EU and UK Russia Sanctions – Escalation in Scope and Enforcement

Recent measures significantly broaden the reach of EU and UK sanctions and heighten enforcement risk for businesses with nexus to either jurisdiction. Key developments include:

• EU 21st Sanctions Package. The largest wave of sanctions since 2022 (218 in total: 48 individuals and 170 entities) extends the “shadow-fleet” regime to support services (bunkering, ship-to-ship transfers, and ports and refineries), expands financial-sector restrictions to additional Russian and third-country banks, and introduces, for the first time, the possibility of a blanket third-country ban on crypto-asset services.
• UK Enforcement Intensifies. OFSI’s (the Office of Financial Sanctions Implementation) first-ever penalty for a circumvention offense signals a tougher enforcement posture.
• Enforcement Remains Uneven Across the EU. Directive (EU) 2024/1226 establishes minimum rules on criminal offenses and penalties for EU sanctions breaches, but national implementation continues to differ in scope, penalty levels, corporate-liability rules and enforcement practice. Companies should therefore assess exposure in each relevant Member State.
• EU Courts Clarify Key Sanctions Concepts. Recent judgments have: (i) confirmed that asset-freezing measures may restrict the exercise of governance and voting rights; (ii) upheld a broad approach to designation criteria based on support for sanctioned governments; and (iii) interpreted anti-circumvention rules expansively.

EU 21st Sanctions Package (July 2026)

On July 23, 2026, the European Union (the “EU”) adopted its 21st Russia sanctions package (the “Package”),[1] targeting both Russian and non-Russian entities across the energy, financial services (including crypto services), and mining sectors. This Package represents the largest round of designations in four years, totaling 218 designations (48 individuals and 170 entities).

Securing the required unanimous Member State approval proved difficult, with certain Member States asserting competing national interests during negotiations. As a result, the final Package is narrower in scope than the EU Commission’s early-June proposal.

The Package designates 218 additional individuals and entities, the biggest round of individual designations since the 2022 invasion of Ukraine. The key measures of the Package are set out below:

• Energy. The Package suspends the oil price cap adjustment mechanism until July 15, 2027. The “oil price cap” is a mechanism that limits the price at which Russian crude oil can be purchased when transported using Western services – it is designed to reduce Russia’s oil revenues while keeping oil flowing to global markets. The Package also designates 41 additional “shadow-fleet” vessels (ships used to evade the price cap), bringing the total to 692. For the first time, the EU also targets vessels providing support services to the shadow fleet, including those providing bunkering and ship-to-ship transfers, as well as ports and refineries involved in Russian oil trade or processing. Additionally, the Package introduces transaction bans on two Russian ports (Olya and Vysotsk) and four airports, and designates the Kulevi refinery in Georgia for processing Russian crude oil. While restricting sales of LNG (Liquefied Natural Gas) tankers to Russia, the Package permits certain transport of Russian LNG to third countries under contracts entered into before February 24, 2022 (the date of Russia’s full-scale invasion of Ukraine) for a renewable one-year period to mitigate adverse consequences for the energy supply of certain countries.
• Financial and Crypto Services. The Package expands transaction bans (prohibitions on conducting financial dealings) to additional banks and financial institutions, including 33 Russian credit institutions and four third-country banks (one in Mongolia, one in Kyrgyzstan, and two Indian branches of Russian banks). It also targets cryptocurrency platforms based in Georgia, Panama, El Salvador, the UAE, the Marshall Islands, and Belarus for facilitating sanctions circumvention. For the first time, the EU introduces the possibility of a full third-country ban on cryptocurrency services. The EU could therefore prohibit any transaction between EU operators and crypto providers in specified countries (no country has been targeted by this measure yet). Businesses using cryptocurrency services should conduct enhanced due diligence on the jurisdictions where their providers are based.
• Trade. The Package introduces new export restrictions on metals and alloys used in aerospace and defense (including nickel powders, beryllium powders, and self-adhesive films used in aerospace and defense sectors); and drone ground-support, jamming, and launch systems. It also imposes new import bans on copper ores, nickel ores, lead ores, precious-metals ores, unwrought zinc, alkaline-earth metals, certain inorganic chemicals (zinc oxides and chromium oxides), tall oil, glassware, imitation pearls, and car parts.
• Anti-Circumvention. The Package lists 51 entities for supporting Russia’s military-industrial complex or enabling the circumvention of EU sanctions. Of these, 24 are established in Russia and 27 are in third countries: 14 in China (including four in Hong Kong), four in Türkiye, three in Kyrgyzstan, two in India, two in Kazakhstan, and two in the UAE. The fact that more than half of the listed entities are in third countries – not Russia – signals that circumvention networks now span multiple jurisdictions; companies must extend due diligence well beyond Russia itself.
• Legal Protection of EU Operators. The Package introduces additional legal protections for EU operators against abusive lawsuits from Russians in retaliation for EU sanctions. First, the EU extends the possibility for EU firms to sue, in the courts of a Member State, their non-Russian contractual parties if these non-Russian parties sue the EU firm outside the EU for having suspended or terminated contracts to comply with sanctions. Second, the Package gives courts of Member States the authority to order “anti-enforcement injunctions” – court orders designed to deter the enforcement in non-EU countries of unlawful judgments or orders issued by Russian courts. Third, it requires Member States not to recognize or enforce decisions by Russian courts or authorities when those decisions are connected to sanctions. Businesses operating in sectors affected by sanctions should be aware of these new remedies.
• Belarus Alignment. The Package mirrors trade and, where necessary, certain financial measures and legal protection provisions in the Belarus sanctions regime, per previous practice. Given this alignment, businesses should subject Belarus-connected transactions to the same due diligence and compliance scrutiny applied to Russia-connected transactions.

