Read the two documents in the wrong order and the story looks like competence: a regulator diagnoses a problem, and a week later the world's most aggressive sanctions authority delivers the cure. Read them in the right order and the cure is a press release.
On July 16, 2026, the Financial Action Task Force published its 7th Targeted Update on virtual assets — a report card telling 147 jurisdictions that their laws have raced far ahead of their ability to enforce them. On July 23, seven days later, the European Union adopted its 21st Russia sanctions package, which for the first time gives Brussels the power to ban an entire third country's crypto services from the European market.
The diagnosis and the prescription landed in the same week. The question worth asking is whether the second document survives contact with the first. It does not.
The diagnosis and the prescription landed in the same week. The question worth asking is whether the second document survives contact with the first. It does not.
Start with the architecture, because it is genuinely new. Until now the EU could only sanction specific tokens or named platforms — the 19th package banned the ruble-pegged A7A5 stablecoin by name; the 20th extended the ban to all Russian and Belarusian crypto service providers. The 21st package changes the unit of enforcement from the actor to the jurisdiction.
The new mechanism lets the Council prohibit any transaction between an EU operator and any crypto provider in a third country that hosts services used by Russia to evade sanctions. Not a company. A country. That is a real escalation in legal ambition, and it deserves to be recognized as one.
But the tell is buried in the same evidence that announces it. Chainalysis notes, flatly, that the mechanism "has not yet been used." It is a loaded gun the EU has shown to the room without firing.
And where the EU did fire — at named targets — the timing is unflattering. The package lists HTX, the exchange owned and advised by Tron founder Justin Sun, under its operator Huobi Global SA. The transaction ban takes effect August 23. The UK sanctioned HTX in May. OFAC still hasn't moved at all.
So the bloc's "landmark" action against one of the world's largest exchanges arrives two months behind Britain and lands as a transaction ban with no asset freeze. That is not the leading edge of enforcement. It is the trailing edge.
Now the reality check, which is what FATF's numbers actually are. Of 139 jurisdictions assessed on preventive AML measures — the controls meant to stop illicit flows before funds move — only 13 fully met the standard. Fewer than one in ten.
Sixty percent of jurisdictions that have passed Travel Rule legislation have taken no supervisory or enforcement action on it whatsoever. The law exists on paper; the enforcement does not exist at all.
And here is the detail that turns the EU's new weapon against itself: 23% of jurisdictions now prohibit VASPs outright, up from 11% in 2023, but have "not progressed" in enforcement. FATF's own language is that prohibition without monitoring "creates a black hole where VA activity continues outside regulatory visibility."
Sit with that. The EU's third-country mechanism is designed to cut off entire jurisdictions. FATF has just documented that cutting off a jurisdiction, without the capacity to watch it, does not close the activity — it darkens it. The tool and the pathology are the same shape.
This is where the case study stops being theoretical. The A7 cross-border network — created in late 2024 by sanctioned Russian bank Promsvyazbank and fugitive Moldovan oligarch Ilan Shor — has processed nearly $120 billion to date. Its ruble-pegged A7A5 stablecoin moved more than 110 billion USD on-chain in just 16 months, per CertiK.
Around 34% of that on-chain volume was classified by Elliptic and TRM Labs as wash trading. But the load-bearing fact is smaller and simpler: A7A5 runs on Ethereum and Tron "without a freeze function."
Think about what a jurisdiction-level ban actually reaches. It reaches EU operators — it tells them whom they may transact with. It does not reach a token that, by design, has no administrator who can freeze it. You can ban the counterparty; you cannot ban the ledger.
The evasion pattern already demonstrates the reflex. When U.S., German, and Finnish authorities took down Garantex in spring 2025 and froze more than $26 million, its clients and liquidity migrated to Grinex — a Kyrgyzstan-registered successor that blockchain analysis showed used shared infrastructure. Seizure did not end the flow. It rerouted it.
And FATF flags the checkmate directly as a "significant and emerging risk." After a third-party issuer froze over $29 million in one criminal conglomerate's wallets, that same conglomerate simply launched its own USD-pegged stablecoin "marketed as immune to asset freezing," issued across multiple public blockchains and a proprietary chain.
The programmable control that regulators were counting on — the ability to freeze at the issuer level — is exactly the control these operators have now engineered out of existence. Freeze-resistant stablecoins are the direct answer to the chokepoint we described in our July 18 Tether-freeze thread: when the freeze function is the leverage, the response is to build coins that cannot be frozen.
Which brings us to HTX and the mechanics of why screening fails even against a named target. Two days before the EU listing, TRM Labs reported that HTX had "rebuilt its on-chain plumbing" since the UK action — cycling hot wallets across TRON, Ethereum, BNB Smart Chain, and Solana fast enough that address screening "cannot keep pace."
Read that against a designation that takes effect August 23. The exchange can reconstitute its wallet topology faster than compliance systems can update their blocklists. The target is moving; the enforcement is scheduled.
HTX, for its part, calls the wallet activity "routine, security-driven platform operations." Whether or not you believe that, the operational point stands: address-level screening is losing a race against address-level rotation, and the EU's newest tool does nothing to change the tempo of that race.
So stack the two documents one last time. FATF: 60% of Travel Rule laws unenforced, 23% of prohibitions unmonitored, 13 of 139 jurisdictions actually preventive. EU: a mechanism to ban entire jurisdictions that has not been used, deployed against infrastructure built to have no freeze function, following the UK by two months while OFAC sits still.
The precedent is real. Brussels has written itself the authority to cut off a country. That authority will outlive this package and shape the next decade of sanctions design, and that matters.
But authority is not capacity, and this is the uncomfortable implication FATF's report card forces. Extraterritorial ambition without on-chain enforcement doesn't deter evasion. It relocates it — pushing activity toward the 23% of jurisdictions that prohibit without watching, into the black hole FATF just mapped.
The EU has built a weapon that designates jurisdictions it cannot chase on-chain, aimed at coins it cannot freeze, enforced against wallets that rotate faster than it can list them. The legal design is a milestone. The enforcement behind it, for now, is theater — and A7A5's $120 billion is the proof that the audience already knows the difference.