Key data
| Regulation | Commission Implementing Regulation (EU) 2026/2287 of 8 October 2026 |
|---|---|
| Modified regulation | Council Regulation (EC) No 881/2002 (362nd amendment) |
| Publication | 9 October 2026 |
| Entry into force | 8 October 2026 |
| Affected parties | Financial entities, companies with international activity and any person operating with the listed sanctioned entities |
| Category | European Regulation |
| Year | 2026 |
If your company has international activity or your entity manages third-party funds, this update affects you directly. The Commission Implementing Regulation (EU) 2026/2287, published on 9 October 2026 and in force from the previous day, modifies for the 362nd time Regulation (EC) No 881/2002, which regulates restrictive measures against persons and entities associated with ISIL (Daesh) and Al-Qaeda. It is not a new regulation: it is the continuous update of a living list that companies must consult systematically.
The message for compliance officers and CFOs is clear: operating with any person or entity listed in the consolidated list—even if through lack of awareness of the update—constitutes a breach with serious administrative and criminal consequences.
What does this regulation establish?
Commission Implementing Regulation (EU) 2026/2287 introduces changes to Annex I of Regulation (EC) 881/2002, which contains the consolidated list of natural and legal persons subject to restrictive measures due to their links with ISIL (Daesh) or Al-Qaeda. The changes may include:
- Addition of new persons or entities to the sanctions list.
- Modification of existing entries (update of identifying data, aliases, dates of birth, nationalities, etc.).
- Removal of previously included entries.
The restrictive measures applied to all listed entities are:
- Freezing of funds and economic resources: no financial asset or economic resource of the listed entities may be moved, transferred, altered or used.
- Prohibition of making available: it is prohibited to make available to the listed entities, directly or indirectly, any fund or economic resource.
This is the 362nd amendment to Regulation 881/2002, which reflects the dynamic nature of this list: it is updated frequently and companies cannot assume that the version they reviewed months ago remains valid.
Economic and operational impact
The impact is not a single figure: it depends on each company's level of exposure to international counterparties and the robustness of its control systems. However, the risks are concrete and quantifiable in terms of consequences:
- Serious administrative sanctions for operating with listed entities or persons, even if the breach was unintentional.
- Criminal liability for administrators and directors if negligence or intent in counterparty control is proven.
- Blocking of operations and possible freezing of own funds if the financial entity detects the irregularity during a transaction.
- Reputational cost with clients, investors and regulators, especially in financial and international trade sectors.
The operational cost of updating compliance systems—reviewing the consolidated list, updating filters in screening software, training the team—is significantly lower than the cost of non-compliance. Companies with automated counterparty screening processes only need to ensure that their list provider has incorporated the update of 8 October 2026.
Who does it affect?
- Financial entities: banks, savings banks, credit cooperatives, fund managers, insurance companies and any entity that manages or transfers third-party funds.
- Companies with international activity: importers, exporters, companies with subsidiaries or partners abroad, especially in high-risk areas.
- Payment and fintech companies: money transfer platforms, payment gateways and payment service providers.
- Law firms and advisors: that manage funds or carry out operations on behalf of clients (obliged entities subject to anti-money laundering regulations).
- International trade companies: any company that has commercial relationships with counterparties outside the EU must verify that none are listed in the updated list.
- Compliance officers and regulatory compliance officers of any organization with international exposure.
Practical example
A Spanish industrial machinery export company has among its regular customers a distribution company based in a third country. The compliance department carried out its last counterparty verification in July 2026, when that distribution company was not listed in any sanctions list.
With the update of 8 October 2026 (Regulation 2026/2287), that distributor could have been added to the Regulation 881/2002 list. If the exporting company processes an order or transfers funds without having updated its screening, it would be in breach of EU anti-terrorism regulations, regardless of its good faith.
The solution is operationally straightforward: launch a review of the updated consolidated list before processing any pending operations with international counterparties, and configure automatic alerts in the compliance system so that each update to Regulation 881/2002 triggers a new verification.
What should companies do now?
- Immediately update the screening list: download or verify that the sanctions list provider has incorporated the updated version of Annex I of Regulation 881/2002 with the changes of 8 October 2026.
- Re-run screening of active counterparties: execute a new verification on all customers, suppliers and business partners with whom there are ongoing or pending operations.
- Review recent operations: check that no transaction executed since 8 October 2026 involves persons or entities that have been added in this update.
- Document the process: keep written record of the verification date, the version of the list used and the screening result. This documentation is key in the event of a regulatory inspection.
- Configure automatic alerts: if the compliance system allows it, activate notifications for each new modification to Regulation 881/2002, given that updates are frequent (already 362).
- Inform senior management: the compliance officer must communicate to management and the CFO the result of the review and any incidents detected, so they can make informed decisions about ongoing operations.
Frequently asked questions
Where can I consult the updated list of persons and entities sanctioned by the EU?
The consolidated list of Regulation (EC) 881/2002, with all amendments including that of Regulation 2026/2287, is available on EUR-Lex, the official EU law portal. It can also be consulted through the European Commission's sanctions search tool. It is the official source and the only valid one for compliance purposes.
What happens if my company operates with someone on the list without knowing it?
Lack of knowledge does not exempt from responsibility. Operating with persons or entities listed in Regulation 881/2002—whether by transferring funds to them, making economic resources available to them or maintaining commercial relationships—constitutes a breach of EU anti-terrorism regulations. The consequences include serious administrative sanctions and, in cases of negligence or intent, criminal liability for administrators and directors.
How frequently is the sanctions list under Regulation 881/2002 updated?
The update published on 9 October 2026 is the 362nd amendment to Regulation 881/2002, which gives an idea of how frequently this list is updated. Companies cannot assume that a one-time verification is sufficient: they must establish periodic or automated counterparty screening processes.
What specific measures does the EU impose on listed persons and entities?
Regulation 881/2002 imposes two main measures: the freezing of all funds and economic resources of the listed entities, and the prohibition of making available any financial asset to them, directly or indirectly. This means that no company or entity can transfer money to them, provide them with financial services or facilitate resources of any kind.
Does this regulation affect only financial entities or also non-financial companies?
It affects any natural or legal person operating with the listed entities, not just financial entities. Companies with international activity—importers, exporters, companies with partners or subsidiaries abroad—are equally obliged to verify that their counterparties do not appear in the updated Regulation 881/2002 list.
Official source
Consult full regulation on official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602287
