Businesses operating in the EU face a rapidly expanding body of sanctions obligations that now encompass asset-freeze requirements, export and re-export controls, best-efforts duties on EU parent companies, and prohibitions on transactions involving instruments such as the digital rouble. Compliance requires structured screening programmes, documented due-diligence procedures, and ongoing monitoring of successive legislative packages – the 20th of which entered into force on 23 April 2026 and the 21st on 23 July 2026. Failure to maintain adequate controls exposes companies to criminal liability, reputational damage, and the practical paralysis of cross-border transactions.
Legal Basis and the Current Regulatory Architecture
EU sanctions derive primarily from Council Regulations adopted under Article 215 TFEU, which have direct effect across all Member States. The principal instrument targeting Russia remains Council Regulation (EU) No 833/2014 and its successive amendments. Each amending package adds new designations, commodity restrictions, service prohibitions, and procedural obligations. The 21st package, enacted by Council Regulation (EU) 2026/1848 on 23 July 2026, focuses on energy, financial services, and the crypto-asset sector, building on the 20th package's extension of restrictions to new financial instruments.
Alongside the Russia-specific measures, the EU maintains separate regimes covering Belarus, Iran, North Korea, Myanmar, and a growing list of thematic frameworks such as those addressing cyber-attacks and human rights violations. Each regime has its own consolidated list and procedural rules. The EUR-Lex portal is the authoritative source for current consolidated texts; businesses should treat any third-party summary as a starting point for research rather than a definitive compliance reference.
The European Commission plays a central coordinating role, issuing Frequently Asked Questions guidance and interpretive notices that, while not legally binding, carry significant weight in enforcement practice. Sector-specific regulators – including the EBA for credit institutions and ESMA for investment firms – have issued their own expectations on sanctions screening and governance integration.
Key Prohibitions: What Has Changed Since Early 2026
Three developments are particularly significant for compliance programmes in 2026:
- Digital rouble and RUBx ban: From 24 May 2026, transactions involving the digital rouble and the RUBx instrument are prohibited. Businesses with payment systems, fintech integrations, or correspondent-banking arrangements must have updated their transaction-monitoring rules to block or flag these instruments by that date.
- Russian LNG import restrictions: For most contracts, the import of Russian liquefied natural gas became prohibited from 25 April 2026. Long-term contracts concluded before 17 June 2025 benefit from a derogation running until 1 January 2027, after which the prohibition applies universally. Energy companies with existing supply agreements should be reviewing their contractual positions and sourcing alternatives now.
- Divestment derogation for Russia exits: The derogation permitting EU entities to divest from Russian operations has been extended to 31 December 2026. This window is finite: companies that have not commenced a structured exit should assess whether the extension provides sufficient time to complete asset disposals or wind-downs without requiring a new derogation application.
If your business intersects with any of these areas and you are uncertain how the current rules apply to your specific contracts or instruments, the team at Ferraz & Whitmore can assist with a targeted legal assessment. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Step-by-Step Compliance Framework
Step 1 – Mapping Your Exposure
Begin by identifying every touchpoint with sanctioned jurisdictions, entities, or instruments: counterparty relationships, supply chains, payment flows, service providers, and beneficial ownership structures. For companies with complex group structures, the analysis must extend to subsidiaries and affiliates, since control relationships can create indirect exposure. Document this mapping formally – it forms the evidentiary foundation for every subsequent step.
Step 2 – Sanctions Screening
Screening must be conducted against the EU Consolidated Sanctions List maintained on EUR-Lex, as well as any applicable national lists. Screening should cover:
- Direct counterparties (customers, suppliers, distributors, agents);
- Beneficial owners and controlling persons, applying the relevant ownership thresholds set out in the applicable regulation;
- Financial intermediaries, correspondent banks, and payment processors involved in any transaction;
- Vessels, aircraft, and other assets where the business operates in shipping, aviation, or logistics.
Automated screening tools reduce operational risk but do not eliminate legal responsibility. False-negative rates, name-transliteration issues, and list-update latency all require documented human-review procedures. The EBA's guidelines on internal governance have repeatedly emphasised that compliance functions must be adequately resourced to carry out effective screening rather than merely operating a software checkbox.
