EU Sanctions against Ukraine 2026: what companies must review

Key data

Companies and financial entities operating at international level have a new compliance obligation as of 11 May 2026. The Council Decision (CFSP) 2026/1072 amends Decision 2014/145/CFSP and updates restrictive measures against persons and entities threatening the territorial integrity, sovereignty and independence of Ukraine.

This is not a new regulation: it is an update of the sanctions regime that has been in force since 2014. But each modification of the designated list or the conditions of the measures generates an immediate obligation to review for any company with international exposure.

What does this regulation establish?

Decision 2014/145/CFSP is the European framework for individual sanctions related to Ukraine. Since its approval in 2014, it has been amended multiple times to update the list of designated persons and entities or to adjust the conditions of restrictive measures.

The Council Decision (CFSP) 2026/1072 introduces the latest of these updates, with two possible types of changes:

• Incorporation of new persons or entities to the designated list.
• Modification of the conditions of restrictive measures already existing for previously included persons or entities.

The measures applied to designated persons are:

• Asset freezing: no company or financial entity can make funds or economic resources available to designated persons.
• Travel ban: designated persons cannot enter or transit through the territory of EU Member States.

Non-compliance with these measures is not a matter of voluntary compliance: it is subject to administrative and criminal sanctions in each Member State, including Spain.

Economic and operational impact

The direct impact of this regulation is not a fixed cost for companies, but a risk of sanction in case of non-compliance. The economic and operational consequences are concentrated in three areas:

• Compliance cost: companies must update their sanctions control systems to incorporate the changes published on 11 May 2026. This involves time and resources from compliance, legal and operations teams.
• Risk of sanction for non-compliance: operating with a designated person—even if unintentionally due to failure to update lists—can result in administrative and criminal sanctions. The severity depends on applicable Spanish legislation.
• Operational blockage: if a company detects that a customer, supplier or counterparty is on the list, it must interrupt the commercial or financial relationship immediately, with the operational impact that entails.

For financial entities, the risk is particularly high: they are on the front line of implementing these measures and are the primary target of compliance inspections regarding international sanctions.

Who does it affect?

• Financial entities: banks, savings banks, credit cooperatives, payment entities and any financial services provider with international customers or counterparties.
• Exporting and importing companies: any Spanish company with business relationships outside Spain must verify that its counterparties are not on the updated list.
• Companies with subsidiaries or partners abroad: especially if they operate in markets with exposure to Russia, Belarus or territories linked to the conflict in Ukraine.
• Advisors and consulting firms: legal, accounting or consulting service providers serving designated persons or entities are also affected.
• Designated natural persons: those included in the updated list are subject to asset freezing and prohibition from entering the EU.

Practical example

A Spanish industrial machinery company has a distributor in a third country with which it has been working for five years. On 11 May 2026, Council Decision (CFSP) 2026/1072 enters into force, incorporating that distributor into the designated list.

If the company does not update its sanctions control list and continues to make shipments or collect invoices from that distributor, it will be in breach of EU restrictive measures. This can result in an administrative or criminal sanctions procedure in Spain, regardless of whether the breach was unintentional.

The only way to avoid this scenario is to have a process for periodic—or real-time—updating of sanctions lists, and to apply it systematically to the entire portfolio of international customers and suppliers.

What should companies do now?

1. Immediately update sanctions control lists: incorporate the changes from Council Decision (CFSP) 2026/1072 into customer, supplier and counterparty screening systems. The compliance date is 11 May 2026.
2. Review the portfolio of international customers and suppliers: cross-reference the counterparty database with the consolidated EU sanctions list, available on EUR-Lex and on the European Commission portal.
3. Establish an action protocol for matches: if a counterparty is detected on the list, the company must suspend the commercial or financial relationship immediately and document the actions taken.
4. Review ongoing contracts with international counterparties: identify whether any active contract involves persons or entities that may have been designated in this update.
5. Train compliance, legal and operations teams: ensure that persons responsible for customer and supplier management are aware of the obligations arising from international sanctions and the internal verification procedure.
6. Consult with a legal advisor specialized in international sanctions if there is any doubt about the company's specific exposure or about the consequences of a possible relationship with a designated person.

Official source

Council Decision (CFSP) 2026/1072 of 11 May 2026, published in the Official Journal of the European Union.