A passport answers one question

Bottom line

Most onboarding flows record one country for each person, usually the issuing country of the identity document, and check it against a list of restricted countries. Sanctions rules on Russia ask three different questions about a person. The EU’s restrictions on deposits, card issuing, e-money, and crypto-asset services reach Russian nationals wherever they live, as well as residents of Russia, and release anyone who holds an EU, EEA, or Swiss nationality or residence permit. OFAC’s Russia services prohibitions and the UK’s restrictions on persons connected with Russia ask where a person lives and where a person is, and leave nationality out of the test. OFAC’s regional embargoes ask about Crimea and the so-called Donetsk and Luhansk People’s Republics, places smaller than any country on a list. One field answers one of these questions and applies the answer to all three, so it refuses customers the rules leave open and serves customers the rules reach. The control is three attributes, each with its own evidence and its own clock, and a written map of which rule reads which.

A customer file that says “Russia” can record any of three facts: the person holds a Russian passport, the person lives in Russia, or the person was in Russia when the file was opened. Each fact describes a different population, and the rules that matter most to a payments firm read them in different combinations.

Rule	What it reads	Who falls outside it
EU, Article 5b of Regulation 833/2014	Russian nationality, or residence in Russia	Holders of an EU, EEA, or Swiss nationality or residence permit
UK, persons “connected with Russia”	Ordinary residence in Russia, or presence there	Anyone both living and present outside Russia, whatever the passport
OFAC, services prohibitions under Executive Order 14071	Presence in Russia, or ordinary residence there	Anyone both living and present outside Russia, whatever the passport
OFAC, regional embargoes	Location in Crimea or the so-called DNR and LNR, including ordinary residence there	Anyone both living and present outside those regions, whatever country the address names
Blocking, in all three regimes	Identity	Anyone unlisted

The passport is decisive in one row. A Russian national living in the United States sits outside OFAC’s services prohibitions and inside the EU’s deposit and card rules, a case the Commission’s deposits FAQ uses as its example: the EU rule applies to Russian nationals “wherever they reside.” Residence and location carry the rest of the table.

Nationality is also plural. The Commission reads the exemption to cover a Russian national who also holds an EU, EEA, or Swiss nationality, and to leave in scope a Russian national whose second nationality is, for instance, Kazakh. A record with room for one nationality loses the fact that decides the case. The passport still matters everywhere as evidence of identity, which is what blocking turns on and what One person, several spellings is about. As an answer to the question “Is this person connected with Russia?”, it speaks for one regime.

For companies the same rules read place of incorporation, establishment, or domicile, and some add ownership. This piece concerns individuals.

2. What binds, and what advises

Read by layer, as From rule to workflow uses the word:

Law. Article 5b(1) of Council Regulation (EU) No 833/2014 prohibits accepting deposits from Russian nationals and natural persons residing in Russia once their total at a credit institution would exceed €100,000. Article 5b(2), as amended by Regulation (EU) 2025/2033 of October 23, 2025, prohibits providing them with crypto-asset services, the issuing of payment instruments, the acquiring of payment transactions, payment initiation services, or the issuing of electronic money. Article 5b(3) exempts nationals of a Member State, an EEA country, or Switzerland, and natural persons holding a temporary or permanent residence permit in one of them. In the United Kingdom, regulations 19A(2) and 21(2) of the Russia (Sanctions) (EU Exit) Regulations 2019 define an individual “connected with” Russia as one ordinarily resident in Russia or located there. In the United States, section 1(a)(ii) of Executive Order 14071 prohibits exporting the services Treasury has determined, among them accounting, management consulting, and certain IT and software services, to any person located in the Russian Federation. Executive Orders 13685 and 14065 prohibit exporting goods, services, or technology to the Crimea region of Ukraine and to the so-called DNR and LNR regions.
Guidance. OFAC’s FAQ 1058 reads “person located in the Russian Federation” to include persons in the Russian Federation, individuals ordinarily resident there, and entities organized under its laws. The European Commission’s FAQs, which carry no binding force, count holders of long-stay visas who have completed local registration as typically covered by the residence exemption; require the residence permit to stay valid for the entire validity of any payment instrument issued under it; and read the card rule to reach the person a card is issued to or personalized for, including the holder of a commercial card under a company’s contract.
Policy. Which legal entity runs which program, and therefore which rules apply; how residence is evidenced; which session signals prompt a review; and whether the firm declines Russian nationals as a class where no rule requires it. That last choice is risk appetite. It belongs in the policy, with an owner and a reason, and nationality can also serve the way Knowledge arrives after the payment uses corridor geography: as context that sets how closely a relationship is reviewed.
Convention. One country per person, read from the identity document and checked against a list that names Russia. It is the layer this piece argues against, because it records a policy choice as though a rule had made it.

