EU Sanctions against Daesh and Al-Qaeda 2026: what companies and financial entities must do

Key data

Any company or financial entity operating in the EU has a legal obligation not to maintain commercial or financial relations with persons and entities included in the list updated by the Commission Implementing Regulation (EU) 2026/1211. This update, the 357th amendment to Council Regulation (EC) No 881/2002, entered into force on the same day of its publication, 2 June 2026, with no adaptation period.

The regulation responds to decisions of the UN Sanctions Committee and directly and immediately binds all EU Member States. It is not a recommendation: it is a legal obligation with serious criminal and administrative consequences in case of non-compliance.

What does this regulation establish?

Commission Implementing Regulation (EU) 2026/1211 amends the consolidated list of persons and entities associated with the organizations ISIL (Daesh) and Al-Qaeda that are subject to specific restrictive measures under Council Regulation (EC) No 881/2002.

The restrictive measures imposed by this regulation are as follows:

• Freezing of financial assets: all funds and economic resources belonging to listed persons and entities must be immobilized immediately.
• Prohibition of making funds available: it is expressly prohibited to transfer, assign or make available, directly or indirectly, funds or economic resources to any person or entity included in the list.
• Prohibition of commercial and financial relations: companies must verify that they do not maintain any active relationship with those affected.

This is the 357th update to Council Regulation (EC) No 881/2002, reflecting the dynamic nature of this list: it is updated frequently following UN Sanctions Committee decisions. Each update may add new persons or entities, modify data of those already listed, or remove those who have been delisted.

Economic and operational impact

The impact is not only legal compliance: operating with a sanctioned person or entity can result in freezing of the funds involved in the transaction, in addition to applicable administrative and criminal sanctions. The specific operational consequences are:

• Immediate review of counterparties: any company that has not updated its screening systems since 2 June 2026 risks maintaining prohibited relationships unknowingly.
• Cost of non-compliance: non-compliance can result in serious administrative and criminal sanctions, as expressly established by the regulation. The specific amount depends on the national legislation of each Member State.
• Operational cost of compliance: companies with a larger volume of counterparties (financial entities, large exporting companies, payment operators) must update their control tools and verification lists.
• Reputational risk: being identified as a counterparty to a sanctioned entity has serious reputational consequences, regardless of whether the non-compliance was intentional.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities, fund managers and any entity that manages assets or carries out transfers. They are the most exposed and have the greatest screening obligations.
• Companies with international activity: importers, exporters and companies with suppliers or customers outside the EU that may have links with risk areas.
• Companies in any sector with active commercial relationships: any company that invoices, pays or has active contracts must verify that its counterparties are not listed.
• Advisors and wealth managers: professionals who manage funds or assets of third parties have a direct obligation to verify the status of their clients.
• EU citizens who may have economic links with listed persons or entities.

Practical example

A Spanish financial entity processes hundreds of international transfers daily. On 2 June 2026, the 357th update of the sanctions list enters into force. If that entity does not update its screening system that same day and processes a transfer to a person or entity newly added to the list, it will have breached Regulation (EU) 2026/1211 from the moment of the transaction.

The practical result: the transaction is illegal, the funds involved are subject to freezing, and the entity is exposed to serious administrative and criminal sanctions under Spanish transposition legislation. Good faith does not exempt from liability if adequate controls have not been adopted.

The same applies to an industrial company that has a raw materials supplier whose legal representative has been added to the list: any payment made after 2 June 2026 without having verified the updated list constitutes a breach.

What should companies do now?

1. Immediately update screening systems: incorporate the updated list into counterparty verification systems. Entry into force was 2 June 2026, with no grace period.
2. Review active commercial and financial relationships: verify that no supplier, customer, payment beneficiary or contractual counterparty appears in the updated list of Regulation (EU) 2026/1211.
3. Freeze assets if a match is detected: if a listed person is identified among counterparties, the obligation is to immediately immobilize related assets and notify the competent authorities.
4. Document the verification process: maintain a record of checks performed and their date, to be able to prove compliance in the event of an inspection.
5. Establish a protocol for periodic updates: given that this is the 357th amendment to Regulation 881/2002, updates are frequent. Companies must have an automated or periodic process for reviewing the consolidated list.
6. Consult a specialized legal advisor if there is any doubt about whether a counterparty may be affected, before carrying out any transaction.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1211