RegRally Insights: Sanctions Regulation, October 2026

Russia’s autocratic political system is not, on its own, proof that a company is controlled by a sanctioned person. The Court of Justice of the EU made this clear in a case referred by a Lithuanian court, while confirming that informal control can count if it is backed by objective and sufficiently solid evidence. In the same month, OFAC sanctioned a crypto marketplace together with its wallet addresses, and the EU extended more than 3,000 Russia-related listings until 2029.

For fintechs, payment institutions and crypto businesses, each of these changes affects screening, onboarding and freezing decisions. This edition of RegRally covers the sanctions developments of September 2026 for financial institutions and fintech companies in the Baltics and across the EU.

At a glance

• Lithuania: in the Inter Rao Lietuva case, the Court of Justice of the EU ruled that control by a listed person must be shown by objective and sufficiently solid evidence. Informal control can count, but the nature of Russia’s political regime alone is not enough.
• EU listings: more than 3,000 Russia-related individual listings were extended until 22 September 2029. New listings followed over the deportation of Ukrainian children, the barring of Yabloko and hybrid threats.
• Crypto: OFAC designated the Xinbi Guarantee marketplace, its messaging and wallet developers, and associated wallet addresses.
• EU General Court: the Abramovich listing was upheld, confirming both “businessperson” criteria.
• United States: OFAC designated a Sinaloa Cartel laundering network and Iranian procurement agents, amended the Lukoil general license, ended the Ethiopia program and consolidated its penalty rules.

Court of Justice sets the evidence standard for control in Inter Rao Lietuva

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

The Court of Justice of the EU delivered its judgment in Case C-147/25 Inter Rao Lietuva, a reference from the Supreme Administrative Court of Lithuania. The company, an electricity importer and supplier, had its funds frozen in 2022 after the Lithuanian Financial Crime Investigation Service (FNTT) added it to a national list of persons linked to sanctioned persons. From May 2022, the listing was based on links to the President of Russia, who is subject to EU restrictive measures under Council Regulation (EU) No 269/2014. This rested mainly on the company being indirectly owned by the Russian company Inter RAO, whose main shareholders are undertakings indirectly owned by Russia.

The Court held that:

• Such a freeze implements the EU measures and is not a separate national sanction. It may apply to a company not named in the EU annexes if its funds belong to, or are owned, held or controlled by, a listed person. A mere “link” with a listed person is not enough: the authority must show that the funds belong to, or are owned, held or controlled by, that person. This applies even if the company can challenge the measure only after it has been listed. The grounds must, however, be communicated as soon as possible afterwards.
• The national court must make sure that the competent authority has established control objectively and on a sufficiently solid basis. Its review may be limited to the statement of reasons, the accuracy of the facts, any manifest error of assessment, compliance with procedural rules and misuse of powers, and it does not have to assess whether the measure is necessary in view of a threat to national security.
• Informal control can be taken into account, but only on objective and sufficiently solid evidence about the specific company. The autocratic nature of Russia’s political regime does not, in itself, prove that the President of Russia controls a company.

Why it matters

The ruling sets the standard of evidence for treating a company as controlled by a listed person. Informal control can count, while general assumptions about the Russian state do not. The case now returns to the Supreme Administrative Court of Lithuania, which will decide it in line with the ruling.

What we recommend for businesses

• Review your ownership-and-control screening methodology so that every “control” conclusion under Regulation 269/2014 is backed by concrete indicia, such as shareholder agreements, board appointment rights, funding flows or management overlap, rather than general assumptions about state influence.
• Where a client or counterparty has been treated as controlled by a listed person solely because of indirect Russian state ownership, reassess the file against the evidentiary standard set by the Court and record the outcome.
• Document the grounds for any internal decision to freeze funds or reject a client on control grounds, so that the decision can be explained to the competent authority.

---

EU extends Russia-related individual listings until 2029

Date: 22 September 2026 | Source: Council of the European Union
Link

The Council of the EU prolonged the individual restrictive measures under the regime concerning actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine for a further 36 months, until 22 September 2029. The measures apply to more than 3,000 individuals and entities and comprise asset freezes, travel bans and a prohibition on making funds or economic resources available.

