21st EU Sanctions Package

S+P Unternehmerforum GmbH mit Sitz in München ist ein führender Anbieter für praxisnahe, rollenbasierte Weiterbildung im deutschsprachigen Raum. Seit der Gründung im Jahr 2004 unterstützt S+P Fach- und Führungskräfte sowie C-Level-Manager:innen aus der Finanzwirtschaft und Industrie dabei, sich gezielt weiterzuentwickeln und regulatorisch sowie strategisch sicher zu handeln.

S+P bietet ein breites Portfolio an Online-Seminaren, E-Learnings, Zertifikatslehrgängen und Executive Education Programmen. Themenschwerpunkte sind unter anderem Compliance, Geldwäscheprävention, Risikomanagement, Projektmanagement, Finance, Leadership und digitale Transformation.

Ein Alleinstellungsmerkmal ist die S+P Tool Box – mit sofort einsetzbaren Arbeitshilfen wie Leitfäden, Checklisten, Gantt-Plänen und Risikochecks. Zusätzlich steht allen Teilnehmer:innen die digitale Lernplattform S+P Lounge zur Verfügung.

Mit dem Zertifikat S+P Certified und dem digitalen Karriere-Badge dokumentieren Absolvent:innen ihre Kompetenz sichtbar – für Arbeitgeber, Kunden und Netzwerke.

Teilnehmer bewerten S+P Seminare auf ProvenExpert mit 4,65 von 5 Sternen. Für jedes gebuchte Seminar pflanzt S+P im Rahmen des ESG-Projekts „Dein Seminar, dein Baum, deine Zukunft“ einen Baum in Deutschland.

Mehr Informationen unter: www.sp-unternehmerforum.de

I. Why this contribution is of central importance

The 21st EU sanctions package further expanded restrictive measures against Russia and Belarus. The new regulations primarily affect financial transactions, dealings with listed persons and organizations, the movement of goods, certain services, and business relationships with selected actors in third countries.

The relevant EU regulations generally apply directly in the member states. Companies must therefore check whether their customers, suppliers, payment methods, goods, services, or other business partners are affected by the new regulations. In doing so, they must consider not only the prohibited activities but also transitional periods, exceptions, and regulatory approval options.

For management and compliance officers, it is crucial to review the affected processes promptly, adjust necessary controls, and document the measures taken in a traceable manner. Depending on the specific circumstances, violations can have criminal, administrative, civil, and economic consequences.

II. Overview of upcoming deadlines
1.) Immediately applicable measures
A significant portion of the new measures has been in effect since the date specified in the respective legal acts. Companies should therefore promptly review which changes are relevant to their business relationships and processes.
New listings and freezing measures: Newly listed persons, organizations, and entities must be included in existing screening processes. If funds or economic resources are identified that belong to, are held by, or are controlled by a listed person or organization, the relevant freezing and availability prohibitions must be observed.
Export and import restrictions: The extended product-related prohibitions and restrictions must be taken into account in export control, procurement, and logistics. Before concluding or executing a transaction, it must be verified whether the specific product, the country of origin or destination, the recipient, the intended use, or any person involved is subject to a prohibition.

Whether a business transaction is prohibited depends on the specific circumstances of the case, as well as any applicable transitional provisions, existing contract clauses, exceptions, or authorization options. A blanket assessment based solely on the country’s location is therefore insufficient.

2.) Transitional period of 6 months (entry into force around the end of January 2027)
Transaction ban for Georgian refinery: The specific ban on transactions with the refinery in Kulevi, Georgia, which processes Russian oil, will explicitly not come into effect for another six months. Companies are given a limited window of time to legally wind up existing supply and payment arrangements and terminate contracts.
3.) Deadline: July 15, 2027
Oil price cap: The automatic adjustment of the price cap for Russian oil will be suspended until July 15, 2027, in order to keep Russia’s revenues consistently capped despite the market situation (closure of the Strait of Hormuz).
Interim review: A formal interim review is scheduled for this timeframe to assess whether the measure will be maintained in its current form.
4.) Timeframe still open (decision subject to the Council)
Visa ban for combatants: While the package creates the legal basis for a comprehensive entry and visa ban for members of the Russian armed forces and proxy groups, the Council still needs to specify in a separate decision when this ban will come into force. Until then, there will be no immediate change to the issuing practices.
III. Obligations for Compliance, C-Level and other stakeholders

The 21st EU sanctions package imposes direct legal obligations on companies. These are divided into active duties (doing) and strict prohibitions (omissions).

