EU Counter-Terrorism List 2026: What Companies and Financial Entities Must Verify

Key data

If your company operates with international counterparties or your financial entity manages accounts of individuals or legal entities with international profile, this update requires you to act today. Commission Implementing Regulation (EU) 2026/1878, published on 30 July 2026, updates the list of subjects subject to fund freezing and economic resources in the framework of the European Union's counter-terrorism efforts.

This is not a new regulation: it is a mandatory periodic update of the mechanism established by Regulation (EC) No. 2580/2001, which has been in force since 2001 and which the EU Council reviews and updates regularly. What changes with each update is the specific content of the list — and that is exactly what companies must verify.

What does this regulation establish?

Regulation 2026/1878 applies Article 7 of Regulation (EC) 2580/2001 and updates the list of natural and legal persons subject to specific restrictive measures in the EU counter-terrorism field. The specific measures it establishes are as follows:

• Freezing of funds and economic resources of all persons and entities included in the updated list.
• Prohibition on making funds available to the listed subjects, whether directly or indirectly.
• Prohibition on maintaining commercial or financial relationships with the included subjects.
• Possibility of humanitarian exceptions under strict conditions, authorized by the competent national authorities.

The regulation is directly applicable in all EU Member States, including Spain, without need for transposition or national regulatory development. It enters into force on the same day as its publication: 30 July 2026.

Supervision of compliance falls to the competent national authorities of each Member State, which are also responsible for processing requests for humanitarian exceptions where applicable.

Economic and operational impact

The impact is not theoretical. Operating with a counterparty included in the EU counter-terrorism list can result in:

• Serious administrative sanctions imposed by the competent national authorities.
• Criminal liability for the natural persons responsible for the operation.
• Blocking of funds already transferred or in transit if the link is detected later.
• Reputational damage and possible additional regulatory consequences for supervised financial entities.

The operational cost of compliance — updating screening systems, reviewing counterparties, training compliance teams — is significantly lower than the cost of a sanction for non-compliance. Financial entities already have an obligation to maintain sanctions list control systems; for other companies, the obligation is equally enforceable although control mechanisms may be more manual.

Who does it affect?

• Financial entities (banks, savings banks, credit cooperatives, payment entities, fund managers): obligation to screen customers and counterparties against the updated list.
• Companies with international activity that maintain commercial relationships with natural or legal persons from third countries.
• Companies in any sector that operate with counterparties whose identity or beneficial ownership may coincide with listed subjects.
• Advisors, consulting firms and law firms that manage funds or assets of third parties.
• Payment platforms and fintechs with compliance obligations regarding international sanctions.
• Compliance and legal departments of any medium or large company with international exposure.

Practical example

A Spanish import company maintains commercial relationships with a foreign supplier with whom it has been working for three years without incident. On 30 July 2026, the EU Council publishes Regulation 2026/1878 updating the counter-terrorism list: the name of that supplier — or its beneficial owner — now appears on the list.

From that same day, any payment made to that supplier constitutes a breach of Regulation (EC) 2580/2001. The company has the obligation to:

1. Immediately block any pending transfers.
2. Not make additional funds available to the supplier.
3. Notify the situation to the competent national authority.
4. Retain the frozen funds until receiving instructions from the authorities.

If the company does not perform this verification and executes the payment, it incurs a breach even if it was unaware of the supplier's inclusion on the list. Due diligence is the responsibility of the operator, not the authorities.

What should companies do now?

1. Access the updated list published in the Official Journal of the EU (Regulation 2026/1878) and verify if any counterparty, client or supplier appears on it.
2. Review the database of active clients and suppliers, especially those with international activity or complex beneficial ownership.
3. Update international sanctions screening systems with the new list. If no automated tool is available, perform the verification manually immediately.
4. Preventively block any pending operations with counterparties about which there is doubt until confirming they do not appear on the list.
5. Document the verification process performed, with date and result, to demonstrate due diligence in the event of an inspection.
6. Consult the competent national authority if any match is detected, before acting unilaterally. Humanitarian exceptions must be expressly authorized.
7. Train or remind the compliance team of the obligation to repeat this process with each periodic update of the list.

Non-compliance with these restrictions can result in serious administrative and criminal sanctions, as established by the regulation itself. Ignorance of the update does not exempt from responsibility.

Official source

Consult complete regulation in official source — EUR-Lex: Commission Implementing Regulation (EU) 2026/1878

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1878