EU’s 21st Sanctions Package: What Georgian Crypto Businesses Need to Know

The EU’s 21st sanctions package of 23 July 2026 raises the financial-compliance threshold for businesses dealing with Russia-related exposure. The package contains 218 designations — 48 individuals and 170 entities — and, according to the Council of the EU, names 14 crypto-related service platforms based in Georgia, Panama, the United Arab Emirates, the Marshall Islands, Kyrgyzstan and Belarus.

Does this mean every Georgian company is sanctioned

No. EU sanctions apply to named persons and entities, and their direct operation depends on EU law and the transaction. A Georgian business can still face practical risk through an EU customer, bank, exchange, payment channel, contractor or a U.S./European compliance programme.

The package also expands financial measures: an asset-freeze and funds-availability prohibition affecting 94 banks and financial institutions, plus transaction bans on 33 additional Russian financial institutions. The practical effect can be more payment holds, requests for supporting documents and demands to identify the ultimate beneficial owner.

What a Georgian VASP should re-check

• Screen customers, beneficial owners, directors, wallets and related companies against updated EU lists.
• Record the screening date, list used, match analysis and compliance decision.
• Identify indirect exposure through a third-country exchange, mixer, OTC partner, payment processor or custody provider.
• Add sanctions, suspension, information-request and refund mechanisms to contracts.
• Preserve transaction-monitoring, source-of-funds and source-of-wealth records for the period required by the applicable rules.

If the facts arise in Georgia, which law applies

Virtual-asset services in Georgia are supervised by the National Bank of Georgia. The NBG’s official guidance states that a VASP requires registration, while the Organic Law of Georgia on the National Bank gives the NBG authority to regulate VASPs, restrict high-risk relationships and impose sanctions.

That domestic regime is not an automatic copy of EU sanctions law. But a Georgian VASP’s AML/CFT programme and international-sanctions risk controls must be strong enough to explain to banks and foreign partners why a transaction is permitted or why it was held.

The strongest practical conclusion

Sanctions compliance is no longer a one-time name-list check. It requires continuous assessment of the counterparty, wallet, ownership, purpose and service chain. Risk is especially high when a Georgian platform serves EU customers or connects to the jurisdictions directly mentioned in the Council’s package.

Frequently asked questions

• Does an EU sanction apply to every VASP registered in Georgia? No. It applies to named persons and entities and relevant legal connections, although banks and partners may apply broader risk-based screening.
• Can a transaction be held before a match is finally confirmed? A compliance policy may require a temporary hold and additional documents; the final step depends on the facts and applicable regime.
• What is the first record a company should preserve? The screening record: who was checked, which list was used, when, what match appeared and who decided the outcome.

Primary sources: Council of the EU, 21st package of sanctions — https://www.consilium.europa.eu/en/press/press-releases/2026/07/23/21st-package-of-sanctions-eu-hits-russian-energy-financial-services-and-crypto-hard/ ; National Bank of Georgia, VASPs — https://nbg.gov.ge/en/page/virtual-asset-service-providers-vasps ; Organic Law of Georgia on the National Bank — https://www.matsne.gov.ge/en/document/view/101044?publication=66