EU Sanctions Against Ukraine 2026: What Companies and Banks Must Do Now

Key data

From 12 October 2026, operating with any person or entity included in the updated list of Decision (CFSP) 2026/2279 is illegal throughout the European Union. There is no adaptation period: the regulation enters into force on the same day of its publication.

This decision modifies Decision 2014/145/CFSP, the EU's sanctioning framework in force since the beginning of the conflict in Ukraine, expanding or updating the list of subjects subject to restrictive measures. For any company with international activity or with counterparties in the post-Soviet space, ignoring this update can have serious criminal and administrative consequences.

What does this regulation establish?

Decision (CFSP) 2026/2279 modifies Decision 2014/145/CFSP by expanding the list of natural and legal persons subject to restrictive measures for undermining or threatening the territorial integrity, sovereignty and independence of Ukraine.

The specific measures that apply to the newly listed parties are:

• Asset freezing: all funds and economic resources belonging to the listed persons or entities must be immobilized. No company or bank can make funds available to them.
• Prohibition of entry into EU territory: natural persons included in the list cannot enter or transit through any EU Member State.

The regulation is part of the sanctioning regime that the EU has maintained active since 2014 and which has been subject to successive expansions. This October 2026 update incorporates new subjects into the existing list, which requires all affected entities to review their counterparty databases immediately.

Economic and operational impact

The direct impact for companies is not a fee or fixed cost: it is the risk of sanctions for non-compliance. Each EU Member State applies its own administrative and criminal sanctions to those who operate with listed persons or entities. In Spain, violations regarding international sanctions can result in:

• Administrative sanctions of a serious or very serious nature.
• Criminal liability for company administrators and executives.
• Blocking of operations and freezing of related accounts.
• Reputational damage and loss of access to bank financing.

The real operational cost is that of updating and executing sanctions screening: reviewing databases of customers, suppliers, partners and financial counterparties against the updated list. Companies that already have automated compliance systems must ensure that their list providers (World-Check, Dow Jones Risk, etc.) have incorporated the new records.

Financial entities have especially high exposure: any transfer, account opening or financing to a listed subject constitutes a direct violation, regardless of whether the entity knew about the updated list or not.

Who does it affect?

• Financial and banking entities: banks, savings banks, payment entities, fund managers and insurance companies with customers or counterparties in the affected space.
• Exporting and importing companies with commercial relationships in Russia, Belarus or territories linked to the conflict.
• Companies in any sector with partners, shareholders or suppliers that may be included in the updated list.
• Law firms, consultancies and advisors providing services to potentially listed persons or entities.
• Payment platforms and fintechs with international operations.
• Compliance officers of any company with international activity.

Practical example

A Spanish industrial machinery company maintains a supply contract with a distributor company based in a third country. One of the majority partners of that distributor is included in the updated list by Decision (CFSP) 2026/2279 on 12 October 2026.

From that same day, continuing to execute the contract—sending goods, issuing invoices or receiving payments—constitutes a violation of the EU sanctions regime. The Spanish company has the obligation to block any transfer of funds or economic resources to that counterparty and notify the situation to the competent authorities.

If the company does not update its screening system and does not detect the change, it may incur administrative and criminal liability even if the non-compliance is involuntary. Continuous due diligence—not just at the time of customer registration—is the only effective protection.

What should companies do now?

1. Update the sanctions screening system immediately: verify that the consolidated EU list (available on EU Sanctions Map) already includes the new records from Decision 2026/2279 and that your data provider has incorporated them.
2. Review your portfolio of customers, suppliers and partners: execute a complete screening against the updated list, not just for new registrations but for all active counterparties.
3. Block operations with listed counterparties: if any match is detected, immediately suspend any transfer of funds, delivery of goods or provision of services.
4. Notify the competent authorities: in Spain, the State Secretariat for Economy and Business Support manages compliance with international sanctions. Consult the applicable notification procedure.
5. Document the review process: keep evidence that screening has been carried out and the decisions made. This documentation is key in case of inspection or investigation.
6. Review ongoing contracts: include or activate sanctions compliance clauses that allow termination of contracts with listed counterparties without penalty.

Official source

Consult full regulation on official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D2279