1.) Personal and corporate sanctions
Legal starting point: According to Article 2 of Regulation (EU) No 269/2014, funds and economic resources belonging to, held by, or controlled by the persons, organisations or bodies listed in Annex I must be frozen. Furthermore, in principle, funds or economic resources may not be made available to them, either directly or indirectly, or benefit from them.
Required checks: Companies should promptly integrate the updated listings into their screening systems and re-examine their relevant inventory data. The screening should not be limited solely to the name of the direct contractual partner. Where necessary, ownership and control structures, as well as indirect supply, should also be investigated.
Handling potential matches: A technical or name-related match does not automatically constitute a confirmed sanction case. Potential matches must be verified using additional identifying characteristics. Until the matter is clarified, it may be necessary to temporarily suspend the affected transaction. If a confirmed sanction case exists, the applicable freezing, provision, and reporting obligations must be fulfilled. Which authority is responsible and within what timeframe a report must be submitted depends on the specific circumstances and the relevant regulations. In Germany, the jurisdiction of the Deutsche Bundesbank (German Federal Bank) must be examined, particularly in the case of financial sanctions.

Exceptions and authorizations:

The regulations provide for narrowly defined exceptions or official authorization options for certain situations. Before granting approval, the specific legal basis for the exception or authorization must be documented.

2. Restrictions in the financial and crypto sectors

Normative basis: Art. 5a of Regulation (EU) No 833/2014 (in conjunction with amending Regulation (EU) 2026/1848)

Specific omissions:
Transaction ban: A complete ban on financial transactions with the 33 newly listed Russian financial institutions as well as sanctioned banks from third countries (e.g. Kyrgyzstan).
Ban on crypto services: Cessation of all transactions and business relationships with the 14 newly listed crypto platforms (including those in the UAE, Georgia, Panama, Marshall Islands, Belarus).
Concrete action:
Payment blocking: Adapting payment systems to automatically block transfers to or from the affected institutions and crypto providers.
3.) Goods-related export and export bans (Trade Compliance)

Regulatory framework: Articles 2, 2a, 3, 3b of Regulation (EU) No 833/2014 (in conjunction with amending Regulation (EU) 2026/1848) and, by analogy, Regulation (EC) No 765/2006 (in conjunction with amending Regulation (EU) 2026/1846) for Belarus

Specific omissions:
Export ban: No sale, delivery, export, or transit of the newly listed goods to Russia or Belarus. This includes, among other things:
Special metals/alloys (e.g. nickel powder, beryllium powder)
Aerospace components (e.g., special adhesive films)
Drone and UAV equipment (e.g. jammers, servo motors, flight termination systems)
Concrete action:
Master data adjustment: Updating customs tariff and goods master data checks in the ERP system (e.g. SAP GTS) to stop deliveries of the newly recorded goods categories to Russian/Belarusian recipients or end users.
4.) Import and import restrictions
Legal basis: Article 3i of Regulation (EU) No 833/2014 restricts the purchase, import and movement of certain goods listed in the annexes if they originate in or are exported from Russia. The decisive factor is not solely the general description of the goods, but in particular the specific classification of the product according to the CN codes listed in the annexes.
Required measures: Companies should check whether their procured items are covered by newly added or amended commodity codes. In addition to the customs tariff number, the origin of the goods, the country of export, the supply chain, and the contract date must be taken into account. Affected orders or contracts should first be legally assessed and, if necessary, temporarily suspended. Automatic termination of all contracts is not always necessary or legally permissible. Before terminating a contract, it is particularly important to check whether a transitional arrangement, a legacy clause, an exemption, or a regulatory approval applies.

The results of the audit and the decision regarding continuation, suspension or termination of the business should be documented in a comprehensible manner.

