The largest sanctions list in European Union history has turned out to be the sloppiest of them all, and the most convenient for the country without which the Russian war machine would grind to a halt within a quarter.
On Monday, October 12, 2026, European Union foreign ministers met in Luxembourg and approved the 22nd sanctions package against Russia with virtually no debate. EU foreign policy chief Kaja Kallas announced the largest expansion of the lists since 2022. The figures were genuinely impressive: 1,569 new listings, including 826 Russian companies and 743 individuals. In a single day, the overall list under the Ukraine-related sanctions regime grew to nearly 4,600 entries.
Two weeks later, the record revealed its flip side. Council Decision (CFSP) 2026/2279 justifies the listing of all fifteen hundred-plus entities with two boilerplate formulations. Some of the plants named have not legally existed for several years. None of the 743 individuals has a date of birth or a passport number. A bank has already frozen a salary payment to an investigative journalist simply because he shares a surname with one of those listed. Not one of the 826 companies is Chinese.
That last fact outweighs all the typos combined. In 2025, China accounted for 84.6% of Russia's imports of goods that the G7 countries have designated as critical to military production. Three years earlier, in 2022, the share was 54.3%. Europe wrote the longest sanctions document in its history and carefully sidestepped its adversary's main supplier.
Two Sentences for Fifteen Hundred Fates: How Brussels Stamped Out Enemies From a Template
Let me begin with a fair caveat. Technical errors are inevitable in any legal act running to hundreds of pages, and the EU Council regularly publishes corrigenda to its sanctions regulations. That in itself is no scandal. The scandal begins where errors stop being random and form a pattern from which one can reconstruct how the document was produced.
Take the statements of reasons. Until now, virtually every package contained a separate paragraph for each new listing: why this particular plant, this CEO, this banker. The paragraphs could be formulaic, but they were individual. Decision 2026/2279 covers 1,569 people and organizations with two standard formulations. The gist of the main one is as follows: the organization is included in a recently compiled Russian government list of defense-industrial enterprises and is therefore eligible for state subsidies. In effect, the source for Europe's largest sanctions list was a Russian government document.
Then comes the linguistic archaeology. For the first time in the history of sanctions packages, the names of every single legal entity are given in literal transliteration. And not even the version the companies themselves list in the Unified State Register of Legal Entities: when registering, a Russian organization submits its full and abbreviated names in Russian, along with its own English name, and the European drafters of earlier packages often made use of this. Now even the capital letters have vanished from the names. Previously this happened in isolated cases; now it is the rule for the entire set.
The investigators who were first to take the document apart found that most of the names were rendered using the transliteration rules of the Python library transliterate, with apostrophes subsequently removed. Personal names follow the British-American BGN/PCGN standard, but far from consistently and with deviations. At least two romanization systems coexist in a single document, and nothing explains the choice between them.
The most telling evidence lies in the addresses. Neva-Ferrit LLC is registered at 50 Svobody Street, Krasnoye Selo, St. Petersburg, 198320. In the European document, the postal code lost its first digit and became 98320. Krasnoye Selo became "city Krasnoe village," meaning the drafter translated the word for "village," which under the rules must not be translated, while simultaneously calling the place both a city and a village. Svobody Street remained transliterated as "ul. Svobody," although by the same logic it should have become Freedom Street. A human translator would have chosen one strategy. A script would have chosen one strategy. This kind of inconsistency is characteristic of a generative model that solves the task anew on every line.
In the English version, Tekhkrim CJSC is located in the "Udmurtskaya Republic of..." The correct name of the region is the Udmurt Republic. Ordinary machine translation does not produce such a hybrid. It is easily explained, however, by the workings of a large language model, which does not translate in the strict sense of the word but predicts the next token. In English, most Russian republics are rendered as Republic of Tatarstan, Republic of Bashkortostan, Republic of Dagestan. A model that has seen thousands of such constructions reflexively adds "of" where it does not belong.
Another detail from the same series appears in the entry for the Kalinovsky Chemical Plant joint-stock company. Inside the Russian word for "joint-stock," the Cyrillic opening is followed by a Latin "c," then the Latin syllable "ion," all fused with the Cyrillic letters that follow. Mixed alphabets have turned up in sanctions lists before, but they looked different. A person who forgot to switch keyboard layouts would type a Latin "A" instead of the Cyrillic one, a Latin "T" instead of the Russian one: invisible to the eye, but noticeable to a computer. Here, however, the mixing involves letters that look different in the two alphabets, and entire syllables. The authors of the analysis rightly point out that precisely such hybrids regularly appear in neural network output when a task requires working in several languages at once.
