EU Sanctions on Syria 2026: What Companies and Banks Must Do

Key data

Spanish companies with operations linked to Syria have an active compliance obligation from 18 May 2026. The Council Implementing Regulation (EU) 2026/1107 updates the lists of natural and legal persons subject to restrictive measures under Regulation (EU) No 36/2012. It is not a new regulation: it is an update of designations that expands the scope of who is sanctioned.

The risk is concrete: operating with a counterparty listed in the updated list—even unintentionally—can result in serious administrative and criminal sanctions. Lack of knowledge is not an excuse.

What does this regulation establish?

Council Implementing Regulation (EU) 2026/1107 applies the sanctions framework of Regulation (EU) No 36/2012 by updating the lists of designated persons and entities. The restrictive measures applied to those included in these lists are two:

• Asset freezing: the funds and economic resources of the designated persons are blocked. They cannot be moved, transferred or used.
• Prohibition on making funds available: no company or entity can provide funds, assets or economic resources to designated persons and entities, either directly or indirectly.

This regulation does not create a new sanctions regime: it updates the lists within the existing regime of Regulation (EU) No 36/2012. Each list update requires all affected companies to review their counterparties again, regardless of the controls already in place.

The updated lists of designated persons and entities are available in the official text published in the Official Journal of the EU (EUR-Lex). It is essential to consult the full text to know the specific names included in this update.

Economic and operational impact

The impact is not only legal: it is operational and economic. Each update of sanctioned lists generates an immediate obligation to review the entire portfolio of clients, suppliers and financial counterparties. This has direct cost in time and resources.

The risks of non-compliance include:

• Administrative sanctions: fines imposed by the competent national authorities (in Spain, the State Secretariat for Economy and Business Support).
• Criminal sanctions: deliberate or negligent breach of restrictive measures can result in criminal liability for managers and the company itself.
• Blocking of operations: transactions with designated persons are automatically prohibited, which can paralyze ongoing contracts.
• Reputational damage: being identified as a company operating with sanctioned persons has consequences beyond the fine.

For financial entities, the operational impact is particularly relevant: they must update their customer and transaction screening systems to incorporate the new designations. This involves coordination between compliance, technology and operations teams.

Who does it affect?

The compliance obligation falls on all companies and entities established in the EU that have any type of commercial or financial relationship with Syria or with designated persons and entities. The sectors with the greatest direct exposure are:

• International trade: importers, exporters and distributors with activity in Syria or with Syrian counterparties.
• Banking and credit entities: obliged to update customer and transaction screening with the new designations.
• Insurance: companies that insure operations, goods or persons linked to Syria.
• Transport and logistics: companies that manage routes, cargo or services with origin or destination in Syria.
• Advisory and law firms: that provide services to clients with exposure to Syria must verify that their clients are not designated.

Practical example

A Spanish international trade company has a Syrian supplier with which it has been operating for three years without incident. On 18 May 2026, Council Implementing Regulation (EU) 2026/1107 enters into force, updating the lists of designated persons.

If that supplier—or any natural person linked to it—appears in the updated list, the Spanish company is prohibited from continuing any operation: it cannot make payments, receive goods or maintain active contracts. If it does, it incurs non-compliance with restrictive measures, with risk of serious administrative and criminal sanctions.

The only way to avoid it is to have carried out counterparty screening after the publication of the new list. If the company does not have a systematic process for review each time a sanctions list is updated, this case can materialize without anyone in the organization detecting it in time.

What should companies do now?

1. Consult the updated list: access the full text of Council Implementing Regulation (EU) 2026/1107 on EUR-Lex to identify the new designated persons.
2. Review the entire counterparty portfolio: cross-reference clients, suppliers, partners and ultimate beneficiaries with the updated list. It is not enough to have done this exercise in previous updates.
3. Update screening systems: financial entities must incorporate the new designations in their customer and transaction control tools immediately.
4. Suspend operations with designated persons: if a counterparty included in the list is detected, halt any ongoing operation and notify the legal or compliance department.
5. Document the verification process: keep written record that screening has been carried out after the update. This documentation is key in case of inspection or investigation.
6. Review active contracts: identify if any active contract may be affected by the new designations and evaluate the legal options available.
7. Consult with a specialized advisor: if there are doubts about whether a counterparty is affected or how to manage an ongoing operation, non-compliance has criminal consequences. Do not act without advice in doubtful cases.