5.) Contract drafting and prevention of sanction evasion
No-Russia Clause: Article 12g of Regulation (EU) No 833/2014 obliges EU exporters in certain cases to contractually prohibit the re-export to Russia and the re-export for use in Russia when selling, supplying, transferring, or exporting certain goods and technologies to a third country. This obligation does not apply across the board to all products, customers, and third-country transactions. Before including such a clause, it is therefore essential to verify whether the specific transaction falls within the material, personal, and geographical scope of the regulation. If Article 12g is applicable, the contractual agreement must provide for appropriate remedies in the event of a breach. The specific details may include, among other things, termination rights, supply stoppages, information obligations, or contractual penalties. They should be commensurate with the risk and significance of the transaction in question.
Circumvention prohibited: Actions that knowingly and intentionally circumvent the prohibitions of the regulation are also prohibited. Increased vigilance is particularly necessary when supply chains, end users, payment flows, or company structures appear economically incomprehensible.

Any irregularities should be documented, escalated internally, and legally assessed before the transaction is carried out. However, a connection to a third country alone does not prove that sanctions have been circumvented.

6.) Transport, Energy & Infrastructure

Norm: Art. 3n and others of Regulation (EU) No. 833/2014 (in conjunction with amended Regulation (EU) 2026/1848)

Specific omissions:
Service ban: Prohibition on the provision of services (e.g. bunkering services, crew placement, insurance) for the 41 newly listed ships of the "shadow fleet".
Port and airport closure: Prohibition of all business contacts and logistics transactions concerning the 2 sanctioned Russian ports and 4 airports.
Concrete action:
Reporting obligation for sales: Obligation to actively report the sale of LNG tankers to supervisory authorities before the transaction is completed.
IV. Pain Points and Possible Consequences of Sanction Violations

Violations of directly applicable EU sanctions regulations can have criminal or administrative consequences in Germany, depending on the specific offense and the degree of culpability. The relevant provisions are, in particular, the criminal and administrative penalty provisions of the Foreign Trade and Payments Act and the general regulations of the Administrative Offenses Act.

In addition to the individual acting on the grounds, a fine can also be imposed on the company under the applicable legal conditions. Furthermore, regulatory measures, civil claims, confiscation of economic benefits, and significant reputational and business risks may also be considered.

Whether and to what extent managing directors, employees, or the company are liable must always be assessed based on the specific circumstances. Decisive factors include the violated regulation, the responsibility of the person acting, the existing control system, and whether the action was intentional, reckless, or negligent.

1.) Criminal law risks
Certain intentional violations of directly applicable economic sanctions of the European Union may be punishable under Section 18 of the Foreign Trade and Payments Act (AWG). The basic offense carries a prison sentence of three months to five years. The law provides for more severe penalties for particularly serious or aggravated cases.
Personal criminal liability requires that the person in question fulfills the legal elements of the offense and that the necessary culpability can be proven. The mere position of managing director, board member, compliance officer, or clerk does not, in itself, establish criminal liability.
Those particularly relevant are individuals who initiate, authorize, carry out, or knowingly support a prohibited transaction. The assessment must take into account the specific division of responsibilities, existing knowledge, internal escalations, and documented control measures.
2.) Fines, breaches of supervisory duties and confiscation
In addition to criminal offenses, Section 19 of the Foreign Trade and Payments Act (AWG) contains provisions for fines for certain intentional or negligent violations. The maximum fine depends on the specific regulation violated and the applicable legal provision.
Under the conditions of Section 30 of the Administrative Offenses Act (OWiG), a fine may also be imposed on a legal person or association of persons if a manager commits a criminal offense or administrative offense and thereby violates the company’s obligations or has been or was intended to be enriched.
A separate administrative offense may also exist under Section 130 of the German Administrative Offenses Act (OWiG) if a manager fails to take necessary supervisory measures, thereby enabling or significantly facilitating business-related criminal offenses or administrative offenses. However, this does not mean that every company is required to use specific sanctions monitoring software. The scope and design of the necessary controls depend in particular on the company’s size, business model, products, countries of operation, customer structure, and the specific sanctions risk.
In addition, confiscation of proceeds of crime may be considered. The subject matter and scope of confiscation are to be determined based on the relevant legal provisions and the specific economic benefit. The entire revenue from a transaction is not automatically confiscated in every case.
3.) Civil liability of corporate bodies
Managing directors and board members must comply with all applicable legal due diligence obligations in their activities. Depending on the size, business activities, and risk profile of the company, this may also include establishing appropriate organizational and control measures to ensure compliance with sanctions.
If a company suffers damage due to a culpable breach of duty by a member of its governing body, claims for compensation may be considered under the conditions of Section 93 of the German Stock Corporation Act (AktG) or Section 43 of the German Limited Liability Companies Act (GmbHG). Whether personal liability actually exists depends in particular on the specific duty, the division of responsibilities, the degree of culpability, and the demonstrable damage.
Whether D&O insurance provides coverage in a specific case depends on the respective policy terms and conditions, any exclusions, and the circumstances of the individual case. A blanket statement that coverage is voided in every case of gross negligence is not possible.
4.) Relationship to the Money Laundering Act
Sanctions-related freezing and reporting obligations are distinct from obligations under the Money Laundering Act. A sanctions list hit does not automatically trigger a suspicious activity reporting obligation under Section 43 of the Money Laundering Act.
A suspicious activity report must be submitted to the Financial Intelligence Unit by obliged entities under the Money Laundering Act (GwG) if there are facts that give rise to a reportable suspicion within the meaning of Section 43 of the GwG. Whether this applies in the case of sanctions must be examined based on the specific circumstances. A separate report to the competent authority regarding sanctions may be required regardless.
Anyone who conceals assets from an unlawful act, disguises their origin, or fulfills other elements of the offense under Section 261 of the German Criminal Code (StGB) can be prosecuted for money laundering. However, mere participation in a transaction involving sanctions does not automatically constitute money laundering.

