EU sanctions for human rights 2026: what companies must review

Key data

If your company operates with international counterparties, Council Implementing Regulation (EU) 2026/1720 affects you from today. The EU Council has updated the list of persons and entities subject to restrictive measures under the horizontal sanctions regime on human rights, established by Regulation (EU) 2020/1998. This is not a future warning: the regulation entered into force on the same day it was published.

The consequences for companies that do not act are direct: operating with any of the newly designated persons—even involuntarily—constitutes a breach of EU restrictive measures, with the legal consequences that entails in Spain.

What does this regulation establish?

Regulation 2026/1720 updates the list of natural and legal persons included in the EU's horizontal sanctions regime on human rights. This regime, in force since 2020, allows the EU to impose restrictive measures on any person or entity in the world responsible for serious violations or abuses of human rights, regardless of their nationality or geographical location.

The two specific measures applied to all designated persons are:

• Asset freezing: all funds and economic resources belonging to designated persons located in EU territory are blocked immediately.
• Prohibition of entry into the EU: designated natural persons cannot access or transit through the territory of any Member State.

Furthermore, and this is critical for companies: designated persons cannot operate with European counterparties or access the EU financial system. This means that any payment, transfer, contract, provision of services or commercial relation with a designated person is prohibited, regardless of whether the Spanish company is unaware of the designation.

The regime under Regulation (EU) 2020/1998 is directly applicable in all Member States, including Spain. Non-compliance is pursued under national regulations: in Spain, Law 10/2021 on combating money laundering and export control regulations establish the applicable sanctions framework.

Economic and operational impact

The impact is not only legal: it is operational and financial. Companies that do not update their compliance systems with the new list expose themselves to:

• Administrative sanctions for non-compliance with EU restrictive measures, the amount of which depends on applicable national regulations.
• Criminal sanctions in the most serious cases, including liability of natural persons (directors, compliance officers).
• Blocking of financial operations by banking entities that detect the relationship with a designated person in their own screening systems.
• Reputational damage to clients, investors and business partners.
• Forced termination of contracts in progress with newly designated entities or persons.

The cost of not acting far exceeds the cost of reviewing and updating compliance systems. Financial entities already have a legal obligation to perform this screening continuously; for other companies, responsibility falls on the operator itself.

Who does it affect?

• Exporting and importing companies with commercial relations outside the EU or with subsidiaries in third countries.
• Financial entities (banks, insurance companies, asset managers, fintechs) with continuous obligation to screen counterparties.
• Foreign trade operators who process international payments or contracts with foreign legal entities.
• Professional services companies (consulting, audit, legal) that provide services to international clients.
• Compliance and legal departments of any company with international exposure, which must update their screening lists.
• CFOs and financial directors responsible for authorizing international payments or relations with non-resident counterparties.

Practical example

A Spanish industrial company maintains a supply contract with a foreign company. On 13 July 2026, that foreign company is included in the updated list of Regulation 2026/1720 as an entity subject to restrictive measures for serious human rights violations.

From that same day, any payment, transfer or provision of services linked to that contract constitutes a breach of EU restrictive measures. The Spanish bank of the company will detect the operation in its screening system and block the transfer. Furthermore, the Spanish company must terminate the contract and notify the situation to the competent authorities.

If the company had not updated its compliance system with the new list and makes the payment unknowingly, lack of knowledge does not exempt from liability. That is why immediate review of the list is the only action that eliminates the risk.

What should companies do now?

1. Access the updated official list published in the EU Official Journal (CELEX:32026R1720) and download the complete list of newly designated persons.
2. Cross-reference the list with the company's counterparty database: clients, suppliers, partners, intermediaries and any natural person with power of representation in foreign entities.
3. Update compliance and screening systems with the newly designated persons. If automated sanctions control tools are used, verify that they already incorporate the update of 13 July 2026.
4. Provisionally suspend any pending operations with counterparties that appear on the list until receiving specific legal advice.
5. Notify the legal department and compliance officer so they can assess whether there is any ongoing contractual relationship that must be terminated or reported to the authorities.
6. Document the review process: in case of inspection or investigation, proving that the company performed due diligence on the date of publication of the regulation significantly reduces sanctions risk.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1720