On 23 July 2026, the Council of the European Union adopted its 21st package of restrictive measures against Russia and Belarus. The press release led with a single number: 218 new listings.

That number is correct. It is also, for anyone who has to load these measures into a screening engine, considerably beside the point.

The package arrived as nine separate legal acts, published individually in the Official Journal on the same day. Three of those acts carried operative list data. Between them they produced 375 discrete records – designations, vessels, banks, crypto platforms, dual-use entities and transaction-ban targets.

FacctList polls the Official Journal every five minutes. Each of the three acts was detected within minutes of appearing, and every one was parsed, human-validated and delivered within two hours thirty minutes of detection.

This is the story of that interval, and why the gap between a measure becoming law and a record becoming screenable is the part of sanctions compliance nobody writes about.

What the 21st package actually did

The 21st package was not an incremental round. It was, by the Council's own account, the largest batch of individual listings this year—and it broke new ground in method, not just in volume.

Energy

The automatic adjustment of the oil price cap was suspended until 15 July 2027, freezing the cap rather than letting it move—an unusual admission that a dynamic mechanism had begun working against its own purpose amid disrupted crude markets.

A further 41 shadow-fleet vessels were listed, bringing the running total to 673.

For the first time, the listing criteria were extended to vessels that service designated ships, including bunkering and towing operators.

Financial services and crypto

Asset freezes hit 94 banks and major financial institutions.

A further 33 Russian credit and financial institutions were added to the transaction ban, alongside a Kyrgyz bank connected to the SPFS financial messaging system and three other non-Russian banks.

Fourteen crypto-asset service platforms across Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus were caught by the transaction ban.

A genuine first: jurisdiction-level crypto targeting

The EU introduced a dedicated third-country ban for crypto-asset services, enabling a full prohibition on transactions with crypto providers established in jurisdictions that host platforms helping Russia evade sanctions.

This is a shift from entity-level to jurisdiction-level targeting—and a meaningful escalation in method.

Military-industrial complex

56 individual listings connected to Russia's military-industrial complex, of which 37 relate directly to long-range drone production and supply chains.

A further 51 entities were added to Annex IV for tighter dual-use export restrictions, including entities in China and Hong Kong, India, Kazakhstan, Kyrgyzstan, Türkiye and the UAE.

Refineries and third countries

A new transaction-ban framework now reaches refineries in Russia and third countries that process Russian crude.

Georgia's Kulevi refinery was the first listed, effective 25 January 2027.

The through-line is unmistakable. After twenty packages, the EU has stopped simply adding Russian entities and started building instruments aimed at the network around them—intermediaries, service providers, and the jurisdictions that host them.

Nine acts, one day: the publication footprint

Here is where operational reality diverges from the headline.

Since October 2023, the Official Journal is no longer published as a collated edition with a table of contents. Each act is published individually as its own authentic Official Journal in PDF form. There is no single "OJ issue" for the 21st package to download and work through.

The package comprised nine acts, all dated 23.7.2026:

Three of the nine carry operative screening data. The remaining six are CFSP mirrors and framework amendments with no independent list impact.

Entry into force was not uniform, and this matters. Implementing Regulation 2026/1843 entered into force on the date of publication - 23 July. Regulations 2026/1848 and 2026/1846 entered into force the following day - 24 July. A twenty-four-hour split inside a single "package," across acts published simultaneously.

218 or 216? Why the headline number isn't the screening number

The Council announced 218 listings: 48 individuals and 170 entities.

The legal text says something different. Council Decision (CFSP) 2026/1845 records that 48 persons and 168 entities should be added to the annex to Decision 2014/145/CFSP. Implementing Regulation 2026/1843 gives effect to exactly that.

FacctList parsed 2026/1843 and returned 216 records. Not 218. The figure was derived from the act itself, not from the announcement.

Both numbers are right, and the difference is not a rounding error—it is a regime boundary. The Council's 218 is a cross-regime total. It combines 216 designations under the Russia asset-freeze regime (Regulation 269/2014) with two Belarusian legal persons added to Annex I of Regulation 765/2006 by a separate act, Implementing Regulation 2026/1817. FacctList detected that act independently and returned 2 records.

216 + 2 = 218.

For a communications team, those numbers are interchangeable. For anyone maintaining a screening list, they are not. The two regimes have different legal bases, different annexes, different amendment histories and different downstream obligations. A system that ingests "218 Russia designations" because that is what the press release said has quietly mis-filed two Belarus records—and will keep mis-filing them at every subsequent amendment.

This is what parsing the primary source, rather than the summary of it, actually buys you.

The number nobody published: 375

The third act is where the real volume sits, and it received almost no quantitative coverage anywhere.

