On October 12, 2026, the EU added 826 entities and 743 persons from Russia’s military-industrial complex to its asset freeze list, with immediate effect. Obliged entities and businesses with Russia-related counterparties or supply chains should rescreen their customers and counterparties now.

November’s RegRally Insights also examines changes to the Democratic Republic of the Congo (DRC) sanctions regime, effective October 28, 2026, including expanded arms-related restrictions and a broader anti-circumvention clause. It also covers Estonia’s national ban on Russian and Belarusian grain transit, effective October 8, 2026.

EU freezes assets of 1,569 persons and entities linked to Russia’s military-industrial complex

Date: October 12, 2026 | Source: Council Implementing Regulation (EU) 2026/2281 of October 12, 2026
Link (Implementing Regulation (EU) 2026/2281) | Link (Regulation (EU) No 269/2014)

The Council of the European Union adopted Implementing Regulation (EU) 2026/2281 on October 12, 2026. It was published in the Official Journal on October 12, 2026, and entered into force on the day of publication. The regulation adds 826 entities and 743 persons to Annex I to Regulation (EU) No 269/2014, the regime on actions undermining the territorial integrity, sovereignty and independence of Ukraine. All new entries have a listing date of October 12, 2026.

The Council lists these entities because they appear on a Russian government list of companies that belong to Russia’s military-industrial complex and are entitled to state subsidies. The persons are listed as executives of those entities. Each entry gives the name in Latin and Russian script, the function held and, for many entries, a tax identification number. Persons are entered under numbers 2199 to 2941 and entities under numbers 1010 to 1835 of Annex I.

Under Article 2 of Regulation (EU) No 269/2014, all funds and economic resources belonging to, owned, held or controlled by a listed person or entity must be frozen, and no funds or economic resources may be made available to them or for their benefit, directly or indirectly.

Why it matters

The listings applied from the day of publication, with no transition period. From October 12, 2026, payments, deliveries and releases of funds to newly listed persons or entities are prohibited, including through intermediaries, unless an applicable exemption or authorization permits them. Many listed persons are directors of the listed companies, so their names may also appear in beneficial ownership and management records for other customers.

What we recommend

Obliged entities and businesses with Russia-related counterparties should:

• confirm that the screening tool loaded the October 12, 2026 update and rescreen the full customer and counterparty base, including directors and beneficial owners;
• review transactions processed since October 12, 2026, for matches and apply the internal freezing and reporting procedure to any confirmed hit;
• check suppliers, distributors and buyers for entities on the list and for companies owned or controlled by them;
• use the tax identification numbers in the Annex to tune matching rules and reduce false positives.

EU expands DRC arms restrictions and anti-circumvention rules

Date: October 27, 2026 | Source: Council Regulation (EU) 2026/2374 of October 26, 2026 amending Regulation (EC) No 1183/2005
Link

On October 26, 2026, the Council adopted Regulation (EU) 2026/2374 amending Regulation (EC) No 1183/2005 on restrictive measures in view of the situation in the DRC. It gives effect to Council Decision (CFSP) 2026/2372 and to UN Security Council Resolution 2825 (2026). It was published in the Official Journal on October 27, 2026, and entered into force on October 28, 2026.

Key changes include:

• Arms and financing ban. It is prohibited to sell, supply, transfer or export items on the Common Military List, firearms and ammunition to any non-governmental entity or person operating in the DRC, and to provide related technical assistance, brokering or other services, or financing or financial assistance. Financing is defined broadly: grants, loans, guarantees, suretyships, bonds, letters of credit, supplier and buyer credits, import and export advances and all types of insurance and reinsurance. Payment of an agreed price on normal business terms is not financing.
• Derogations. Competent authorities may authorize supplies and related services for the United Nations Organization Stabilization Mission in the Democratic Republic of the Congo (MONUSCO) or the African Union Regional Task Force, protective clothing for UN personnel, media and humanitarian workers, non-lethal equipment for humanitarian or protective use, or supplies approved in advance by the UN Sanctions Committee.
• New listing criterion. Persons who deliberately and gravely obstruct MONUSCO’s mandate may now be listed.
• Anti-circumvention. Knowing or intentional participation in circumvention now expressly includes cases where a person does not seek that result but is aware that their participation may have that effect and accepts that possibility.
• Information duty. Persons and entities must immediately supply information that facilitates compliance, such as information on frozen accounts and amounts, to the competent authority and cooperate in its verification, subject to judicial confidentiality and legal professional privilege.
• Territorial scope. The regulation applies within the EU, to EU nationals and EU-incorporated entities anywhere, and to any business done in whole or in part within the EU.

Why it matters

For obliged entities, the amendment defines financing broadly, so the existing ban on financing military supplies to non-governmental buyers in the DRC expressly covers loans, guarantees, letters of credit and insurance. Such financing can breach the regulation even if the buyer is not listed.

What we recommend

Obliged entities should:

• add end-user checks for DRC-related trade finance, guarantees and insurance, focusing on non-governmental counterparties and military or dual-use goods;
• make sure information on frozen funds is reported to the competent authority immediately;
• reflect the “accepting the possibility” standard of circumvention in sanctions training and escalation rules.

Estonia bans Russian and Belarusian grain transit from October 8, 2026

Date: October 7, 2026 | Source: Government of Estonia Regulation No 99 of October 2, 2026 amending Regulation No 93 of September 29, 2022 (national sanction)
Link

On October 2, 2026, the Estonian Government adopted Regulation No 99 under section 27(1) of the International Sanctions Act. It amends Regulation No 93 of September 29, 2022, which established a national (Government) sanction banning the purchase of certain goods in connection with Russia’s aggression in Ukraine supported by Belarus. It was published in Riigi Teataja on October 7, 2026, and entered into force on October 8, 2026.

The sanction now also prohibits transporting through Estonian territory, delivering or transferring goods originating in or exported from Russia or Belarus that fall under Combined Nomenclature code 10 (cereals). The title of the regulation now refers to a ban on the purchase and transfer of goods.

Why it matters

The ban is a national Estonian measure adopted under the International Sanctions Act, not an EU regulation, so it is not part of the EU sanctions framework and has to be added to sanctions rulebooks separately. It is a ban on goods movements, and the regulation does not address financial services.

What we recommend

Obliged entities with Estonian trade or logistics clients should:

• add the Estonian national sanction to the sanctions rulebook and to transaction monitoring scenarios for cereals of Russian or Belarusian origin;
• review clients active in transit, port services, freight forwarding and grain trading;
• ask affected clients to confirm how they comply with the ban.

Our view

The October package tests how quickly sanctions programs can process a large number of new listings, rather than how they interpret the rules. Close to 1,600 new names took effect on the day they were published, so a firm that relies on a monthly screening cycle or a manual list upload has already been exposed for several weeks.

Use the package to test your controls: check when the screening system received the update, how many alerts it generated and how quickly those alerts were closed. The listed executives also serve on the boards of other companies and appear in their ownership charts, which is where indirect exposure is most often missed.

The DRC amendment and the Estonian grain ban are smaller, but they show two trends. EU regimes are being rewritten to a common template, with a broad definition of financing and an anti-circumvention standard that covers accepting the possibility of circumvention. National measures are also growing alongside the EU lists, and screening built only on EU data will miss them.

How ECOVIS ProventusLaw can help with sanctions compliance

We advise obliged entities and businesses trading with sanctioned regions on applying EU sanctions in daily operations.

