The EU sanctions list is the European Commission's consolidated list of every person, group and entity subject to an EU asset freeze. If a supplier or customer is on it, a business covered by EU law cannot pay them or make anything of value available to them.
For the basics of how sanctions lists work, start with what a sanctions list is.
What are EU "restrictive measures"?
The EU calls its sanctions "restrictive measures". They are made in two steps by the Council of the EU, the body of member state governments.
- A Council decision. The Council's own page says restrictive measures "are laid down in Common Foreign and Security Policy (CFSP) Council decisions." The EU's foreign policy chief, the High Representative, makes the proposal. The Council adopts it by unanimity.
- A Council regulation. If the decision includes an asset freeze or other economic measures, the Council adopts a regulation to put them into effect. The High Representative and the Commission propose it jointly.
The regulation is the part that binds businesses. The Council says it "is binding on any person or entity (economic operators, public authorities, etc.) within the EU." The decision and the regulation are usually adopted together and take effect on the same day, so an asset freeze starts without a gap.
One example is Council Regulation (EU) No 269/2014, the asset freeze over actions against Ukraine. It rests on Article 215 of the Treaty on the Functioning of the European Union (TFEU) and Council Decision 2014/145/CFSP. The listed names sit in its Annex I.
What does an EU asset freeze stop you doing?
Article 2 of Regulation 269/2014 sets out the two rules you will find in almost every EU financial sanctions regime:
- All funds and economic resources belonging to, owned, held or controlled by a listed person "shall be frozen".
- "No funds or economic resources shall be made available, directly or indirectly, to or for the benefit of" a listed person.
Both terms are wide. "Funds" covers cash, bank balances, debts, shares, guarantees and letters of credit. "Economic resources" means any other asset that could be used to get funds, goods or services.
In practice, do not pay a listed supplier, even for work already done. Do not deliver goods or services to a listed customer. Do not route either through someone else. If a listed party's money reaches you, it is frozen in your hands.
Where do you find the EU consolidated list?
The Commission publishes the list as an open dataset on data.europa.eu, titled "Consolidated list of persons, groups and entities subject to EU financial sanctions". The publisher is the Commission's Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA).
The dataset says the Commission "is responsible for its maintenance and for keeping the consolidated list of sanctions up-to-date."
The page links to the full list as CSV, XML and PDF files, plus an RSS feed of changes. The files come from the Commission's Financial Sanctions Files (FSF) service. The FSF website asks you to sign in with an EU Login account. The file links on data.europa.eu downloaded without one when we checked.
The CSV generated on 12 October 2026 held 6,233 entries: 4,459 people and 1,774 entities. Entries can carry aliases, dates of birth, addresses and ID numbers.
Is the EU Sanctions Map official?
The EU Sanctions Map is a free website that shows each EU sanctions regime by country or theme, with links to the legal acts. Its information page says the Estonian Presidency of the Council of the EU created it and launched it on 29 September 2017.
It is an EU tool, but not a legal source. Its disclaimer says the information "is not intended to be basis for any decisions with legal implications" and that only legal acts published in the Official Journal are authentic. Use it to find which regime applies. Use the list files to screen names.
Who has to comply with EU sanctions?
Each EU sanctions regulation has a clause setting out where it applies. In Regulation 269/2014 it is Article 17. The regulation applies:
- within the territory of the EU, including its airspace
- on board any aircraft or vessel under the jurisdiction of a member state
- to any national of a member state, inside or outside the EU
- to any legal person, entity or body incorporated or constituted under the law of a member state, inside or outside the EU
- to any legal person, entity or body "in respect of any business done in whole or in part within the Union"
The last point reaches non-EU businesses for the part of their business done in the EU.
Who enforces EU sanctions?
The EU writes the rules. Member states enforce them. The Council says implementation and enforcement "is primarily the responsibility of EU member states", with the Commission overseeing them as guardian of the treaties.
Regulation 269/2014 shows the split. Article 15 tells each member state to set the penalties for breaches, which "must be effective, proportionate and dissuasive". Article 16 has each state name its competent authorities. Annex II of the regulation lists their websites. The Commission keeps a contact list of national competent authorities.
Is breaching EU sanctions a crime?
It is meant to be, in every member state bound by Directive (EU) 2024/1226. Adopted on 24 April 2024, the directive sets minimum rules for which breaches are crimes and how they are punished.
Article 3 lists the conduct that must be a crime when done intentionally. It includes:
- making funds or economic resources available to a designated person
- failing to freeze funds or economic resources of a designated person
- trading in goods or providing services that a sanctions regulation prohibits
- getting round a sanctions measure, for example by hiding who really owns frozen assets
Member states may leave out cases worth less than EUR 10,000. Several linked acts by the same offender can add up to that threshold.