Step 3 – Re-Export Controls and Anti-Circumvention Obligations
One of the most significant developments in EU sanctions enforcement is the shift from transaction-by-transaction analysis to systemic anti-circumvention obligations. EU operators are now required to include no-re-export-to-Russia clauses in contracts for goods on the Common High Priority Items list and other controlled categories. Failure to include such clauses is itself a breach, regardless of whether re-export ultimately occurs.
Beyond contractual clauses, businesses must exercise due diligence regarding the actual end-use of exported or re-exported goods. Where an operator has reasonable grounds to suspect that a transaction facilitates circumvention – for example, because a shipment is routed through a third country with historically elevated Russia-related trade flows – it must either decline the transaction or obtain satisfactory documentary assurances. This is not a hypothetical risk: CJEU and national court decisions have confirmed that constructive knowledge can ground liability.
For businesses operating in or through jurisdictions that present elevated circumvention risk, our analysis of relevant routing patterns and enforcement trends is available at Sanctions Circumvention Risk: China. For guidance specific to trade routes involving Georgia or Austria, please see our country-specific pages for Georgia and Austria.
Step 4 – Best-Efforts Obligations for EU Parent Companies
Since the introduction of the best-efforts obligation, EU-incorporated parent companies are required to take all reasonable steps to ensure that their non-EU subsidiaries and affiliates do not participate in activities that undermine EU sanctions. This obligation does not mandate the impossible, but it does require documented, proportionate action: updating group policies, issuing compliance directives, conducting training, and – where necessary – restricting the subsidiary's access to EU-origin goods, technology, or financial support that could fuel non-compliant activity.
Assessing the sufficiency of best-efforts measures is fact-specific. Relevant factors include the parent's degree of operational control over the subsidiary, the nature of the subsidiary's business, and the enforcement environment in the subsidiary's jurisdiction. Companies should not assume that a group-wide policy document alone satisfies the obligation.
Step 5 – Documentation and Record-Keeping
Every compliance decision – whether to proceed with a transaction, request a licence, or decline a counterparty – should be documented contemporaneously. Records should include the date of the decision, the identity of the decision-maker, the information reviewed, the conclusion reached, and the rationale. In the event of a regulatory inquiry or enforcement action, contemporaneous documentation is often the most effective evidence that a business acted in good faith and with due diligence.
Retention periods are subject to national implementing rules, which vary across Member States. As a practical baseline, businesses commonly retain sanctions-related records for a minimum of five years, though some national frameworks impose longer periods for financial institutions.
Step 6 – Licence Applications and Derogations
Certain prohibited activities may be permitted under specific licences or derogations. The competent authority for issuing such licences is the relevant national authority in each Member State rather than an EU-level body. Licence applications typically require a detailed factual description of the proposed activity, evidence of the applicable derogation ground, supporting documentation, and – in some jurisdictions – a legal opinion. Processing times vary significantly across Member States and depend on the complexity of the application and the workload of the competent authority; businesses should not assume rapid turnaround.
Common Errors Made by Foreign Clients
Based on recurring patterns in cross-border advisory work, the following errors are particularly prevalent among businesses entering the EU market or expanding EU-connected operations:
- Treating sanctions compliance as a one-time exercise: With packages now being adopted multiple times per year, a compliance review conducted in 2024 or early 2025 will not reflect the current legal position. Programmes need scheduled review cycles and a mechanism for absorbing legislative updates rapidly.
- Underweighting beneficial ownership analysis: Screening a legal entity name is insufficient. The obligation extends to persons who own or control the entity, directly or indirectly. Ownership structures involving trusts, foundations, or multi-layered holding companies require careful analysis.
- Assuming non-EU subsidiaries are outside scope: The best-efforts obligation and the jurisdictional scope of certain prohibitions mean that non-EU group entities cannot simply be quarantined from compliance responsibility.
- Conflating EU sanctions with US OFAC sanctions: The two regimes overlap but are not identical in scope, designated persons, or procedural requirements. Compliance with one does not guarantee compliance with the other.
- Failing to update contracts for re-export clauses: Many businesses operating under legacy contracts have not yet incorporated the required no-re-export provisions. This gap creates independent liability risk separate from any actual re-export.
