EU Sanctions List Against Daesh and Al-Qaeda Updated: What Companies Must Verify in 2026

Key data

If your company has international operations, clients or suppliers outside Spain, or manages financial assets of third parties, this update affects you directly. Commission Implementing Regulation (EU) 2026/2384, published on 22 October 2026 and in force since 21 October, introduces the 363rd amendment to Regulation (EC) No 881/2002, the basic rule that imposes restrictive measures against persons and entities associated with Daesh and Al-Qaeda.

The obligation is not new, but the list changes. Each update may include additions of new persons or entities, removals from previous listings or modifications of data for those already included. If your company does not review the updated list, it may be operating with a sanctioned counterparty without knowing it, which constitutes a breach with serious legal consequences.

What does this regulation establish?

Regulation (EC) No 881/2002 is the European framework that imposes specific restrictive measures against persons and entities linked to Daesh (also known as EIIL or Islamic State) and Al-Qaeda. Its Annex I is the operational list: it contains the names of all natural and legal persons subject to sanctions.

This 363rd amendment updates that Annex I. Amendments may include:

• Additions: incorporation of new persons or entities to the sanctions list.
• Removals: deletion of previously listed persons or entities.
• Data updates: correction or expansion of identifying information for those already included (aliases, dates of birth, nationalities, addresses).

The practical consequences for any person or entity appearing on the list are two:

• Freezing of funds and economic resources: all their assets are blocked and cannot be moved, transferred or used.
• Prohibition on making assets available: no company or person in the EU can transfer funds, goods or economic resources to those listed, either directly or indirectly.

The complete and updated text of Annex I can be consulted in the Official Journal of the EU.

Economic and operational impact

The impact is not theoretical. Operating with a sanctioned counterparty—even unknowingly—exposes the company to very concrete consequences:

• Administrative sanctions: fines whose amount depends on the legislation of each Member State. In Spain, Law 10/2010 on the prevention of money laundering and terrorist financing establishes the applicable sanctioning framework.
• Criminal sanctions: in serious cases, liability can be criminal for the company's administrators and directors.
• Blocking of operations: financial entities are obliged to block any transaction linked to a sanctioned person, which can paralyze ongoing operations.
• Reputational damage: appearing in a sanctioning file for links to terrorist financing has reputational consequences that are difficult to reverse.

The operational cost of implementing the necessary controls—counterparty screening systems, database updates, compliance team training—is significantly lower than the cost of non-compliance.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities and electronic money entities. Obligation to screen in each operation.
• Fund managers and investment companies: must verify the identity and status of their investors and counterparties.
• Export and import companies: any foreign trade operation with persons or entities that may be listed.
• Insurance companies: in policy underwriting and claims management with international counterparties.
• Companies with international operations: any company that has clients, suppliers, partners or subsidiaries outside Spain and in markets with presence of networks linked to these organizations.
• Advisors and auditors: providing services to companies with international exposure and having their own obligations under money laundering prevention regulations.

Practical example

A Spanish bank processes an international transfer of €50,000 to an account in a Middle Eastern country. Before executing the operation, its compliance system performs automatic screening of the beneficiary against the updated list in Annex I of Regulation (EC) No 881/2002. If the beneficiary's name matches any of those listed in this 363rd update, the transfer is blocked immediately and the bank is obliged to report it to the competent authorities.

If the bank had not updated its database with this new version of Annex I and had executed the transfer, it would be in breach of European regulation, with the resulting exposure to administrative and criminal sanctions under Spanish legislation.

The same principle applies to an export company that closes a supply contract with a foreign distributor: it must verify that the distributor does not appear on the list before executing the contract or any associated payment.

What should companies do now?

1. Immediately update screening databases: incorporate the updated version of Annex I of Regulation (EC) No 881/2002 into compliance systems and counterparty verification. Entry into force was 21 October 2026.
2. Review active counterparties: launch a re-screening process on current clients, suppliers and business partners, especially those with activity in high-risk areas.
3. Verify ongoing operations: any transaction pending execution with international counterparties must pass through the updated list filter before completion.
4. Document the verification process: maintain a record of checks performed. In case of inspection, the company must be able to demonstrate that it applied due diligence controls.
5. Train the compliance and operations team: ensure that persons managing third-party relationships know the verification obligation and the procedure to follow in case of a match.
6. Consult with a specialized legal advisor: if there is doubt about whether a specific counterparty may be affected, or if a match is detected, act with the support of a specialist in international sanctions before making any decision.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602384