The 19th EU Sanctions Package: What's Changed and How to Adapt

On October 24, 2025, the European Union adopted its 19th package of sanctions against Russia – one of the most extensive in recent years.

‍

The consequences reach well beyond Russia itself. Companies working with contractors from Russia and CIS countries are now facing serious restrictions, as European and American businesses can no longer interact with Russia’s payment card system. The sanctioned banks list has expanded considerably, and here’s what many don’t realize: having contractors outside the UK, US, and EU doesn’t protect you from liability. Regulations require businesses to perform thorough due diligence on every link in the chain – counterparties, intermediaries, and transactions – before signing any agreement or sending any payment.

‍

Let’s break it all down.

‍

What’s in the 19th Sanctions Package

‍

The 19th package expands restrictions across multiple sectors. Energy, finance, and defense technologies all face tighter controls. The sanctions list has grown by 69 individuals and several companies. The EU also introduced measures targeting Belarus for its support of Russian policy, and put significant focus on closing circumvention schemes.

‍

This has become one of the most comprehensive packages to date. It affects energy exports, payment systems, banks, cryptocurrency services, and logistics. For businesses participating in international supply chains, this means reworking entire workflows. For individuals, it means new obstacles with cross-border transactions and maintaining bank accounts.

‍

‍

Financial Sector: Extensive Banking Restrictions

‍

The financial component of the 19th package stands out as one of the harshest yet. The EU has essentially eliminated most ways to pay cardholders and account holders at banks operating in Russia and Belarus. Cryptocurrency services face new restrictions as well.

‍

In short, the new package has made cross-border payments to Russia and Belarus significantly more difficult.

‍

‍

Ban on Russian Payment Systems

‍

The EU has prohibited European companies from working with Russian payment infrastructure. The restrictions target the National Payment Card System (NSPK) – the operator behind Visa, Mastercard, and Mir cards issued in Russia, as well as the country’s Faster Payments System (SBP). Businesses from the EU, US, and UK can no longer conduct any operations involving NSPK. Violations carry serious liability.

‍

‍

Restrictions on Crypto and Payment Services

‍

Pressure on the crypto sector has increased substantially – it’s been increasingly used to circumvent sanctions. The main restriction is a ban on operations involving the A7A5 stablecoin, which was created with Russian state support. The sanctions target the token developer, the Kyrgyz issuer, and the trading platform that handled significant transaction volumes.

‍

In the EU, all transactions involving A7A5 are now prohibited. The same goes for providing crypto services to Russian individuals and legal entities. This specifically includes issuing electronic money, initiating payments, payment processing (acquiring), and providing services related to crypto assets.

‍

{{_highlight-module-grey--1}}

‍

‍

Fewer Banking Channels for Payments to Russia

‍

Russian financial institutions have, predictably, fallen under sanctions. The new list includes MTS Bank, Alfa-Bank, Zemsky Bank, Absolut Bank, and NPO Istina. Similar measures now apply to several banks from Belarus and Kazakhstan that were connected to Russian financial messaging systems and helped process settlements.

‍

A separate set of restrictions targets banks that handled payments to Russia. The EU has banned transactions with eight organizations from Tajikistan, Kyrgyzstan, the UAE, and Hong Kong – all believed to have provided circumvention channels. The result: international financial routes for payments to Russia have narrowed considerably, and accessing alternative channels has become far more difficult.

‍

{{_highlight-module-grey--2}}

‍

‍

How the New Sanctions Work

‍

It’s a common misconception that sanctions only apply within the EU, US, or UK. The reality is more complex. Restrictions extend to any transactions and operations that have a “nexus” – a connection or touchpoint – with these jurisdictions, and regulators interpret this broadly.

‍

A nexus can mean:

• Using euros, dollars, or pounds
• Processing transactions through banks or payment systems in these countries
• Working with European or American contractors
• Using their services, software, or infrastructure

‍

Even if your company is registered outside the EU, US, and UK, any of these factors is enough for an operation to fall under sanctions regulations.

‍

The regulations are explicit about this: if EU, US, or UK residents knowingly allow sanctions violations through subsidiaries or partners, they bear liability. The same applies when a business structures its operations so that prohibited actions are formally carried out by others. Regulators consider this sanctions circumvention.