Following its review, the Council decided not to renew the listings of three individuals and one entity, and removed three deceased persons from the list. Previously, the listings were renewed every six months.

Why it matters

The listings no longer need to be renewed every six months, but the Council can still add or remove names at any time, as the 28 September listings over the deportation of Ukrainian children show. The names that were not renewed are no longer on the list, so screening lists and any related freezes need to reflect them.

What we recommend for businesses

• Note the new expiry date of 22 September 2029 in the sanctions calendar and remove any internal contingency planning built around the six-month renewal risk.
• Update screening lists for the delisted persons and review any funds or economic resources frozen solely on the basis of those listings. Release them only after confirming that the persons are not listed under another EU regime or owned or controlled by another EU-listed person, and that no UK or U.S. restrictions apply to your business.
• Keep ownership-and-control checks against this list in the sanctions risk assessment for the full period of the listings.

---

OFAC sanctions the Xinbi Guarantee crypto marketplace and its wallet developer

Date: 9 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC designated Xinbi Guarantee, a Chinese-language online marketplace operating from Myanmar, Thailand and Laos, as a significant transnational criminal organization under Executive Order 13581, as amended by Executive Order 13863. It also designated SafeW Technology Co., Ltd. (Singapore), the developer of an encrypted messaging application, and Anwen Technology Co., Ltd. (Cambodia), the developer of the XinbiPay/NewPay crypto-asset wallet.

According to the U.S. Treasury, the marketplace has processed the equivalent of over USD 24 billion in digital assets and fiat currency since 2022, providing escrow services and connecting scam center operators in Southeast Asia, whose victims include Americans, with merchants offering money laundering, technology and other services. The Xinbi Guarantee SDN entry includes numerous associated crypto-asset wallet addresses. On the same day, the Department of Justice seized infrastructure and digital-asset wallets used by the marketplace. OFAC also amended ten existing FAQs and published two new licensing FAQs (1269 and 1270).

Why it matters

Because the designations include wallet addresses, exposure can be traced on-chain as well as by name. Under the OFAC 50 percent rule, entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by blocked persons are blocked too, even if they are not named.

What we recommend for crypto businesses and payment institutions

• Load the newly designated entities and the listed wallet addresses into sanctions and blockchain-analytics screening tools, and rescreen the transaction history of crypto-asset and payment clients for exposure.
• Reassess the risk rating of clients operating guarantee-type marketplaces, escrow services or wallet applications in Southeast Asia, and of clients with transaction flows to counterparties in Burma (Myanmar), Cambodia, Laos and Thailand.
• Remind the monitoring team that the OFAC 50 percent rule applies to entities owned 50 percent or more, individually or in the aggregate, by the designated organizations, and that U.S. dollar transactions and counterparties with a U.S. nexus must be screened against the updated SDN List.

---

EU sanctions 27 persons over the deportation of Ukrainian children

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU imposed restrictive measures on 10 individuals and 17 entities responsible for the unlawful deportation and forced transfer of Ukrainian children to Russia and within occupied territories, and for their forced assimilation. The listings were adopted under the Ukraine territorial-integrity regime by Council Decision (CFSP) 2026/2185 and Council Implementing Regulation (EU) 2026/2184.

Those listed include Rustam Minnikhanov, President of the Republic of Tatarstan, education and sports officials in the occupied territories, heads of children’s camps and schools, the Moscow City Tourism Committee, Russian companies active in children’s recreation and tourism, and the Songdowon International Children’s Camp in North Korea. Listed persons are subject to an asset freeze and, for natural persons, a travel ban. No funds or economic resources may be made available to them.

Why it matters

Besides officials, the listings include a public tourism body, children’s camps and sports centers, and companies in children’s recreation and tourism, so exposure is not limited to state officials.

What we recommend for businesses

• Update sanctions screening lists with the new designations and rescreen the client base, paying particular attention to travel, tourism, education and youth-camp businesses with Russian or occupied-territory links.
• Confirm that the screening tool ingests the consolidated EU list on the day of publication in the Official Journal.

---

General Court upholds the Abramovich listing

Date: 9 September 2026 | Source: General Court of the EU
Link

The General Court dismissed the action in Case T-358/25 Abramovich v Council, upholding the Council acts that extended the restrictive measures against Roman Abramovich until 15 March 2026 and dismissing his damages claim. The listing relies on the criteria covering leading businesspersons operating in Russia and businesspersons involved in economic sectors that provide a substantial source of revenue to the Russian Government.

