Council of the EU ¦ EU adopts 18th package of economic and individual measures against Russia

EU’s 18th Russia Sanctions Package: What Financial Crime Teams Need to Know Now

The EU has adopted its 18th sanctions package against Russia — its toughest to date — targeting energy, banking, and the military-industrial complex, with complementary measures on Belarus. For compliance, sanctions, and financial crime professionals, this package expands exposure across vessels, banks, software, commodities, and third-country intermediaries. Below is a structured breakdown and practical implications for risk, controls, and investigations.

Key takeaways at a glance

• Scope expansion:
  • 55 new listings (14 individuals, 41 entities), taking individual listings to 2,500+.
• Financial sector:
  • Full transaction ban replaces prior messaging-ban scope for 22 more Russian banks;
  • widened exposure for third-country banks and crypto providers linked to sanctions evasion or System for Transfer of Financial Messages (SPFS);
  • Russian Direct Investment Fund (RDIF), a sovereign fund, and affiliates restricted;
  • new software export bans for banking/finance.
• Energy crackdown:
  • Lowered oil price cap to USD 47.6;
  • 105 more shadow fleet vessels sanctioned (total 444);
  • port/service bans widened;
  • backdoor refined products ban;
  • full transaction ban on Nord Stream 1 and 2;
  • end of Czech oil exemption.
• Military supply chain:
  • Expanded dual-use controls and new listings, including China, Hong Kong, and Türkiye-based entities for UAV-linked circumvention;
  • €2.5bn+ in new export bans including CNCs and propellant chemicals.
• Accountability:
  • More listings tied to deportation and indoctrination of Ukrainian children, proxies in occupied territories, and propagandists.
• Belarus alignment:
  • Trade and financial restrictions mirrored;
  • full transaction ban for messaging services;
  • arms embargo.
• Legal shield:
  • EU measures to counteract Bilateral Investment Treaty (BIT) arbitration claims by Russian entities and proxies.
• Effective date:
  • Legal acts to be published in the Official Journal;
  • last review 22 July 2025.

Banking and crypto: From messaging bans to full transaction bans

• 22 additional Russian banks now under full transaction bans, beyond the prior 23. This extends to all EU-based services, not just messaging.
• Lowered thresholds for sanctioning third-country FIs and CASPs that frustrate EU measures, support the war, or connect with Russia’s SPFS. The widened transaction ban captures more non-EU intermediaries facilitating Russian flows.
• Broadened transaction ban for third-country operators circumventing oil-related restrictions.
• Russian Direct Investment Fund (RDIF) and sub-funds: blanket transaction ban, with a mechanism to extend to portfolio companies and service providers to RDIF. Four Russian RDIF investees are already listed.
• New ban on exporting/supplying certain software management systems used in banking/finance—implications for core banking vendors, treasury, risk, AML, and payment engines.

Action items for FIs and CASPs

• Refresh sanctions screening lists to capture the new banks and RDIF-related entities; re-run customer and counterparty screenings (KYC/KYCC) with lookbacks.
• Build System for Transfer of Financial Messages (SPFS) exposure flags: if counterparties use SPFS rails or market it as a workaround, treat as high risk; enhance EDD and consider exit if risk is not mitigable.
• Review correspondent networks, nested relationships, and payment processors in high-risk jurisdictions (CIS, Middle East, South/East Asia, Türkiye, Caucasus) for sanctions evasion indicators.
• For crypto, scrutinize OTC brokers, P2P ramps, mixers, and high-risk exchanges servicing Russia; deploy blockchain analytics to identify clusters linked to sanctioned entities and evasion typologies.
• Vendor risk: map software exports and updates to Russian or Belarusian banking/finance users; implement geofencing, license controls, and kill switches. Validate distributors and resellers.

Bastian Schwind-Wagner_Follow "This package materially raises legal, operational, and reputational risk for entities touching Russian trade and finance directly or via third-country intermediaries. Financial crime teams should treat shadow fleet exposure, SPFS-linked networks, refined product origin tracing, and dual-use supply chains as immediate priority controls."

Energy: Enforcement moves to choke the shadow fleet and close backdoors

• Oil price cap cut to USD 47.6 with an automatic, dynamic adjustment mechanism. This increases breach incentives; expect more falsified attestations, opaque FOB/CIF manipulations, transshipment schemes, AIS gaps, doctored BLs, and blended crude narratives.
• 105 new vessels sanctioned tied to the shadow fleet, arms transport, or stolen Ukrainian grain. Port access and maritime services bans extend to 444 ships in total. High residual risk for ship managers, insurers, P&I clubs, bunker suppliers, and classification societies.
• Listing of managers, traders, a major Indian refinery with Rosneft shareholding, plus a first-ever captain and an operator of an international flag registry. Individual-level liability raises the bar for KYC on beneficial owners, DGS, flags, and technical managers.
• Import ban on refined products derived from Russian crude via third countries, except Canada, Norway, Switzerland, the UK, and the US. Traders must trace crude origin in refinery runs; “same molecules” defenses won’t hold. Refined product due diligence must include refinery feedstock attestations, assay data where available, and certificate validation.
• Full transaction ban on Nord Stream 1 and 2 kills any maintenance/insurance loopholes.
• End of Czech oil exemption tightens intra-EU arbitrage.