• Screening review: testing whether screening tools and list updates cover new EU listings on the day they apply, including beneficial owners and directors.
• Exposure assessment: reviewing customers, counterparties and supply chains for listed persons and for entities they own or control.
• Sanctions policies and procedures: drafting and updating sanctions policies, freezing and reporting procedures and internal controls.
• Handling matches: advising on confirmed or potential matches, frozen funds and communication with the competent authorities.
• Training: training compliance teams and management on EU sanctions obligations and red flags.
• National sanctions: mapping Lithuanian, Latvian and Estonian national sanctions and building them into screening and monitoring.

Contact our sanctions team to test your screening against the October 12, 2026 listings.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has advised financial institutions for many years and is one of the most experienced financial regulatory law firms in the Baltics. The firm is ranked by IFLR1000, The Legal 500 and Chambers and Partners.

Our Banking and Finance & FinTech department has separate regulatory, compliance and audit teams. They work together to provide coordinated legal and operational support across licensing, anti-money laundering and counter-terrorist financing (AML/CFT), sanctions, internal controls and regulatory risk management, and our audit team adds experience in independently testing sanctions controls. Members of our audit team have carried out more than 50 internal and external AML and sanctions audits. When the EU adds as many listings as it did in the October Russia package, our teams can assess both the client’s legal exposure and its screening and freezing processes.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions.

We were among the first legal advisors to crypto businesses in the Baltics and have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.

The post RegRally Insights: Sanctions Regulation, November 2026 appeared first on ECOVIS ProventusLaw.

For fintechs, payment institutions and crypto businesses, each of these changes affects screening, onboarding and freezing decisions. This edition of RegRally covers the sanctions developments of September 2026 for financial institutions and fintech companies in the Baltics and across the EU.

At a glance

• Lithuania: in the Inter Rao Lietuva case, the Court of Justice of the EU ruled that control by a listed person must be shown by objective and sufficiently solid evidence. Informal control can count, but the nature of Russia’s political regime alone is not enough.
• EU listings: more than 3,000 Russia-related individual listings were extended until 22 September 2029. New listings followed over the deportation of Ukrainian children, the barring of Yabloko and hybrid threats.
• Crypto: OFAC designated the Xinbi Guarantee marketplace, its messaging and wallet developers, and associated wallet addresses.
• EU General Court: the Abramovich listing was upheld, confirming both “businessperson” criteria.
• United States: OFAC designated a Sinaloa Cartel laundering network and Iranian procurement agents, amended the Lukoil general license, ended the Ethiopia program and consolidated its penalty rules.

Court of Justice sets the evidence standard for control in Inter Rao Lietuva

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

The Court of Justice of the EU delivered its judgment in Case C-147/25 Inter Rao Lietuva, a reference from the Supreme Administrative Court of Lithuania. The company, an electricity importer and supplier, had its funds frozen in 2022 after the Lithuanian Financial Crime Investigation Service (FNTT) added it to a national list of persons linked to sanctioned persons. From May 2022, the listing was based on links to the President of Russia, who is subject to EU restrictive measures under Council Regulation (EU) No 269/2014. This rested mainly on the company being indirectly owned by the Russian company Inter RAO, whose main shareholders are undertakings indirectly owned by Russia.

The Court held that:

• Such a freeze implements the EU measures and is not a separate national sanction. It may apply to a company not named in the EU annexes if its funds belong to, or are owned, held or controlled by, a listed person. A mere “link” with a listed person is not enough: the authority must show that the funds belong to, or are owned, held or controlled by, that person. This applies even if the company can challenge the measure only after it has been listed. The grounds must, however, be communicated as soon as possible afterwards.
• The national court must make sure that the competent authority has established control objectively and on a sufficiently solid basis. Its review may be limited to the statement of reasons, the accuracy of the facts, any manifest error of assessment, compliance with procedural rules and misuse of powers, and it does not have to assess whether the measure is necessary in view of a threat to national security.
• Informal control can be taken into account, but only on objective and sufficiently solid evidence about the specific company. The autocratic nature of Russia’s political regime does not, in itself, prove that the President of Russia controls a company.

Why it matters

The ruling sets the standard of evidence for treating a company as controlled by a listed person. Informal control can count, while general assumptions about the Russian state do not. The case now returns to the Supreme Administrative Court of Lithuania, which will decide it in line with the ruling.

What we recommend for businesses

• Review your ownership-and-control screening methodology so that every “control” conclusion under Regulation 269/2014 is backed by concrete indicia, such as shareholder agreements, board appointment rights, funding flows or management overlap, rather than general assumptions about state influence.
• Where a client or counterparty has been treated as controlled by a listed person solely because of indirect Russian state ownership, reassess the file against the evidentiary standard set by the Court and record the outcome.
• Document the grounds for any internal decision to freeze funds or reject a client on control grounds, so that the decision can be explained to the competent authority.

EU extends Russia-related individual listings until 2029

Date: 22 September 2026 | Source: Council of the European Union
Link

The Council of the EU prolonged the individual restrictive measures under the regime concerning actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine for a further 36 months, until 22 September 2029. The measures apply to more than 3,000 individuals and entities and comprise asset freezes, travel bans and a prohibition on making funds or economic resources available.

Following its review, the Council decided not to renew the listings of three individuals and one entity, and removed three deceased persons from the list. Previously, the listings were renewed every six months.

Why it matters

The listings no longer need to be renewed every six months, but the Council can still add or remove names at any time, as the 28 September listings over the deportation of Ukrainian children show. The names that were not renewed are no longer on the list, so screening lists and any related freezes need to reflect them.

What we recommend for businesses

• Note the new expiry date of 22 September 2029 in the sanctions calendar and remove any internal contingency planning built around the six-month renewal risk.
• Update screening lists for the delisted persons and review any funds or economic resources frozen solely on the basis of those listings. Release them only after confirming that the persons are not listed under another EU regime or owned or controlled by another EU-listed person, and that no UK or U.S. restrictions apply to your business.
• Keep ownership-and-control checks against this list in the sanctions risk assessment for the full period of the listings.

OFAC sanctions the Xinbi Guarantee crypto marketplace and its wallet developer

Date: 9 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC designated Xinbi Guarantee, a Chinese-language online marketplace operating from Myanmar, Thailand and Laos, as a significant transnational criminal organization under Executive Order 13581, as amended by Executive Order 13863. It also designated SafeW Technology Co., Ltd. (Singapore), the developer of an encrypted messaging application, and Anwen Technology Co., Ltd. (Cambodia), the developer of the XinbiPay/NewPay crypto-asset wallet.

According to the U.S. Treasury, the marketplace has processed the equivalent of over USD 24 billion in digital assets and fiat currency since 2022, providing escrow services and connecting scam center operators in Southeast Asia, whose victims include Americans, with merchants offering money laundering, technology and other services. The Xinbi Guarantee SDN entry includes numerous associated crypto-asset wallet addresses. On the same day, the Department of Justice seized infrastructure and digital-asset wallets used by the marketplace. OFAC also amended ten existing FAQs and published two new licensing FAQs (1269 and 1270).

Why it matters

Because the designations include wallet addresses, exposure can be traced on-chain as well as by name. Under the OFAC 50 percent rule, entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by blocked persons are blocked too, even if they are not named.

What we recommend for crypto businesses and payment institutions

• Load the newly designated entities and the listed wallet addresses into sanctions and blockchain-analytics screening tools, and rescreen the transaction history of crypto-asset and payment clients for exposure.
• Reassess the risk rating of clients operating guarantee-type marketplaces, escrow services or wallet applications in Southeast Asia, and of clients with transaction flows to counterparties in Burma (Myanmar), Cambodia, Laos and Thailand.
• Remind the monitoring team that the OFAC 50 percent rule applies to entities owned 50 percent or more, individually or in the aggregate, by the designated organizations, and that U.S. dollar transactions and counterparties with a U.S. nexus must be screened against the updated SDN List.

