EU sanctions against 14 crypto exchanges: criminal liability under section 18 AWG
Since 13 and 23 August 2026 respectively, it has been prohibited to do business with 14 named crypto and payment platforms. Anyone who does so anyway risks not a routine fine but imprisonment under the Foreign Trade and Payments Act — and the earlier route to self-disclosure with immunity from prosecution has not existed since February 2026.
- Regulation (EU) 2026/1848 bans transactions with 14 crypto and payment platforms from six third countries.
- Eleven platforms have been affected since 23 August 2026, three more already since 13 August 2026.
- What is criminal is an intentional violation under section 18 AWG — not anything in the Foreign Tax Act.
- Since the 2026 AWG reform there is no two-day grace period and no self-disclosure route to immunity.
- Note: a withdrawal route exists only for natural persons, not for companies.
The background: not a footnote
On the night of 5 August 2026, a drone fitted with an explosive device was recovered on the southern runway of Leipzig/Halle Airport — close to a Ukrainian Antonov An-124 carrying kerosene in its wings. Flight operations were suspended, several aircraft diverted. The same night, a cargo aircraft aborting its landing collided with a second, unidentified flying object. Saxony's state criminal police office and the Dresden public prosecutor's office are investigating; a CDU defence policy spokesperson publicly voiced suspicion of a Russian-directed hybrid attack.
There is no direct legal connection between the Leipzig incident and anyone's personal criminal liability under the Foreign Trade and Payments Act. We put it first deliberately, because it shows the climate the tightening described below sits in: the EU's 21st sanctions package, which lists the 14 crypto platforms, also contains 37 individual listings aimed squarely at the production chain behind Russian long-range drones. Both events belong to the same larger conflict — the incident itself supplies no legal basis for liability.
The 21st sanctions package in brief
The Council of the European Union adopted the 21st package of restrictive measures against Russia on 23 July 2026 — by its own account, the largest batch of individual listings in four years.
Listed persons and entities
48 individuals and 170 entities, spread across the financial sector, energy, the military-industrial complex and the crypto economy.
Banks and financial institutions
94 banks subject to an asset freeze, plus a transaction ban on a further 33 Russian credit and financial institutions.
Crypto and payment platforms
For the first time, a transaction ban against 14 platforms based in six third countries — Georgia, Panama, the United Arab Emirates, the Marshall Islands, Kyrgyzstan and Belarus.
For the first time, the EU is also introducing the possibility of a complete ban on crypto-asset services with an entire third country — a deterrent aimed at countries hosting platforms that help Russia evade sanctions. This instrument has not yet been applied, but is now available.
The legal basis is Council Regulation (EU) 2026/1848 of 23 July 2026, amending Regulation (EU) No 833/2014. The foreign-policy basis is the parallel Council Decision (CFSP) 2026/1849.
The 14 platforms at a glance
The governing provision is Annex VIII of Regulation (EU) 2026/1848, which supplements Part A of Annex XLV to Regulation (EU) No 833/2014. That part of the annex is headed, in substance: a list of credit and financial institutions and entities established outside the Union providing crypto-asset services or payment services that significantly frustrate the purpose of the prohibitions under this Regulation and Regulation (EU) No 269/2014.
| No. | Platform | Associated entity | Effective from |
|---|---|---|---|
| 1 | Rapira | — | 23 Aug 2026 |
| 2 | Aifory Pro | Sooty Ltd. | 23 Aug 2026 |
| 3 | ABCeX | Nueva Cryptologia S.A.S. de C.V. | 23 Aug 2026 |
| 4 | WhiteBird | — | 23 Aug 2026 |
| 5 | NoOnecrypto | NoOnecrypto Inc. | 23 Aug 2026 |
| 6 | Tradex | Brightum LLC | 23 Aug 2026 |
| 7 | Monease | Monease Ltd. | 23 Aug 2026 |
| 8 | BitPapa | — | 23 Aug 2026 |
| 9 | Exnode / Exnode Pay | Arvix | 23 Aug 2026 |
| 10 | HTX | Huobi Global S.A. | 23 Aug 2026 |
| 11 | EXMO | EXMO Ltd. | 23 Aug 2026 |
| 12 | A7 Nigeria | — | 13 Aug 2026 |
| 13 | A7 Africa | — | 13 Aug 2026 |
| 14 | PilotFinance | PilotFinance Ltd. | 13 Aug 2026 |
23 August 2026 applies to the first eleven entries. A7 Nigeria, A7 Africa and PilotFinance Ltd were already subject to the transaction ban from 13 August 2026 — alongside three banks (Chinggis Khaan Bank, Sberbank India, VTB India) that fall under the package's broader banking measures and are not counted here. Exnode and Exnode Pay are treated as a single platform group. For some of the associated-entity names shown, we have no independently verified primary source; we have included only what is confirmed across several independent sources.
