EU Sanctions against Iran 2026: what companies and banks must review

Key data

European companies and financial entities with links to Iran have a new urgent obligation as of 16 March 2026: to verify that none of their counterparties appear on the updated list of sanctioned parties under the Commission Implementing Regulation (EU) 2026/648. Failure to do so exposes the organization to administrative and criminal sanctions under the legislation of each Member State.

This implementing regulation amends the list of persons, entities and bodies subject to restrictive measures under the Regulation (EU) No 359/2011, the EU's base instrument for sanctions related to the situation in Iran. The update applies immediately: there is no transitional period.

What does this regulation establish?

The EU Council approves through this implementing regulation an amendment to the list of persons, entities and bodies subject to restrictive measures in the Iranian context. The two specific measures applied to designated parties are:

• Asset freezing: all funds and economic resources belonging to the persons and entities included in the list are blocked. No European company or bank can make funds or economic resources available to them.
• Travel ban to the EU: designated natural persons cannot enter or transit through the territory of the Member States of the European Union.

The regulation falls within the framework of the Regulation (EU) No 359/2011, which is the base legal instrument. The 2026 implementing regulation updates the list of designated parties without modifying the underlying sanctions regime, which remains as established in 2011 and its successive updates.

The complete list of designated persons and entities is available in the full text of the regulation published in the Official Journal of the EU via EUR-Lex.

Economic and operational impact

The impact is not theoretical. Maintaining a commercial or financial relationship with a subject included in the list, even involuntarily, constitutes a breach of European law with direct consequences:

• Administrative sanctions: each Member State establishes its own penalties. In Spain, the sanctions regime in matters of international sanctions may involve fines of substantial amounts.
• Criminal sanctions: depending on national legislation, non-compliance may result in criminal liability for company administrators and executives.
• Operational blockade: any transfer of funds or provision of services to a designated party must be stopped immediately, which may affect ongoing contracts, pending payments or active credit lines.
• Reputational risk: association with sanctioned entities can generate severe reputational damage, especially for financial entities subject to regulatory supervision.

Financial entities have particularly high exposure, as they are required to implement real-time compliance controls over their operations and customers. Exporting companies with activity in Iran must review their entire counterparty chain.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment institutions and any institution that processes transactions with Iranian counterparties or entities with links to Iran.
• Exporting companies: any Spanish or European company that exports goods or services to Iran or to entities based or operating in that country.
• Importing companies: companies that import products of Iranian origin or from entities linked to the regime.
• Companies with service contracts: consultancies, engineering firms, technology companies or other sectors that provide services to Iranian clients.
• Compliance and legal departments: responsible for keeping counterparty screening systems updated and ensuring regulatory compliance.
• CFOs and financial directors: responsible for authorizing payments and transfers that could be blocked if the counterparty appears on the list.

Practical example

A Spanish industrial machinery company has an active supply contract with an Iranian company it has been working with for three years without incident. On 16 March 2026, Commission Implementing Regulation (EU) 2026/648 enters into force, including that Iranian company in the updated list of designated entities.

From that same day, the Spanish company is prohibited from making any delivery of goods, collecting outstanding invoices or maintaining any financial relationship with that counterparty. If the compliance department fails to detect the inclusion in the list and a payment is processed or a shipment is made, the company automatically incurs non-compliance with the regulation, with exposure to administrative and criminal sanctions under Spanish legislation.

The only way to avoid this situation is to have a counterparty screening system that updates with each new publication in the Official Journal of the EU and generates automatic alerts when an existing counterparty appears on a list of sanctioned parties.

What should companies do now?

1. Access the updated list: download and review the full text of Commission Implementing Regulation (EU) 2026/648 on EUR-Lex to identify the new designated parties included in the update.
2. Perform immediate counterparty screening: cross-reference the updated list with all current counterparties of the company: customers, suppliers, partners, intermediaries and any entity with which a commercial or financial relationship is maintained linked to Iran.
3. Suspend any operations with designated parties: if any counterparty included in the list is detected, immediately stop all pending operations, payments and deliveries and consult with specialized legal advice before taking any further action.
4. Update compliance systems: ensure that counterparty screening systems include EU sanctions lists and are automatically updated with each new publication in the Official Journal.
5. Document the verification process: keep evidence of the screening performed and the decisions made. In case of inspection or investigation, documentation of the compliance process is a determining factor.
6. Train the team: ensure that sales, procurement, finance and operations departments are aware of the obligation to verify counterparties before initiating or continuing any relationship with Iranian entities.

Official source

Commission Implementing Regulation (EU) 2026/648 of the Council, of 16 March 2026, amending Regulation (EU) No 359/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Iran. Published in the Official Journal of the European Union.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. The interpretation and application of EU sanctions regulations is complex and may vary depending on the specific circumstances of each company and the legislation of each Member State. Companies should consult with specialized legal and compliance advisors to ensure full compliance with their obligations under Regulation (EU) No 359/2011 and its implementing regulations. The author and publisher assume no liability for the use or misuse of the information contained herein.