EU sanctions 27 persons over the deportation of Ukrainian children

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU imposed restrictive measures on 10 individuals and 17 entities responsible for the unlawful deportation and forced transfer of Ukrainian children to Russia and within occupied territories, and for their forced assimilation. The listings were adopted under the Ukraine territorial-integrity regime by Council Decision (CFSP) 2026/2185 and Council Implementing Regulation (EU) 2026/2184.

Those listed include Rustam Minnikhanov, President of the Republic of Tatarstan, education and sports officials in the occupied territories, heads of children’s camps and schools, the Moscow City Tourism Committee, Russian companies active in children’s recreation and tourism, and the Songdowon International Children’s Camp in North Korea. Listed persons are subject to an asset freeze and, for natural persons, a travel ban. No funds or economic resources may be made available to them.

Why it matters

Besides officials, the listings include a public tourism body, children’s camps and sports centers, and companies in children’s recreation and tourism, so exposure is not limited to state officials.

What we recommend for businesses

• Update sanctions screening lists with the new designations and rescreen the client base, paying particular attention to travel, tourism, education and youth-camp businesses with Russian or occupied-territory links.
• Confirm that the screening tool ingests the consolidated EU list on the day of publication in the Official Journal.

General Court upholds the Abramovich listing

Date: 9 September 2026 | Source: General Court of the EU
Link

The General Court dismissed the action in Case T-358/25 Abramovich v Council, upholding the Council acts that extended the restrictive measures against Roman Abramovich until 15 March 2026 and dismissing his damages claim. The listing relies on the criteria covering leading businesspersons operating in Russia and businesspersons involved in economic sectors that provide a substantial source of revenue to the Russian Government.

The applicant argued that the listing had in practice been decided by Council working parties and that his designation reflected public notoriety rather than objective criteria. The Court rejected both arguments. It found that the Council retained full decision-making power and that his position as the principal shareholder in Evraz and his shareholding in Norilsk Nickel provided an objective basis for the listing. The Court also held that the criteria are sufficiently clear and proportionate, and that the travel ban is lawful even though he is also a Portuguese, and therefore EU, citizen, given the periodic review of listings and the available derogations.

Why it matters

The judgment confirms that significant holdings in key Russian companies can support a listing under these criteria, and that the criteria themselves are sufficiently precise and proportionate.

What we recommend for businesses

• Treat these criteria as judicially confirmed listing grounds, subject to any appeal to the Court of Justice, when assessing exposure to Russia-linked ultimate beneficial owners, including through significant holdings in revenue-generating sectors.
• Keep beneficial ownership information up to date for clients with Russian-linked shareholders so that new listings under this criterion can be identified and acted on the same day.
• Brief compliance and onboarding teams that a listing continues to apply while a court challenge is pending, so a pending challenge is not a reason to release funds.

EU lists ten individuals over the barring of Yabloko

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed ten individuals under the framework of restrictive measures in view of the situation in Russia, which targets serious human rights violations and the repression of civil society and the democratic opposition. The listings respond to the barring of the Yabloko party from the September 2026 State Duma elections and to the prosecution of its leaders.

Those listed include three judges of the Supreme Court of the Russian Federation, an official of the Prosecutor General’s Office, the judge and prosecutor involved in sentencing Lev Shlosberg, and judges involved in proceedings against Maxim Kruglov and Nikolai Rybakov. The regime now covers 108 individuals and 7 entities, all subject to an asset freeze and a prohibition on making funds or economic resources available.

Why it matters

This round targets judges and prosecutors, including three Supreme Court judges. The regime has its own legal basis, Regulation (EU) 2024/1485, and its own list.

What we recommend for businesses

• Add the ten designations to screening lists and confirm that the Russia human rights regime (Regulation (EU) 2024/1485) is included in the list sources used by your screening provider.

OFAC designates a Sinaloa Cartel laundering network and Iranian procurement agents

Date: 29 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC added 23 individuals and 30 entities to the SDN List in a coordinated action under its counter-narcotics, counter-terrorism, Iran-related and non-proliferation authorities, and updated six existing entries.

The largest group of designations targets the “Los Mayos” faction of the Sinaloa Cartel and its leader Ismael Zambada Sicairos. It also covers a network of businesses in northern Mexico, mainly in Baja California, used to launder proceeds, and politicians who protected the cartel. Among them are currency exchange houses (Galerias Centro Cambiario, MIA Centro Cambiario), real estate developers, hospitality venues and logistics operators. OFAC also designated five individuals and five entities linked to Kavoshcom Asia R&D Group and Iran’s Ministry of Defense and Armed Forces Logistics for military procurement conducted through intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.

Why it matters

The action names currency exchange houses and other cash-intensive businesses used for laundering, giving monitoring teams a current typology. All the new entries carry a secondary sanctions warning: non-U.S. financial institutions that knowingly conduct or facilitate significant transactions for these persons risk losing or facing restrictions on U.S. correspondent accounts.

What we recommend for payment and financial institutions

• Load the new designations into screening tools and rescreen counterparties in the currency exchange, real estate and hospitality sectors in northern Mexico, as well as trading intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.
• Treat the exchange houses and cash-intensive businesses named in the action as an updated typology for cartel laundering when reviewing transaction-monitoring scenarios for USD and MXN flows.

OFAC amends the Lukoil general license and ends the Ethiopia program

Date: 18 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC issued amended Russia-related General License 131J, which authorizes negotiations and contingent contracts for the sale of Lukoil International GmbH and the maintenance or wind-down of the operations of LIG entities. General License 131J is valid until 12:01 a.m. EDT on 22 October 2026. OFAC also announced the expiry of the national emergency concerning Ethiopia and removed the persons designated under that program, mainly Eritrean entities and officials, from the SDN List.

Why it matters

The license applies under U.S. sanctions only and does not change obligations under EU sanctions.

What we recommend for financial institutions

• Where you service counterparties connected to the Lukoil asset sale, check that the transactions fall within the scope and validity period of General License 131J and document your reliance on it.
• Update screening lists for the Ethiopia-related delistings, after confirming that no other listing ground applies.

EU lists former RT France head under the hybrid threats regime

Date: 24 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed Xenia Fedorova, former President and Director of Information of RT France, under the hybrid threats regime (restrictive measures in view of Russia’s destabilizing activities) for continuing foreign information manipulation through French media after RT broadcasting was suspended in the EU. The regime now covers 81 individuals and 20 entities.

Why it matters

The hybrid threats regime is separate from the Russia territorial-integrity regime, with its own legal basis, Regulation (EU) 2024/2642, and its own list.

What we recommend for businesses

• Add the new listing to screening tools and check that the hybrid threats regime is included in the list sources used by your screening provider.

OFAC consolidates its penalty rules in new Sanctions Penalties Regulations

Date: 24 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link | 30 September rule

OFAC moved the penalty provisions for programs based on IEEPA and the UNPA, previously repeated across individual program regulations, into a single new part, the Sanctions Penalties Regulations (31 CFR Part 505). The first rule made no substantive changes to the penalties. A second rule of 30 September removed the old program-specific provisions and reorganized several program regulations. OFAC also removed a Syria-specific general license that is no longer needed after Syria was removed from the U.S. list of State Sponsors of Terrorism.

Why it matters

Since 30 September, sanctions policies that cite the old program-specific provisions may point to sections that have been removed or moved.