Regulation (EU) 2026/1848 – the sectoral regulation amending Reg. 833/2014 – yielded 157 records. Vessels, banks subject to the transaction ban, crypto platforms, Annex IV dual-use entities, oil traders, ports, airports and the first listed refinery.

Every published summary of the 21st package describes these measures narratively – "41 more vessels," "33 additional banks," "51 entities added to Annex IV" – but none aggregates them, because narrative analysis has no reason to. A screening engine does.

Total ingested: 375 records

The announced figure was 218. The actual data change was 375 records – roughly 1.7 times larger.If your list-maintenance process is calibrated to the press release, you are sizing the work at well under two-thirds of what arrived.

All times CEST.

Every act was detected within minutes of publication, and every act was delivered within two hours thirty minutes of detection. The largest – 216 designations, each carrying aliases, identifiers and a statement of reasons – took two hours and eight minutes end to end.

Three details are worth dwelling on.

The Official Journal does not record a publication time. EUR-Lex gives a date and nothing more: OJ L, 2026/1848, 23.7.2026. Nor does OJ publication necessarily coincide with the Council's announcement – the press release and the Journal are separate systems on separate clocks.

Because FacctList polls at five-minute intervals, these detection timestamps are, to within five minutes, the closest thing that exists to an observational record of when each act actually went live.

And that record shows the acts did not appear together. Despite all nine bearing the same Official Journal date of 23.7.2026, the three list-bearing acts surfaced across a span of more than four hours – 19:22:20, 21:42:36 and 23:45:40.

A "package" published on a single date is not a package published at a single moment. Anyone running a scheduled end-of-day sweep against a single date stamp is making an assumption the data does not support.

Regulation 2026/1848 entered into force on 24 July. Delivery completed at 00:40 CEST on 24 July – forty minutes into the day the obligations became legally binding.

The comparison set. Substantive professional analysis of the package began appearing on 25 July and continued through 29 July, with several major international firms publishing their breakdowns six days after adoption.

That commentary is valuable, and neither is a substitute for the other: legal analysis tells you what the measures mean; a validated record set tells you whether you are transacting with someone on them.

But the sequencing is the point. Records were screening-ready roughly six days before the interpretive guidance most institutions rely on had been written.

On enriched data, and the gap before it arrives

None of this is an argument that FacctList replaces enriched commercial list data.

Established providers do things a primary-source pipeline does not: they resolve aliases and transliterations across scripts, attach beneficial-ownership and control chains, reconcile identifiers against corporate registries, and carry the accumulated cross-referencing that makes a designation genuinely screenable rather than merely present.

That enrichment and editorial work takes time, and it should.

The question is what happens in the meantime.

Since 9 January 2025, Article 5d of the Instant Payments Regulation (EU) 2024/886 has required payment service providers to screen their customers against EU financial sanctions at least once a day—and to re-screen immediately whenever new or amended measures enter into force.

The standard is expressly tied to entry into force.

For Regulation 2026/1848, that was 24 July 2026.

And the penalties for missing it have sharpened.

Germany's transposition of EU Directive 2024/1226, passed by the Bundestag on 15 January 2026, broadened the range of sanctions offences under the Foreign Trade and Payments Act, raised maximum sentences to five years, and made deliberate reporting failures a crime in their own right.

Banks now risk BaFin and prosecutorial action up to account-blocking orders and loss of licence.

Companies face fines of €10 million or more for organisational failure.

Enriched data is still the destination.

FacctList makes sure the journey there isn't spent unscreened.

The takeaway

The 21st package is a good stress test precisely because it was ordinary in form and large in substance.

Nine acts.

One publication date but several publication moments.

Two entry-into-force dates.

Three regimes.

A headline number that was accurate and operationally misleading at the same time.

Four things separate a list that is current from a list that merely looks current:

1. Read the acts, not the announcement.

The press release said 218.

The regulation said 216, and a second regulation under a different legal basis said 2.

2. Count what actually enters the engine.

375 records arrived, against a headline of 218.

3. Do not assume a shared date means a shared moment.

These acts surfaced more than four hours apart under one Official Journal date.

A schedule that sweeps once a day is a schedule that finds out late.

4. Measure latency against entry into force, not against publication.

That is the standard the Instant Payments Regulation applies, and it is increasingly the standard enforcement authorities apply too.

Sanctions lists do not fail loudly.

They fail quietly, in the interval between a measure becoming law and a record becoming screenable.

FacctList is built to close that interval.

Sources

• Council of the EU press release, 23 July 2026.

• EUR-Lex (OJ L, 2026/1843, 2026/1844, 2026/1845, 2026/1846, 2026/1847, 2026/1848, 2026/1849, 2026/1816, 2026/1817, all dated 23.7.2026).

• FacctList processing telemetry, 23–24 July 2026.