EU Sanctions against Iran 2026: what exporters and banks must review

Key data

If your company exports technology, operates in the financial sector or has any commercial ties with Iran, the Middle East or the Red Sea, this update affects you directly. Council Decision (CFSP) 2026/1157, published on 26 May 2026 in the EU Official Journal, modifies the sanctions regime established in 2023 against Iran and updates the lists of natural and legal persons subject to restrictive measures.

Non-compliance is not a minor administrative matter: according to the legislation of each Member State, the consequences can be both administrative and criminal sanctions. The obligation to verify counterparties is enforceable from 22 May 2026, four days before official publication.

What does this regulation establish?

Council Decision (CFSP) 2026/1157 modifies the sanctions regime that the EU established in 2023 through Council Decision (CFSP) 2023/1532. That original regime responded to Iran's military support for Russia's war of aggression against Ukraine and armed groups in the Middle East and the Red Sea.

The 2026 update introduces changes to the lists of natural and legal persons subject to two types of measures:

• Asset freezing: all funds and economic resources belonging to listed persons and entities are blocked. No European company can make funds available to them.
• Prohibition of entry into the EU: natural persons included in the list cannot enter or transit through the territory of the European Union.

European companies have the obligation to verify that their commercial counterparties do not appear in the updated lists before carrying out any transaction, fund transfer or provision of services.

Economic and operational impact

The main impact is not a direct cost of the regulation, but the risk of operating without having updated compliance controls. The consequences of a breach can be significantly more costly than the verification process.

• Criminal and administrative risk: sanctions for non-compliance are determined according to the legislation of each Member State. In Spain, breaches of the international sanctions regime can result in sanctioning proceedings and, in serious cases, criminal liability.
• Operational blockade: any ongoing transaction with a sanctioned entity must be stopped immediately. Assets linked to listed persons or entities are frozen.
• Compliance cost: companies with exposure to Iran or the region must update their counterparty screening systems, review existing contracts and train their compliance teams.
• Reputational risk: operating with sanctioned entities, even unknowingly, can cause reputational damage with customers, investors and financial entities.

Who does it affect?

This regulation directly affects the following companies and professionals:

• Financial sector entities: banks, credit institutions, fund managers, insurance companies and any entity that processes payments or manages assets with counterparties in Iran or the region.
• Exporters of dual-use technology: companies that export products or technology that may have civilian and military applications to Iran or linked entities.
• Companies with activity in the Middle East and the Red Sea: logistics, maritime transport, energy companies or any sector with operations in the region.
• Importers with supply chain in the region: companies that receive goods or services from suppliers with ties to Iranian entities.
• Legal advisors and consultants: professionals who provide services to clients with exposure to Iran must know the updated lists to advise correctly.
• CFOs and financial directors: responsible for approving payment or investment transactions with counterparties in the region.

Practical example

A Spanish electronics components company has a supply contract with an intermediary company based in a third country, which in turn works with an Iranian distributor. Following the update of the lists under Council Decision (CFSP) 2026/1157, that Iranian distributor appears on the list of sanctioned entities.

Although the Spanish company does not operate directly with Iran, if the payment chain or supply of goods ultimately reaches a sanctioned entity, the company may be in breach of the EU sanctions regime. The obligation to verify is not limited to the direct counterparty: it includes knowing the chain of relevant commercial relationships.

In this case, the company must: stop any pending transactions with that chain, notify its legal department, review the existing contract and, if appropriate, report it to the competent authorities according to Spanish legislation on international sanctions control.

What should companies do now?

1. Consult the updated lists immediately: access the full text of Council Decision (CFSP) 2026/1157 on EUR-Lex and the EU consolidated sanctions database to identify whether any counterparty appears in the updated lists.
2. Review all counterparties with ties in Iran or the region: not just direct relationships, but also suppliers, intermediaries and business partners with activity in the Middle East and the Red Sea.
3. Update counterparty screening systems: ensure that the compliance tools used already incorporate the updated lists from Council Decision (CFSP) 2026/1157.
4. Review contracts and ongoing transactions: identify whether there are any active transactions with entities that may have been included in the new lists and, if so, suspend them until obtaining legal advice.
5. Train the compliance team: ensure that compliance officers, the financial department and the commercial team are aware of the update and its implications.
6. Document the verification process: maintain a record of verifications performed as evidence of due diligence in case of inspection or investigation.