What we recommend for businesses with U.S. exposure

• Check references to OFAC penalty and procedural provisions in the sanctions policy against the reorganized regulations, including the new 31 CFR Part 505.

Our view

For the Baltics, Inter Rao Lietuva is the development of the month. It began as a Lithuanian freezing decision and now sets the evidence standard for control findings by national authorities across the EU. Informal control can count, while general assumptions about the Russian state cannot. Firms should check that their own control conclusions rest on evidence of this kind rather than on assumptions.

Most of the other September changes come down to keeping screening lists and procedures up to date. But screening alone does not make a sanctions program. It also takes a documented risk assessment, enhanced due diligence where the counterparty risk calls for it and someone who follows regulatory change as it happens. With enforcement paying more attention to circumvention, internal controls have to keep pace with how the rules are actually applied.

How ECOVIS ProventusLaw can help with sanctions compliance

ECOVIS ProventusLaw advises fintechs, payment institutions, crypto businesses and other financial institutions on EU sanctions compliance, sanctions screening, ownership and control analysis, Russia and Belarus sanctions, circumvention risks, crypto-asset sanctions compliance, trade restrictions and regulatory investigations.

We can help with:

• Sanctions compliance assessments – reviewing sanctions programs and risk assessments against current EU, U.S. and national requirements.
• Sanctions screening and risk reviews – list sources, screening configuration and ownership-and-control methodology.
• Internal policies and procedures – sanctions policies, freezing and escalation procedures, and internal controls.
• Supply chain and counterparty risk analysis – due diligence on counterparties, intermediaries and beneficial owners.
• Regulatory investigations and enforcement matters – asset freezes, supervisory inquiries and enforcement proceedings.
• Sanctions-related business structuring and compliance advice – transactions, restructurings and exits with sanctions exposure.
• Financial services licensing – license applications for fintech, payment, crypto and investment businesses, including the sanctions and AML/CFT controls supervisors review.
• Independent AML/CFT and sanctions audit – testing whether controls work in practice.

Contact us to discuss your sanctions controls, a licensing project or a transaction requiring legal review.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has advised financial institutions for many years and is one of the most experienced financial regulatory law firms in the Baltics.

Our advantage is having a dedicated regulatory team and a separate compliance team within the Banking and Finance and FinTech departments. The two teams work together to provide coordinated legal and operational support across licensing, AML/CFT, sanctions, internal controls and regulatory risk management.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions.

We were among the first legal advisors to crypto businesses in the Baltics and have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.

The post RegRally Insights: Sanctions Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

For EU-based institutions, what becomes permissible under U.S. law can remain prohibited under EU law, and the same names can now be enforced well beyond the Union. The September edition of RegRally covers what this means for financial institutions, exporters and businesses with cross-border exposure.

This month at a glance

• Lithuania: by orders of 5 August, the FNTT added three Lithuanian companies to the national list of entities owned or controlled by sanctioned persons and supplemented the grounds for two existing entries. Asset freezing applies to them despite the absence of a direct EU or UN listing.
• EU reach: two High Representative statements confirmed the alignment of third countries with EU restrictive measures on Ukraine, Belarus, human rights and terrorism, extending the practical effect of EU listings beyond the Union.
• United States: OFAC removed Syria’s State Sponsor of Terrorism designation while issuing fresh Iran-related designations the same day. EU and UK measures on Syria remain fully in force, so U.S. permissibility does not equal EU permissibility.
• U.S. enforcement: a USD 60,764 settlement with Rice Lake Weighing Systems over exports of weighing equipment to Iran through a distributor in the United Arab Emirates shows how indirect routes create liability even at modest amounts.
• Rolling U.S. actions: through August, OFAC issued designations, de-listings and General License changes across the Cuba, Iran, Venezuela, counter-terrorism and Russia programs, and its International Criminal Court (ICC)-related designations raise tension with the EU Blocking Statute.

FNTT adds three Lithuanian companies to the national list of entities controlled by sanctioned persons

Date: 5 August 2026 | Source: FNTT (Financial Crime Investigation Service)
Link

What happened?

By orders of 5 August 2026, the Director of the FNTT amended the list of legal persons and other organizations owned or controlled by a sanctioned entity.

Orders No. V-174, V-175 and V-176 added three companies to the list: UAB “Valientė” (code 305265888), UAB “Next Logistic” (code 305694948) and UAB “Litproduktai” (code 305088459).

Orders No. V-172 and V-173 supplemented the grounds for inclusion of two companies already on the list: AB “Inter Rao Lietuva” (code 126119913) and UAB “Vydmantai wind park” (code 302666616).

Inclusion on the list means the entity is treated as owned or controlled by a person subject to sanctions. Asset freezing and the prohibition on making funds available apply to it even though it is a Lithuanian-registered company.

Why does it matter for businesses?

Lithuanian registration is no safe harbour. These are local companies to which freezing measures apply without any direct EU or UN listing, so a screening set-up that only checks EU and UN lists will miss them.

The supplemented grounds matter too. The reasoning behind two existing entries has changed, so decisions taken earlier on those relationships may rest on an outdated basis.

Recommended actions

Businesses should:

• re-screen the customer and counterparty base against the updated FNTT list and check for indirect exposure through payment chains and ownership links
• where a relationship with any listed company exists, freeze and report as required, and not rely on the absence of a direct EU or UN listing
• reassess any earlier decision taken on relationships with the two existing entries, since the grounds for their inclusion have changed

Third countries align with EU restrictive measures over Ukraine’s territorial integrity

Date: 28 August 2026 | Source: Council of the European Union
Link

What happened?

The High Representative, on behalf of the EU, declared the alignment of certain third countries with EU restrictive measures concerning actions undermining or threatening Ukraine’s territorial integrity, sovereignty and independence.

Alignment means the aligning states commit to adopt corresponding measures, so the practical reach of EU listings extends beyond the Union. For institutions, this widens the set of jurisdictions in which the same names and prohibitions are effectively enforced.

Why does it matter for businesses?

Routing a transaction through an aligned jurisdiction no longer sidesteps the listings. The same names are enforced there, so correspondent and routing assessments should treat aligned states accordingly.

Recommended actions

Businesses should:

• factor the widening group of aligned jurisdictions into counterparty, routing and correspondent-risk assessments
• confirm screening fully reflects the EU restrictive-measures listings under the Russia and Ukraine program

Third countries align with EU sanctions on Belarus, human rights and terrorism

Date: 18 August 2026 | Source: Council of the European Union
Link

What happened?

The High Representative, on behalf of the EU, issued statements on the alignment of certain third countries with EU restrictive measures relating to three regimes: the situation in Belarus and its involvement in Russia’s aggression against Ukraine, serious human rights violations and abuses under the EU Global Human Rights Sanctions Regime, and measures to combat terrorism.

The statements confirm the continued extension of these three regimes to aligning partner countries, reinforcing their cross-border effect.

Why does it matter for businesses?

The three regimes were extended in parallel. A nexus to an aligned country is a factor to weigh, and screening limited to the Russia program misses the Belarus, human rights and counter-terrorism listings that are being extended in parallel.

Recommended actions

Businesses should:

• confirm screening covers the Belarus, EU Global Human Rights and counter-terrorism sanctions regimes
• treat a nexus to an aligned country as an elevated-risk indicator in onboarding and ongoing monitoring

OFAC removes Syria’s State Sponsor of Terrorism designation while EU measures stay in force

Date: 24 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC removed Syria’s designation as a State Sponsor of Terrorism and published a set of associated Sanctions List updates, marking one of the most significant easings of the U.S. sanctions posture toward Syria in years.

