EU sanctions, what are they and how the list actually works

Two beliefs about EU sanctions circulate widely in compliance teams, and both are wrong. The first is that a payment denominated in euros pulls a firm into EU jurisdiction. The second is that screening the EU consolidated sanctions list discharges the obligation. The scope clause of an EU sanctions regulation sets five conditions, and currency is not among them. The consolidated list carries designated persons subject to financial sanctions, which leaves travel bans, sectoral trade restrictions, and ownership-blocked entities outside it entirely. The Council of the European Union currently runs almost 50 sanctions regimes covering almost 6,000 individuals and entities, as of its December 2025 review. What follows sets out the measures, the list, the scope test, and the penalty exposure.

What are EU sanctions?

EU sanctions are restrictive measures adopted by the Council of the European Union to change the policy or conduct of governments, companies, groups, and individuals outside the bloc. “EU restrictive measures” is the term the institutions use in legal texts, and the European Commission is explicit that they are not punitive. The intent is behavioural, which is why measures are aimed at the parties responsible for a policy and calibrated to limit collateral damage to everyone else.

Three families of regimes exist:

• UN sanctions: The EU transposes every measure adopted by the United Nations Security Council into EU law.
• Mixed sanctions: The EU reinforces a UN regime by adding stricter measures of its own on top of the UN baseline.
• Autonomous sanctions: The Council designates them on its own initiative, following a proposal from the High Representative or a Member State. These normally apply for 12 months before renewal.

The EU perimeter is therefore wider than the UN one and moves on a different clock, so a firm that mirrors only the UN consolidated list will under-screen its EU obligation.

How are EU sanctions regulations adopted, and when do they take effect?

A sanction becomes binding EU law the moment it appears in the Official Journal of the European Union, not when a screening file next refreshes.

Two instruments carry the measure. Restrictive measures are laid down first in a Common Foreign and Security Policy Council decision. The economic and financial elements are then given effect through a Council regulation, which applies directly in every Member State without national implementing law. The Commission’s Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA) prepares those regulation proposals, and the Council adopts them unanimously on a joint proposal from the Commission and the High Representative.

That two-step structure explains a recurring gap. Not every measure in a Council decision reappears in the regulation, because the regulation reaches only what falls inside the Union’s economic and financial competence. EU sanctions regulations therefore define most of what a regulated firm has to operationalise, and the effective date is always the Official Journal date. Any screening cadence slower than publication is an operational choice the firm owns, not a grace period the law grants.

What types of sanctions does the EU impose?

The EU imposes six categories of restrictive measures, and most regimes combine several of them inside a single package.

Only two of the six produce a record you can match a customer name against, and those two are halves of one designation. The other four bind a firm without generating any screenable entry. A logistics operator can breach an arms embargo on a completely clean sanctions screen because the prohibited element is the goods and their destination, not the counterparty’s name. Travel bans sit further outside still, since a Member State applies them at a border and no bank applies them at onboarding.

What is the EU consolidated sanctions list, and who maintains it?

The European Commission maintains the EU consolidated sanctions list through DG FISMA. The Commission describes it as the record of individuals, groups and organisations subject to EU financial sanctions, managed and updated whenever necessary so that it reflects the officially adopted texts published in the Official Journal. The machine-readable version is published as the EU Financial Sanctions Files.

Two other resources are routinely confused with it. The EU Sanctions Map sets out every sanctions regime alongside its underlying legal acts, which makes it a research tool and not a screening file. The EU Sanctions Tracker is a dashboard for looking up an entity. Neither one is the authoritative source of a designation, and neither substitutes for screening.

Who is on the EU sanctions list?

The consolidated list carries the natural persons, legal persons, entities and bodies designated for asset freezes under EU financial sanctions regulations. Designations cluster by regime, so one individual can appear under a country regime and a thematic regime simultaneously. Alongside the country regimes, the EU operates four thematic ones which cover terrorism, human rights violations, cyber-attacks, and the proliferation and use of chemical weapons. Anyone asking who is on the EU sanctions list is really asking about that asset-freeze population, which is narrower than the full set of counterparties the rules restrict.

How often is the EU sanctions list updated?

The EU sanctions list follows no fixed update schedule. The Commission updates the consolidated list whenever necessary, which means the cadence tracks the Council’s adoption calendar and not a clock. Designations arrive in packages, not a steady trickle, and the pace can be sharp. The EU adopted its 21st package of measures against Russia on 23 July 2026. What governs operationally is that legal effect attaches at Official Journal publication, so the date that matters is the publication date and not the date a file was pulled.

