Published 7 October 2026

EU financial sanctions: what applies the moment a name is on the list

Once a client's name is on an EU list, risk-based judgement no longer comes into it: you freeze, you pay nothing over, you tell the authority. Where the lists come from, what they mean for a notary, an accountant or an estate agent, and what the AMLR adds from 10 July 2027.

This guide covers European Union law. What each Member State sets for itself (the authority that supervises you, the financial intelligence unit that receives your reports, how you file them) is set out country by country: Ireland, Malta and every other Member State.

Everyone says sanctions; the Treaties say restrictive measures: foreign-policy decisions the Union takes against a country, a regime, individuals or organisations. They are made in two steps. The Council first adopts a decision under the common foreign and security policy (Article 29 of the Treaty on European Union), as a rule unanimously (Article 31). Where that decision targets natural or legal persons, groups or entities, the Council then adopts, by qualified majority, the regulation that makes it binding on everyone (Article 215 of the Treaty on the Functioning of the European Union). A regulation applies directly in every Member State, with no national transposition (Article 288 of the same Treaty).

One annex per regime, one consolidated list to work from

There is no single EU sanctions list. Each regime has its own regulation, and each regulation its own annex. Regulation (EU) No 269/2014, adopted on 17 March 2014 over Ukraine, shows the mechanics at their plainest: it is based on Article 215 TFEU and on Decision 2014/145/CFSP, adopted the same day under Article 29 TEU. Its Annex I gives, for each person, the grounds for listing and, where available, what is needed to identify them: names and aliases, date and place of birth, nationality, passport and ID card numbers (Article 3(2) and (3)). The list is reviewed at least every 12 months (Article 14(4)).

Nobody opens every regulation before every file. So the European Commission keeps the "Consolidated list of persons, groups and entities subject to EU financial sanctions", published on data.europa.eu in XML, CSV and PDF. It is a working list, not the law: the dataset page itself warns that only what is published in the Official Journal of the EU is authentic, and that updates to the list may lag behind it.

UN listings come in through the same door

The UN Security Council designates people and entities too. Its designations become Union law through the same two acts, a decision under Article 29 TEU and a regulation under Article 215 TFEU, as recital 36 of the AMLR points out, ahead of that Regulation applying on 10 July 2027.

The regime against ISIL (Da'esh) and Al-Qaida shows the route. Regulation (EC) No 881/2002 freezes the funds of persons and entities designated by the Security Council or its Sanctions Committee (Article 2). When the Committee lists a name for the first time, the Commission adds it to Annex I as soon as the Committee has provided a statement of reasons; when the UN delists a name, the Commission amends the Annex accordingly (Article 7a(1) and (5)).

So there is a gap between UN publication and the EU act. From 10 July 2027, the AMLR will require obliged entities to keep records, during that gap, of the funds they manage for a UN-designated customer, the transactions the customer attempts and those carried out for them (Article 27).

Two prohibitions, and no threshold

Regulation 269/2014 and Regulation 881/2002 rest on the same two rules. All funds and economic resources belonging to, owned, held or controlled by a listed person are frozen. No funds or economic resources may be made available, directly or indirectly, to them or for their benefit (Article 2 of each).

The definitions show how far that reaches. Funds means cash, deposits, securities, claims. Economic resources means any asset, movable or immovable, that is not a fund but can be used to obtain one. Freezing an economic resource means preventing its use to obtain funds, goods or services, including by selling, hiring out or mortgaging it (Regulation 269/2014, Article 1(d), (e) and (g)). Selling, letting, mortgaging: that is a notary's or an estate agent's ordinary working day, and it is precisely what a freeze stops.

Nothing in these texts sets a minimum amount. A deposit of a few hundred euros paid to a listed person is making funds available like any other.

Directive (EU) 2024/1226 added a criminal layer. By 20 May 2025, Member States had to make it a criminal offence, when intentional, to make funds available to a designated person or to fail to freeze their funds (Article 3(1)(a) and (b), and Article 20). They may leave conduct involving less than €10,000 outside criminal law, although linked acts of the same kind by the same offender can add up to that threshold (Article 3(2)). The threshold only concerns criminal law. The freeze itself applies from the first euro, and each Member State sets the other penalties (Regulation 269/2014, Article 15).