The change re-opens the question of how Syrian counterparties, correspondent flows and trade-finance exposure should be treated. It does not by itself lift all Syria-related prohibitions.

On the same day, OFAC issued fresh Iran-related designations and updated several Iran-related General Licenses. The Syria recalibration runs in parallel with continued pressure on Iran, not a general relaxation.

For EU-based institutions, the key point is that EU and UK measures on Syria remain fully in force and are unaffected by the U.S. step. A transaction that becomes permissible under U.S. law may still be prohibited under EU law.

Why does it matter for businesses?

Permissibility is a jurisdiction-by-jurisdiction question. A U.S. easing does not make the same transaction lawful for an EU operator.

The analysis also needs a paper trail. When regimes point in different directions, the multi-jurisdictional reasoning behind each decision is what a supervisor will ask to see.

Recommended actions

Businesses should:

• re-run sanctions screening against the updated OFAC Specially Designated Nationals (SDN) and Sanctions List files and refresh internal watchlists and payment-filter rules
• reassess any Syria-related exposure and correspondent relationships against the EU and UK frameworks before treating business as permissible, and document the multi-jurisdictional analysis
• where reliance is placed on an Iran-related General License, record its number, scope and expiry and confirm the activity fits squarely within it

OFAC’s ICC-related designations create tension with the EU Blocking Statute

Date: 18 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC issued International Criminal Court (ICC)-related designations together with a Venezuela-related designation and an ICC-related General License.

The ICC-related measures are politically sensitive and can create direct tension with EU law. Institutions with an EU nexus should be alert to the EU Blocking Statute (Regulation (EC) No 2271/96), which may prohibit EU operators from complying with certain U.S. measures. The same conduct can be required under one regime and prohibited under another.

Why does it matter for businesses?

The same conduct can be required under one regime and prohibited under another. Complying with the U.S. measure, for example by declining or exiting EU-lawful business, can itself breach EU law.

Decisions on affected relationships therefore need legal analysis before action, not after. The Blocking Statute question has to be answered first.

Recommended actions

Businesses should:

• screen against the new ICC-related and Venezuela-related designations
• where an EU nexus exists, take advice on the interaction with the EU Blocking Statute before declining or exiting EU-lawful business solely on the basis of the U.S. measure
• document the conflict-of-laws analysis for any affected relationship

OFAC settles with Rice Lake Weighing Systems over Iran exports through a UAE distributor

Date: 12 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC announced a settlement of USD 60,764 with Rice Lake Weighing Systems, Inc., resolving apparent violations of U.S. sanctions arising from the export of weighing equipment to Iran via a distributor in the United Arab Emirates (UAE) between July 2019 and November 2021.

Although the amount is modest, the case is a useful enforcement benchmark. It underlines OFAC’s expectations on distributor and re-export due diligence, geographic red flags, and the mitigating value of remediation and voluntary self-disclosure.

Why does it matter for businesses?

The case sets out OFAC’s expectations on distributor and re-export due diligence and on geographic red flags. Exposure through distributors and intermediaries is judged by where the goods end up, not where the invoice goes.

It also shows the mitigating value of remediation and voluntary self-disclosure.

Recommended actions

Businesses should:

• review the enforcement findings as a benchmark for their own sanctions controls, especially indirect exposure through distributors and intermediaries
• confirm procedures for voluntary self-disclosure, escalation and remediation where a potential breach is identified
• test end-user and re-export screening for goods and services that can reach sanctioned jurisdictions through third countries

OFAC’s rolling August actions: designations, de-listings and shifting General Licenses

Date: 6 to 27 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC made list changes throughout August. On 6 August it issued Cuba-related designations with a clarifying FAQ on the treatment of the newly listed parties. On 7 August it combined Counter Terrorism and Iran-related designations with same-day removals of certain Counter Narcotics designations and an amended Iran-related FAQ. On 20 August a broad multi-program round spanned the Counter Narcotics, Counter Terrorism, Cuba-related and Iran-related programs, accompanied by a new Russia-related General License and associated FAQs.

Venezuela-related General Licenses issued on 21 August were amended again on 27 August. Further Counter Terrorism designations on 26 August came with a Counter Terrorism General License and an amended Russia-related General License, which is particularly relevant to institutions still managing legacy exposure, as it can change the permitted scope or timing of otherwise restricted dealings.

Why does it matter for businesses?

Additions and removals both change screening outcomes. Stale watchlists produce missed hits and unnecessary rejects, so list maintenance has to be continuous rather than periodic.

The General License churn carries its own risk. When authorizations are amended within a week, reliance on any single version is a timing exposure.

Recommended actions

Businesses should:

• refresh watchlists to capture both the new designations and the de-listings, and re-screen recently rejected or blocked transactions that may be affected by the removals
• map exposure against the scope and expiry of the current General Licenses, diarize the amendments, conditions and any wind-down periods, and re-verify the applicable license version before executing payments
• review the accompanying FAQs for interpretation points relevant to the firm’s book of business

What businesses should take from this month’s developments

The FNTT orders are the local reminder. A company registered in Lithuania can be subject to asset freezing without ever appearing on an EU or UN list, and the grounds behind an existing entry can change, so past decisions do not stay decided.

Across borders, the pictures are moving in opposite directions. The EU’s reach is widening as more third countries align with its restrictive measures, while the U.S. is recalibrating: easing on Syria, pressing on Iran, and adjusting General Licenses week by week. The same transaction can be permissible under one regime and prohibited under another, so permissibility has to be assessed and documented jurisdiction by jurisdiction.

Screening lists need continuous maintenance covering both additions and de-listings, and any reliance on a General License needs its version, scope and expiry on record.

How ECOVIS ProventusLaw can help with sanctions compliance

Our sanctions team works with businesses across the Baltics on EU, U.S. and national sanctions questions, including:

• building and stress-testing sanctions compliance programs and risk assessments
• screening set-up, watchlist management and internal controls
• ownership and control analysis of counterparties
• exposure reviews covering Russia, Belarus and other sanctioned jurisdictions
• circumvention and third-country intermediary risk
• crypto-asset sanctions exposure and blockchain analytics findings
• export controls and trade restrictions
• handling asset freezes, investigations and supervisory enquiries
• internal policies, procedures and staff training

If an FNTT listing, an OFAC action or a divergence between EU and U.S. rules touches your business, we can help you work out what is prohibited, what is permitted and what to document.

The post RegRally Insights: Sanctions Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

The latest FATF findings also highlight how virtual assets and decentralised finance are being used to move and obscure illicit funds, including in connection with sanctions evasion and the financing of the proliferation of weapons of mass destruction.

This month’s RegRally focuses on the developments most relevant to businesses exposed to Russia or Belarus, international trade, shipping, financial services, crypto-assets and higher-risk cross-border transactions.

This month at a glance

• Russia: The EU adopted its 21st sanctions package, introducing new restrictions targeting the energy sector, financial services, crypto operators, the Russian shadow fleet and sanctions circumvention. The package includes 218 new listings.
• Belarus: New measures extend restrictions affecting crypto-asset services, ownership and governance, exports and entities supporting the Belarusian or Russian defence and security sectors.
• Crypto and sanctions evasion: FATF identifies stablecoins, offshore VASPs, unhosted wallets and complex DeFi transaction structures as increasingly relevant channels for sanctions evasion and proliferation financing.
• Compliance focus: Effective sanctions compliance increasingly requires businesses to assess ownership, control, transaction flows, counterparties, geography and potential circumvention — not simply perform name screening.

