Russian sanctions compliance guide 2024–2026: banking restrictions, cross-border sanctions risk & financial institution requirements

The global financial architecture has entered a state of structural fragmentation as the regime of international sanctions against Russia reaches great complexity and extraterritorial reach.

The strategy employed by the G7, the EU, and allied partners has evolved from initial broad-brush sectoral exclusions into a granular infrastructure blockade designed to isolate the Russian state and its military-industrial complex while managing peripheral risks to the global economy. This has created a multi-tiered reality where state-level sanctions, individual asset freezes, and systemic restrictions on ordinary citizens intersect with the sanctions exposure that global financial institutions face when clients, counterparties or payment routes connect to middle power hubs like the UAE, Turkey, and Central Asia. Treating that exposure as "corridor risk" means knowing where it builds up and escalating it early.

The architecture of state-level sanctions and infrastructure blockades

The current regime goes beyond a list of prohibited goods: it targets the logistical and financial infrastructure that lets the Russian state operationalize its economy. Through 2025 and 2026, the focus has shifted toward the "shadow fleet" and the secondary mechanisms of energy-revenue generation. The EU's shadow fleet vessel list reached 632 vessels after its 20th package (23 April 2026), and the 21st package (23 July 2026) added 41 more. UK and US designations overlap with the EU list, so the totals should not be added together. These vessels are linked to oil trades outside the G7 oil price cap framework. On 22 October 2025, the US Treasury designated Rosneft and Lukoil, Russia's two largest oil companies, and the EU has set out a phased roadmap to end its imports of Russian energy.

Financial isolation is further anchored by the immobilization of Russian Central Bank reserves held in G7 jurisdictions, including about €210 billion in the EU (a figure reported in December 2025), most of it at Euroclear. In December 2025 the EU agreed to keep those assets immobilized indefinitely. The 2025 discussion also moved from immobilization alone to using the assets to fund Ukraine, through a proposed reparations loan. At their meeting on 18 and 19 December 2025, EU leaders instead agreed a €90 billion loan for 2026 and 2027 funded by EU borrowing, while reserving the right to use the immobilized assets to repay it.

The systemic reach is reinforced by Executive Order 14024 and its amendments, which empower the US Treasury to sanction any foreign financial institution (FFI) that conducts or facilitates "significant transactions" involving Russia's military-industrial base. In 2024, the definition of that base was expanded to include all persons blocked under E.O. 14024, which effectively makes any interaction with a designated Russian entity a point of potential secondary-sanctions risk for banks anywhere in the world.

Differentiating the sanctions burden: SDNs vs. ordinary citizens

A central feature of the current regime is the legal differentiation between individuals on the SDN and Consolidated lists and the millions of non-sanctioned Russian citizens, which creates a tiered system of financial accessibility and legal risk for global banks.

For SDNs, the restrictions are absolute and "blocking" in nature. In the US, UK, and EU, an asset freeze requires all persons within the jurisdiction to freeze the designated party's assets and prohibits making funds or economic resources available, directly or indirectly. This extends to entities owned 50% or more by designated persons under the US and EU tests, while the UK applies a test of more than 50% ownership plus a separate control test. Canada's Special Economic Measures (Russia) Regulations prohibit dealing in property owned, held or controlled by or on behalf of a listed person and set no fixed ownership percentage. Ownership is a primary focus of due diligence, with authorities increasingly "looking behind" complex trust and offshore arrangements to identify the true beneficial owner.

By contrast, ordinary citizens face systemic hurdles designed to prevent capital flight and the obfuscation of state-linked funds. The most significant is the €100,000 deposit cap: EU credit institutions may not accept deposits from Russian nationals or residents above €100,000 per institution (Switzerland applies CHF 100,000), with exemptions for nationals of EU and EEA states and Switzerland and for holders of residence permits there. There are also bans on supplying banknotes to Russia: the EU bans euro banknotes (Article 5i of Regulation 833/2014) and the US bans exports of US dollar banknotes. Under the Article 5r reporting mandate (Council Regulation (EU) 833/2014), EU entities more than 40% owned by Russian nationals or residents must report transfers out of the EU exceeding €100,000, and credit and financial institutions report semi-annually from July 2024.