Why is the list narrower than your exposure?

A company can be blocked without appearing on any list at all. Where a designated person holds 50% or more of the proprietary rights in an entity, or a majority interest in it, the Council’s EU Best Practices for the effective implementation of restrictive measures treat that entity as owned by the designated person, and ownership is assessed on an aggregated basis across multiple designated persons. Control can produce the same outcome on a different set of facts. Neither test resolves to a name on the consolidated list, which makes sanctions exposure a beneficial-ownership problem as much as a screening one. Our guide to sanctions screening covers how that resolution runs inside a live onboarding flow.

What is an EU asset freeze, and what does it prohibit?

An EU asset freeze imposes two separate prohibitions, and firms regularly satisfy the first while breaching the second.

Article 2 of Council Regulation (EU) No 269/2014 states that all funds and economic resources belonging to, owned, held or controlled by a listed party shall be frozen. It then states, as a distinct obligation, that no funds or economic resources shall be made available, directly or indirectly, to or for the benefit of a listed party.

The second limb is where most breaches live. The word ‘indirectly’ reaches payments routed through an intermediary, and the phrase ‘for the benefit of’ reaches value delivered to a third party that the designated person ultimately enjoys. The same regulation defines economic resources as assets of every kind, whether tangible or intangible, movable or immovable, which are not funds but may be used to obtain funds, goods or services. Under that definition, a leased vehicle, a software licence or professional services all qualify, so EU asset freeze rules bite well beyond a bank balance.

Who must comply with EU sanctions?

EU sanctions bind anyone who meets any one of five conditions, and holding a European banking licence is only one of them. The scope clause at Article 17 of Regulation (EU) No 269/2014 applies the regulation as follows.

Currency is absent from that list. A euro-denominated payment between two non-EU parties, cleared outside the Union, does not by itself trigger the regulation, so the widely repeated claim that euro usage creates EU jurisdiction misstates the test. The fifth condition reaches furthest, because business done in whole or in part within the Union means a single EU leg of an otherwise external transaction brings this arrangement into scope.

What are the penalties for breaching EU sanctions?

Penalties for breaching EU sanctions are set and imposed by Member States, not by the European Commission.

Who enforces, and what the 2024 directive changed

Member States and their national competent authorities investigate suspected non-compliance, while the Commission monitors consistent implementation and issues guidance. That division produced years of divergence, and identical conduct attracted very different consequences depending on the Member State that caught it.

Directive (EU) 2024/1226 of 24 April 2024 set common minimum rules to close that gap. It requires Member States to criminalise intentional violations of Union restrictive measures, circumvention included, and sets floors for the maximum penalties national law must provide. For companies, those floors are tiered by offence at not less than 1% or 5% of total worldwide turnover, or at fixed sums of at least €8 million or €40 million, with each Member State choosing which of the two approaches to adopt when it transposes. Individuals face maximum prison terms for the more serious offences.

The transposition deadline was 20 May 2025, and the Commission opened infringement procedures against 18 Member States on 24 July 2025 for missing it. Real exposure therefore depends on which Member State has jurisdiction and how far its transposition has progressed, so a group operating across several EU markets faces an uneven enforcement map instead of one standard.

What EU sanctions compliance requirements look like in practice

EU sanctions compliance requirements reduce to four operational obligations:

1. Screen at onboarding and continuously: A clean check at account opening says nothing about a designation published the following week.
2. Resolve ownership and control: Screening a corporate customer’s own name misses the entity blocked because a designated person holds 50% or more of it, and business verification that traces a structure down to its natural persons is what closes that gap.
3. Evidence of the decision: A competent authority reviews the record, so the reasoning behind a discounted match matters as much as the match itself.
4. Freeze and report: Where a match is confirmed, funds and economic resources are frozen, and the national competent authority is notified.

How Shufti helps compliance teams screen EU designations

The gap most teams carry is timing. A designation binds from the moment it reaches the Official Journal, so a screening file on a slower refresh clock leaves a window the firm owns, and the regulator does not forgive.

Shufti’s sanctions screening runs on a data foundation Shufti builds and owns rather than licenses from a third party, covering 215+ sanction regimes and 4,000+ watchlists, refreshed every 15 minutes. That refresh interval is the whole point. It narrows the distance between a new EU designation reaching the Official Journal and that same name reaching your alert queue, and because the data layer and the decisioning layer belong to one platform, the reasoning behind every discounted match lands in a single audit record instead of being reconciled across two vendors.