New EU sanctions against Ukraine 2026: what companies and financial entities must do

Key data

If your company operates internationally or your entity manages assets of foreign clients, this Regulation requires you to act today. The Implementing Regulation (EU) 2026/1940, published and in force on 7 August 2026, expands or modifies the list of natural and legal persons subject to restrictive measures in the context of the Ukraine conflict, applying Regulation (EU) 269/2014. There is no adaptation period: the regulation is directly applicable in Spain without need for transposition.

The message for executives and compliance officers is clear: any active commercial or financial relationship with the newly designated parties must be suspended immediately. Failing to do so is not a minor administrative risk — it is a criminal risk.

What does this regulation establish?

Implementing Regulation (EU) 2026/1940 updates the list of persons and entities subject to EU restrictive measures in the context of the Ukraine conflict. The two central measures it imposes are:

• Asset freezing: all funds and economic resources belonging to designated parties must be immobilized immediately.
• Prohibition of making funds available: no company or entity may transfer, pay, assign or facilitate in any way economic resources to listed parties.

This regulation is part of the sanctions regime established by Regulation (EU) No. 269/2014, which is the general framework of EU restrictive measures against actions that undermine the territorial integrity, sovereignty and independence of Ukraine. Implementing Regulation 2026/1940 does not create new categories of sanctions, but rather expands or modifies the list of designated parties within that existing framework.

As an EU Regulation, it has direct effect in all Member States. Spain does not need to approve any additional regulation: the obligations are enforceable from 7 August 2026 itself.

Economic and operational impact

The impact is not abstract. For a company with active contracts, outstanding invoices or open credit lines with any of the newly designated parties, the obligation to freeze assets may result in:

• Immediate paralysis of pending payments and collections with designated parties.
• Blocking of accounts or assets managed by financial entities on behalf of listed parties.
• Urgent review of supply, distribution or service provision contracts with affected counterparties.
• Operating costs arising from updating screening systems and sanctions lists.
• Risk of criminal and administrative liability if due diligence is not exercised.

For credit institutions and insurance companies, the impact is particularly critical: they must update their regulatory compliance systems immediately to detect any relationship with newly designated parties before processing operations.

Who does it affect?

• Credit institutions and banks: obliged to block accounts and assets of designated parties and not to process any transfers in their favor.
• Insurance companies: must review policies and contractual relationships with newly listed parties.
• Companies with international operations: any company that has contracts, suppliers, clients or partners in Russia, Belarus or territories linked to the conflict must verify its counterparties.
• Asset managers and investment funds: obliged to immobilize any assets managed on behalf of designated parties.
• Professional services companies: consultancies, law firms, auditors providing services to listed entities must suspend the relationship.
• Natural and legal persons included in the list: directly subject to freezing and prohibition measures.

Practical example

Imagine a Spanish industrial machinery export company that has an active contract with a Russian company. On 7 August 2026, Regulation 2026/1940 enters into force and that Russian company appears on the expanded list of designated parties.

From that same day, the Spanish company has the following obligations:

1. Immediately suspend any pending shipment of goods or provision of services.
2. Block collection of any outstanding invoice from that company (it cannot receive the funds).
3. Notify its banking entity so that it does not process any transfers related to that client.
4. Document all actions taken to prove compliance in the event of an inspection.

If the company continues to execute the contract or receives payments from that company without having verified the updated list, it incurs a breach of the Regulation that may result in criminal and administrative liability under applicable Spanish law.

What should companies do now?

1. Immediately update screening systems: incorporate the expanded list from Regulation 2026/1940 into counterparty verification systems. Do not wait for the next periodic review cycle.
2. Review all active commercial and contractual relationships: identify whether any supplier, client, partner or ultimate beneficiary appears on the new list of designated parties.
3. Suspend operations with newly designated parties: block payments, collections, deliveries and any service provision immediately if a match is detected.
4. Notify your banking entity: inform the bank of any account or asset that must be frozen under the Regulation.
5. Document all actions: record the verifications performed, the dates and the decisions made. This documentation is essential in the event of an inspection or investigation.
6. Consult with the legal department or external advisor: if there is doubt about whether a counterparty is affected or how to manage ongoing contracts, seek specialized advice before acting. The risk of criminal liability justifies the investment.

Non-compliance with the restrictive measures established in Regulation (EU) 269/2014 and its implementing regulations may result in criminal and administrative liability in Spain. This is not a minor infringement: the competent authorities of the Member States are responsible for ensuring effective compliance.

Official source

View complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1940