EU adopts 21st sanctions package against Russia, expanding restrictions on energy, finance, crypto and the shadow fleet

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

The EU adopted its 21st package of sanctions against Russia, targeting the energy sector, financial services, crypto-assets, trade and Russia’s military-industrial complex.

The package introduces 218 new listings — 48 individuals and 170 entities — subject to asset freezes and, for individuals, travel restrictions. It also includes 51 additional anti-circumvention listings, including entities in third countries.

Key energy and shipping measures include:

• suspension of the oil price cap adjustment mechanism until July 2027, maintaining the cap at USD 44.10 per barrel;
• designation of 41 additional shadow fleet vessels;
• designation, for the first time, of vessels servicing designated shadow fleet vessels;
• transaction bans covering designated Russian ports, locks and airports;
• restrictions concerning a third-country refinery processing Russian oil;
• a notification obligation concerning the sale of LNG tankers to third countries.

The package also targets more than 100 banks and crypto operators and introduces further measures affecting Russia’s financial infrastructure.

In addition, the EU introduced legal protection measures intended to protect EU operators from certain retaliatory lawsuits connected with sanctions and requires Member States not to recognise or enforce certain Russian judgments linked to sanctions.

Why does it matter for businesses?

The new package significantly increases the number of entities, vessels and infrastructure points that businesses need to consider when assessing sanctions exposure.

Importantly, the package also targets third-country entities involved in circumvention. A counterparty, therefore, does not need to be Russian or directly listed to create sanctions risk.

For businesses involved in international trade, shipping, financial services or crypto-assets, sanctions controls increasingly need to extend beyond customer screening to transaction-level analysis and assessment of ownership, control and intermediary relationships.

Recommended actions

Businesses should:

• update sanctions screening lists without delay and rescreen existing customers, counterparties and relevant third parties;
• review exposure to newly designated banks, crypto operators, vessels, ports, refineries and other infrastructure;
• assess third-country counterparties and intermediaries for potential Russia-related circumvention risks;
• review payment and trade-finance flows involving higher-risk jurisdictions and counterparties;
• strengthen due diligence on shipping transactions involving shadow fleet vessels;
• review contractual arrangements with third-country counterparties in light of the new legal protection measures.

Businesses with material Russia-related exposure should combine automated screening with ownership/control analysis and transaction-level due diligence.

EU expands Belarus sanctions, including restrictions affecting crypto-asset services and exports

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

What happened?

Alongside the Russia measures, the EU adopted additional restrictive measures concerning Belarus, including trade-related provisions and measures intended to protect EU operators.

The package extends restrictions on crypto-asset service companies, including a prohibition on Belarusian nationals owning, controlling, or serving on the boards of companies providing crypto-asset services.

It also expands export restrictions on certain goods, including aviation-related products intended for UAVs, and designates four additional Belarusian entities that support the Belarusian or Russian defence and security sectors.

Why does it matter for businesses?

The measures create compliance implications beyond direct dealings with sanctioned Belarusian entities.

For crypto-asset service providers, sanctions compliance now requires closer attention to nationality, ownership and governance structures. For exporters, the expanded restrictions require businesses to consider not only the classification of goods but also their intended end use and end user.

The measures also reinforce the importance of checking ownership and control rather than relying exclusively on sanctions-list screening.

Recommended actions

Businesses should:

• review ownership and governance structures of Belarus-related counterparties;
• for crypto-asset service providers, verify whether Belarusian nationals hold relevant ownership, control or board positions;
• update export-control screening for newly restricted aviation and UAV-related goods;
• strengthen end-use and end-user checks for relevant exports;
• rescreen counterparties against the newly designated Belarusian entities;
• assess transactions involving Belarus for potential indirect exposure or sanctions circumvention.

FATF highlights virtual assets as an increasing channel for sanctions evasion and proliferation financing

Date: 16 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF’s Seventh Targeted Update on implementation of Recommendation 15 highlights the increasing complexity of illicit finance involving virtual assets. The report identifies sanctions evasion and proliferation-financing risks associated with stablecoins, offshore VASPs, unhosted wallets, and more complex DeFi transaction structures.

FATF highlights techniques such as chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation, which can be used to layer or obscure illicit funds within legitimate financial flows.

The report also highlights significant DPRK-linked activity. According to FATF, two major DeFi attacks attributed to the DPRK in April 2026 accounted for approximately 76% of annual virtual-asset hacking losses identified in the report, with combined proceeds exceeding USD 570 million.

Why does it matter for businesses?

For businesses dealing with crypto-assets, sanctions risk can arise even when a transaction does not directly match a sanctions list.

The risk may instead stem from the transaction path, an intermediary VASP, wallet exposure, rapid cross-chain movement, interaction with mixers or decentralised exchanges, or links to sanctioned jurisdictions or actors.

This means that sanctions compliance for CASPs and financial institutions increasingly needs to combine traditional screening with blockchain analytics and transaction-level risk assessment.

Recommended actions

CASPs and financial institutions exposed to virtual assets should:

• incorporate stablecoin-related sanctions-evasion typologies into transaction-monitoring scenarios;
• assess exposure to offshore VASPs and higher-risk P2P transactions;
• apply risk-based controls to transactions involving unhosted wallets;
• monitor for chain-hopping, cross-chain bridges, mixers and decentralised exchanges;
• ensure sanctions-risk indicators identified through blockchain analytics trigger appropriate escalation and investigation;
• assess whether existing blockchain analytics tools can identify indirect exposure, rather than only direct wallet matches.

Sanctions-evasion indicators should also feed into the wider customer and transaction risk assessment.

What businesses should take from this month’s developments

The latest developments reinforce a fundamental shift in sanctions compliance:

Screening names are necessary, but they are no longer sufficient.

The EU’s 21st Russia sanctions package demonstrates the increasing importance of ownership, control, shipping, financial flows, third-country intermediaries and anti-circumvention analysis. Belarusian measures similarly show that nationality and governance can become relevant factors in sanctions control.

FATF’s latest findings add another dimension for businesses dealing with virtual assets: sanctions evasion can occur through complex transaction structures that may not yield a straightforward sanctions-list match.

Businesses with international operations should therefore consider whether their sanctions framework can identify:

• indirect exposure to sanctioned persons and entities;
• ownership and control risks;
• higher-risk third-country intermediaries;
• shadow fleet and shipping exposure;
• sanctions-evasion patterns in payment and trade flows;
• crypto-asset transactions involving higher-risk wallets, VASPs or jurisdictions.

The practical test is whether the organisation can identify and investigate a potentially evasive transaction before it becomes a sanctions breach, rather than simply demonstrate that its screening system is operating.

Need assistance?

ECOVIS ProventusLaw advises businesses on EU sanctions and restrictive measures, including:

• sanctions compliance frameworks and risk assessments;
• sanctions screening and internal controls;
• ownership and control analysis;
• Russia and Belarus sanctions;
• sanctions circumvention and third-country exposure;
• crypto-asset sanctions compliance and blockchain-related risks;
• trade and export-control restrictions;
• sanctions investigations and regulatory response;
• sanctions policies, procedures and employee training.

If your business has exposure to Russia, Belarus, international trade, shipping, financial services or crypto-assets, our team can help assess whether your sanctions controls address both direct restrictions and circumvention risks.

The post RegRally Insights: Sanctions Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

Key developments include new EU listings linked to the forced deportation of Ukrainian children, renewed Russia and Syria-related sanctions frameworks, and expanded human rights regimes, alongside significant UK measures targeting propaganda networks and child deportation structures. At the same time, enforcement capacity continues to strengthen through enhanced export controls, anti-circumvention tools, and coordinated cross-border asset recovery operations led by Europol and partner agencies.