The phrase "14 exchanges" is, strictly speaking, imprecise — the list covers crypto and payment service providers, not exclusively conventional trading platforms.
What a transaction ban means in law
A transaction ban is not the same thing as an asset freeze — the distinction decides what options remain open.
Freezing funds is governed by Regulation (EU) No 269/2014 and targets the listed individuals and entities themselves. The 14 platforms listed here are instead subject to a transaction ban under Regulation (EU) No 833/2014: no balance is confiscated — what is prohibited is the act itself, meaning any transaction with the listed entity.
The territorial and personal scope of Regulation 833/2014 is set out in its Article 13: it covers acts within the territory of the Union as well as nationals of a member state and companies incorporated under the law of a member state — including outside the EU. For a German resident, the ban applies regardless of where the platform's servers are located.
- Reg. 833/2014transaction ban, no confiscation
- Reg. 269/2014freezing of funds of listed persons
- Art. 13territorial and personal scope
- Art. 5ad(4)new exemption, natural persons only
- Deadlineapplication within three months of the effective date
- Payout destinationan EU-regulated institution only, not your own wallet
The newly inserted exemption in Article 5ad(4) lets the competent authority authorise transactions that are strictly necessary to withdraw funds or close accounts. It applies expressly only to natural persons who are nationals of a member state, an EEA state or Switzerland, or who hold a residence permit there. The provision names no corresponding route for companies.
First, the transaction must be necessary to terminate business dealings with the listed entity. Second, the application must be filed no later than three months after the relevant effective date — for the platforms that became effective on 23 August 2026, that means by 23 November 2026. Third, the funds may only go to a credit or financial institution authorised under the law of a member state, or failing that to a third-country institution it controls. On the wording, your own wallet does not satisfy this condition. An authorisation granted is also valid for no more than three months and does not cover continued trading.
In Germany, applications for an exemption are handled by the Deutsche Bundesbank's Financial Sanctions Service Centre, based in Munich. Given the volume of enquiries, general telephone guidance on individual cases is not the norm — the formal application is the actual route.
Criminal liability: section 18 AWG, not the Foreign Tax Act
The point where most people affected look in the wrong place.
The Foreign Tax Act (Außensteuergesetz, AStG) governs exit taxation, controlled foreign company rules and transfer pricing. It contains not a single offence for sanctions violations. Criminal liability for using a listed platform arises from section 18 of the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG), read together with the directly applicable EU regulation. Searching the AStG turns up no matching provision — and understates the actual risk considerably.
The base offence
Anyone who intentionally violates a directly applicable EU regulation implementing an economic sanctions measure under the Common Foreign and Security Policy commits an offence. The range runs from three months to five years' imprisonment — the base offence provides no fine as an alternative.
Negligence: a regulatory offence
Negligent violations are, in principle, only a regulatory offence carrying a fine — up to €500,000 for individuals, and since the 2026 AWG reform up to €40 million for companies per violation.
Up to ten years
The 2026 AWG reform substantially raised the penalty for especially serious cases. These include concealment in particular: false statements to authorities about the recipient, origin or payment route, or interposing third-country companies controlled by EU businesses.
Liability to the day
Before the reform, violations of EU sanctions regulations carried a two-day grace period after publication in the Official Journal. That has been abolished. Liability now begins exactly on the date named in the regulation — 23 August 2026 for eleven of the 14 platforms, 13 August 2026 for the other three.
The reach of such circumvention offences was not historically settled: the Federal Court of Justice held in 2010 that circumvention provisions too indeterminate to satisfy the certainty requirement in Article 103(2) of the Basic Law could not carry criminal liability (BGH, order of 23 April 2010, AK 2/10, BGHSt 55, 94). The 2026 AWG reform responded by drafting indirect conduct — such as using interposed companies — into an explicit, more clearly defined offence.
The end of self-disclosure with immunity
Perhaps the most important practical change in the whole reform — and one that differs fundamentally from the tax-law self-disclosure our practice otherwise handles.
Until 6 February 2026, anyone who committed an AWG violation could obtain immunity from prosecution through a timely self-disclosure under section 22(4) AWG — a mechanism similar to the one familiar from German tax law. That route has not existed since 6 February 2026.