Companies should therefore have separate but coordinated processes for sanctions reporting, internal escalations and money laundering suspicion reports.

5.) Reputational and business risks
In addition to legal sanctions, violations or significant control deficiencies can have economic consequences. These include, for example, delayed payments, stopped deliveries, additional audits by banks and business partners, contract terminations, loss of financing options, or reputational damage.
Individuals and companies involved in sanctions circumvention or providing material support to Russia may themselves be subject to restrictive measures under the conditions of the relevant legal acts. Such a listing can significantly restrict their economic activity.
Banks and other business partners can also review, restrict, or terminate business relationships based on their own risk assessment. However, account closure does not automatically occur for every identified compliance deficiency.
V. Concrete solutions

To avert massive liability and reputational risks, management must act immediately. Since the 21st sanctions package came into effect just a few days ago (on July 23, 2026), the following measures cannot be postponed.

Here are the specific recommendations for action, categorized by urgency and area of expertise:

1.) Short-term measures

Focus: Screening, payment transactions and master data

Update sanctions lists: Companies should ensure that their screening systems fully incorporate the current EU sanctions lists. For external service providers, it is essential to verify when the updated data was made available for production use.
Conduct risk-based re-screening: Relevant existing data should be compared against the updated lists. The scope of the re-screening depends on the affected business processes and the quality of the available data. In addition to customers and suppliers, beneficial owners, payees, banks, intermediaries, and other business partners may be particularly relevant.
Check for potential matches: Potential matches must be verified using additional identifying characteristics. Affected payments or deliveries should be held until the review is complete, unless a relevant risk of sanctions can be ruled out.
Handling confirmed matches: In the event of a confirmed match, the applicable freezing, provision, and reporting obligations must be implemented. The competent authority must be determined before a report is filed. In cases involving financial sanctions in Germany, the jurisdiction of the Deutsche Bundesbank (German Federal Bank) must be taken into account.
Document decisions: Hit checks, legal assessments, approvals, blocking and reporting should be documented in a traceable manner.
2.) Trade Compliance & Supply Chain (Short term)

Focus: Export control, purchasing & logistics

Set up ERP blocks for new goods: The new customs tariff numbers for export bans (e.g. drone technology, special metals) and import bans (e.g. car parts, zinc, copper) must be assigned a delivery block for Russia and Belarus in the ERP system (e.g. SAP GTS).
Stop ongoing deliveries: The shipping department and freight forwarders should be instructed to halt transports of now sanctioned goods and have them legally reviewed before they leave the EU customs territory.
Update logistics blacklist: The 41 newly listed ships of the Russian "shadow fleet" as well as the sanctioned ports and airports must be blocked in the dispatching systems in order to comply with service bans.
3.) Contracts & Third-Country Review (Medium-term)