Action items for energy/trade finance

• Update vessel screening to include the expanded 444 list; integrate MMSI/IMO change detection, AIS gap analytics, high-risk port transits, and STS operations near known transfer hotspots.
• Enhance attestation controls for price cap compliance; reconcile documents across BLs, invoices, charterparties, and sanctions attestations; deploy anomaly detection on freight rates versus market.
• Require refinery-level origin attestations for refined products; scrutinize non-exempt third-country exports for Russian-origin crude derivation.
• Reassess all relationships with Rosneft-linked counterparties and shadow fleet service providers; add captain/master and registry operator screening fields to KYC workflows.

Military-industrial restrictions: Dual-use choke points and third-country exposure

• 26 new entities under tighter export controls for dual-use and military-enhancing goods; 11 located in China, Hong Kong, and Türkiye, tied to UAV-related circumvention.
• €2.5bn+ in new export bans: CNC machines and propellant chemicals now restricted; transit ban expansion for economically critical goods used in construction and transport.
• Eight Belarusian military-industrial entities listed.

Action items for exporters and logistics

• Update product classification (HS/CN, control lists) for CNCs, chemicals, and dual-use components; re-assess BOMs and end-use statements.
• Strengthen screening of distributors and “last-mile” resellers in China, Hong Kong, Türkiye, and free zones; add audit clauses and site inspections.
• Transit risk controls: route approvals, sealed container verification, geofenced tracking, and anomaly alerts on Russia-adjacent transits.
• Watch UAV supply chains: sensors, optics, RF modules, microelectronics, servos, and composite materials.

Accountability and influence operations

• Additional listings tied to deportation/indoctrination of Ukrainian children, proxies in occupied territories, cultural manipulation, a leading businessperson, and a prominent propagandist.
• Heightened reputational and legal exposure for media and cultural entities facilitating state narratives or occupied-territory integration efforts.

Belarus: Mirroring and tightening

• Belarus measures aligned with Russia on trade; full transaction ban for messaging services; new arms import embargo.
• Eight Belarusian military-industrial listings intensify diversion risks via Minsk.

Bilateral Investment Treaty (BIT) arbitration shield

• EU instruments to counter illegitimate BIT arbitration by Russian entities and proxies, including damages recovery and non-recognition mechanisms. Expect reduced leverage of sanctioned claimants in EU fora.

Risk indicators to integrate into monitoring

• Banking/Payments:
  • use of SPFS references;
  • nested correspondent chains in small non-EU banks;
  • bursty activity around oil settlement dates;
  • use of offshore SPVs with Russian UBOs.
• Crypto:
  • P2P conversions via ruble pairs;
  • links to exchanges serving Russia without strong KYC;
  • laundering through mixers or high-risk bridges;
  • OTC desks with thin compliance profiles.
• Maritime:
  • frequent AIS dark periods;
  • repeated IMO/MMSI changes;
  • STS near Kalamata, Ceuta, Skagen, or off Malta;
  • calls at high-risk Black Sea or Syrian ports;
  • aged tankers with opaque ownership.
• Trade finance:
  • inconsistent load/discharge documentation;
  • price cap attestation gaps;
  • unusual Incoterms shifts;
  • invoice round-tripping via small intermediaries;
  • sanctions clauses removed or resisted.
• Procurement:
  • orders for CNCs, avionics, RF, and chemicals to new buyers in China/HK/TR with limited operating history;
  • distributor switches post-2022;
  • unusual shipping routes via Caucasus or Central Asia.

Governance and control upgrades

• Sanctions program:
  • rapid rule updates tied to Official Journal publication;
  • board-level attestation;
  • named accountable executive;
  • model risk management for sanctions screening.
• Data and tooling:
  • entity resolution across variations;
  • UBO enrichment;
  • vessel intelligence;
  • blockchain analytics;
  • trade document OCR and anomaly detection.
• Contracting:
  • sanctions snapback clauses;
  • audit rights;
  • termination triggers for SPFS usage or shadow fleet ties.
• Training:
  • targeted modules for trade desk, maritime operations, vendor management, and crypto compliance covering this package’s specifics.
• Documentation:
  • maintain defensible rationale for counterparties in higher-risk third countries;
  • keep detailed adverse media and ownership files.

Jurisdictional conflicts and de-risking strategy

• Expect countermeasures from Russia and pressure in certain third countries.
• Adopt a tiered risk appetite:
  • Prohibited: direct Russia/Belarus nexus, listed parties, shadow fleet links, SPFS-enabled transactions.
  • Permissible with EDD: third-country entities in China/HK/TR with plausible non-Russia end-use, subject to audit and telemetry.
  • Decline/exit: repeated documentation deficiencies, refusal of end-use transparency, or unwillingness to include sanctions clauses.

What to do today

• Update screening lists and re-screen all customers, vessels, and suppliers.
• Pause transactions involving newly listed vessels, banks, RDIF-linked entities, and refined products of uncertain origin.
• Launch a rapid lookback on oil-related deals since the last cap adjustment; verify attestation integrity.
• Freeze rollout or support for covered finance/banking software to Russia/Belarus; assess reseller exposure.
• Brief senior management and the board; allocate resources for enhanced monitoring in China/HK/TR corridors.

Dive deeper

• Council of the EU ¦ EU adopts 18th package of economic and individual measures against Russia ¦ Link