EU Sanctions Against Daesh and Al-Qaeda 2026: What Companies and Financial Entities Must Verify

Key data

Operating with a person or entity included in the EU sanctions list linked to Daesh or Al-Qaeda is not a minor administrative error: it is an infraction with serious legal and regulatory consequences. The Commission Implementing Regulation (EU) 2026/2143, published on 21 September 2026, updates for the 361st time Regulation (EC) No. 881/2002, which regulates restrictive measures against persons and entities associated with these terrorist organizations.

This update may include additions of new sanctioned subjects, removals from previous lists or modifications of identifying data of natural and legal persons already included. Any change in the list requires companies and financial entities to immediately review their active counterparties.

What does this regulation establish?

Regulation (EC) No. 881/2002 is the European legal framework that imposes specific restrictive measures against persons and entities associated with Daesh (ISIL) and Al-Qaeda. With this 361st amendment, the European Commission updates the annex of sanctioned subjects.

The restrictive measures applicable to all listed subjects are:

• Freezing of funds and economic resources: no company or entity may make available to a listed party any financial asset, property or economic resource.
• Prohibition on making assets available: it is prohibited, directly or indirectly, to transfer, assign or allow the use of funds or economic resources in favor of sanctioned subjects.

The amendments that this update may incorporate are of three types:

• Additions: new natural or legal persons added to the list.
• Removals: subjects removed from the list by resolution of the UN Sanctions Committee or EU decision.
• Data updates: corrections or expansions of identifying information for already listed subjects (aliases, dates of birth, nationalities, addresses).

The updated consolidated list is available in the EU's official database and must be the reference for any counterparty verification process.

Economic and operational impact

The direct impact of this regulation is not a fixed cost: it is an unlimited cost risk for those who fail to comply. Operating with a sanctioned subject may result in:

• Administrative and criminal sanctions imposed by the competent national authorities (in Spain, the Executive Service of the Commission for the Prevention of Money Laundering, SEPBLAC, and the Ministry of Economy).
• Regulatory blocking of the infringing entity's activity.
• Reputational damage with consequences for banking relationships, clients and business partners.
• Criminal liability for collaboration with terrorist organizations in serious cases.

Operationally, each update of the list requires relaunching counterparty screening processes in compliance systems, updating internal databases and documenting the verifications performed. For financial entities with large volumes of customers and transactions, this entails continuous automated review efforts.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities, investment firms and insurers that must apply screening controls on customers and operations.
• Exporting and importing companies: any company with international commercial activity that may have counterparties in risk areas.
• Companies in any sector that maintain commercial, contractual or financial relationships with natural or legal persons from third countries.
• Advisors, lawyers and consultants who manage funds or assets on behalf of third parties.
• Compliance officers and regulatory compliance officers in organizations of any size.
• Executives and CFOs with responsibility for managing regulatory risks in their organization.

Practical example

A Spanish international trade company receives an order from a new customer with an address in a third country. Before signing the contract and making any transfer, the compliance officer must verify that neither the customer, nor their legal representatives, nor related entities appear in the updated consolidated EU sanctions list as modified by Regulation (EU) 2026/2143.

If the company omits this verification and it turns out that the customer has been added in this 361st update, the company will have operated with a sanctioned subject from the date the regulation entered into force: 18 September 2026. At that point, the company is obliged to freeze any funds or economic resources linked to that operation and notify the competent authorities. Failing to do so from the outset constitutes an infraction.

This scenario repeats with each update of the list, making it essential to have an automated and periodic counterparty review process.

What should companies do now?

1. Consult the updated consolidated list in the EU's official sanctions database to identify the changes introduced by Regulation (EU) 2026/2143 (additions, removals or data modifications).
2. Relaunch screening of active counterparties against the updated list: customers, suppliers, partners, beneficial owners and any party with which an economic or contractual relationship is maintained.
3. Update compliance systems with the new list data to ensure that automated verifications reflect the version in force from 18 September 2026.
4. Document the verifications performed and retain evidence of the screening process, especially in financial entities subject to regulatory supervision.
5. Freeze and notify immediately any funds or economic resources linked to a subject detected on the list, following the procedure established by the Spanish competent authorities.
6. Review internal onboarding procedures and due diligence to ensure that verification against sanctions lists is a mandatory and documented step in each new commercial or financial relationship.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602143