The finishing touch is the website addresses. The website of NPO AMB LLC is listed in the document as licenzia-gos.rf. The top-level domain .rf does not exist: the Cyrillic domain for Russia is encoded entirely differently in Latin script. The Cyrillic-domain site the entry was meant to represent does not exist either. The algorithm transliterated an internet address with the same mechanical diligence it applied to a street name.
The neural network theory remains a reconstruction based on circumstantial evidence, and Brussels is entitled to dispute it. But the circumstantial evidence is too plentiful and too internally consistent. The scenario looks like this: the bureaucracy was tasked with turning a Russian list of defense enterprises into a European legal act, handed the job to a language model, the model wrote a script using a popular library and finished some of the lines on its own, and the result went through legal clearance without a line-by-line check. The motive is clear. The 21st package, adopted on July 23, contained 218 listings. Two and a half months later, seven times as many had to be processed. The staff of the European Commission's sanctions units did not grow sevenfold over the summer.
Dead Souls of the Russian Defense Industry: Europe Sanctions Plants That Do Not Exist
Careless transliteration irritates lawyers. Factual errors undermine the very purpose of the document.
Sanctions were imposed on the federal state-owned enterprise Novosibirsk Experimental Plant of Measuring Instruments (TIN 5425100089), along with its director, Alexei Timofeyevich Morozov. This legal entity has not existed since 2021: the plant was merged into the federal state-owned enterprise National Testing Association "State Munitions Testing Grounds of Russia" (TIN 5023002050). The parent structure also made the list. Its director general, Stanislav Gennadyevich Yuzov, did not. Europe punished the director of a defunct subsidiary and missed the head of the operating holding company.
The logic of the error is transparent. If the basis was a data dump from a Russian government list compiled several years ago, it faithfully reflected the structure of the defense industry at the time it was created. Reorganizations, mergers, and personnel changes after that date were left out of the picture, and no one checked against the current register.
The examples multiply. Radiodetal OJSC, TIN 1308038496, has in reality long been called Zubova Polyana Radio Components Plant PJSC, with a different legal form. The Scientific Research Institute for System Studies appears on the list as an institution of the Russian Academy of Sciences, although Government Order No. 268-r of February 7, 2023, transferred it to the National Research Center Kurchatov Institute, and today it is a federal state autonomous institution with an entirely different name.
With people, it is even worse. The list names Nikolai Nikolayevich Grechushkin as director general of Textile Trading Company LLC (TIN 9701054138). In fact, the director general is Anatoly Mikhailovich Trubin, while Grechushkin serves as his deputy. The piquant part is that next to Grechushkin's name is Trubin's TIN, 592003498702. Grechushkin's own TIN, 253303297804, appears nowhere in the document. Yevgenia Vladimirovna Kovalenko is listed as director of Khimreaktiv JSC, whereas the company is run by Vladimir Nikolayevich Lyamkin. Even a cursory reading of the decision reveals at least 25 discrepancies in names, legal forms, and positions.
Now for the main point. Suppose every error were corrected tomorrow. Would anything change for the Russian military industry? Almost nothing. The defense plants in Novosibirsk, Saransk, and Nizhny Novgorod buy practically nothing abroad themselves. They have no accounts in European banks, no assets in the EU, and only a handful of employees dreaming of a Schengen visa. Procurement on their behalf is carried out by entirely different entities: trading houses, shell companies in Moscow and the regions, intermediaries in Hong Kong, Shenzhen, Dubai, Istanbul, and Bishkek. It is precisely this architecture that investigative journalists have described time and again over the past three years, and it is precisely this architecture that the 22nd package leaves virtually untouched.
The result is a sanction against the sign at the factory gate. The sign does not suffer.
Hunting Namesakes: How 743 Names Without Dates of Birth Hit the Innocent and Miss the Guilty
All 743 individuals in the new package lack dates of birth and passport numbers. Instead, taxpayer identification numbers are given. A second fair caveat is in order here: a Russian TIN is indeed unique and, in theory, identifies a person more reliably than a name. The trouble is that almost no one checks it in international compliance.
