The EU Just Gave Itself a Kill Switch for Entire Countries
Sanctions used to be a list of names. As of this week, they can be a list of countries — and crypto is the first industry to find out what that feels like.
On July 23 the Council of the European Union adopted its 21st sanctions package against Russia, the largest batch of individual listings in four years: 218 designations covering 48 individuals and 170 entities. Fourteen crypto platforms across Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus now sit under a transaction ban, HTX among them.
The listings will get the headlines. They are not the important part.
Brussels wrote itself a jurisdictional off switch
Buried in the package is a legal instrument the EU has never held before: the power to ban all crypto-asset transactions between EU operators and any provider operating in an entire third-country jurisdiction.
Not a company. A country.
If Brussels decides that a given jurisdiction has become a durable host for sanctions-evasion infrastructure, it can now cut off every crypto business registered there in a single act — the compliant alongside the complicit, the exchange that files suspicious activity reports alongside the one that exists to launder ruble flows.
The Commission has been explicit that the point is deterrence aimed at governments rather than firms. Host the wrong infrastructure and your entire domestic industry loses access to a market of 450 million people.
The thing that provoked it was a stablecoin
This escalation did not come from nowhere. At the center of the package is the A7 cross-border payments network and its A7A5 stablecoin, running on Tron and Ethereum, which regulators say has moved close to $120 billion since launch.
The pattern that infuriated European enforcement is the one crypto keeps repeating. Authorities seized the Russia-linked exchange Garantex in March 2025. Within months the same operators had stood up a near-identical replacement called Grinex, and A7A5 let users carry their balances across.
Take down the entity, the entity reappears under a new name in a friendlier registry. Every enforcement cycle teaches the target to move faster than the paperwork.
At some point a regulator watching that loop stops trying to win the race and changes the rules of the track instead. That is what happened on Thursday.
The case against the compliant is that they're collateral
Here is the honest objection, and it deserves more than a wave.
A jurisdiction-level ban is a blunt instrument that assumes a national regulator can control what registers within its borders. Panama and the Marshall Islands sell corporate registration as a product. The UAE has spent five years building a legitimate licensing regime under VARA that a great many serious firms now operate under. Threatening all of them because of a handful of bad actors punishes the countries that invested in supervision alongside the ones that never bothered.
There's also the displacement problem. Cutting EU operators off from a jurisdiction doesn't stop transactions inside that jurisdiction. It stops European visibility into them. Compliance teams lose the counterparties they could at least monitor and gain nothing but a clean legal position.
Both objections are fair. Both were also true of banking sanctions in 2014, and the EU went ahead anyway, because the alternative was watching the evasion machine iterate indefinitely while enforcement filed one designation at a time.
Crypto regulation is now foreign policy, not financial policy
The strategic shift here matters more than the specific listings.
For a decade, crypto rules were written by financial supervisors thinking about consumer protection, capital requirements and market integrity. MiCA was that kind of law — a licensing regime with a transitional period that expired on July 1, forcing every service provider in the bloc to secure full authorisation or leave.
Sanctions law is a different animal with different authors. It moves at the speed of a foreign ministry, it is written to be a lever against states, and it does not much care whether the industry it is squeezing had a good quarter.
Crypto firms now sit inside both frameworks at once. A compliance department that was built to answer questions about proof of reserves and custodial segregation is suddenly responsible for a geopolitical judgment call: which registries might become uninvestable, and how quickly.
That is a research function, not a checklist. Most of this industry does not have one.
Where this ends up
The obvious next question is whether anyone else copies the mechanism. The United States has had secondary sanctions authority for years and uses it against banks; extending an equivalent tool to crypto rails would be a small legal step and a very large practical one. The UK, mid-build on its own stablecoin regime, is watching.
The subtler question is what a jurisdiction ban does to the thing it targets. A7A5 exists because dollars became hard to get. A ruble-denominated stablecoin moving $120 billion is not a story about crypto being permissive — it's a story about sanctioned economies rebuilding payment infrastructure from whatever primitives remain available.
Cut off Kyrgyzstan and the network re-registers somewhere the EU hasn't listed yet. Cut off enough places and it stops registering anywhere at all, moving fully onchain, permissionless, unincorporated and considerably harder to see.
Brussels has just built a weapon that works beautifully against companies. The thing it's aimed at is increasingly not a company.