What a firm does, step by step

1. Screen at onboarding the customer and every beneficial owner, before any payment and any signature: a freeze works before the deal, not after it.
2. Screen again when the list changes. A customer with a clean record at onboarding can be listed two years later. From 10 July 2027, the AMLR spells it out: regular checks, at a frequency matched to your exposure, and at every new designation for credit and financial institutions only (Article 26(4)).
3. Check a match before drawing conclusions: the same name is not the same person. Compare the identifiers the annex gives, such as date of birth, nationality or document numbers.
4. Freeze once the match is confirmed: the deal stops there, and nothing leaves the firm. A freeze carried out in good faith does not make you liable unless negligence is proved (Regulation 269/2014, Article 10(1)).
5. Report to the competent authority of the Member State where you are resident or located. Regulation 269/2014 asks for information on frozen funds within two weeks of obtaining it at the latest (Article 8(1)); Regulation 881/2002 says "immediately" (Article 5(1)). Each regime sets its own terms: read the one that covers the person.
6. Keep a record: the date of the check, the version of the list, what was compared, the decision and who took it.

The same Regulation does not hold liable anyone who did not know, and had no reasonable cause to suspect, that they were breaching it (Article 10(2)). One more reason to be able to show that you looked.

A freeze is not a suspicious activity report. If the facts also point to money laundering or terrorist financing, the report goes its own way, to the financial intelligence unit, whatever the amount (Directive (EU) 2015/849, Article 33). Your supervisor and your FIU are listed on our Europe page; the authority that receives information on freezes in your State, which is not always the same body, can be found through Annex II to the Regulation.

Lawyers keep their privilege. Regulation 269/2014 applies its reporting duty consistently with the confidentiality of communications between lawyers and their clients (Article 8(1)), and Directive 2024/1226 states that it does not oblige legal professionals to report what they learn from a client while ascertaining their legal position or representing them in proceedings (Article 3(4)).

Today, and from 10 July 2027

The freeze already binds everyone. Screening customers, on the other hand, is not yet written into the EU's anti-money laundering rules for non-financial professions: Directive (EU) 2015/849 mentions targeted financial sanctions only for crypto-asset service providers (Article 19a). Your own country may go further, as the Directive allows (Article 5). The AMLR changes that on 10 July 2027, with one exception: football agents and professional football clubs only come under it on 10 July 2029 (Article 90).

The detail will come from AMLA: regulatory technical standards on due diligence information (Article 28) and guidelines on monitoring business relationships (Article 26(5)), which the AMLR made due by 10 July 2026, a year before it applies on 10 July 2027. Our AMLA guide explains how those standards are adopted, and our AMLR guide what changes for you in 2027.

OFAC and the rest: foreign lists

Other countries publish their own lists. The one most often cited is kept by OFAC, the Office of Foreign Assets Control at the US Treasury: the List of Specially Designated Nationals and Blocked Persons, or SDN list. According to OFAC itself, its sanctions bind "U.S. persons": US citizens and permanent residents wherever they are, anyone in the United States, and US-incorporated entities and their foreign branches. These lists are not EU law. They are called extraterritorial because they follow those persons outside the United States, and OFAC itself points to how much further they reach: some programmes also cover foreign subsidiaries owned or controlled by a U.S. person, and a non-U.S. person must neither cause a U.S. person to violate the sanctions nor evade them. A firm in Ghent or Porto is not bound by these lists merely because it practises in the EU; it can come within their reach through one of those links.

So they matter in your risk assessment whenever a file touches the United States: an American partner or customer, a US shareholder who controls the customer, a payment routed through a US bank. And the Union draws a line in the other direction. Regulation (EC) No 2271/96 forbids complying with requirements based on certain US laws listed in its Annex, on Cuba and Iran (Article 5). Before turning a client away because of a foreign list, ask where the prohibition actually comes from.

Vigilae screens on its own servers, against lists it downloads: your clients' names are never sent to a data provider. It flags matches with the details you need to qualify them and prepares a dated file. It freezes nothing and notifies no authority on your behalf: you decide, and you remain solely responsible for your reports. See how it works.

Informative article, current as of 7 October 2026, not constituting legal advice. The articles cited were checked against the texts published in the Official Journal of the European Union, in their consolidated version where one exists; each sanctions regime has its own regulation, to be read for the person concerned.

Frequently asked questions