EU Sanctions Against Iran 2026: What Companies Must Verify

Key data

European companies that maintain commercial, financial or logistical relationships with Iranian counterparties have an immediate obligation: to review their lists of partners and verify that none appear on the updated list of sanctioned parties. The Implementing Regulation (CFSP) 2026/1225, published and in force since June 8, 2026, expands the EU's restrictive measures against Iran in application of Regulation (EU) 2023/1529.

This is not a future regulation: it entered into force on the same day as its publication. The risk of non-compliance is immediate for any company that has not updated its compliance controls.

What does this regulation establish?

Regulation 2026/1225 is an implementing regulation, that is, it directly applies the existing sanctions framework—Regulation (EU) 2023/1529—by adding new persons and entities to the lists of designees. The reasons for designation fall within three areas:

• Supply of military material to Russia for use in the war of aggression against Ukraine.
• Support for armed groups in the Middle East and the Red Sea (including entities that finance, supply or facilitate operations of these groups).
• Actions that compromise freedom of navigation in the Middle East region.

The legal consequences for designees are two, and they are automatic from the date of entry into force:

• Freezing of all assets of designees in EU territory.
• Prohibition of making funds or economic resources available to them, directly or indirectly.

The regulation does not publish in the official summary the specific names of the new designated persons and entities; these appear in the annexes of the full text published in the EU Official Journal. Consultation of those annexes is mandatory for any company operating with Iranian counterparties.

Economic and operational impact

The impact is not only legal: it has direct operational and economic consequences for affected companies.

• Immediate blocking of operations: any transaction in progress with a designee must be stopped from June 8, 2026. Pending payments, shipments in transit or active contracts are affected.
• Freezing of assets in the EU: if the European company manages or holds assets of a designee (accounts, deposits, guarantees), it is obliged to freeze them and notify the competent authorities.
• Risk of criminal and administrative sanctions: non-compliance with the sanctions regime is prosecuted according to the legislation of each Member State. In Spain, serious breaches of the international sanctions regime may result in substantial fines and, in cases of willful misconduct, criminal liability.
• Reputational and financing risk: banks and financial entities apply their own compliance controls; a company that appears linked to a sanctioned party may have its accounts or credit lines blocked.

Who does it affect?

• Exporters and importers with Iranian counterparties (direct or indirect).
• Financial entities and banks that manage accounts, transfers or financing linked to Iranian persons or companies.
• Logistics and transport companies that operate routes with stops or destinations in Iran or with Iranian clients.
• Insurance and reinsurance companies that cover operations or assets with Iranian nexus.
• Technology and defense companies that supply or have supplied dual-use material to Iranian counterparties.
• Advisors, consultancies and law firms that provide professional services to Iranian entities.
• CFOs and compliance departments of any company with exposure to Iran, even if indirect.

Practical example

A Spanish industrial machinery company has an active supply contract with an Iranian engineering company. On June 8, 2026, Regulation 2026/1225 enters into force. If that Iranian company—or its parent company, or its legal representative—appears in the new annexes of designees, the Spanish company must:

1. Immediately stop any pending shipments and block any payments.
2. If it holds assets of the Iranian company (advances, security deposits), freeze them and notify the State Secretariat for Trade (the competent authority in Spain for international sanctions).
3. Document all actions taken to demonstrate due diligence in the event of an inspection.

If the Spanish company does not verify the updated list and continues operating with that client, it commits a breach of the European sanctions regime, regardless of whether it acted in good faith. Responsibility rests with the operator, not with the designating authority.

What should companies do now?

1. Consult the annexes of Regulation 2026/1225 in the EU Official Journal to identify the new designees. The complete list is available at EUR-Lex (CELEX:32026R1225).
2. Cross-reference the list of new designees with the internal database of Iranian clients, suppliers, partners, intermediaries and representatives or those with Iranian nexus.
3. Immediately suspend any active operations with counterparties that appear on the list, including payments, deliveries and provision of services.
4. Freeze and notify any assets of a designee that are under the custody or management of the company, communicating this to the competent authority of the Member State (in Spain, the State Secretariat for Trade).
5. Update due diligence procedures to include automatic verification against EU sanctions lists in each new operation with counterparties of elevated geopolitical risk.
6. Document all actions taken since June 8, 2026 to demonstrate due diligence in the event of an inspection or request from the authorities.
7. Consult with a specialized legal advisor if there is doubt about whether a counterparty is affected or if there are ongoing contracts that need to be resolved.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1225