The applicant argued that the listing had in practice been decided by Council working parties and that his designation reflected public notoriety rather than objective criteria. The Court rejected both arguments. It found that the Council retained full decision-making power and that his position as the principal shareholder in Evraz and his shareholding in Norilsk Nickel provided an objective basis for the listing. The Court also held that the criteria are sufficiently clear and proportionate, and that the travel ban is lawful even though he is also a Portuguese, and therefore EU, citizen, given the periodic review of listings and the available derogations.

Why it matters

The judgment confirms that significant holdings in key Russian companies can support a listing under these criteria, and that the criteria themselves are sufficiently precise and proportionate.

What we recommend for businesses

• Treat these criteria as judicially confirmed listing grounds, subject to any appeal to the Court of Justice, when assessing exposure to Russia-linked ultimate beneficial owners, including through significant holdings in revenue-generating sectors.
• Keep beneficial ownership information up to date for clients with Russian-linked shareholders so that new listings under this criterion can be identified and acted on the same day.
• Brief compliance and onboarding teams that a listing continues to apply while a court challenge is pending, so a pending challenge is not a reason to release funds.

---

EU lists ten individuals over the barring of Yabloko

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed ten individuals under the framework of restrictive measures in view of the situation in Russia, which targets serious human rights violations and the repression of civil society and the democratic opposition. The listings respond to the barring of the Yabloko party from the September 2026 State Duma elections and to the prosecution of its leaders.

Those listed include three judges of the Supreme Court of the Russian Federation, an official of the Prosecutor General’s Office, the judge and prosecutor involved in sentencing Lev Shlosberg, and judges involved in proceedings against Maxim Kruglov and Nikolai Rybakov. The regime now covers 108 individuals and 7 entities, all subject to an asset freeze and a prohibition on making funds or economic resources available.

Why it matters

This round targets judges and prosecutors, including three Supreme Court judges. The regime has its own legal basis, Regulation (EU) 2024/1485, and its own list.

What we recommend for businesses

• Add the ten designations to screening lists and confirm that the Russia human rights regime (Regulation (EU) 2024/1485) is included in the list sources used by your screening provider.

---

OFAC designates a Sinaloa Cartel laundering network and Iranian procurement agents

Date: 29 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC added 23 individuals and 30 entities to the SDN List in a coordinated action under its counter-narcotics, counter-terrorism, Iran-related and non-proliferation authorities, and updated six existing entries.

The largest group of designations targets the “Los Mayos” faction of the Sinaloa Cartel and its leader Ismael Zambada Sicairos. It also covers a network of businesses in northern Mexico, mainly in Baja California, used to launder proceeds, and politicians who protected the cartel. Among them are currency exchange houses (Galerias Centro Cambiario, MIA Centro Cambiario), real estate developers, hospitality venues and logistics operators. OFAC also designated five individuals and five entities linked to Kavoshcom Asia R&D Group and Iran’s Ministry of Defense and Armed Forces Logistics for military procurement conducted through intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.

Why it matters

The action names currency exchange houses and other cash-intensive businesses used for laundering, giving monitoring teams a current typology. All the new entries carry a secondary sanctions warning: non-U.S. financial institutions that knowingly conduct or facilitate significant transactions for these persons risk losing or facing restrictions on U.S. correspondent accounts.

What we recommend for payment and financial institutions

• Load the new designations into screening tools and rescreen counterparties in the currency exchange, real estate and hospitality sectors in northern Mexico, as well as trading intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.
• Treat the exchange houses and cash-intensive businesses named in the action as an updated typology for cartel laundering when reviewing transaction-monitoring scenarios for USD and MXN flows.

---

OFAC amends the Lukoil general license and ends the Ethiopia program

Date: 18 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC issued amended Russia-related General License 131J, which authorizes negotiations and contingent contracts for the sale of Lukoil International GmbH and the maintenance or wind-down of the operations of LIG entities. General License 131J is valid until 12:01 a.m. EDT on 22 October 2026. OFAC also announced the expiry of the national emergency concerning Ethiopia and removed the persons designated under that program, mainly Eritrean entities and officials, from the SDN List.

