diff --git a/vmhost/flags.go b/vmhost/flags.go
index b9f4d008b..b329b1b6e 100644
--- a/vmhost/flags.go
+++ b/vmhost/flags.go
@@ -5,4 +5,7 @@ import "github.com/multiversx/mx-chain-core-go/core"
 const (
 	// CryptoOpcodesV2Flag defines the flag that activates the new crypto APIs for RC1.7
 	CryptoOpcodesV2Flag core.EnableEpochFlag = "CryptoOpcodesV2Flag"
+
+	// MultiESDTNFTTransferAndExecuteByUserFlag defines the flag that activates the enshrined sovereign functions
+	MultiESDTNFTTransferAndExecuteByUserFlag core.EnableEpochFlag = "MultiESDTNFTTransferAndExecuteByUserFlag"
 )
diff --git a/vmhost/hostCore/host.go b/vmhost/hostCore/host.go
index 8ba4ec040..8fe028ab5 100644
--- a/vmhost/hostCore/host.go
+++ b/vmhost/hostCore/host.go
@@ -40,6 +40,7 @@ const internalVMErrors = "internalVMErrors"
 // allFlags must have all flags used by mx-chain-vm-go in the current version
 var allFlags = []core.EnableEpochFlag{
 	vmhost.CryptoOpcodesV2Flag,
+	vmhost.MultiESDTNFTTransferAndExecuteByUserFlag,
 }
 
 // vmHost implements HostContext interface.
@@ -544,6 +545,10 @@ func (host *vmHost) AreInSameShard(leftAddress []byte, rightAddress []byte) bool
 
 // IsAllowedToExecute returns true if the special opcode is allowed to be run by the address
 func (host *vmHost) IsAllowedToExecute(opcode string) bool {
+	if !host.enableEpochsHandler.IsFlagEnabled(vmhost.MultiESDTNFTTransferAndExecuteByUserFlag) {
+		return false
+	}
+
 	mapAddresses, ok := host.mapOpcodeAddressIsAllowed[opcode]
 	if !ok {
 		return false