EU Plans Unprecedented Russia Sanctions Expansion, Compliance Risk Set to Widen

The European Union is preparing what EU foreign policy chief Kaja Kallas describes as its most far-reaching sanctions listings against Russia since the start of the war, with the proposed autumn package expected to increase the number of sanctioned Russian entities by roughly one third.

Kallas said existing EU sanctions had already cost Russia’s war effort more than €1 trillion and argued that pressure must continue until Moscow ends the war. The precise measures and timing of the new package have not yet been disclosed, but the proposed expansion signals another significant escalation in the EU’s sanctions architecture.

The announcement comes shortly after the EU adopted its 21st sanctions package in July, targeting more than 100 banks and cryptocurrency operators, over 40 vessels associated with Russia’s shadow fleet and more than 50 military-industrial entities.

From a compliance perspective, the significance of the proposed autumn package extends beyond the number of new names that could appear on sanctions lists.

A one-third expansion in sanctioned entities would create a substantially larger screening universe for banks, insurers, payment companies, exporters, logistics operators, commodity traders and multinational businesses with exposure to Russia or Russian-linked supply chains.

The immediate challenge for compliance departments will be identification.

Sanctions screening systems will need to capture newly designated companies and individuals quickly, but name matching alone will not be sufficient. Businesses will also need to examine ownership and control structures, subsidiaries, intermediaries, beneficial owners and related counterparties that may not appear directly on a sanctions list.

This is particularly important because sanctions evasion increasingly relies on networks rather than obvious direct relationships.

A company may not be named on a sanctions list but could be owned or controlled by a designated individual, linked to a sanctioned enterprise through a complex corporate structure, or operating as an intermediary in a transaction designed to conceal the ultimate Russian connection.

The proposed expansion therefore increases the importance of beneficial ownership checks and enhanced due diligence.

The compliance burden is also likely to extend into supply chains.

European companies importing commodities, machinery, technology or industrial components must assess whether new designations affect suppliers, distributors, freight companies, financial institutions or other intermediaries within their trading networks.

The risk becomes particularly acute where transactions involve jurisdictions that have become important channels for Russian trade.

The EU has increasingly focused on sanctions circumvention, recognising that restrictions applied to Russia can be weakened if goods, financial services and technology continue reaching sanctioned parties through third countries.

That makes transaction context increasingly important.

A payment that appears legitimate when assessed in isolation can become higher risk when combined with an unusual shipping route, recently established intermediary, unexplained change in supplier or a counterparty with links to a sanctioned Russian entity.

The same principle applies to financial institutions.

Banks may need to reassess customers whose business models involve Russia-related trade, energy, commodities, shipping, cryptocurrency or jurisdictions considered vulnerable to sanctions circumvention.

The challenge is not simply preventing transactions with listed parties. It is identifying transactions that may be structured to avoid sanctions controls.

The EU’s latest measures already demonstrate the direction of travel. Its July package targeted Russian banks and crypto operators alongside vessels and military-industrial companies, showing that sanctions enforcement is increasingly aimed at the infrastructure supporting Russia’s ability to finance and sustain its war effort.

For compliance teams, that means sanctions risk is becoming increasingly interconnected with financial crime, trade compliance, cybersecurity, shipping and supply chain risk.

The proposed autumn package could therefore have consequences well beyond European businesses.

International companies dealing with European banks, insurers, suppliers or customers may find themselves subject to heightened due diligence even where they have no direct Russian operations.

A third-country company that previously appeared low risk could attract greater scrutiny if it suddenly experiences increased trade with Russia, handles goods with potential military applications or becomes involved in transactions involving newly designated entities.

This is where sanctions compliance moves from a screening exercise into a broader risk-management discipline.

The EU’s announcement also raises the importance of sanctions governance at board level.

As sanctions regimes become larger and more complex, compliance failures can result from weak internal communication as much as from deliberate misconduct. Procurement teams may onboard a new supplier without understanding its ownership structure. Treasury departments may process a payment without identifying the ultimate beneficiary. Logistics teams may approve a shipment without fully reviewing its destination or intermediary.

Effective sanctions compliance therefore requires coordination across the organisation.

The proposed package will also test the ability of companies to respond quickly to regulatory change.

When new designations are adopted, businesses may have to update screening databases, review existing customers, freeze or reject affected transactions, reassess contracts and determine whether regulatory reporting obligations have been triggered.

A compliance programme that relies heavily on manual processes could struggle with the volume.

The EU itself says sanctions are designed not only to impose economic pressure but also to prevent international crises, support peace and security and reinforce international law.

The proposed autumn package suggests that Brussels intends to make the sanctions regime progressively broader and more difficult to circumvent.

For businesses, the message is clear.

The risk is no longer simply whether a counterparty is sanctioned today. The risk is whether the organisation can identify, assess and respond quickly when the sanctions landscape changes tomorrow.

With the EU signalling a potential one-third increase in sanctioned Russian entities, companies exposed to European markets should begin reviewing screening controls, beneficial ownership data, Russian and third-country exposure, intermediary relationships and sanctions escalation procedures before the new listings arrive.

Compliance takeaway: The proposed EU package could significantly expand sanctions exposure across banking, trade, shipping, energy, cryptocurrency and supply chains. Businesses should treat the announcement as a forward compliance warning and review their ability to identify newly designated entities, detect indirect ownership and control, assess sanctions-evasion risks and respond rapidly to new designations.