The 20th EU Sanctions Package: From Lists to Enforcement

Have you got a question?

One of the most far-reaching, enforcement-focused sanctions packages adopted to date, it has moved sanctions from a compliance question into a criminal-liability question. Here is what changed, what is already being enforced, and what it means for cross-border trade.

By Kai Scholz, LL.B., Partner / Rechtsanwalt – Sanctions, Export Control, International Trade • 2 June 2026

Twenty packages into the European Union’s response to Russia’s war against Ukraine, the law has reached an inflection point. The early packages were about lists – names added, goods restricted, accounts frozen. The 20th package, adopted on 23 April 2026, is about something harder: closing the routes around those lists, and making the cost of getting it wrong criminal rather than merely commercial. For any business trading between the EU and third countries – and for the banks, insurers and freight forwarders that stand behind those trades – the practical question is no longer whether a counterparty appears on a list. It is whether the entire structure of a transaction can withstand scrutiny.

This matters now because the package’s sharpest measures are no longer prospective. The bank transaction bans took effect on 14 May 2026 and the blanket crypto ban on 24 May 2026. Germany, meanwhile, has rebuilt its sanctions criminal law from the ground up. The result is one of the toughest enforcement environments the EU regime has seen, and authorities have already begun applying the new framework in ongoing investigations.

What the 20th package actually changed

Banking. The package adds 20 further Russian credit and financial institutions to the transaction ban in Annex XIV of Regulation 833/2014, bringing the total number of excluded Russian banks to 70. More significant, structurally, is that it reaches beyond Russia’s borders for the first time: four banks in Kyrgyzstan, Laos and Azerbaijan have been listed for facilitating circumvention or for connections to Russia’s SPFS financial-messaging system. Correspondent-bank and euro-denominated routing through any of these institutions is now prohibited, and pre-existing contracts may be wound down only under the regime’s narrow standard derogations.

Crypto-assets. The EU has abandoned the strategy of naming individual platforms – it openly concedes that each listed exchange simply spawned a successor – in favour of a sectoral total ban. Since 24 May 2026, transactions with any crypto-asset service provider established in Russia or Belarus are prohibited, whether or not the provider is named. The digital ruble and the stablecoins RUBx and A7A5 are caught explicitly. The digital-ruble prohibition is deliberately pre-emptive, taking effect ahead of the currency’s planned roll-out in September 2026 – the EU closing a circumvention channel before it opens.

Energy and the shadow fleet. A full ban on LNG terminal services applies from 1 January 2027, and a further 46 shadow-fleet tankers – plus, notably, a maritime insurer – have been listed. For commodities traders the most consequential change is quieter: the import ban now extends to refined products processed in third countries from Russian crude (Article 3i of Regulation 833/2014). A diesel cargo blended at a Turkish refinery is no longer “Turkish” for sanctions purposes if the underlying crude was Russian – and the burden of proving otherwise sits squarely with the importer.

The shift that defines this package: anti-circumvention

The single most important development is the first activation of Article 12f of Regulation 833/2014, the EU’s anti-circumvention instrument, against a third country. Kyrgyzstan was designated after, according to Commission data, imports of controlled EU goods and re-exports to Russia increased several-fold compared with pre-war levels. The mechanism allows the Council to extend trade restrictions to an entire jurisdiction where the risk of circumvention is “particularly serious.”

The precedent matters far beyond Kyrgyzstan. It establishes a pattern – warning signals, diplomatic pressure, then country-level listing – that the Commission will now apply to every transit hub showing the same import-export mismatch. Companies routing goods through the Caucasus, Central Asia or the Gulf should read the Kyrgyz designation as a template, not an isolated event. The relevant question for any trade lane is no longer “is my counterparty listed?” but “does the corridor I am using look like the next Article 12f candidate?”

Enforcement is now real – and personal

The legal architecture would matter little without teeth. The 20th package coincides with a step-change in national enforcement, led by Germany. Under the Sanctions Criminal Law Adaptation Act, which transposes Directive (EU) 2024/1226 and entered into force in early February 2026[1], intentional sanctions violations are now almost without exception criminal offences rather than administrative ones.

The numbers tell the story. Intentional breaches of §§ 17 and 18 of the German Foreign Trade Act (AWG) now carry imprisonment of three months to five years, rising to up to ten years in particularly serious cases – organised commission, military end-use, or goods valued above EUR 100,000. The corporate fine ceiling has risen to EUR 40 million. Reckless dual-use violations, previously not criminal at all, now are. And companies can no longer assume any practical adjustment period following a new designation: restrictions apply from the effective date.