Consider how screening works in practice. A European bank receiving a payment checks the surname, first name, transliteration variants, date of birth, passport details, address, position, and employer. A consulate issuing a Schengen visa checks the passport and date of birth. The Russian taxpayer number plays no part in these procedures. If a person is not a founder or director of a company, it is impossible to match their name to a TIN using open data: this information is not public in Russia.
Hence a double failure. A sanctioned engineer at a defense design bureau passes the bank check because the bank has no parameter other than his surname, and his surname is a common one. At the same time, a namesake with no connection whatsoever to the defense industry gets his transfer blocked. The first such victim is already known: an employee of an independent outlet devoted precisely to exposing Russian military procurement was unable to receive his salary. The bank froze the payment because his surname matched that of someone on the October list. The irony is almost literary: the sanctions mechanism struck a man who had spent years helping to populate it.
There were precedents. Promsvyazbank director Mikhail Dorofeyev was previously listed without a patronymic, date of birth, or TIN, creating risks for every Mikhail Dorofeyev on the planet. Comedian Mikhail Galustyan was included in the 16th package on February 24, 2025, under his stage name, although his passport reads Nshan Sergeyevich. His year of birth was given as 1970 instead of 1979. According to available information, the error has still not been corrected after twenty months. Back then it looked like a curiosity. Now the European Commission has elevated the curiosity into a method.
Carelessness has a legal price. EU courts long ago established a standard: the Council must rely on a sufficiently solid factual basis and give individual reasons for each listing. That bar was set in the Yassin Kadi case, when the EU Court of Justice, in 2008 and then definitively in 2013, annulled sanctions imposed without a coherent evidentiary basis. Since then, the principle has worked against Moscow as well. On April 10, 2024, the EU General Court ruled that the listing of Petr Aven and Mikhail Fridman for the period from February 2022 to March 2023 was unjustified. In May 2025, according to investigators, the court lifted sanctions on Andrei Kharkovsky, whom Brussels had described as a representative of a Cossack union: the Council failed to prove his connection to the organization and did not even provide unambiguous identifying information.
Two boilerplate formulations for 1,569 entities are a gift to lawyers. The deadline for filing an action for annulment with the General Court is two months from publication plus ten days. My forecast: by the end of December 2026, the first few dozen lawsuits from those listed in the 22nd package will reach Luxembourg, and in 2027 some of them will win simply because the Council will be unable to show how one LLC from Udmurtia differs from the LLC next door, other than by a line in a Russian government list.
Quantity Over Quality: Why Brussels Needed a Record
To understand where this document came from, we need to go back to the summer. The 21st package was prepared from June 9 to July 23, and the negotiations turned into grueling haggling. Each capital defended its own interests: Austria its banks, Greece its shipowners, Germany its fish-processing industry. Viktor Orbán's departure as prime minister of Hungary, on which hardliners had pinned their hopes, did not end the haggling. In the end, the list included 218 listings: 48 individuals and 170 organizations. For a war now in its fifth year, it looked almost like capitulation.
The reaction came five days later. On July 28, a leak appeared in the Western business press: the European Commission was preparing a package of 1,600 companies for October to make up for the watered-down 21st. In mid-August, Kallas promised in an interview with a German newspaper the largest package since 2022, one that would increase the number of listings by about a third. The political objective was set before the content. A number was needed, and a number was found.
Note the structure of the package. It introduces no new sectoral restrictions, does not touch energy, and does not touch Rosatom, which by various estimates generates up to 1.5% of Russian budget revenues and has remained untouchable for years because of the positions of Hungary, Slovakia, and France. There are no oligarchs in it: Vladyslav Vlasiuk, the Ukrainian president's representative for sanctions policy, said so openly even before it was approved. At the same time, however, the EU Council removed Mikhail Fridman and Alisher Usmanov from the sanctions list, which provoked open indignation in the Baltic states. Lithuania ultimately froze their assets under its national regime.
The result was the perfect consensus construction. No capital objects to freezing the assets of enterprises that have no assets in Europe. No European corporation loses a single cent. European Council President António Costa can say that now is not the time to ease pressure on Russia, and it sounds like a response to Donald Trump, who in the meantime is striking his own deals with Moscow. Kallas can point to a record. A record built from a two-year-old Russian government list.
