EU Sanctions against Iran 2026: What Companies and Banks Must Do

Key data

Companies and financial entities with links to Iran have an immediate obligation from 16 March 2026: to review their counterparties and update their compliance systems. The Council Implementing Decision (CFSP) 2026/645 expands the list of Iranian persons and institutions sanctioned by the EU for serious human rights violations, implementing and updating the restrictive regime that has been in force since 2011 under Decision 2011/235/CFSP.

This is not a new regulation: it is an update of an established sanctions regime. However, each update to the list generates immediate obligations for any European operator that has or may have contact with the designated parties.

What does this regulation establish?

This Implementing Decision applies the EU's framework of restrictive sanctions against Iranian persons and entities responsible for serious human rights violations. The specific measures it establishes are:

• Asset freezing: the funds and economic resources of designated persons and entities are blocked. No European company or entity can make them available.
• Travel ban to the EU: natural persons included in the list cannot enter or transit through the territory of the European Union.
• Transaction prohibition: European companies and citizens must cease any commercial or financial transaction with the designated parties.

The sanctions regime is based on Decision 2011/235/CFSP, which has been active for more than a decade. This new Implementing Decision updates the list of designated parties, which requires all affected operators to review and update their own control systems.

Economic and operational impact

The direct commercial impact of this regulation is limited for most Spanish and European companies, as it only affects those who maintain relationships with specifically designated Iranian persons or entities. However, for sectors with links to Iran, the operational consequences are immediate.

The costs are not fees or taxes: they are compliance costs. Affected companies must:

• Update their screening systems and internal control lists.
• Review contracts, accounts and active commercial relationships with Iranian counterparties.
• Document the review process to demonstrate due diligence in the event of an inspection.

The real economic risk is not in the cost of adaptation, but in the cost of non-compliance: the legal consequences of operating with designated entities can be serious, including administrative and criminal sanctions according to the legislation of each Member State.

Who does it affect?

• Financial entities: banks, insurance companies, fund managers and any entity that processes payments or manages assets with Iranian counterparties. They are the most exposed due to the obligation to freeze assets.
• Export and import companies with commercial activity with Iran or with intermediary companies linked to Iranian entities.
• Logistics and transport companies that operate routes or services with origin or destination in Iran.
• Compliance and legal departments of any business group with presence or activity in Iran or in countries with intensive commercial links with Iran.
• Advisors and consultants who provide services to companies with exposure to Iran: they must know the updated list to advise correctly.

Practical example

A Spanish industrial company maintains a supply contract with an Iranian company with which it has been working for three years. On 16 March 2026, the Implementing Decision (CFSP) 2026/645 enters into force, which includes that Iranian company in the list of designated entities.

From that same day, the Spanish company is prohibited from making any payment, delivery of goods or provision of services to that counterparty. If it holds assets of that company in its possession (deposits, guarantees, pending refunds), it must freeze them and cannot return them without express authorization from the competent authority.

If the Spanish company does not review the updated list and makes a payment after 16 March, it incurs a breach of the sanctions regime, with the legal consequences that entails. Periodic review of the list of designated parties is not optional: it is an obligation of due diligence.

What should companies do now?

1. Review the updated list of designated parties: access the Implementing Decision (CFSP) 2026/645 published on EUR-Lex and identify if any of your Iranian counterparties appear on the list.
2. Update internal screening systems: incorporate the new designated parties into the control lists used by compliance, treasury and operations departments.
3. Immediately suspend any transaction with persons or entities identified as designated, including payments, deliveries, provision of services and return of assets.
4. Document the review process: keep written evidence that the check has been carried out and the decisions made. This documentation is essential in case of inspection or request by authorities.
5. Consult with specialized legal advice if there are ongoing contracts with Iranian counterparties, to determine the specific obligations and steps to follow without incurring non-compliance.
6. Establish a periodic review process: the list of designated parties is updated with each new Implementing Decision. Companies with exposure to Iran must monitor these updates systematically.