Article 7 sets the floor for fines on companies. For most offences, member states must allow maximum fines of at least 5% of total worldwide turnover, or an amount corresponding to EUR 40 million. For individuals, making funds available or failing to freeze them must carry a maximum prison term of at least five years where the value is EUR 100,000 or more.
Article 20 set the transposition deadline: member states had to bring their national laws into line "by 20 May 2025". On 24 July 2025 the Commission sent letters of formal notice to 18 member states that had not notified full transposition. Denmark is not bound by the directive. Ireland chose to take part.
How do ownership and control work under EU sanctions?
A company can be frozen without being named on the list. The Commission's asset freeze FAQs for Regulation 269/2014 explain why.
However, if the listed person is deemed to own or control a non-listed entity, it can be presumed that the control also extends to the assets of that entity, and that any funds or economic resources made available to that entity would reach or benefit the listed person.
The entity can rebut that presumption case by case. Until it does, treat the company as frozen.
The ownership test comes from the Council's EU Best Practices for the effective implementation of restrictive measures, updated on 3 July 2024.
The criterion to be taken into account when assessing whether a legal person or entity is owned by another person or entity is the possession of 50% or more of the proprietary rights of an entity or having majority interest in it.
Ownership is added up across listed owners. If one listed person owns 30% and another owns 25%, both the Best Practices and the Commission's FAQ treat the entity as owned by listed persons.
Control is a separate test. Paragraph 64 of the Best Practices lists signs of control, including:
- the right or power to appoint or remove a majority of the board
- control of a majority of voting rights under an agreement with other shareholders
- the power to exercise a dominant influence in practice, without holding the formal right
- the right to use all or part of the company's assets
The Best Practices say they "are not legally binding". The Commission's FAQs still point businesses to them for guidance on ownership and control.
How does the EU list compare with the UK and US lists?
| EU | UK | US | |
|---|---|---|---|
| List | Consolidated list of persons, groups and entities subject to EU financial sanctions | UK Sanctions List | SDN list and OFAC's other sanctions lists |
| Publisher | European Commission (DG FISMA) maintains it. The Council adopts the listings. | Foreign, Commonwealth & Development Office (FCDO). OFSI enforces financial sanctions. | Office of Foreign Assets Control (OFAC), US Treasury |
| Legal basis | CFSP Council decisions plus Council regulations under Article 215 TFEU | Regulations made under the Sanctions and Anti-Money Laundering Act 2018 | Programme regulations in 31 CFR chapter V |
| Who must comply | EU nationals anywhere, EU-incorporated entities, anyone in the EU, and any business done in whole or in part in the EU | Everyone in the UK and its territorial sea, plus UK nationals and UK-law entities anywhere | US persons: citizens and permanent residents anywhere, anyone in the US, US-incorporated entities and their foreign branches |
| Ownership threshold | 50% or more, aggregated across listed owners | More than 50%. OFSI does not simply aggregate separate holdings. | 50% or more in aggregate |
For more on the US side, see OFAC's sanctions lists explained.
Does the EU sanctions list matter for UK businesses?
The UK runs its own sanctions under the Sanctions and Anti-Money Laundering Act 2018. The FCDO's UK Sanctions List page says it "is now the only source for all UK sanctions designations." A UK company on Xero checks that list first. Our guide on how to check Xero contacts against sanctions lists walks through it step by step.
Going by the jurisdiction clause above, EU rules still reach a UK business when it has a subsidiary incorporated in an EU country, when staff who are EU nationals handle the deal, or when part of the business is done within the EU.
The two lists are made by separate governments. A name can be on one and not the other, and the ownership rules differ, as the table shows.
Non-EU businesses with EU customers or suppliers
Your EU partners are bound by EU sanctions. So are their banks. An EU company that pays a listed party, or a company a listed party owns, is in breach. That gives your partners and their banks a reason to check who you are, who owns you and who you deal with. If you sell to or buy from EU companies, screening your own contacts against the EU list finds a problem before it stalls a payment.
How to check a name against the EU list
- Download the CSV from the data.europa.eu dataset page.
- Search it for each supplier and customer name, with spelling variants. Search for owners and directors too.
- Compare any hit with the entry's date of birth, address and ID numbers before calling it a match.
- Record the date, the file, what you searched and the result.
For a likely match, hold the payment and get legal advice before you release anything.
The list changes whenever the Council adds or removes names, so a one-off check goes stale. Sanctions Clear, opening to QuickBooks Online and Xero users, will fetch the EU list every 6 hours, screen your contacts against it alongside OFAC, UK, UN and four other sources, and keep a dated record of each check. Our guide to sanctions compliance for small businesses covers how often to recheck and what records to keep.