This is not theory. In February 2026, authorities conducted simultaneous searches in Schleswig-Holstein and southern Germany. The targets were not criminal networks but machine builders, suppliers and logistics firms – ordinary exporters whose dual-use goods were re-routed to Russia through third countries. Three enforcement realities now shape every cross-border file:

The look-back. Once a correspondent bank is listed, EU account-holding banks open a forensic review of all prior payments routed through it. Historical transactions that cleared without objection become evidence overnight.
Origin runs upstream. For commodities, “origin” means the crude wellhead, not the refinery gate. A certificate of origin naming the processing country is no defence; documented feedstock tracing is.
Self-disclosure works – but only if it is prompt, complete and cooperative. A prompt and comprehensive voluntary disclosure can substantially mitigate corporate exposure; a buried problem does the opposite.

The package also, for the first time, arms EU companies offensively. Member State courts may now bar Russian parties from litigating in Russia in breach of agreed jurisdiction or arbitration clauses, backed by penalties payable to the EU company, and may award damages where a Russian party seeks to enforce a Russian judgment in a third country. Sanctions defence is no longer purely about avoiding liability – it is becoming a litigation tool.

[1]Directive (EU) 2024/1226 of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures. In Germany the relevant criminal provisions are §§ 17-18 of the Außenwirtschaftsgesetz (AWG), with administrative offences under § 19 AWG and corporate liability and fines under §§ 30 and 130 of the Gesetz über Ordnungswidrigkeiten (OWiG). The precise in-force date and provision references should be confirmed against the consolidated statutory text.

The third-country dimension: Azerbaijan as a case study

The Azerbaijani bank listing illustrates how narrowly – and how broadly – these measures cut at the same time. The listing concerns one named institution, for links to certain Russian payment infrastructure. It does not extend to the Azerbaijani banking sector, and it does not touch the Republic of Azerbaijan. The legal effect is clearly bounded: the restriction applies only to that institution from 14 May 2026, captures indirect routing through correspondent banks, and allows existing contracts to wind down under standard derogations.

Yet the practical lesson is broad. Affected euro routings must be switched, existing contracts re-papered, and correspondent chains re-verified – and every counterparty that settled through the listed institution is now exposed to a look-back. Azerbaijan has not been designated under Article 12f and remains outside any country-wide anti-circumvention measures. But with high-priority-item imports up roughly threefold since 2022, and an EU partnership track that may be among the factors slowing any formal designation, that position should not be taken for granted. Individual entities and banks are already targetable regardless of any country-level step.

What businesses should do now

None of this requires withdrawal from third-country trade. It requires building transactions that survive scrutiny. Six measures separate the companies that will weather an audit from those that will not:

Secure bank routing. Fix two to three pre-cleared correspondent banks in the contract, and screen weekly rather than once. A single listing should never freeze operations.
Treat all Russia/Belarus crypto rails as off-limits. The ban is sectoral; it bites without any named listing.
Document commodity origin at the crude level. Feedstock declarations, AIS tanker tracking and 60-day-plus proof – because the burden of proof lies with the importer.
Upgrade the contract. A “No-Russia” clause (Article 12g), automatic sanctions termination on listing, audit and post-shipment verification rights, and a carve-out from liability caps for sanctions losses are now standard, not optional.
Maintain a documented internal compliance programme. A dated, genuinely operated ICP is the single biggest mitigating factor under §§ 30/130 OWiG. “No paper” is increasingly read as intent or recklessness.
Pre-plan a self-disclosure route. Decide in advance who decides, and how fast, if a problem surfaces.

Outlook

Three trajectories are now set. The anti-circumvention instrument will be used again, and the next designations will follow the Kyrgyz pattern. National enforcement will continue to converge on the German model as the rest of the EU transposes Directive 2024/1226. And the locus of supervision is shifting: with the EU’s new Anti-Money Laundering Authority now operational in Frankfurt and direct supervision beginning in 2028, financial-crime and sanctions compliance are merging into a single, harder-edged discipline. The 20th package is best understood not as a culmination but as the moment the regime turned from drafting lists to enforcing them. Businesses should plan accordingly.

Sources (selection): Council of the EU / European Commission (20th package, 23.04.2026); Reg. (EU) 833/2014 and 269/2014; BAFA; Directive (EU) 2024/1226 and its German implementing legislation; Authority for Anti-Money Laundering (AMLA). Firm analyses incl. Skadden, Morgan Lewis, Squire Patton Boggs, Elliptic/TRM (crypto). Quantitative figures are drawn from Commission and specialist reporting and should be verified against primary sources before republication.

This article is for general information only and does not constitute legal advice in any individual case. For tailored guidance, contact Oracle Law Global.