Cross-border sanctions risk: onboarding clients with Russian links

Russian capital still moves through the global system, and differences between jurisdictions create real exposure for institutions that onboard clients with Russian links. Some hubs do not apply Western sanctions as domestic law, so a transaction that looks lawful locally can still carry sanctions risk for a bank with US, EU, UK or Canadian touchpoints. Treat that gap as a risk to assess and escalate, never as room to operate in.

The UAE and Turkey sit at the centre of this exposure. Foreign sanctions such as OFAC's do not automatically carry the force of law within the UAE, which applies its own domestic and UN lists, though many UAE banks have begun to "de-risk" under Western pressure. In Turkey, after US warnings, banks tightened policies and closed some business accounts, though Turkey remains a major transit point where dual use goods call for careful end use checks. For Central Asian states (Kazakhstan, Kyrgyzstan, Tajikistan), trade and remittance flows should prompt transshipment and end use questions. The EU's 19th package (23 October 2025) added Central Asian banks, including banks in Tajikistan, to its transaction bans, and later packages went further: the 20th (23 April 2026) covered banks in Kyrgyzstan, Laos and Azerbaijan, and the 21st (23 July 2026) covered banks in Kyrgyzstan, Mongolia and India, A7 network payment entities (including one in Nigeria) and crypto platforms, and added companies in the UAE, Türkiye and other hubs to its export restrictions. Exposure to these hubs is a legal question as well as a reputational one.

Nexus, payment routing and red flags to escalate

Sanctions exposure follows the "nexus" to a sanctioning jurisdiction, which is created by the involvement of US, EU, UK or Canadian persons, currencies, territory, or infrastructure. A foreign institution cannot rely on the absence of a nexus: under E.O. 14114, a foreign financial institution can face US sanctions for significant transactions involving Russia's military industrial base even without a US connection. Compliance teams should treat the following patterns as red flags and escalate them to the sanctions officer.

• Unusual currency and routing. Russia related payments settled in a third currency or sent through an unrelated third country bank with no clear commercial reason. Hold the payment, ask for the business rationale and supporting documents, and escalate.
• Requests to keep specific people or banks out. A customer or counterparty asks that US, EU, UK or Canadian staff or correspondent banks not handle a payment. Do not process it; escalate and consider reporting.
• Russian payment rails. On November 21, 2024, OFAC warned that foreign financial institutions that join Russia's SPFS messaging system risk designation under E.O. 14024 and treated joining as a red flag. Check whether counterparties use it.
• New cross border platforms. The mBridge project (China, the UAE, Hong Kong, Thailand and Saudi Arabia) is a multi CBDC platform for cross border payments. It does not change a firm's sanctions duties: screening, ownership checks and escalation apply on every payment rail.

When a red flag cannot be cleared, stop. Do not process the payment, freeze or block where the law requires it, and report. In Canada, persons must disclose to the RCMP or CSIS without delay property they believe is owned or controlled by a listed person, and related transactions (section 7 of the Special Economic Measures (Russia) Regulations), and reporting entities submit a suspicious transaction report to FINTRAC when they have reasonable grounds to suspect a money laundering, terrorist activity financing or sanctions evasion offence. In the US, blocked and rejected transactions are reported to OFAC within 10 business days. In the UK, relevant firms inform OFSI as soon as practicable. In the EU, persons supply information to the competent authority of their member state immediately. If the relationship cannot be made safe, exit it and record why.

