Key data
| Regulation | Council Implementing Regulation (EU) 2026/2160 — CELEX:32026R2160 |
|---|---|
| Publication | 22 September 2026 |
| Entry into force | 22 September 2026 (immediate effect) |
| Legal basis | Regulation (EU) No 269/2014 |
| Affected parties | Companies, banks and persons with financial or commercial links to the listed sanctioned parties |
| Category | European Regulation — Restrictive measures |
| Year | 2026 |
If your company operates internationally, works with counterparties in the post-Soviet space or manages cross-border payments, this regulation requires you to act today. Council Implementing Regulation (EU) 2026/2160, published on 22 September 2026, updates the list of sanctioned parties under Regulation (EU) No 269/2014 and enters into force on the same day of its publication. There is no transitional period.
The measures are not new in nature, but they are in scope: each update to the list incorporates new names that companies must screen immediately in their control systems. The most frequent —and most costly— mistake is assuming that the sanctions list used yesterday is still valid today.
What does this regulation establish?
Council Implementing Regulation (EU) 2026/2160 applies the sanctions framework of Regulation (EU) 269/2014 and introduces the following concrete measures:
- Update of the list of designated persons: New natural and legal persons considered responsible for actions that undermine or threaten the territorial integrity, sovereignty and independence of Ukraine are added.
- Asset freezing: All funds and economic resources belonging to the newly listed parties are frozen immediately. No European entity may release, transfer or make available assets related to them.
- Prohibition on making funds available: It is prohibited, directly or indirectly, to make funds or economic resources available to any person or entity included in the list.
- Obligation of active verification: European entities —financial institutions and companies— must verify that they do not maintain commercial or financial relations with the newly designated parties.
- Sanctions regime: Non-compliance may result in administrative and criminal sanctions according to the national legislation of each EU Member State.
This regulation does not repeal the previous framework, but updates it: Regulation (EU) 269/2014 remains the base rule, and each implementing regulation like this one adds to or modifies the list of designated parties.
Economic and operational impact
The impact is not only legal: it is operational and financial. Companies that do not update their sanctions control lists are exposed to consequences on three levels:
| Level | Concrete consequence |
|---|---|
| Legal / criminal | Criminal sanctions according to the national legislation of the Member State where the company operates |
| Administrative | Administrative sanctions imposed by the competent national authorities |
| Operational | Transaction blocking, freezing of associated accounts, interruption of commercial relations |
| Reputational | Public exposure for links with sanctioned entities; impact on relations with international correspondent banks |
The cost of not acting always exceeds the cost of updating compliance systems. The review of sanctions lists is a process that, if properly automated, can be executed in hours. The risk of not doing so can translate into fines of hundreds of thousands of euros or disqualification from operating in certain markets.
Who does it affect?
- Financial institutions: banks, credit entities, fund managers, insurance companies and any entity that processes payments or manages assets with international counterparties.
- Companies with international operations: importers, exporters, distributors or any company with customers, suppliers or partners in markets linked to the sanctioned parties.
- Companies with subsidiaries or holdings abroad: especially in post-Soviet countries or with exposure to Russia, Belarus and conflict zones.
- Law firms and advisors: that provide services to potentially listed persons or entities.
- Payment platforms and fintechs: required to screen transactions in real time against updated sanctions lists.
- Logistics and transport companies: that may be moving goods for or from sanctioned entities.
Practical example
A Spanish industrial machinery company has a distributor in a third country with which it has been working for three years without incident. On 22 September 2026, that distributor —or its parent company— is included in the updated list by Regulation 2026/2160.
If the Spanish company does not update its sanctions control system that same day and processes a payment or sends merchandise to that distributor, it is in breach of Regulation (EU) 269/2014 from the moment of the transaction. The breach is objective: it does not matter if the company "did not know" that the distributor had been listed. The obligation to verify actively rests with the European company.
The consequence: blocking of the transaction by the correspondent bank, investigation by the competent national authority and possible administrative or criminal sanction according to applicable Spanish regulations.
What should companies do now?
- Immediately update sanctions lists in compliance systems: Incorporate the revised list from Regulation 2026/2160 in all counterparty screening tools. Entry into force is 22 September 2026, with no transitional period.
- Conduct a review of active counterparties: Cross-reference the current portfolio of customers, suppliers and business partners against the new list of designated parties. Pay special attention to complex corporate structures where the sanctioned party may be the ultimate beneficial owner, not the direct entity.
- Cautiously suspend any pending transactions with counterparties under review: Until confirming that there is no match with the newly listed parties, block payments, shipments and any making available of funds or resources.
- Document the verification process: Record date, source consulted and result of each verification. This documentation is the primary defense against an inspection or investigation by the competent authority.
- Review contracts with sanctions clauses: Ensure that existing contracts include clauses that allow immediate termination if a counterparty is designated as sanctioned.
- Consult with the legal department or external advisor: If there is doubt about whether a counterparty is affected or how to manage a pre-existing relationship with a sanctioned party, obtain specific legal advice before acting.
Frequently asked questions
What concrete measures does Regulation 2026/2160 impose on companies?
The regulation imposes two main measures: the freezing of assets of the newly designated parties and the prohibition on making funds or economic resources available to them, directly or indirectly. Additionally, it requires European entities —companies and financial institutions— to actively verify that they do not maintain commercial or financial relations with any of the listed parties.
When does this sanctions update enter into force and is there a deadline to adapt?
Council Implementing Regulation (EU) 2026/2160 entered into force on the same day of its publication: 22 September 2026. There is no transitional period. Companies must update their sanctions control systems immediately from that date.
What happens if my company operates with a counterparty that has been included in the list without my knowledge?
The obligation to verify actively rests with the European company. Lack of knowledge does not exempt from responsibility. If a relationship with a sanctioned party is detected, the company must immediately suspend any transaction and notify the competent authority. Non-compliance may result in administrative and criminal sanctions according to the national legislation of the Member State where the company operates.
What companies are required to comply with this sanctions regulation?
All companies and financial institutions established in the European Union, including banks, fund managers, insurance companies, importing and exporting companies, payment platforms, law firms and any entity with commercial or financial relations with international counterparties. The obligation applies regardless of the size of the company.
Where can I consult the updated list of sanctioned persons and entities?
The consolidated list of persons and entities subject to restrictive measures under Regulation (EU) 269/2014 is published in the Official Journal of the European Union and is kept up to date in the EU financial sanctions database, accessible through the European Commission portal.
Official source
Consult full regulation in official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R2160
