EU Sanctions Against Iran 2026: What Exporters and Banks Must Do

Key data

If your company exports, finances, invests or transports goods with a connection to Iran, this regulation affects you from 30 March 2026. The Council Decision (CFSP) 2026/762 amends Decision 2010/413/CFSP and updates the European sanctions regime against Iran, including changes to the lists of designated persons and entities. Operating with a counterparty that appears on those lists without being aware of it does not exempt from liability.

The risk is not theoretical: non-compliance with these restrictive measures can result in administrative and criminal penalties applied by the authorities of each Member State. In Spain, this includes both financial fines and criminal consequences for those responsible within the company.

What does this regulation establish?

Decision (CFSP) 2026/762 amends Decision 2010/413/CFSP, which is the main EU sanctions framework against Iran in force since 2010. This 2026 update revises the lists of natural and legal persons subject to restrictive measures, that is, those with whom European companies are prohibited or restricted from operating.

The restrictive measures include, within the general framework of this sanctions regime:

• Freezing of assets of designated persons and entities.
• Prohibition on making funds or economic resources available to designated parties.
• Restrictions on the export and import of certain goods and technologies.
• Limitations on financial and investment relations with Iranian counterparties.

The regulation does not create a new regime: it updates the existing one. This means that companies already operating under the previous framework must review whether the changes to the lists affect their current counterparties, not just new commercial relationships.

Economic and operational impact

The direct impact on companies is not a new tax or a fixed cost: it is the cost of non-compliance and the operational cost of strengthening internal controls. Both can be significant.

On the operational level, affected companies must assume:

• Review of active counterparties: Any Iranian company, bank or entity with which business is conducted must be verified against the updated EU lists.
• Strengthening of compliance processes: Pre-transaction controls must be more thorough, which involves time, resources and, in many cases, external legal advice specialised in foreign trade and international sanctions.
• Possible suspension of operations: If a counterparty appears on the updated lists, the operation must be halted until legal clarity is obtained, which may generate losses from unexecuted contracts.

On the risk level, non-compliance is not just an administrative fine. Penalties can be criminal for the responsible executives, which makes this matter a priority for CFOs, export directors and compliance officers.

Who is affected?

This regulation affects any company or individual established in the EU that maintains or intends to establish relations with Iran. The most exposed profiles are:

• Exporters: Companies that sell or intend to sell goods or technology to Iranian buyers.
• Banking and financial entities: Banks, credit institutions and payment service companies that manage transfers, financing or investments with an Iranian connection.
• Energy sector: Companies with contracts, investments or projects related to the Iranian energy sector.
• Transport sector: Shipping companies, freight forwarders, logistics operators and air or land transport companies with routes or clients linked to Iran.
• Investors: Individuals or funds with investment positions in Iranian entities or with assets in Iran.
• Advisors and consultants: Law firms, consultancies and advisors providing services to companies with operations in Iran, as they may incur liability if they fail to warn of the risk.

Practical example

A Spanish company in the industrial sector has a machinery supply contract with an Iranian company with which it has been operating for three years without incident. With the entry into force of Decision (CFSP) 2026/762 on 30 March 2026, the lists of designated entities have been updated.

If that Iranian company has been added to the updated lists and the Spanish company executes a shipment or receives a payment without having previously verified the status of its counterparty, it would be in breach of the EU's restrictive measures. The consequences would include administrative penalties and, potentially, criminal consequences for the executives responsible for authorising the operation.

The correct course of action is to verify the counterparty's status on the official EU lists before executing any transaction, regardless of the prior history of the commercial relationship. A trouble-free relationship in the past does not guarantee that the counterparty has not been designated in the most recent update.

What should companies do now?

1. Review the updated EU lists: Verify whether any active Iranian counterparties (customers, suppliers, partners, financial entities) appear on the lists of designated persons and entities updated by Decision (CFSP) 2026/762. The lists are available on the EU Sanctions Map.
2. Preventively suspend ongoing transactions with Iran: Until verification is complete, suspend any payment, shipment or financial commitment with Iranian counterparties to avoid incurring non-compliance.
3. Strengthen pre-transaction compliance controls: Implement or update internal counterparty verification procedures to include consultation of EU sanctions lists before each operation, not only at the time of customer or supplier onboarding.
4. Consult legal advisors specialised in foreign trade and international sanctions: In case of any doubt about whether a specific operation is permitted, obtain legal advice before executing it. The cost of legal advice is always lower than the cost of administrative or criminal penalties.
5. Document all verifications carried out: Keep evidence of list consultations and decisions made. In the event of an inspection or investigation, documentation of the compliance process is the company's primary defence.
6. Train the team responsible for international operations: Ensure that the export, finance and operations departments are aware of the regulatory update and the updated verification procedures.

Official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, please consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D0762