Across jurisdictions, the direction is consistent: sanctions compliance is becoming broader in scope, more operationally complex, and increasingly focused on indirect exposure risks across digital assets, third-country intermediaries, and information ecosystems.

As your legal advisors we will be happy to assist you regarding all the questions related to proposed changes in regulation, including legal advice as well as revision and preparation of your internal documents.

The post RegRally Insights: Sanctions Essentials – May 2026 appeared first on ECOVIS ProventusLaw.

We also cover key updates on EU listings across multiple regimes, including cyber, Myanmar, and hybrid threat sanctions, as well as important clarifications on payment services restrictions and compliance perimeter risks.

Stay informed, stay compliant, and ensure your sanctions frameworks are aligned with rapidly evolving regulatory expectations. We wish you a good read!

The post RegRally Insights: Sanctions Essentials – May 2026 appeared first on ECOVIS ProventusLaw.

EU Sanctions Expanded for Russian Hybrid Activities

The Council added four individuals to the EU sanctions list under the regime targeting Russia’s destabilising and hybrid activities, particularly Foreign Information Manipulation and Interference (FIMI):

• Sergey Klyuchenkov
• Ernest Mackevičius
• Graham Phillips
• Adrien Bocquet

All listed persons are subject to asset freezes and travel bans, and EU persons and companies are prohibited from making funds or economic resources available to them.

The EU sanctions list under this regime now covers 69 individuals and 17 entities.

EU financial institutions and companies should update their screening processes to reflect the four newly listed individuals. Given the expanding scope of this sanctions regime, institutions should ensure their FIMI-related designations are monitored on an ongoing basis alongside other Russia-related restrictive measures.

EU Expands Iran Human Rights Sanctions

The Council imposed restrictive measures on 16 additional individuals and 3 entities for serious human rights violations in Iran, bringing the total to 263 individuals and 53 entities.

The new listings target persons involved in the violent suppression of January 2026 protests, including senior security officials, IRGC commanders, judiciary representatives, and the head of Iran’s prison organisation.

Newly listed entities include:

• Mohammad Rasulullah Corps
• Imam Reza IRGC (Khorasan Razavi Province)
• Naji Research and Development Company (NRDC), linked to surveillance technology.

All listed persons are subject to asset freezes and travel bans, while EU persons and companies are prohibited from making funds or resources available to them.

EU export bans on equipment for internal repression and telecommunications monitoring remain in force.

EU financial institutions and companies should immediately update their screening processes to reflect the 16 newly listed individuals and 3 entities. Particular attention should be paid to any potential exposure to Iranian IT and technology-sector counterparties, given NRDC’s listing. Ongoing monitoring of this rapidly expanding sanctions list is strongly advised.

EU Cyber Sanctions Target New Entities Linked to Attacks on Member States

The Council imposed restrictive measures on three entities and two individuals under the EU horizontal cyber sanctions regime, which now covers 19 individuals and 7 entities.

New listings include:

• Integrity Technology Group (China) – linked to cyber operations compromising over 65,000 devices across six EU Member States;
• Anxun Information Technology (China) and its co-founders – involved in hacking activities targeting critical infrastructure;
• Emennet Pasargad (Iran) – linked to data breaches, disinformation activities, and attacks affecting EU digital services.

All designated persons are subject to asset freezes and travel bans, and EU persons and companies are prohibited from making funds or economic resources available to them.

EU financial institutions and companies should update their screening processes to reflect the five newly listed parties. Given that two of the three listed entities are Chinese-based technology and IT services companies, institutions with exposure to the Chinese tech sector should apply enhanced due diligence. The listings also serve as a reminder of the growing intersection between sanctions compliance and cybersecurity risk management.

EU Sanctions Target Russian Military Officials Over Bucha Atrocities

The Council imposed restrictive measures on nine individuals linked to the Bucha massacre (Feb–Mar 2022), marking the fourth anniversary of the events.

The listings include senior Russian military officials, led by Colonel General Aleksandr Chayko, former Commander of the Eastern Military District, as well as eight other commanders involved in operations in Bucha and surrounding areas, including Hostomel, Irpin, and Borodianka.

The individuals are associated with killings of civilians, looting, torture, and forced deportations during Russia’s invasion of Ukraine.

All designated persons are subject to asset freezes and travel bans, with EU persons and entities prohibited from making funds available to them.

The EU’s Russia-related sanctions regime now covers approximately 2,600 individuals and entities.

Institutions should update their screening processes to reflect the nine newly listed individuals. Given the now very large scale of Russia-related sanctions (approximately 2,600 designated parties), institutions are reminded of the importance of maintaining robust, up-to-date and automated screening systems capable of handling frequent list updates across multiple sanctions regimes simultaneously.

EU Extends Russia-Related Sanctions Targeting Ukraine’s Territorial Integrity

The Council extended individual restrictive measures for a further six months, until 15 September 2026, targeting those responsible for undermining Ukraine’s territorial integrity, sovereignty, and independence.

The sanctions regime includes travel bans, asset freezes, and prohibitions on making funds or economic resources available to listed persons, and continues to apply to approximately 2,600 individuals and entities.

As part of the review, two individuals were delisted, and five deceased persons were removed from the sanctions list.

Institutions should note the updated validity period and ensure their screening systems reflect the delisting of two individuals and the removal of five deceased persons. Sanctions compliance programmes should be calibrated to capture such periodic list updates, which occur routinely at each extension cycle.

EU Extends Bosnia and Herzegovina Sanctions Framework

The Council extended the EU restrictive measures framework in view of the situation in Bosnia and Herzegovina for a further 12 months, until 31 March 2027.

The framework enables the EU to impose asset freezes, travel bans, and funding prohibitions on individuals or entities that undermine Bosnia and Herzegovina’s sovereignty, territorial integrity, constitutional order, or the Dayton/Paris Peace Agreement, or that threaten its security.

No individuals or entities are currently listed under this regime.

While no parties are currently designated, institutions should ensure this framework is captured in their sanctions monitoring systems, as listings could be activated at short notice should the situation in Bosnia and Herzegovina deteriorate.

EU Extends Iran Human Rights Sanctions

The Council extended EU restrictive measures in response to serious human rights violations in Iran until 13 April 2027.

The sanctions include:

• travel bans and asset freezes;
• a ban on exports of equipment used for internal repression or telecommunications monitoring;
• a prohibition on making funds or economic resources available to listed persons.

The regime currently applies to 262 individuals and 53 entities.

EU financial institutions and companies should ensure their screening processes reflect the updated list and extended validity of the regime. Particular attention should be paid to the prohibition on making funds available to listed individuals and entities. Source:

OFAC Advisory on Sham Transactions and Sanctions Evasion

The U.S. Office of Foreign Assets Control (OFAC) issued an advisory clarifying that nominal transfers of property by blocked persons do not extinguish a blocked interest.

The advisory highlights key red flags, including:

• transfers to family members or close associates;
• commercially unreasonable or poorly documented transactions;
• complex, multi-layered structures in high-risk jurisdictions;
• continued involvement of the blocked person after transfer;
• transfers occurring close in time to designation.

OFAC also referenced enforcement actions, including penalties against GVA Capital Ltd. (approximately $215.99 million) and IPI Partners, illustrating the liability risks posed by proxy structures used to circumvent sanctions.

The guidance reinforces OFAC’s position that substance, not form, determines whether sanctions evasion has occurred.