Regulatory carve-outs: the use of General Licenses

Many institutions maintain legitimate, compliant relationships with Russian entities using "General Licenses", which are broad authorizations issued by bodies like OFAC permitting specific transaction types. General License 8L, which authorized energy-related transactions with certain Russian banks, ended on March 12, 2025 and was not renewed, so the GL 8 series no longer authorizes energy-related transactions. OFAC has since issued narrow, time-limited licenses of its own, for example the GL 134 series for Russian-origin oil cargoes loaded before set dates and extensions for certain Lukoil entities and retail stations, and these change often. Check OFAC's current general licenses and their expiry dates before relying on any authorization.

Authorizations for agricultural trade, medicine, and telecommunications keep sanctions from entirely disrupting civil society or triggering a food crisis; banks document the purpose of these payments and the authorization relied on. As Western firms exit Russia, GLs also manage wind-down, for example by authorizing negotiations and contingent contracts for the sale of international assets to non-blocked parties, while ensuring proceeds do not provide a windfall to a sanctioned entity until sanctions lift.

Citizenship-by-investment and the scrutiny of second passports

Some high net worth Russian individuals hold a second citizenship or residency obtained through investment programs. A second passport does not change a person's sanctions status or source of wealth. Banks commonly treat CBI and dual-passport holders as higher risk. The acquisition of a second passport often triggers Enhanced Due Diligence focused on wealth provenance (tracing funds back through original Russian entities regardless of the passport used) and jurisdictional risk (heightened after the Court of Justice of the EU ruled on 29 April 2025, in Commission v Malta (Case C-181/23), that Malta's scheme breached EU law). Screen every known name, nationality and identity document, and escalate any match or unexplained change of identity.

The legal battlefield: retaliatory jurisdictions and the Lugovoy Law

The conflict has moved into the courtroom. Russian amendments to the Arbitrazh Procedural Code (the "Lugovoy Law," Articles 248.1 and 248.2) allow Russian courts to claim exclusive jurisdiction over any dispute involving a sanctioned Russian entity, overriding pre-existing arbitration agreements seated in "unfriendly" states like London, New York, or Paris. Russian courts have interpreted this broadly and have issued anti-suit injunctions against foreign proceedings.

Western courts, particularly in the UK, have responded with their own anti-suit injunctions, describing the law as disregarding corporate personality and contractual privity. This places institutions in a "Catch-22": obeying the Russian court risks violating sanctions, while obeying Western courts risks seizure of Russian assets. To manage it, many banks have opted for total de-risking: exiting all contracts with any Russian nexus.

Technological and structural evolution of compliance

As the regime enters its fifth year, the "best efforts" requirement under Article 8a of EU Regulation 833/2014 (EU operators must use best efforts so that non EU entities they own or control do not undermine the restrictions) has evolved into a demand for advanced RegTech and AI integration. Mapping Russian-owned entities in Europe requires more than list-based screening; banks increasingly use predictive risk modelling ("corridor risk" analysis to flag higher risk routes before a payment is released), natural-language processing for real-time interpretation of policy shifts across jurisdictions, and blockchain analytics to track the provenance of commodities like gold and oil from extraction to final buyer.

The permanent bifurcation of global finance

The system is moving toward a permanent bifurcation, not a unified global standard of compliance. On one side is the G7-centred "Core," defined by transparency, the €100,000 cap, and total exclusion of designated persons. On the other is a "Periphery" of hubs such as Dubai, Istanbul, and Hong Kong, where firms operate under different legal frameworks, use non USD rails and CBDC platforms like mBridge, and still handle Russia related trade and finance. That gap is where cross border sanctions risk concentrates for institutions with Western exposure.

For institutions, the gap between jurisdictions is a source of risk, not a safe harbour. The rise of secondary sanctions and the expansion of US and EU reporting mandates mean firms need controls that apply the strictest relevant regime. The future of global banking in this context will be defined by corridor risk management and the ability to navigate a world where a single transaction can be simultaneously lawful in one jurisdiction and a criminal offence in another. ComplyFactor's AML advisory and compliance program services help institutions build the sanctions-screening, ownership-mapping, and EDD controls this environment demands.