Focus: Legal & Sales

Third-country monitoring must be tightened: KYC and due diligence processes for customers in high-risk countries for sanctions evasion (China, UAE, Turkey, Kazakhstan, Kyrgyzstan) must be intensified immediately. End-user certificates must be more rigorously reviewed.
Integrate a "No-Russia clause": New contracts with customers in third countries that include sensitive goods must necessarily include contractual resale bans to Russia and strict penalties.
Phase-out of Georgian refinery: Contracts and supply relationships with the listed Kulevi refinery in Georgia must be legally terminated and fully settled within the stipulated 6-month period.
4.) Management tasks

Focus: Organization, resources and documentation

Define responsibilities: Management should ensure that responsibilities for sanctions screening, hit processing, export control, payment transactions, reporting and legal escalations are clearly defined.
Provide adequate resources: IT, compliance, legal, procurement, and logistics functions must have the human, professional, and technical resources necessary for risk-appropriate implementation. Whether external consulting or additional capacity is required depends on the scope and complexity of the affected business.
Document decisions transparently: Relevant reviews, internal instructions, system changes, approvals, and escalations should be documented. Reliable documentation can demonstrate, during official or internal audits, which organizational measures were taken. However, it does not automatically preclude liability.

Inform affected departments:

Employees in sales, purchasing, logistics, accounting, and other relevant functions should be informed about the changes in a way that is tailored to their specific needs. The communication should include clear contact persons, escalation channels, and practical instructions.

VI. Conclusion

The 21st EU sanctions package expands the requirements for financial, sanctions, and trade compliance. Companies should promptly assess the extent to which customers, suppliers, payment methods, goods, services, and business with third countries are affected by the new regulations.

The focus is on updating screening and control systems, reviewing existing business relationships, adjusting goods-related bans, and establishing clearly defined escalation and reporting processes. Transitional arrangements, exceptions, and authorization options must also be taken into account.

For management, it is crucial to establish appropriate responsibilities and controls, provide sufficient resources, and document key decisions transparently. This helps reduce legal risks and avoid unnecessary business closures due to hasty or sweeping assessments.

S+P Editorial Team

VII. List of Sources
European law (Official Journal of the European Union)

Regulations:

Council Regulation (EU) 2026/1844 amending Regulation (EU) No 269/2014 on restrictive measures in view of actions that undermine or threaten the territorial integrity, sovereignty and independence of Ukraine (OJ L 2026/1844):

https://eur-lex.europa.eu/eli/reg/2026/1844/oj

Accessed on 28.07.2026.

Council Regulation (EU) 2026/1848 amending Regulation (EU) No 833/2014 on restrictive measures in view of Russia’s actions which are destabilizing the situation in Ukraine (OJ L 2026/1848):

https://eur-lex.europa.eu/eli/reg/2026/1848/oj

Accessed on 28.07.2026.

Council Regulation (EU) 2026/1846 amending Regulation (EC) No 765/2006 on restrictive measures against Belarus (OJ L 2026/1846):

https://eur-lex.europa.eu/eli/reg/2026/1846/oj

Accessed on 28.07.2026.

National law of Germany (Federal Law Gazette)

Laws:

Foreign Trade and Payments Act (AWG) of 06.06.2013 (Federal Law Gazette 2013 I p. 1482):

https://www.gesetze-im-internet.de/awg_2013/

Accessed on 28.07.2026.

Money Laundering Act (GwG) of 23 June 2017 (Federal Law Gazette 2017 I p. 1822):

https://www.gesetze-im-internet.de/gwg_2017/

Accessed on 28 July 2026.

Law on Administrative Offenses (OWiG) as promulgated on 19 February 1987 (Federal Law Gazette 1987 I p. 602):

https://www.gesetze-im-internet.de/owig_1968/

Accessed on 28 July 2026.

Stock Corporation Act (AktG) of 06.09.1965 (BGBl. 1965 I p. 1089):

https://www.gesetze-im-internet.de/aktg/

Accessed on 28.07.2026.

Law concerning limited liability companies (GmbHG) of 20 April 1892 (RGBl. 1892 p. 477):

https://www.gesetze-im-internet.de/gmbhg/

Accessed on 28 July 2026.

German Criminal Code (StGB) as promulgated on 13 November 1998 (Federal Law Gazette 1998 I p. 3322):

https://www.gesetze-im-internet.de/stgb/

Accessed on 28 July 2026.