3. Each attribute keeps its own clock

Nationality changes rarely, and its evidence arrives with the identity documents. Residence changes when a permit is granted or lapses, or when a person moves. Location changes with every trip. A control that checks all three at onboarding and at periodic review is right on the day it runs and drifts from there at three different speeds.

Each attribute captured with its evidence and its date
Eligibility computed for each program, from the attribute its rule reads
Recomputation on the event that moves that attribute
Evidence that points two ways goes to a named reviewer

The EU checks at the relationship. Recital 19 of the amending regulation places primary responsibility on the provider that services the account, and relieves payment initiation providers of determining nationality or residence transaction by transaction. Nationality and residence are therefore read at onboarding, issue, renewal, and replacement, and on the events that change them.

The permit carries a date. For an EU program, a Russian national without a second EU, EEA, or Swiss nationality needs a residence permit for the exemption, and permits expire. The Commission ties the card to the permit: the permit has to cover the card’s whole validity, and a renewal or replacement counts as a new issue. The permit’s expiry date therefore belongs in its own field: it caps the expiry date of any card issued under it, and its passing is an event. When a customer comes into scope, the Commission expects the firm to act as soon as it learns of the change.

Residence is a judgment with evidence. “Residing” and “ordinarily resident” are conclusions drawn from facts about where a person lives. A proof of address and a residence permit support the conclusion, and behavior can undercut it. A Kazakh residence permit alongside two years of logins from Moscow is evidence pointing two ways, and the case goes to a reviewer equipped the way A human in the loop needs a job description specifies.

Location is corroboration, and sometimes the test itself. Session and device location moves faster than any document and is easy to mask, so it serves best as a trigger: sessions from Russia on a customer recorded as resident elsewhere send the residence record to review. For OFAC’s services prohibitions and the UK test, though, presence counts in its own right. For a service those rules reach, a customer resident in Almaty is within them for the week of a visit to Moscow.

4. The region below the country

The embargoes reach places a country list has no way to name. OFAC’s orders call it the Crimea region of Ukraine, and a customer living there may give either country. In a December 2023 enforcement release, OFAC described a virtual currency exchange that opened 89 accounts for customers, nearly all of whom gave Russia as their country of residence and all of whom gave an address in Crimea, by naming a Crimean city, the word “Crimea,” or both. The screening read the country field. OFAC counted 989 apparent violations of the Crimea prohibitions over two years. The remediation it recorded included rejecting any applicant whose residential address names a Crimean city, whatever country accompanies it; geo-blocking IP addresses in sanctioned jurisdictions; and tools to detect VPNs that can obscure location. Its compliance considerations stress “integrating all available KYC and other relevant information” into screening, and name IP location information as part of it.

The same address arrives under Russia or under Ukraine depending on who typed it, and the same holds for Donetsk and Luhansk. The control resolves every address to a region below the country and checks the region, whatever the country field says.

A worked hypothetical

The following scenario is hypothetical and is included only to illustrate the framework. The platform, the customer, and the cardholders below are invented.

A spend-management platform issues commercial cards to the staff of its business customers: in the United States through a partner bank, and in the EU through its own e-money subsidiary. Onboarding records one country for each cardholder, read from the identity document, and declines any cardholder whose country appears on a restricted list that includes Russia. A delivery address is collected for shipping the card. Screening against the sanctions lists clears everyone below. The EU card rule reaches each cardholder, since the Commission reads it to cover a commercial card personalized for a person in scope.

A software company with staff and contractors in several countries requests four cards.

Cardholder	Passport	Lives in	Program	Stored country	Platform’s answer
A	Russian	Berlin, on a German residence permit valid for fourteen more months	EU	Russia	Declined
B	Russian	Almaty, on a Kazakh residence permit	US	Russia	Declined
C	Kazakh	Moscow, for the past six years	EU	Kazakhstan	Issued
D	Ukrainian	Sevastopol	US	Ukraine	Issued

Reading it through the framework.

A falls within the EU rule by nationality and out of it again by the German permit, under Article 5b(3). The card may be issued with an expiry date inside the permit’s validity, and the permit’s expiry stored as the event that brings A back into scope. The platform refused a card the rules allow.
B sits outside OFAC’s services prohibitions, which read presence and ordinary residence in Russia, and B has neither. Nothing in OFAC’s Russia program reached this card. Had B asked for an EU card, nationality would have decided the other way, since B holds no EU, EEA, or Swiss nationality or permit. The platform refused on a policy nobody had written.
C falls within the EU rule as a natural person residing in Russia, whatever the passport says. The card was issued in apparent breach of Article 5b(2).
D lives in the region OFAC’s Crimea embargo covers, and the card exported a service to it. The embargo’s general license for accounts of individuals ordinarily resident in Crimea, at 31 CFR 589.515, covers transactions of a personal nature and excludes supporting or operating a business, which is what a commercial card is for. The country field said Ukraine. The address said Sevastopol.