EU “Mini” Package and 12-Month Sectoral Renewal (June 2026)

• Mini Package (June 15, 2026). The Council adopted a rolling “mini” package[2] adding new asset-freeze designations spanning Russia, Belarus, Azerbaijan, China, Hong Kong, Liberia, Türkiye, and the UAE. The mini-package targets 34 individuals and 47 entities, including drone manufacturers and suppliers, shadow-fleet ecosystem entities, propagandists, FIMI (Foreign Information Manipulation and Interference) actors, and individuals linked to the Navalny poisoning. The sanctions on the annexation of Crimea and Sevastopol were renewed until June 23, 2027.

Implementation of Directive (EU) 2024/1226

Directive (EU) 2024/1226 (the “Directive”) establishes minimum rules concerning the definition of criminal offenses and penalties for violations of EU sanctions. The Directive sets minimum standards for EU Member States, including: (i) criminal liability for intentional violations of asset-freeze, travel-ban, trade, and financial-services prohibitions, as well as circumvention and failure to report; (ii) criminal liability for serious negligence involving dual-use goods or items on the Common Military List; (iii) for natural persons, maximum imprisonment terms of at least five years for the most serious offenses (at least three years for travel-ban violations, and at least one year for reporting failures); and (iv) for legal persons, maximum fines of at least 5% of total worldwide turnover or EUR 40 million for the most serious offenses (1% or EUR 8 million for reporting failures). EU Member States were required to transpose the Directive into national law by May 20, 2025. On July 24, 2025, the European Commission opened infringement proceedings against 18 Member States that had failed to notify measures fully transposing the Directive.

Since then, progress has varied significantly across the EU, in particular:

• Germany. On January 15, 2026, the Bundestag adopted legislation implementing the Directive (published February 5, 2026), amending AWG (Foreign Trade Act) §§18–19. This legislation broadens the range of sanctions violations subject to criminal liability, increases the maximum corporate fine from EUR 10 million to EUR 40 million, and removes the previous two-day grace period following the publication of new sanctions listings. Businesses operating in Germany must update screening systems immediately when new designations are published – there is no longer a buffer period.
• France. A draft transposition bill submitted in March 2026 would establish a dedicated regime for EU sanctions offenses. For legal persons, the bill would raise corporate penalties to 5% of worldwide turnover or, where turnover-based calculation is not feasible, EUR 40 million. These maximum penalty levels align with the minimum thresholds prescribed by the Directive for the most serious offenses. Businesses with significant French operations should accordingly prepare for materially heightened penalty exposure.

Material differences remain between national regimes. Businesses operating across several Member States should not assume that a single EU-wide compliance standard will address all local exposure. Instead, they should map the applicable national measures and ensure they meet the strictest requirements applicable to their operations.

