Brussels Is Writing Its 22nd Russia Package, and This Time the Trigger Is Arson and Drones

EU ambassadors reached a provisional agreement on Wednesday to add 145 individuals and entities to the Union's Russia sanctions lists, according to a European diplomat quoted by reporters in Brussels. The listings cover people and organisations involved in the war, in cyberattacks and in hybrid activity, and are due to be finalised at the Foreign Affairs Council on 16 November.

Separately, Bloomberg reported on Thursday that the Commission is preparing more than a hundred further measures for a 22nd package, aimed at Russian banks, energy companies and the tankers that carry Russian oil around existing restrictions. EU foreign ministers may discuss those measures as early as the 16 November meeting, with adoption expected at their December session.

The justification has changed

The detail that matters is not the count. It is the reasoning. According to accounts of the preparatory work, the new measures are being tied not only to the war in Ukraine but to a series of incidents inside the EU: cyberattacks, arson, and an attempted drone attack on an airport in Germany.

That is a different legal and political animal from an asset freeze on a defence manufacturer. Hybrid-attack designations require the Union to attribute conduct to a state with enough confidence to defend it in court, and to name the European-based facilitators who make it possible. It also moves sanctions from the foreign policy pages into the domestic security debate, where the evidence has to satisfy interior ministries rather than only diplomats.

It has been building for weeks. The EU has already attributed arson at the Milrem facility in Estonia to Russian special services. Bomb threats forced the evacuation of newsrooms and diverted flights in Dublin in early November. The Commission has been building what officials describe as a permanent sanctions machine, with a dedicated crypto task force, since the summer.

What is likely in the December package

The reporting points to three blocks. Banking: further pressure on Russian financial institutions, including those used to route payments for sanctioned goods. Energy: measures against Russian energy companies, extending a campaign that has already covered oil services, liquefied natural gas transshipment and the insurance chain. Shadow fleet: additional tanker designations, the instrument the Union has used most aggressively because it hits revenue without touching European consumers directly.

None of those is novel in kind. What is new is the volume in a single instrument, and the willingness to present it as a security package rather than a Ukraine package.

The sequencing problem

This is where it gets complicated. The Commission is also due to present its proposals for closing Ukraine's 2027 financing gap before the end of the year. Friedrich Merz has made a universal contribution to that gap a precondition for discussing the next seven-year budget. Slovakia's Robert Fico opposes further support outright. Hungary and the Czech Republic have opt-outs from the existing €90 billion loan and are expected to seek them again.

A sanctions package is adopted by unanimity in the Council. So is any new financing instrument. That gives the governments that want to slow one file a lever on the other, and it is why the December foreign affairs council and the December European Council are now effectively a single negotiation conducted in two rooms.

There is also the question of the frozen assets. A group of MEPs wrote to the institutions this week arguing that the Russian Central Bank funds held at Euroclear should be placed in an EU-controlled structure, so that they cannot be released as part of a settlement struck without Europe. That proposal has been circulating since the summer under various names. If it advances, the December package stops being only about new designations and becomes about who controls roughly €200 billion of someone else's money.

What to watch

Whether the 145 listings survive the 16 November council intact, or whether a member state strips out names for lack of admissible evidence. Whether the Commission publishes the legal basis for the hybrid-attack designations, because that will determine how many of them are challengeable in the Court. And whether the December package lands before or after the leaders settle Ukraine's financing, since the answer tells you which file the Council is actually treating as the priority.