Four cardholders, four wrong answers: two refusals of cards the rules allow, and two cards issued that the rules prohibit. Every stored country was true, and every decision turned on a fact the field left out.

What would have caught it. Every nationality, residence with the permit’s issuing country and expiry, and an address resolved below the country, stored as separate fields. Eligibility computed for each program against the attribute its rule reads. A’s card capped at the permit’s expiry, with the lapse as an event. C’s proof of address read against the EU residence test. D’s address resolved to Crimea before the card shipped. B’s case decided by a written policy, whichever way the firm chooses to decide it. As From recurring question to durable control argues, the fix is a structured field and a trigger.

5. Failure modes, and the measures that expose them

The single field. Share of individual customers whose record holds nationality, residence, and address as separate fields, each with a source and a date.
The lost second nationality. Customers whose documents show two nationalities, against records that store two.
The undated permit. For every EU cardholder relying on the residence exemption, a stored permit expiry, and a count of cards issued, renewed, or replaced past it, a number a working control holds at zero.
The country-level address. Share of addresses resolved to a region below the country, and addresses in Crimea or the so-called DNR and LNR, grouped by the country value they arrived under.
The policy presented as law. Declines on nationality, by program, each tagged with the rule or the policy it rests on. A US-program decline that cites a rule reading nationality is a policy with the wrong label.
The ignored session. Customers recorded as resident outside Russia with sessions from Russia or an embargoed region, and the share reviewed within a set time.

What this changes operationally

A sanctions owner publishes a map from every restriction to the attribute it reads, for each program and each legal entity, and writes any class-wide decline as policy, with an owner and a reason.

An onboarding or product lead asks for every nationality, for residence with its evidence, and for a full address, as separate fields, and resolves the address below the country before a card ships.

A data engineer stores eligibility per program, as One cap table, several answers recommends for ownership, and recomputes on the events that move each attribute: a permit expiring, a new document, a change of address, a card renewal, a session from a watched location.

An operations lead routes evidence that points two ways to a named reviewer, and reads nationality-based declines each month by the rule or policy each one cites.

Limitations

This addresses attribute capture for individual customers. It offers no legal view on any customer or program, no evidence standards, and no review intervals, and it describes no institution’s program. Which regimes bind a firm turns on where its entities are established and where its business is done, a question for counsel. Companies raise different attributes, and the EU deposit rule also reaches entities outside the Union more than 50 percent owned by Russian nationals or residents, an ownership calculation of the kind One cap table, several answers describes. Parallel measures on Belarus are left aside. The Commission’s FAQs are guidance, and each Member State defines its own residence permits.

Residence and ordinary residence are judgments, and the evidence behind them can be thin, stale, or forged; session location can be masked. The design records which evidence each attribute rests on, so a reviewer can weigh it, and so a later reader can see what the decision knew.

Primary sources

Council of the European Union. Council Regulation (EU) No 833/2014, Article 5b, as amended by Council Regulation (EU) 2025/2033 (October 23, 2025), including recital 19 of the amending regulation.
European Commission. Provision of Payment Services, Article 5b(2) of Council Regulation 833/2014: Frequently Asked Questions (as of March 13, 2026), Questions 2, 5, 7, 8, and 12.
European Commission. Deposits, Articles 5b, 5c, and 5g of Council Regulation 833/2014: Frequently Asked Questions (as of October 12, 2022), Questions 10, 12, 28, and 30.
Executive Order 14071. Prohibiting New Investment in and Certain Services to the Russian Federation in Response to Continued Russian Federation Aggression (April 6, 2022), section 1(a)(ii), and the services determinations issued under it.
US Department of the Treasury, OFAC. Frequently Asked Question 1058 (June 9, 2022), on the meaning of “person located in the Russian Federation.”
Executive Order 13685 (December 19, 2014), on the Crimea region of Ukraine, and the Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.207 and 589.515; Executive Order 14065 (February 21, 2022), on the so-called DNR and LNR regions.
OFAC. OFAC Settles with CoinList Markets LLC for $1,207,830 Related to Apparent Violations of the Ukraine-/Russia-Related Sanctions Regulations, enforcement release (December 13, 2023).
United Kingdom. The Russia (Sanctions) (EU Exit) Regulations 2019, regulations 19A(2) and 21(2), on persons “connected with” Russia.