- Overlooking the digital rouble prohibition: For fintech companies, payment service providers, and businesses accepting crypto-adjacent instruments, the ban in force from 24 May 2026 requires specific technical and policy updates that may not be captured by conventional sanctions screening tools calibrated for entity names.
Realistic Timelines and Cost Drivers
There is no single timeline for sanctions compliance because the scope of the exercise depends on the complexity of the business, the number of counterparties, the geographic footprint, and the maturity of existing compliance infrastructure. The following generalisations reflect common experience rather than guaranteed benchmarks:
- A gap analysis for a mid-size trading company with a defined counterparty base: typically several weeks of focused work.
- Implementation of a compliant screening programme, including vendor selection and staff training: two to four months for a business starting from a low base.
- A licence application to a national competent authority: the application itself may take weeks to prepare; the authority's processing time is determined by national rules and cannot be controlled by the applicant.
- A structured Russia divestment using the current derogation (available until 31 December 2026): timing is driven by transaction complexity, not just legal process.
Cost drivers include the volume of counterparties requiring screening, the complexity of beneficial ownership structures, the need for external legal counsel in multiple jurisdictions, and the degree to which existing compliance infrastructure can be adapted rather than rebuilt. Businesses should budget for ongoing monitoring costs as a recurring operational expense, not a one-off project.
Decision Checklist
Before entering or continuing a transaction with any EU-sanctions nexus, consider the following:
- Have all counterparties, their beneficial owners, and relevant intermediaries been screened against the current EU Consolidated Sanctions List?
- Does the transaction involve goods, technology, or services on a controlled list, and has end-use been assessed?
- Is a no-re-export clause required and, if so, has it been included in the relevant contract?
- Does the routing or destination of the transaction create circumvention risk, and has that risk been documented and addressed?
- For financial transactions: does the payment involve any prohibited instrument, including the digital rouble or RUBx, as of 24 May 2026?
- For energy transactions: does the transaction involve Russian LNG, and if so, does a valid derogation apply?
- Has the decision and its supporting rationale been recorded and stored in a retrievable format?
- If the transaction is borderline, has specialist legal advice been obtained?
If any item on this checklist gives rise to uncertainty, Ferraz & Whitmore's sanctions and trade practice can provide a structured review tailored to your transaction or operational context. Reach us at info@ferrazwhitmore.com or through our contacts page.
Enforcement Trends and What They Mean for Businesses
Enforcement activity across EU Member States has increased substantially since 2022 and continues to intensify. National prosecutors and customs authorities have pursued criminal investigations, asset seizures, and administrative penalties in cases involving both direct sanctions breaches and circumvention-facilitation. The CJEU has addressed interpretive questions relating to asset-freeze obligations, confirming a broad reading of "economic resources" and "making available" that captures arrangements that might not intuitively appear as financial transactions.
The EU's anti-circumvention framework has also generated significant enforcement interest in third-country routing: goods transiting through jurisdictions that have recorded anomalous export volume increases to Russia attract heightened scrutiny at EU customs points. This scrutiny extends backwards along the supply chain to the EU exporter. Businesses should therefore not regard compliance as complete at the point of export; ongoing monitoring of downstream distribution is increasingly expected.
ESMA has emphasised that investment firms and asset managers must integrate sanctions obligations into their broader AML/CFT and KYC frameworks rather than treating them as a separate workstream. The EBA has made similar points in its risk-based supervision guidance for credit institutions. For regulated entities, a fragmented compliance structure that separates sanctions work from other financial crime controls creates both operational gaps and regulatory risk.
How Ferraz & Whitmore Can Assist
Our sanctions and trade practice advises businesses, financial institutions, and investors on the full lifecycle of EU sanctions compliance – from initial exposure mapping and programme design through to licence applications, transaction clearance, and enforcement response. We work across multiple EU jurisdictions and maintain close familiarity with the national competent authorities responsible for licensing and enforcement in each Member State.
We do not offer template compliance programmes or generic advice. Every engagement is structured around the specific regulatory exposure and operational context of the client. Whether you are assessing a new trading relationship, restructuring an existing supply chain, or responding to a regulatory inquiry, we can provide the focused legal analysis your situation requires.
To discuss your compliance position with a member of our team, please write to info@ferrazwhitmore.com or use the form on our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.