UK Sanctions Developments

• New Designations (June 16, 2026). The FCDO (Foreign, Commonwealth and Development Office) designated 70 new targets (11 individuals, 32 entities, 27 ships) under the Russia (Sanctions) (EU Exit) Regulations 2019. The designations include suspected GRU (Russian military intelligence) front companies, dual-use technology procurement networks, third-country entities from China, Thailand, and Türkiye, Russian financial institutions, and LNG/oil transport vessels.
• Record OFSI Penalty for Sanctions Circumvention (May 26, 2026). OFSI imposed a £1,000,920.59 penalty on Sabre Global Technologies Limited (SGTL)[3] – the largest UK Russia-related sanctions penalty since 2022 and OFSI’s first-ever penalty for a circumvention offense. SGTL continued providing GDS (Global Distribution System) services to a designated Russian airline and explored alternative payment routes. This case confirms that “economic resources” (a key legal concept in UK sanctions law) include digital services such as software and platform access. OFSI’s penalty notice emphasizes that “services that can be exchanged, directly or indirectly, for funds, goods, or services may constitute an economic resource even if they are intangible or provided digitally.” The case also underscores the importance of senior management oversight (SGTL’s deficient sanctions compliance framework during the breach period being an aggravating factor in OFSI’s case) and prompt voluntary disclosure when potential breaches are identified. This builds on OFSI’s new settlement scheme, introduced in February 2026.

EU Courts Reshape Sanctions Enforcement

The EU Courts have recently clarified key concepts under EU sanctions laws. The key developments are listed below:

• Beloglazov v. Council (T-492/24, July 15, 2026). The EU General Court upheld the designation of Mr. Beloglazov for facilitating sanctions circumvention. The judgment confirms that “facilitating circumvention” means making easier an operation whose “object or effect” is to circumvent sanctions, and that it is sufficient to show an objective intention to evade an asset freeze – the scheme does not need to succeed. The Court also rejected the argument that a transaction between non-EU persons outside the EU falls outside the scope of EU sanctions: even where the transaction is structured entirely outside the EU by non-EU parties, it may fall within the anti-circumvention prohibition if the underlying assets are themselves subject to an EU asset freeze (in this case, shares in an Austrian company frozen in an Austrian bank). Businesses should be aware that structuring arrangements to avoid sanctions, even if unsuccessful, may still constitute a breach.
• NSD v. Council (C-801/24 P, June 11, 2026). The Court of Justice dismissed the Russian National Settlement Depository’s appeal and confirmed a broad reading of “support” for the Russian Government. The Court held that “support” captures any assistance that, by its qualitative or quantitative importance, provides resources or facilities to the regime.
• SBK Art (C-465/24) and EM System (C-84/24), March 12, 2026. In SBK Art, the Court held that freezing funds prevents, “absolutely and unconditionally,” a designated person from exercising voting or meeting-attendance rights attached to shares or depositary receipts – treating such rights as inherent to the underlying funds. In EM System, the Court held that funds of a company in which a designated person holds a 50% or greater shareholding must be presumed to be “held or controlled” by that person and therefore frozen. The Court reasoned that a 50% shareholding enables the holder to dictate or prevent certain decisions within the company, or at least ensure the company’s affairs are conducted in accordance with their wishes.

Implications for Businesses

Recent developments materially expand compliance and operational risk for multinationals with EU or UK nexus and consolidate several enforcement trends warranting prompt action.

• First, the asset-freeze perimeter continues to widen well beyond Russia, with third-country designations now spanning China, Türkiye, the UAE, Hong Kong, Liberia, and Central Asia. The expanded shadow-fleet regime draws in maritime services, bunkering, ports, and refineries.
• Second, OFSI’s record Sabre penalty confirms that “economic resources” include digital services such as software and platform access. OFSI’s penalty notice provides important compliance guidance: firms “should not assume that software, data services, or digital tools fall outside the scope of financial sanctions” and must “undertake careful assessment of all products and services they offer to ensure that they are not inadvertently providing economic resources to sanctioned persons.” The penalty notice also warns that attempts to test, reroute, restructure, or otherwise manipulate payment pathways to avoid UK sanctions may constitute circumvention. This signals a tougher UK enforcement posture and underscores the importance of maintaining robust sanctions oversight and compliance programs.
• Third, national transposition of the Directive is producing heavier criminal penalties – including liability for serious negligence and corporate fines of up to EUR 40 million or 5% of worldwide turnover for the most serious offenses.
• Fourth, recent EU Court judgments have broadened the scope of asset-freeze obligations – confirming that voting and governance rights attached to frozen shares are themselves frozen – and expansively interpreted the anti-circumvention prohibition.

In light of these developments, businesses should: (i) refresh sanctions risk assessments to reflect expanded sectoral and geographic scope; (ii) extend due diligence through ownership chains and third-country networks; (iii) ensure compliance programs address the broad interpretation of anti-circumvention rules; and (iv) align corporate governance protocols with evolving EU and UK enforcement standards.