EU Sanctions on Iraq 2026: What Companies and Financial Entities Must Review

Key data

Spanish companies with activity in Iraq—whether commercial, financial or investment-related—face an update to the EU sanctions regime that came into force on 21 October 2026, two days before its official publication. Implementing Regulation (EU) 2026/2388 modifies Regulation (EC) No 1210/2003, which is the base regulation governing specific economic and financial restrictions with Iraq within the framework of the European Union's common foreign and security policy.

Failing to act in time is not an option: the sanctions regime is directly applicable throughout the EU and ignorance of the regulation does not exempt from responsibility.

What does this regulation establish?

Implementing Regulation (EU) 2026/2388 modifies Regulation (EC) No 1210/2003, which establishes the framework for EU economic and financial restrictions in relation to Iraq. This type of modification may include one or more of the following changes:

• Update of the lists of natural or legal persons subject to restrictions (asset freezing, prohibition on making funds available).
• Modification of the lists of entities with which economic or financial operations are restricted.
• Adjustments to the conditions applicable to transactions with Iraqi counterparties.
• Changes to the goods or categories of goods subject to restrictions on export, import or transfer.

The base regulation (Regulation 1210/2003) was adopted in the context of the international sanctions regime related to Iraq and has been subject to successive updates to reflect changes in the lists designated by the UN Security Council and decisions by the EU itself.

Economic and operational impact

The direct impact of this update is fundamentally operational and regulatory compliance. Companies that do not update their screening systems and due diligence are exposed to:

• Significant administrative and criminal sanctions for operating with persons, entities or goods included in the updated lists.
• Blocking of ongoing operations if an Iraqi counterparty appears in the new lists.
• Reputational liability to clients, investors and regulators for non-compliance with the EU sanctions regime.
• Costs of review and adaptation of contracts, internal procedures and compliance control systems.

Financial entities have particularly high exposure, as they are required to apply real-time controls over their international transactions. A failure in screening can result in the execution of a prohibited operation, with the regulatory consequences that entails.

Who does it affect?

• Exporters and importers with active commercial operations with Iraq.
• Financial entities (banks, savings banks, payment entities) that process transfers, letters of credit or financing linked to Iraq.
• Investment companies with holdings or projects in Iraqi territory.
• Companies with service provision contracts to Iraqi clients or entities.
• Logistics and transport operators that manage goods originating from or destined for Iraq.
• Legal and financial advisors providing services to clients with exposure to Iraq.
• Regulatory compliance departments of any company with international activity.

Practical example

A Spanish engineering company has an active contract with an Iraqi public company for the supply of industrial equipment. Following the entry into force of Regulation (EU) 2026/2388 on 21 October 2026, the compliance officer must verify whether the contracting Iraqi entity—or any of its legal representatives—appears in the updated lists of Regulation (EC) No 1210/2003.

If the counterparty appears in the new lists, the company cannot execute the contract or receive payments until obtaining express authorization from the competent Spanish authority (the State Secretariat for Trade or the Bank of Spain, depending on the type of operation). Continuing with the operation without this prior verification exposes the company to significant administrative and criminal sanctions, regardless of whether the contract was valid before the update.

What should companies do now?

1. Immediately review the updated lists of Regulation (EC) No 1210/2003 as modified by Regulation (EU) 2026/2388, available in the Official Journal of the EU.
2. Cross-check all active Iraqi counterparties (clients, suppliers, partners, intermediaries) against the lists of restricted persons and entities.
3. Update compliance screening systems to incorporate the new lists with effective date 21 October 2026.
4. Review ongoing contracts with Iraqi parties to identify possible incompatibilities with the new restrictions.
5. Document the verification process performed: date, methodology and result. This documentation is key in the event of regulatory inspection.
6. Consult with the legal department or a specialist advisor in international sanctions if there is any doubt about the applicability of restrictions to a specific operation.
7. Train the operations and finance team on the changes introduced to avoid involuntary errors in daily management.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602388