EU sanctions policy appears to have shifted definitively to the logic of KPIs. Twenty-two packages, nearly 4,600 entries, 100 Russian banks cut off from SWIFT. These numbers look good in a press release and correlate poorly with reality at the front. According to Western and Ukrainian analysts, Russia continues to obtain most of the components it needs for missiles and drones, and drone production is growing.
The $185 Billion Elephant in the Room
Now for what the document does not contain.
Russian-Chinese trade fell 6.9% in 2025, to $228.1 billion, and Moscow was already explaining this as a natural ceiling. The ceiling did not hold for long. According to China's General Administration of Customs, trade grew 28.4% in January through August 2026, reaching $185 billion. Chinese exports to Russia over the same eight months totaled $84.7 billion, up 30.7% from the previous year. Russia is buying more from China than ever before, and a significant share of these purchases has nothing to do with cars and household appliances.
The figures for military items are even starker. China's share of Russian imports of goods on the G7 high-priority list rose from 54.3% in 2022 to 84.6% in 2025. According to an estimate from this September, about 80% of the critical electronics in Russian drones are of Chinese origin. Ukrainian military intelligence reported that Chinese components make up 60 to 65% of the Geran-2, whereas American components used to dominate. Figures from parties to a conflict should be taken with a grain of salt, but the direction of the trend is confirmed both by independent analyses of wreckage and by customs statistics.
The investigators whose analysis served as the starting point for this article identified, in a series of publications, several bottlenecks in the production of the long-range Geran and Gerbera strike drones, as well as mass-produced FPV drones. Their conclusion is fundamental: the bottleneck for Russian plants is not the intermediary exporters and importers, who can be replaced within a week, but specific Chinese manufacturers and the Chinese banks that serve them. According to the estimates they cite, FPV drones account for about 70% of combat casualties at the front. The Gerans inflict the greatest harm on civilians and the civilian infrastructure of Ukrainian cities.
This spring, citing customs documents, the Western press reported that the Chinese state-owned Jilin Chemical Fiber Group shipped 46 tons of carbon materials to Russia in early 2026. The recipient was a Rosatom subsidiary that produces components for strike drones. This is a state-owned company, not a Hong Kong shell, and that substantially changes the picture: Beijing's claim of private traders whom the state failed to keep track of looks less and less convincing.
Among the 826 companies in the 22nd package, there is not a single Chinese manufacturer, not a single Chinese reseller, not a single Chinese bank. Zero.
The Price of Every Chinese Entry: How Beijing Taught Europe Caution
The zero result looks strange only to those who have not followed the previous rounds. To everyone else, it looks like the outcome of a well-learned lesson.
For a long time, Europe approached China on tiptoe. In the spring of 2023, during preparation of the 11th package, Germany became the leading voice against any future restrictions on trade with China, and the mechanism for pressuring third countries was ultimately softened. The first companies from mainland China were sanctioned only in February 2024, two years after the war began. Brussels then began to step up the pressure, and each step drew a mirror response.
In the summer of 2025, the 18th package for the first time included two Chinese financial institutions. In August, Beijing imposed sanctions on two Lithuanian banks, UAB Urbo Bankas and Mano Bankas, and explicitly called this a response. In the fall of 2025, the 19th package targeted Chinese oil refineries and traders, 15 Chinese companies in all. Chinese Foreign Ministry spokesman Guo Jiakun declared that the EU was repeatedly imposing illegal unilateral sanctions on Chinese enterprises on a Russian pretext.
After that, the response became almost instantaneous. On April 23, 2026, the EU approved the 20th package with Chinese companies. The next day, April 24, China's Ministry of Commerce banned exports of dual-use goods to seven European firms, including the Belgian arms maker FN Herstal. On July 23, the 21st package included 14 enterprises from mainland China and Hong Kong. On July 24, Beijing added exactly 14 European companies to its export control list. One for one, with a one-day lag.
