Key data
| Regulation | Commission Implementing Regulation (EU) 2026/2292 |
|---|---|
| CELEX Reference | 32026R2292 |
| Publication | 12 October 2026 |
| Entry into force | 12 October 2026 (immediate effect) |
| Base regulation amended | Regulation (EU) No 269/2014 |
| Affected parties | Companies, financial entities and persons with commercial links to Russia or Ukraine |
| Category | European Regulation — Restrictive measures |
| Year | 2026 |
Any company with international operations that has links to Russia or Ukraine must act today. The Commission Implementing Regulation (EU) 2026/2292, published and in force on 12 October 2026, updates the annex of Regulation (EU) No 269/2014 by adding or modifying entries in the list of natural and legal persons subject to restrictive measures. This is not a warning: it is a compliance obligation with criminal consequences in case of breach.
The EU sanctions regime related to Ukraine has been active since 2014. Each update to the annex of Regulation 269/2014 expands the risk perimeter for European companies. This is the latest of those updates and enters into force without an adaptation period.
What does this regulation establish?
Regulation 2026/2292 amends the annex of Regulation (EU) No 269/2014, which is the EU's base sanctions framework for actions that undermine the territorial integrity, sovereignty and independence of Ukraine. The specific measures applied to the newly designated parties are two:
- Asset freezing: all funds and economic resources belonging to the listed persons and entities are immobilized. No European company or bank can make funds or economic resources available to them, directly or indirectly.
- Prohibition of entry into the EU: natural persons included in the list cannot enter or transit through the territory of EU Member States.
The update adds or modifies entries in that annex. This means that the list of prohibited counterparties is expanded, and any existing commercial or financial relationship with the newly designated parties becomes illegal from the moment of publication.
| Measure | Description | Obligation for companies |
|---|---|---|
| Asset freezing | Immobilization of funds and economic resources of the designated parties | Do not transfer funds or resources to the listed parties, directly or indirectly |
| Prohibition of entry into the EU | Ban on access to EU territory for listed natural persons | Do not facilitate travel, accommodation or services that permit entry |
| Prohibition of commercial relations | Derived from asset freezing | Verify that no active counterparty appears in the updated annex |
Economic and operational impact
The impact is not theoretical. Companies that do not update their sanctions screening lists and maintain relations with the newly designated parties are exposed to consequences on two fronts:
- Administrative penalties: fines and corrective measures imposed by the competent authorities of each Member State.
- Criminal penalties: depending on the applicable national legislation, breach can result in criminal liability for executives and the company itself.
The immediate operational cost falls on compliance, legal and financial departments. They must review and update their counterparty screening systems, their sanctions screening lists and their due diligence procedures. Financial entities have particularly high exposure, as any transaction with a designated party constitutes a direct breach of the regulation.
Companies with supply chains or commercial relations with Russia or Ukraine must also review their indirect suppliers and customers, as the prohibition applies to both direct and indirect relations.
Who does it affect?
- Financial entities: banks, insurance companies, fund managers and any entity that processes payments or manages assets with Russian or Ukrainian counterparties.
- Export and import companies with operations in Russia, Ukraine or countries with commercial links to both.
- Companies with subsidiaries or partners in Russia or Ukraine that maintain active legal or financial relations.
- Professional service providers (consulting, legal advice, logistics) that provide services to persons or entities with presence in the region.
- Executives and compliance officers (CCO, CFO, legal directors) who are personally responsible for ensuring compliance in their organizations.
- Companies in any sector that, although not operating directly in the region, may have indirect counterparties affected by the list.
Practical example
A Spanish industrial machinery company has an active supply contract with a Russian company. Following the publication of Regulation 2026/2292 on 12 October 2026, the compliance officer performs a counterparty verification and detects that the legal representative of that Russian company appears in the new annex of Regulation 269/2014 as a designated person subject to asset freezing.
From that same day, the Spanish company cannot execute any pending payment or delivery under that contract. It must freeze any transfer of funds or economic resources linked to that counterparty and notify the competent authorities according to Spanish implementing legislation. If it does not do so and processes a payment, it incurs a breach of the European regulation with possible administrative and criminal consequences for the company and its executives.
This scenario is repeated in any sector: logistics, energy, food, financial services. The key is speed of detection: the sooner the screening system is updated, the lower the risk of unintentional breach.
What should companies do now?
- Immediately update sanctions screening lists: incorporate the new annex of Regulation 2026/2292 into counterparty screening systems. Entry into force is the same day as publication, with no transitional period.
- Review all active counterparties with links to Russia or Ukraine: customers, suppliers, partners, representatives and ultimate beneficial owners. Also include indirect counterparties.
- Preventively suspend any pending transactions with counterparties that may be affected until confirming they do not appear in the new annex.
- Notify the competent authorities if an active counterparty is detected in the list. Regulation 269/2014 requires notification of frozen assets to national authorities.
- Document the verification process: record the checks performed, the dates and the results. This documentation is essential in case of inspection or subsequent investigation.
- Train the compliance and financial team on the new risk perimeter and procedures for acting on a positive alert.
- Consult with specialized legal advice if there are ongoing contracts with potentially affected counterparties, to determine specific obligations under Spanish legislation.
Frequently asked questions
What happens if my company already has an active contract with someone who appears on the new sanctions list?
From 12 October 2026, any execution of that contract that involves transfer of funds or economic resources to the designated person or entity constitutes a breach of Regulation (EU) 269/2014. The company must suspend pending payments and deliveries, freeze related assets and notify the competent authorities. Breach can result in administrative and criminal penalties under Spanish national legislation.
Where can I consult the updated list of persons and entities sanctioned by the EU in relation to Ukraine?
The official and updated list appears in the annex of Regulation (EU) No 269/2014, as amended by Commission Implementing Regulation 2026/2292. You can consult it directly on EUR-Lex. Additionally, the EU maintains a consolidated sanctions database on the official portal of the European External Action Service (EEAS).
When does this sanctions update enter into force and is there a deadline to adapt?
Commission Implementing Regulation (EU) 2026/2292 entered into force on the same day as its publication: 12 October 2026. There is no transitional adaptation period. Obligations are enforceable from the outset, making immediate update of compliance systems essential.
Are penalties for breach the same in all EU countries?
No. The European regulation establishes the obligation, but the specific penalties for breach are determined by each Member State according to its own national legislation. In Spain, breach of EU restrictive measures can result in serious administrative penalties and, in cases of deliberate breach, criminal liability for the company and its executives.
Does this regulation only affect companies with direct operations in Russia or Ukraine?
No. Restrictive measures apply to any commercial or financial relationship with the designated parties, regardless of where it takes place. A Spanish company operating in a third country but having as a counterparty a person or entity included in the annex of Regulation 269/2014 is also obliged to comply with the measures. The prohibition extends to both direct and indirect relations.
Official source
Consult complete regulation on official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R2292