Why it matters

The license applies under U.S. sanctions only and does not change obligations under EU sanctions.

What we recommend for financial institutions

• Where you service counterparties connected to the Lukoil asset sale, check that the transactions fall within the scope and validity period of General License 131J and document your reliance on it.
• Update screening lists for the Ethiopia-related delistings, after confirming that no other listing ground applies.

---

EU lists former RT France head under the hybrid threats regime

Date: 24 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed Xenia Fedorova, former President and Director of Information of RT France, under the hybrid threats regime (restrictive measures in view of Russia’s destabilizing activities) for continuing foreign information manipulation through French media after RT broadcasting was suspended in the EU. The regime now covers 81 individuals and 20 entities.

Why it matters

The hybrid threats regime is separate from the Russia territorial-integrity regime, with its own legal basis, Regulation (EU) 2024/2642, and its own list.

What we recommend for businesses

• Add the new listing to screening tools and check that the hybrid threats regime is included in the list sources used by your screening provider.

---

OFAC consolidates its penalty rules in new Sanctions Penalties Regulations

Date: 24 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link | 30 September rule

OFAC moved the penalty provisions for programs based on IEEPA and the UNPA, previously repeated across individual program regulations, into a single new part, the Sanctions Penalties Regulations (31 CFR Part 505). The first rule made no substantive changes to the penalties. A second rule of 30 September removed the old program-specific provisions and reorganized several program regulations. OFAC also removed a Syria-specific general license that is no longer needed after Syria was removed from the U.S. list of State Sponsors of Terrorism.

Why it matters

Since 30 September, sanctions policies that cite the old program-specific provisions may point to sections that have been removed or moved.

What we recommend for businesses with U.S. exposure

• Check references to OFAC penalty and procedural provisions in the sanctions policy against the reorganized regulations, including the new 31 CFR Part 505.

---

Our view

For the Baltics, Inter Rao Lietuva is the development of the month. It began as a Lithuanian freezing decision and now sets the evidence standard for control findings by national authorities across the EU. Informal control can count, while general assumptions about the Russian state cannot. Firms should check that their own control conclusions rest on evidence of this kind rather than on assumptions.

Most of the other September changes come down to keeping screening lists and procedures up to date. But screening alone does not make a sanctions program. It also takes a documented risk assessment, enhanced due diligence where the counterparty risk calls for it and someone who follows regulatory change as it happens. With enforcement paying more attention to circumvention, internal controls have to keep pace with how the rules are actually applied.

---

How ECOVIS ProventusLaw can help with sanctions compliance

ECOVIS ProventusLaw advises fintechs, payment institutions, crypto businesses and other financial institutions on EU sanctions compliance, sanctions screening, ownership and control analysis, Russia and Belarus sanctions, circumvention risks, crypto-asset sanctions compliance, trade restrictions and regulatory investigations.

We can help with:

• Sanctions compliance assessments – reviewing sanctions programs and risk assessments against current EU, U.S. and national requirements.
• Sanctions screening and risk reviews – list sources, screening configuration and ownership-and-control methodology.
• Internal policies and procedures – sanctions policies, freezing and escalation procedures, and internal controls.
• Supply chain and counterparty risk analysis – due diligence on counterparties, intermediaries and beneficial owners.
• Regulatory investigations and enforcement matters – asset freezes, supervisory inquiries and enforcement proceedings.
• Sanctions-related business structuring and compliance advice – transactions, restructurings and exits with sanctions exposure.
• Financial services licensing – license applications for fintech, payment, crypto and investment businesses, including the sanctions and AML/CFT controls supervisors review.
• Independent AML/CFT and sanctions audit – testing whether controls work in practice.

Contact us to discuss your sanctions controls, a licensing project or a transaction requiring legal review.

---

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has advised financial institutions for many years and is one of the most experienced financial regulatory law firms in the Baltics.

Our advantage is having a dedicated regulatory team and a separate compliance team within the Banking and Finance and FinTech departments. The two teams work together to provide coordinated legal and operational support across licensing, AML/CFT, sanctions, internal controls and regulatory risk management.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions.

We were among the first legal advisors to crypto businesses in the Baltics and have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.