinex–A7A5 story is still unfinished, and what your sanctions screening program needs to cover right now to stay compliant.

The EU's 20th Package of Russia Sanctions, Explained

The 20th package of EU sanctions against Russia was adopted on April 23, 2026. The crypto-specific measures are effective from May 24, 2026, giving businesses roughly one month to update their screening and onboarding processes.

The most significant change for the crypto sector: EU persons – including EU-regulated crypto asset service providers (CASPs) – are now prohibited from engaging in transactions with any crypto-asset service provider established in Russia, whether or not that provider has been individually designated.

Every previous package targeted named platforms. This one targets the category. In practice, it means a newly launched Russian exchange sits in the same position as a sanctioned one, the moment it opens.

Here is what the new sanctions on Russia specifically prohibit in the crypto space:

• Transactions with any crypto-asset service provider established in Russia, including exchanges, custodians, transfer providers, and platforms established in Russia that enable the transfer or exchange of crypto-assets.

• Engaging in transactions involving prohibited crypto-assets: RUBx and the digital rouble join A7A5 on the EU's prohibited list (Annex LIII). A7A5 was already prohibited under the 19th package. All three are now off-limits to EU persons from May 24.

• Transactions with payment agents that settle Russian cross-border trade through netting or mirror account schemes, where debts cancel on paper and no funds physically cross the Russian border. For VASPs, this matters because the netting layer and the on-chain settlement layer serve the same evasion purpose — the EU targeted both deliberately.

The 20th package also marks the first activation of the EU's anti-circumvention tool — a mechanism introduced with the 11th sanctions package in 2023. The tool allows the EU to impose targeted trade restrictions involving specified goods and jurisdictions identified as presenting systematic circumvention risks.

On the financial side, the package also includes:

• Transaction bans on 20 Russian banks
• Restrictions on four third-country financial institutions connected to Russia's SPFS — the domestic messaging system Russia uses as a SWIFT alternative
• 120 individual designations, the largest single-package count in two years.

To understand how the 20th package fits into the broader sanctions picture and why crypto has become a central enforcement focus, here is how the measures have escalated since 2022.

The Full List of Sanctions Against Russia: A Timeline of Crypto-Specific Measures

Russia is now the most sanctioned country in the world. Over 40 countries have imposed some form of restrictive measures, including all G7 members. Understanding how many sanctions are on Russia — and how the crypto-specific measures have escalated — matters because the compliance perimeter is shaped by every jurisdiction your business operates in.

Here is the Russia sanctions timeline with a focus on crypto: 

The Garantex–Grinex–A7A5 Chain: How Russia Crypto Sanctions Circumvention Works

To understand why the EU moved from entity-level to sector-level designations, it's necessary to trace the evasion architecture that made individual listings ineffective. This is also the architecture the 20th package was specifically built to close.

Here is how the chain unfolded.

Garantex — the exchange that wouldn't stay sanctioned

Garantex was first sanctioned by OFAC in April 2022 for processing funds tied to darknet markets and ransomware gangs. It kept operating anyway — for nearly three years.

In March 2025, US authorities seized Garantex's USDT holdings in a coordinated international operation. The exchange was shut down. But shutting down a platform, it turned out, was only half the problem.

Grinex — the successor that was ready

Within weeks of the Garantex seizure, funds began flowing to a new exchange: Grinex.

Grinex wasn't a coincidence. It emerged directly from Garantex's user base and infrastructure. The migration was made frictionless by a single instrument: A7A5, a ruble-backed stablecoin that let customers move their liquidity to the successor platform without touching the global banking system. No wire transfers. No monitored corridors. No alerts.

The mechanism worked on three principles:

• A7A5 bridged liquidity between the shuttered exchange and its replacement
• No dollar-denominated international transfer was required
• Licensed centralized exchanges remained the primary liquidity venues throughout.

Grinex halts but the architecture doesn't

In April 2026, Grinex halted trading following a reported hack. Global Ledger on-chain analysis found that approximately $19.38 million was drained from Grinex's customer deposit wallets on the TRON network in a single coordinated operation.

The hack matters. But the bigger compliance story is what the on-chain record shows about the months leading up to it.

From its launch over a year ago until the hack (and subsequent suspension), Grinex processed $16.54 billion worth of USDT and A7A5:

• $7.29 billion before OFAC sanctions (March 6 – August 14, 2025)
• $9.25 billion after sanctions (August 15, 2025 – April 15, 2026)

Sanctions cut monthly volumes — but did not stop the flows. And the structure of what remained is what should concern compliance teams most: after designation, Grinex became more reliant on licensed, regulated platforms to move money, not less.