In its place stands a criminally enforced duty to report. It applies, in principle, to anyone who becomes aware of a sanctions violation — not only the company acting or its management. Failing to report is now itself a criminal offence.
What this means in practice
- A violation already committed can no longer be made immune from prosecution through timely disclosure.
- Anyone who learns of someone else's violation — as an adviser, business partner or family member — carries a reporting duty of their own.
- Whether a reportable situation exists at all is an assessment for a qualified professional, before anyone makes a statement to an authority.
Anyone who discovers a possible violation, in their own affairs or in their surroundings, should seek legal advice immediately. The remaining options differ fundamentally from those in tax law — a well-intentioned but badly timed disclosure can become the central piece of evidence against the person making it.
The tax side effect: the forced sale
The sanction itself raises no tax question. Its practical implementation can raise one anyway.
Transferring your own crypto-assets to another address is not, by itself, a taxable event. A sale for euros is different: under section 23(1) sentence 1 no. 2 of the Income Tax Act, a private disposal arises where no more than one year lies between acquisition and disposal. On top of that comes the exemption threshold in section 23(3) sentence 5: gains stay tax free where the total gain for the calendar year is below 1,000 euros — once that is exceeded, the entire gain is taxable.
Because your own wallet does not satisfy the wording of the exemption clause as a payout destination, some of those affected are left with little choice but to sell in order to exit a listed platform in time at all. The time pressure created by the sanction changes nothing for tax purposes — German income tax law recognises no exception for a forced sale within the one-year period.
Anyone still within the one-year period who has to sell should document the transaction cleanly: the acquisition date, the date of the forced sale, and the fact that the sanction — not a free business decision — dictated the timing. That does not change the tax assessment, but it makes the position considerably easier to explain to the tax office later.
Overlap with money laundering law
Transactions with a listed platform can carry a money-laundering dimension alongside the sanctions dimension. An obliged entity under the German Money Laundering Act — a bank or crypto service provider, for instance — that becomes aware of a connection to one of the listed platforms will regularly have a duty to file a suspicious activity report with Germany's Financial Intelligence Unit. For private individuals this creates no direct duty of that kind, but it is exactly the sort of thing that can surface later when a bank or payment provider reviews the source of funds. Our article on source of funds evidence
Checklist
Six steps if you or a client use, or have used, one of the 14 platforms.
- Check whether any balance remains on one of the 14 platforms at all — smaller residual holdings count too
- Establish the relevant effective date (13 or 23 August 2026) and note the three-month deadline for an exemption application
- For natural persons: assess whether an application to the Bundesbank's Financial Sanctions Service Centre is still sensible and can still be filed in time
- For companies: have your position reviewed by a lawyer, since the exemption clause names no route here
- For any sale within the one-year period: document the acquisition date, the sale date, and the sanctions-driven reason for it
- If you become aware of a violation already committed: seek legal advice immediately — self-disclosure with immunity from prosecution has not existed since February 2026
Questions and answers
Why does the Foreign Trade and Payments Act apply here, not the Foreign Tax Act?
Is using one of the 14 platforms automatically a criminal offence?
Can I still withdraw my balance?
Who grants this authorisation in Germany?
Can I still self-report to avoid prosecution if I notice a violation?
Does a forced sale trigger a tax liability?
What does the drone incident at Leipzig airport have to do with the crypto sanctions?
Legal position: 30 August 2026. Sources: Council Regulation (EU) 2026/1848 of 23 July 2026, Annex VIII; Regulation (EU) No 833/2014, in particular Article 5ad(4) and Article 13; Regulation (EU) No 269/2014; Council Decision (CFSP) 2026/1849; sections 18, 19 and 22(4) of the Foreign Trade and Payments Act (AWG) as amended by the 2026 reform; Federal Court of Justice, order of 23 April 2010, AK 2/10, BGHSt 55, 94; section 23 of the Income Tax Act.
Further sources: Council of the European Union, press release "21st package of sanctions: EU hits Russian energy, financial services and crypto hard" of 23 July 2026; Deutsche Bundesbank, statements on its Financial Sanctions Service Centre; German reporting on the incident at Leipzig/Halle Airport of 5 August 2026 (ZDF, NZZ, Nius).
The associated-entity names for individual listed platforms rest on several consistent sources rather than our own review of the full Official Journal text, which remains the governing document. The account of how section 18 AWG relates to especially serious cases reflects the professional literature available to us; the final paragraph numbering of the 2026 AWG reform should be verified against the current statutory text in any individual case. This article is not advice on an individual case and is not criminal defence. Where this English text and the German version differ, the German version governs.