EU Sanctions Against Daesh and Al-Qaeda 2026: What Companies and Financial Entities Must Verify

Key data

Companies with international activity and Spanish financial entities have an immediate obligation: to verify that none of their clients, suppliers, counterparties or partners appear on the updated lists of subjects sanctioned by the EU in the fight against jihadist terrorism. The Decision (CFSP) 2026/2378, published on 27 October 2026 and in force from the previous day, modifies the sanctions regime established in Decision 2016/1693 and implies changes to the lists of persons, groups, companies and entities associated with ISIL (Daesh) and Al-Qaeda.

This is not a voluntary compliance rule. Non-compliance with these restrictive measures may result in criminal and administrative consequences in accordance with national transposition regulations. Reviewing the lists is not optional: it is a due diligence obligation.

What does this regulation establish?

Decision (CFSP) 2026/2378 modifies Decision 2016/1693, which is the European legal instrument regulating restrictive measures against ISIL (Daesh) and Al-Qaeda. This update may involve three types of changes to the lists of sanctioned subjects:

• Incorporation of new natural or legal persons to the lists.
• Modification of existing entries (update of identifying data, designation reasons, etc.).
• Removal of entries previously included in the lists.

The restrictive measures applied to designated subjects are of two types:

The rule modifies a regime that has been in force since 2016. Each update of the lists requires companies and financial entities to repeat the verification process, as a counterparty that was valid yesterday may have been designated today.

Economic and operational impact

The direct impact of this rule is not a fixed cost: it is a potentially very high cost of non-compliance. Operating with a sanctioned entity or person exposes the company to:

• Serious administrative sanctions in accordance with Spanish regulations transposing restrictive measures.
• Criminal liability for terrorism financing, with prison sentences and substantial fines.
• Blocking of operations, immobilization of funds and irreversible reputational damage.

The real operational cost falls on the compliance, risk and international operations departments: they must update their screening systems, review the consolidated EU sanctions lists and repeat due diligence verifications (KYC/KYB) on existing and new counterparties.

For financial entities, this process is especially critical, as they are subject to direct supervision by the Bank of Spain and the CNMV in matters of prevention of money laundering and terrorism financing (AML/CFT).

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities, fund managers, insurance companies and any entity subject to AML/CFT regulations.
• Companies with international activity: importers, exporters, companies with subsidiaries or partners in third countries, especially in high-risk regions.
• International trade and logistics companies: operators managing supply chains with multiple counterparties in different jurisdictions.
• Advisors and consultants: law firms, consulting firms and tax advisors providing services to potentially affected entities.
• Natural or legal persons listed: those appearing on the updated lists who will see their assets frozen and/or their entry into the EU vetoed.

Practical example

A Spanish international trade company has a supplier in a Middle East region with which it has operated for three years without incident. Following the publication of Decision (CFSP) 2026/2378 on 27 October 2026, that supplier could have been added to the lists of sanctioned subjects due to its links with ISIL (Daesh) or Al-Qaeda.

If the company does not review the updated lists and makes a payment to that supplier, it would be making funds available to a designated subject, thereby breaching EU restrictive measures. The consequences would include the opening of an administrative sanctions proceeding and, potentially, referral to the competent criminal authorities for possible terrorism financing.

The solution is simple but urgent: execute a new screening of all active counterparties against the consolidated EU sanctions list following each update published in the Official Journal.

What should companies do now?

1. Immediately review the updated lists: Access the consolidated EU sanctions list and verify whether any active counterparty (clients, suppliers, partners, payment beneficiaries) appears on it following the update of 26 October 2026.
2. Update screening systems: Ensure that compliance tools (KYC/KYB software, sanctions screening systems) have incorporated the latest version of the lists.
3. Document the verification process: Keep written records of the checks performed, with date and result. This documentation is essential in the event of an inspection or regulatory request.
4. Block operations with listed subjects: If a match is detected, immediately halt any pending operations and notify the compliance officer and, if appropriate, SEPBLAC (Executive Service of the Commission for the Prevention of Money Laundering).
5. Review the internal list update procedure: Establish a protocol that ensures each new publication in the EU Official Journal modifying sanctions lists automatically triggers a re-screening process.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602378