According to Global Ledger's investigation, $1.75 billion USDT was sent by Grinex to low- and medium-risk exchanges, including major licensed CEXs. 

Russia Sanctions Screening: What Your Compliance Program Must Cover Now

The 20th package changes the practical scope of Russia sanctions compliance for any crypto business within the EU. Start with these four questions — they will define the next steps in your compliance workflow.

Here are four key questions to ask:

1) Is this counterparty established in Russia?

The sector-level ban means any CASP with its operational nexus, legal registration, or core infrastructure in Russia is now off-limits to EU persons — whether or not it's been individually designated. Identifying this requires more than a name match.

2) Does this transaction involve a prohibited crypto asset?

Three state-linked instruments are now subject to transaction prohibitions under EU law: A7A5 (since 25 November 2025), RUBx (from 24 May 2026), and the digital ruble (from 24 May 2026).

3) Does this flow use a netting or set-off settlement pattern?

The payment agent prohibition targets a mechanism, not just specific entities. Mirror accounts and netting schemes — where debts cancel across borders without funds actually crossing them — are exactly how Russian trade finance has been keeping flows off-screen.

4) How deep is the indirect exposure?

Grinex-type exposure doesn't always appear directly. It can sit two, three, or five hops away in a transaction chain. Under OFAC rules, strict liability applies: processing sanctioned funds unknowingly is not a defense but a potential violation.

EU Russia Sanctions: What Will Change for Crypto Businesses

The EU's 20th package coming into force doesn't mean your business has done anything wrong. It means the perimeter has shifted — and exposure that didn't exist yesterday may exist today, sometimes several hops away from any decision you made. The goal isn't to alarm, but to help you find it before a regulator does.

The changes are layered, but manageable if you approach them systematically. Here is a practical checklist:

Update your onboarding and counterparty due diligence

• Add jurisdiction of establishment as a mandatory screening field for CASP counterparties. A Russian-established exchange is now prohibited regardless of whether it appears on a named list.
• Apply enhanced due diligence to any counterparty with operations, ownership links, or a significant user base in Russia or in high-risk third-country corridors where Russian flows have been documented.

Entity Database feature in the Global Ledger platform. Source: Global Ledger

Expand your prohibited asset screening

• Add RUBx and the digital ruble to your blocked asset lists before May 24.
• Confirm A7A5 remains on your blocked list — it has been prohibited under EU law since November 2025.
• Monitor for new stablecoin instruments that may emerge as successors.

Review your transaction monitoring for netting patterns

• Identify any settlement relationships that involve netting or set-off arrangements connected to Russian-origin trade.
• Check whether any payment intermediaries in your flow match the mechanism described in the 20th package, even if they are not among the four named operators. The prohibition is mechanism-based — new names will follow.

Audit your indirect exposure

• Run a counterparty exposure review across your top-tier exchange relationships. Global Ledger data shows licensed platforms processed approximately $13 billion in sanctioned funds including Russian-origin flows. This kind of exposure is often invisible through standard screening — which is exactly why it's worth checking proactively.
• Consider regularly generating detailed entity exposure reports for counterparties operating in Central Asian, Caucasus, and Gulf corridors where Russian liquidity has been documented as concentrating.

Entity Exposure Report feature in the Global Ledger platform. Source: Global Ledger

Document your compliance decisions

• OFAC's enforcement approach recognizes good-faith compliance efforts. Keeping clear records of your screening methodology, decision logs, and due diligence steps taken on Russia-adjacent counterparties shows that your program is working as it should — and in a strict-liability environment, that documentation matters.

Conclusion

The EU's 20th sanctions package does not eliminate Russia sanctions evasion. Instead, it reflects a shift from naming individual platforms to banning entire categories, blocking state-designed instruments before they scale, and targeting the settlement mechanisms. It signals that enforcement is finally catching up to the evasion architecture.

What the Garantex–Grinex–A7A5 chain illustrates is how quickly infrastructure can be reconstituted after enforcement actions, allowing illicit activity to continue under new branding and technical layers.

Effective sanctions compliance now requires continuous visibility into counterparty relationships, indirect exposure, and asset-level risk across evolving networks.

Global Ledger's sanctions screening solution provides compliance teams with the tools to identify Russia-linked exposure before it becomes a regulatory issue. It allows cross-chain transaction tracing in visual format, detailed entity exposure reports with transaction risk breakdown, and real-time monitoring across all major blockchains covering 98% of total market cap.  

FAQ