Key data
| Regulation | Council Decision (CFSP) 2026/2103 — CELEX:32026D2103 |
|---|---|
| Modified regulation | Decision 2014/145/CFSP (sanctioning framework adopted following the annexation of Crimea) |
| Publication | 15 September 2026 |
| Entry into force | 15 September 2026 (immediate effect) |
| Affected parties | EU companies and financial entities with commercial links to Russia or occupied territories of Ukraine |
| Category | European Regulation — Restrictive measures (sanctions) |
| Year | 2026 |
| Type of measures | Travel ban to Schengen area + asset freezing in European territory |
If your company operates with Russian counterparties, holds accounts or assets linked to persons on that list, or maintains commercial relations with occupied territories of Ukraine, this update affects you from today. Council Decision (CFSP) 2026/2103, published on 15 September 2026, modifies the sanctioning framework in force since 2014 — Decision 2014/145/CFSP — expanding or adjusting the list of persons and entities subject to restrictive measures.
This is not a regulation of future application: it entered into force on the same day of its publication. Any commercial or financial relationship with an entity or person listed in the updated list constitutes a breach from that moment.
What does this regulation establish?
Decision 2026/2103 modifies Decision 2014/145/CFSP, which is the EU's central instrument for sanctioning those who undermine or threaten the territorial integrity, sovereignty and independence of Ukraine. This framework was originally adopted following Russia's illegal annexation of Crimea.
The September 2026 update expands or adjusts the list of natural and legal persons subject to two types of restrictive measures:
- Travel ban to the Schengen area for natural persons included in the list.
- Asset freezing in European territory for natural and legal persons listed.
EU companies and financial entities have a legal obligation to verify their commercial and financial relationships against these updated lists. The official consolidated list is consulted in the EU Sanctions Map and in the EEAS consolidated lists repository.
Economic and operational impact
The impact for Spanish companies is not theoretical: operating with a sanctioned counterparty — even unintentionally — exposes the company to direct consequences:
- Administrative sanctions imposed by the competent Spanish authorities (State Secretariat for Trade, Bank of Spain in the financial sphere).
- Criminal liability for administrators and executives who authorize operations with listed entities.
- Freezing of own funds if the company has assets in European territory linked to sanctioned persons.
- Immediate operational blockade: European banks are obliged to reject transactions with entities or persons on the list, which can paralyze ongoing collections and payments.
The operational cost of verification is manageable; the cost of non-compliance — fines, operational paralysis, reputational damage and criminal risk — can be devastating for a medium-sized company.
Who does it affect?
- Export and import companies with Russian customers, suppliers or intermediaries or with headquarters in occupied territories of Ukraine.
- Financial and banking entities (banks, savings banks, credit cooperatives, payment entities) that manage transfers, credits or accounts linked to Russian counterparties.
- Transport and logistics companies that operate routes with origin or destination in Russia or occupied territories.
- Law firms, consultancies and advisory firms that provide services to potentially listed persons or entities.
- Companies with subsidiaries, partners or shareholders with links in Russia or occupied territories of Ukraine.
- CFOs and financial directors responsible for managing regulatory compliance risks.
Practical example
A Spanish industrial machinery company has a distributor in Moscow with whom it has been operating since 2019. Following the update of 15 September 2026, the name of the general director of that distributor appears in the expanded list of Decision 2026/2103.
From that same day, any payment, shipment of goods or provision of services to that company constitutes a breach of the EU sanctions regime. The Spanish bank of the company is obliged to block the pending transfer of €45,000 for a delivery in progress. Furthermore, the financial director of the Spanish company may incur personal liability if he authorizes the operation knowing the situation.
The solution: verify the list before each relevant operation and document that verification as part of the compliance process.
What should companies do now?
- Immediately review the EU consolidated sanctions list to verify if any counterparty, supplier, customer or business partner with Russian links appears in the updated list. Use the EU Sanctions Map.
- Preventively suspend any ongoing operations with counterparties whose situation has not been verified, until confirming they are not listed.
- Document the verification process: date of consultation, name of counterparty verified and result. This documentation is your shield in an inspection.
- Update internal compliance procedures to include verification against sanctions lists as a mandatory step before any new operation with Russian counterparties or from occupied territories.
- Inform the legal department and administrators about the update, given that criminal liability may fall on natural persons who authorize prohibited operations.
- Consult a legal advisor specialized in foreign trade or international sanctions if you have doubts about the situation of a specific counterparty or about your company's actual exposure.
Frequently asked questions
Where can I consult the updated list of persons and entities sanctioned by the EU?
The official consolidated list is consulted in the EU Sanctions Map (sanctionsmap.eu) and in the European External Action Service repository. Decision 2026/2103 modifies the list of Decision 2014/145/CFSP, so you should always consult the most recent consolidated version, not the original 2014 version.
What happens if my company operates unknowingly with a sanctioned entity?
Lack of knowledge does not exempt from liability. Companies have an active obligation to verify their counterparties. Non-compliance may result in administrative and criminal sanctions under Spanish legislation, including personal liability for administrators and executives who authorize operations.
When did this sanctions update enter into force?
Council Decision (CFSP) 2026/2103 entered into force on the same day of its publication: 15 September 2026. There is no adaptation period. Any operation with a listed entity or person is a breach from that date.
Do sanctions only affect companies with direct operations in Russia?
No. They affect any EU company or financial entity that maintains commercial or financial relationships with listed persons or entities, regardless of where they are physically located. This includes intermediaries, distributors, partners or shareholders with links in Russia or in the occupied territories of Ukraine.
What specific measures does the EU impose on listed persons and entities?
Restrictive measures are of two types: travel ban to the Schengen area (for natural persons) and asset freezing in European territory (for natural and legal persons). EU companies are obliged not to make funds or economic resources available to listed persons and entities.
Official source
Consult complete regulation in official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D2103