‍

{{_highlight-module-grey--3}}

‍

This is why sanctions law focuses not just on prohibitions but on business obligations as well. Any company entering into a transaction or initiating a payment must verify in advance whether the operation will violate sanctions. This requirement is explicitly stated in Article 12 of Regulation No 833/2014.

‍

Regulators expect businesses to analyze transaction documentation, the economic basis for payments, cash flow structure, fund transfer routes, and every participant in the chain. You need to verify not just direct counterparties but also intermediaries: banks, payment services, and any agency structures involved.

‍

If an intermediary violates sanctions, liability can fall on the company that worked with them. This is especially true if the intermediary operates outside the EU, US, or UK and has no assets in these jurisdictions – in such cases, it’s often easier for regulators to pursue the company that initiated the transaction. The consequences can be severe: blocked accounts, fines calculated as a percentage of turnover, loss of residency status, and in some cases, criminal prosecution.

‍

In today’s environment, formal compliance isn’t enough. Businesses need to demonstrate they’ve taken all reasonable measures to comply with sanctions legislation.

‍

‍

Handling Payment Transfers After the 19th Sanctions Package

‍

The new restrictions have made settlements with contractors from Russia and Belarus significantly more complicated. The banking routes you’ve relied on no longer work, and European companies are now explicitly prohibited from interacting with Russian payment infrastructure. This means businesses need to focus not on finding “workarounds” but on rebuilding their processes to comply with EU, US, and UK sanctions law.

‍

‍

How to Structure a Payment Route Legally

‍

From a sanctions regulation perspective, one approach remains permitted: transferring funds to jurisdictions that aren’t subject to direct restrictions. The critical requirement is that companies from the EU, US, or UK don’t interact with NSPK on their end and don’t participate in operations that could be classified as sanctions circumvention.

‍

‍

The Role of Payment Services

‍

Under these new conditions, a payment service’s main responsibility is to structure the process so that the European side doesn’t interact with sanctioned infrastructure. Funds are transferred to payment instruments in CIS jurisdictions that aren’t connected to NSPK – for example, in Tajikistan. Any further movement of funds happens outside Russia’s payment system.

‍

‍

Mellow handles the part of the chain that falls within current regulations. The service doesn’t participate in operations within Russian card infrastructure and doesn’t use arrangements that could be classified as sanctions circumvention. For all operations, we work with a carefully selected, limited list of banks and partners chosen to meet sanctions requirements.

‍

‍

Fines and Liability for Sanctions Violations

‍

EU legislation requires companies to verify counterparties and transaction routes in advance. This requirement is specified in Regulation 833/2014, which outlines minimum standards for verifying documents, payment chains, and logistics. If an intermediary violates sanctions rules, liability can also fall on the company that engaged them – regulators expect companies to verify every participant in the chain.

‍

The consequences of getting this wrong can be severe: fines, blocked assets, loss of access to financial instruments, and in some cases, criminal prosecution. Companies working through partners outside the EU or US face particular vulnerability. Since regulators often have no direct authority over these intermediaries, they may pursue the company that initiated the operation instead.

‍

‍

What to Expect: Future Sanctions Policy

‍

While the new package is one of the most extensive to date, European authorities have slowed the pace for now. According to Politico, further restrictions aren’t currently a priority – discussions will resume in January. Still, most analysts expect continued pressure on Russia’s financial and energy sectors.

‍

Looking ahead, the focus may shift toward commodities and logistics. Possible measures under discussion include a ban on natural rubber exports, additional restrictions on petroleum products, and expanded oversight of transactions with third-country banks. The EU plans to strengthen monitoring of circumvention schemes.

‍

‍

What’s Next: The 20th Sanctions Package

‍

The 19th package represents a turning point. For the first time, national payment systems and crypto assets came under direct restrictions, signaling the EU’s clear intention to target financial infrastructure. This sets the stage for what’s next – more focused measures aimed at revenue-generating sectors and circumvention routes. The EU has already prepared its 20th sanctions package and will announce it soon.