EU Sanctions Against Iran 2026: What Companies with Commercial Links Must Do

Key data

European companies with links to Iran have a new compliance obligation as of 26 May 2026. Regulation (EU) 2026/1164 expands and updates restrictive measures against Iran, in response to its military support for Russia's war of aggression against Ukraine and armed groups in the Middle East and the Red Sea. The regulation amends Regulation (EU) 2023/1529, which already established the previous sanctioning framework.

Non-compliance is not an option: the consequences include serious administrative and criminal sanctions. For executives, CFOs and compliance officers, this requires an immediate review of commercial and financial relationships with Iranian entities.

What does this regulation establish?

Regulation 2026/1164 amends the sanctioning framework of Regulation 2023/1529, expanding or updating restrictive measures against Iran. The measures contemplated are of three types:

The geopolitical justification for the regulation is twofold: Iranian support for Russia's war of aggression against Ukraine through military supplies, and support for armed groups and entities in the Middle East region and the Red Sea. This context determines that designations may be expanded to entities linked to these areas.

Economic and operational impact

The impact for companies is not only legal: it is operational and financial. Working with an Iranian counterparty listed in the designated lists can result in the immediate freezing of assets linked to that commercial relationship, in addition to sanctions for non-compliance.

The sectors with the greatest exposure are those that the regulation itself identifies as highest risk:

• Defence: any component, technology or service with military application.
• Dual-use technology: products and technologies with both civil and military applications, subject to specific export controls.
• Maritime transport: operators, shipping companies, agents and logistics companies with routes or calls involving Iranian entities or traffic in the Red Sea.

Beyond these sectors, any company with supply contracts, distribution agreements, joint ventures or financial relationships with Iranian counterparties must assess whether any of them are listed in the lists updated by this regulation.

Who does it affect?

• Exporting or importing companies with Iranian counterparties
• Financial entities (banks, insurance companies, funds) with exposure to Iran
• Defence sector companies with direct or indirect relationships with Iran
• Manufacturers and distributors of dual-use technology
• Shipping companies, logistics operators and maritime agents with activity in the Red Sea or with Iranian clients
• Advisors, consultants and lawyers providing services to designated Iranian entities
• Any EU company that receives payments, transfers funds or maintains assets linked to persons or entities included in the lists of designees

Practical example

A Spanish industrial components company has an active supply contract with an Iranian engineering company. Following the publication of Regulation 2026/1164, the compliance officer must verify whether that Iranian company is listed in the updated designated lists.

If the Iranian counterparty has been included in the lists as a designated entity, the Spanish company is obliged to:

• Immediately suspend any pending deliveries or fund transfers.
• Freeze assets linked to that commercial relationship (outstanding payments, goods in transit, guarantees).
• Notify the competent authorities according to Spanish legislation on the application of sanctions.

Continuing the commercial relationship without verifying the status of the counterparty exposes the company to serious administrative and criminal sanctions, which can affect both the company and its executives personally.

What should companies do now?

1. Audit all relationships with Iranian counterparties: review active contracts, distribution agreements, joint ventures and financial relationships with Iranian entities or individuals.
2. Verify updated designated lists: check whether any Iranian counterparty is listed in the lists of Regulation 2026/1164, consulting the official text on EUR-Lex.
3. Suspend operations with designated entities: if a designated counterparty is detected, immediately halt any pending transaction.
4. Strengthen due diligence processes: especially in the defence, dual-use technology and maritime transport sectors, implement controls prior to any new operation with Iranian counterparties.
5. Document all verifications performed: maintain an updated record of checks carried out as evidence of compliance in the event of an inspection.
6. Consult specialized legal advice: given that non-compliance can result in serious administrative and criminal sanctions, it is advisable to have legal support to assess the specific exposure of each company.