The meaning of this arithmetic is clear to every European minister. Every Chinese entry on a sanctions list costs specific European industrialists access to Chinese raw materials and components. Beijing has already shown how painful this lever can be: in the spring of 2025, export licensing for rare earth metals brought European automakers to the brink of halting their assembly lines. EU-China trade, according to Eurostat data for 2024, exceeds 730 billion euros. German automakers and machine builders sell so much to China that any escalation translates into falling share prices in Frankfurt.
There is also a less obvious detail that Brussels prefers not to mention out loud. Ukraine plans to produce 6 to 7 million FPV drones in 2026, and by some estimates 80 to 90% of the components for its own drones also come from China. On October 19, a week after the 22nd package was approved, Beijing announced new export controls on 13 categories of drone components, from motors and flight controllers to communications equipment and software. The restrictions take effect on November 18. Beijing claimed no direct link to the European decision, and attributing one would be a stretch. But everyone read the signal: China has its hand on the tap from which both warring sides drink, and it can shut it off for either of them.
Against this backdrop, the empty Chinese section of the 22nd package no longer looks like an oversight. It is more likely the result of a deliberate choice, or, worse still, a choice no one articulated out loud but everyone silently accepted. The script that processed the Russian list of defense enterprises physically could not have produced a Chinese company: there were none in it. A convenient technology relieves politicians of the need to make an inconvenient decision.
Strict With the Small, Deferential to the Big
The most revealing aspect of European sanctions policy in 2026 emerged not in Luxembourg but in Central Asia. This year, Brussels for the first time applied the anti-circumvention mechanism built into Regulation 833/2014, and it applied it to Kyrgyzstan. After years of monitoring re-exports, the EU banned shipments there of certain advanced metalworking equipment and data transmission technology.
The decision is formally justified: Kyrgyz re-exports to Russia grew manyfold for years. But the scales are not comparable. A small republic with an economy of a few tens of billions of dollars received the first strike in EU history against a transit country. China, through which the overwhelming share of critical components passes, did not get even a single line on the list.
This asymmetry is all too familiar to me from the region I write from. European demands on the small states of the South Caucasus and Central Asia are often detailed, nitpicking, and loud. Brussels' demands on the major players run dry exactly where its own economic interests begin. A sanctions policy that behaves this way ceases to be an instrument of coercion and becomes an instrument of display: it punishes those who can be punished without consequences.
The American system works differently. Washington has secondary sanctions capable of cutting off any bank in the world from dollar transactions. On July 28, 2026, the U.S. Senate voted 86 to 12 to advance a sweeping Russia sanctions bill that provides for pressure on Russia's trading partners. Trump himself, meanwhile, continues his own diplomacy with Moscow, and its outcome is uncertain. Brussels has no comparable instrument, and its existing mechanism against third countries requires the unanimity of 27 capitals at every stage. As long as that remains the case, Beijing can calmly plan next year's shipments.
A Potemkin Village in the Official Journal of the EU
Let us tally up the 22nd package without diplomatic niceties.
The winners are European politicians who needed a big number after a humiliating July. Lawyers have gained hundreds of potential clients with good chances in court. Beijing has once again confirmed that its tactic of mirror responses works. Russian procurement networks remain virtually untouched.
The losers are European banks and their customers, who face months of false positives on matching surnames. The reputation of the sanctions instrument itself suffers: every listing overturned in court becomes an argument for those in Budapest, Bratislava, and Rome who have long spoken of the futility of pressuring Moscow. Ukraine fared worst of all: it got a splashy headline instead of a blow to the real supply chains behind the Gerans flying over its cities.
I will make three verifiable forecasts. First: by December 31, 2026, the EU Council will publish a corrigendum to Implementing Regulation 2026/2281 affecting at least several dozen entries. Second: by the same date, the first actions for annulment from those listed in the 22nd package will reach the EU General Court, and in 2027 at least some of them will succeed. Third: the 23rd package, which Brussels is timing for the fourth anniversary of the full-scale war on February 24, 2027, will once again include a few Chinese companies, most likely intermediaries and Hong Kong shells, but will bypass China's major manufacturers and banks.
One question remains to which I have no answer. Who in Brussels signed the document without reading it, and did he know what he was signing?
While he ponders that, one page of the Official Journal of the European Union still bears the website licenzia-gos.rf. The .rf domain does not exist. The website does not exist. Europe sent its sanctions to an address that does not exist, and that single line holds more truth about the 22nd package than all the press releases about its record size.