EU sanctions for human rights 2026: what companies and financial institutions must do

Key data

Any Spanish company with international suppliers, customers or partners has a new operational obligation as of 30 July 2026: to verify that none of the counterparties appear on the updated list of parties sanctioned by the EU. The Council Implementing Regulation (EU) 2026/1895 updates the list of natural and legal persons subject to restrictive measures under the Regulation (EU) 2020/1998, the European instrument for sanctions for serious human rights violations.

There is no grace period. The regulation has direct effect in all Member States from its publication, without the need for national transposition. This means that the compliance obligation is enforceable from the same day it enters into force.

What does this regulation establish?

Council Implementing Regulation (EU) 2026/1895 amends and updates the list of designations under Regulation (EU) 2020/1998, which is the general European framework for imposing sanctions on those responsible for serious human rights violations and abuses anywhere in the world.

The measures applied to persons and entities included in the list are as follows:

• Asset freezing: all funds and economic resources belonging to or controlled by the designated parties are blocked. No EU company or financial institution can make them available to the sanctioned parties.
• Prohibition of entry into EU territory: natural persons designated cannot enter or transit through European territory.

The regulation updates the existing list, which means that new natural persons, new legal persons (companies or organizations), or modifications to existing designations may have been added compared to previous versions of the list.

Economic and operational impact

The direct impact for companies is not a regulatory cost in itself, but the risk of non-compliance. Operating with an entity or person included in the sanctions list—even unintentionally—may result in administrative and criminal sanctions according to the legislation of each Member State.

In operational terms, the consequences are immediate:

• Urgent review of counterparties: any active commercial relationship with persons or entities that may have been included in the list must be identified and suspended.
• Update of screening systems: sanctions verification programs (control lists) must incorporate the new version of the list without delay.
• Operational blocking of payments: financial institutions must stop any transaction to or from the designated parties.
• Reputational risk: maintaining relationships with sanctioned parties, even through ignorance, can have serious reputational consequences.

The cost of adaptation depends on the size and sophistication of each company's compliance system. Organizations with automated sanctions screening tools only need to ensure that their list providers have updated the data. Companies without automated systems must perform verification manually against the EU sanctions map.

Who does it affect?

• Financial institutions: banks, insurance companies, fund managers, payment institutions and any financial intermediary with international operations.
• Exporting and importing companies: any operator that maintains commercial relationships with counterparties outside the EU.
• Companies with international supply chains: suppliers, distributors or partners in third countries must be verified.
• Compliance and legal departments: responsible for keeping compliance programs updated regarding sanctions.
• Advisors and consultants with international clients: law firms, consulting firms and tax advisors managing cross-border operations.
• Technology and service companies: any company providing services to clients or partners outside the EU.

Practical example

A Spanish industrial machinery export company has a distributor in a third country with which it has been operating for three years. On 30 July 2026, Council Implementing Regulation (EU) 2026/1895 enters into force, updating the list of sanctioned parties.

If the legal representative of that distributor—or the distribution company itself—has been included in the new list, the Spanish company has the immediate obligation to:

1. Suspend any pending payment to that entity.
2. Not deliver goods in transit if the final recipient is sanctioned.
3. Notify its financial institution to block transactions.
4. Document the measures adopted to demonstrate compliance to the competent authorities.

Failing to act immediately, even through ignorance of the list update, does not exempt from responsibility. The regulation has direct effect from its publication.

What should companies do now?

1. Immediately update sanctions control lists: verify that screening systems incorporate the most recent version of the list published in Regulation (EU) 2026/1895. If external sanctions data providers are used, confirm that they have already incorporated the update.
2. Review active counterparties: cross-reference the database of international customers, suppliers and partners against the updated list. Prioritize relationships with higher economic volume or higher geographic risk.
3. Suspend operations with potential affected parties: in case of any match or doubt, preventively block payments and deliveries until confirming the status of the counterparty.
4. Inform financial and legal departments: ensure that treasury, banking and the legal team are aware of the update and act in a coordinated manner.
5. Document compliance actions: record the verifications performed, dates and results. This documentation is key to demonstrating due diligence in the event of an inspection.
6. Review contracts with sanctions clauses: check that current international contracts include clauses that allow termination or suspension in case one of the parties is designated as sanctioned.

Official source

Consult complete regulation in official source

Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1895