Financial institutions should update their sanctions due diligence frameworks to reflect the identified red flags, with particular attention to structures involving trusts, multi-layered entities, or intermediaries closely tied to designated persons. Existing portfolios and client relationships should be reassessed for potential exposure to sham structures, especially in the context of Russia-related designations.

The post RegRally Insights: Sanctions Essentials – April 2026 appeared first on ECOVIS ProventusLaw.

EU Extends Economic Sanctions Against Russia Until 31 July 2026

On 22 December 2025, the Council of the European Union renewed and extended the EU’s economic restrictive measures against the Russian Federation in response to its ongoing war of aggression in Ukraine, prolonging the sanctions regime for six months. These measures are part of a broader framework first introduced in 2014 and expanded following Russia’s full-scale invasion of Ukraine in 2022. The sanctions cover multiple sectors, including trade, finance, energy, technology, dual-use goods, industry, transport, and luxury products. They also include a ban on seaborne crude oil and specified petroleum products, restrictions on access to EU financial messaging systems (“de-SWIFTing”) for designated Russian banks, and the suspension of broadcasting activities and licences of certain Kremlin-linked outlets. The Council emphasised that sanctions will remain in force as long as Russia continues destabilising actions and violations of international law, with the possibility of additional measures if necessary.

Entities should update sanctions screening and transaction monitoring systems to reflect the extended measures through 31 July 2026, ensure trade, payment, investment, and asset-freeze controls fully incorporate sectoral restrictions, and reaffirm internal sanctions governance and escalation procedures to demonstrate ongoing compliance.

EU Adds Two Russian Officials to Human Rights Sanctions List

On 22 December 2025, the Council of the European Union expanded the EU Global Human Rights Sanctions Regime by designating Dmitry Sergeyevich Gordeev, a member of the Russian judiciary, and Lyudmila Balandina, a public prosecutor, for their involvement in serious human rights violations, including politically motivated prosecutions and actions undermining fundamental rights and the rule of law in Russia. As a result, all funds and economic resources belonging to or controlled by these individuals are frozen within the EU, and it is prohibited to make any funds or resources available to them, directly or indirectly.

Entities should update their EU sanctions screening lists to include the newly designated individuals and ensure that asset-freezing and transaction-blocking controls are applied immediately, in line with the relevant Council Implementing Regulations.

EU Expands Sanctions Targeting Hybrid Threats from Belarus and Russia

On 15 December 2025, the Council of the European Union extended restrictive measures in response to hybrid threats from Belarus and the Russian Federation. The sanctions target individuals and entities engaged in disinformation, cyber operations, and other destabilising activities that threaten EU security, democratic processes, and societal cohesion. For Russia, twelve individuals and two entities were designated, subject to an EU asset freeze and prohibitions on making funds or economic resources available to them. The Belarusian sanctions were broadened to cover hybrid activities directed against the EU, extending existing asset-freeze and transaction-prohibition obligations.

Entities should update sanctions screening and transaction monitoring systems to include the newly designated individuals and entities, promptly apply asset-freezing and transaction-blocking controls, and review internal escalation and reporting procedures to ensure timely notification of potential matches to competent authorities.

EU Extends Sanctions on Individuals Undermining Stability in the Democratic Republic of the Congo

On 8 December 2025, the Council of the European Union prolonged restrictive measures targeting individuals responsible for actions that threaten stability, security, or democratic processes in the Democratic Republic of the Congo (DRC) through 12 December 2026. These measures, initially introduced in response to human rights violations, attacks on civilians, and deteriorating security in the eastern provinces, continue to impose an EU-wide asset freeze and prohibit the provision of funds or economic resources by EU persons and entities. The Council highlighted that the extension underscores ongoing concern about the humanitarian and security situation in the DRC and the need for accountability for those contributing to instability.

Entities should update sanctions screening and transaction monitoring systems to reflect the extended listing period, ensure asset freeze and transaction prohibitions are applied consistently, and review internal escalation and reporting procedures to support timely notification of potential matches with the extended DRC sanctions listings.

EU Targets Russia’s Maritime “Shadow Fleet” with Sanctions

On 18 December 2025, the Council of the European Union adopted restrictive measures against Russia’s maritime “shadow fleet” in connection with its ongoing war in Ukraine, designating 41 vessels and their beneficial owners under the EU economic sanctions framework. The measures aim to prevent circumvention of existing sanctions, particularly those restricting Russia’s energy exports by sea. Designated vessels and their associated owners are subject to an EU asset freeze, and EU persons and entities are prohibited from providing funds, economic resources, or related services, including port access, insurance, and financing. The action closes loopholes used to obscure vessel ownership, flagging, or transactional history, reinforcing enforcement against sanctions evasion.

Entities should update sanctions screening and transaction monitoring systems to reflect the new listings, and assess trade finance, shipping, insurance, and correspondent banking controls to ensure prohibited services are not provided to the designated vessels or their operators.

EU Global Human Rights Sanctions Regime Extended Through 8 December 2026

On 4 December 2025, the Council of the European Union extended the EU Global Human Rights Sanctions Regime for one year, continuing to target individuals and entities responsible for serious human rights violations worldwide. Designated persons and entities remain subject to an EU asset freeze, and EU persons and entities are prohibited from providing funds or economic resources directly or indirectly. The decision underscores the EU’s commitment to accountability for human rights abuses, the rule of law, and protection of civil society and democratic opposition.

Entities should update sanctions screening and transaction monitoring systems to reflect the extended listings, maintain asset-freeze and transaction-blocking controls in line with the Council Implementing Regulations, and review internal escalation and reporting procedures to ensure ongoing compliance throughout the extended period.

OFAC Updates Sanctions Lists and Issues New General Licences

On 18 December 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued updates to the Specially Designated Nationals (SDN) and Foreign Sanctions Evaders (FSE) lists, including new designations under Iranian sanctions authorities and the International Criminal Court (ICC) programme, additions of maritime vessels and affiliated shipping companies, and the removal of certain Russia-related FSE listings. OFAC also issued new general licences, including ICC General License 11 for wind-down transactions, a Belarus licence for certain companies, and Iran-related General License S for limited offloading and safety transactions. Amended Russia-related FAQs (1224 and 1225) provide clarifications for sanctions compliance.

Entities should update sanctions screening databases and watchlists, ensure transaction monitoring systems capture newly designated vessels and entities, circulate and assess the amended Russia-related FAQs, and maintain compliance controls aligned with OFAC’s current designations and general licence provisions.

Latvian Court Upholds FIU Authority on EU Sanctions Compliance

On 18 December 2025, the Administrative Regional Court of Riga upheld the Financial Intelligence Unit of Latvia’s (FIU Latvia) assessment regarding the application of EU financial sanctions by a supervised financial institution. The court confirmed that the FIU’s interpretation of asset freeze, transaction prohibition, and reporting obligations under EU sanctions law was consistent with applicable law and within its supervisory remit. By rejecting the institution’s challenge, the judgment reinforces the FIU’s authority to enforce sanctions compliance. It signals that EU sanctions interpretations by competent authorities are likely to be upheld by Latvian courts.

Financial institutions should review and, if necessary, strengthen sanctions compliance frameworks to ensure alignment with EU-level interpretations, and validate that internal controls for asset freezes, transaction interdiction, and reporting are robust, documented, and demonstrably compliant with statutory obligations.

FIU Latvia Highlights the Strategic Impact of Sanctions on Russia

On 30 December 2025, FIU Latvia published an analytical article titled “The cost of war: how sanctions are reshaping Russia’s future,” assessing the evolving role and impact of sanctions imposed in response to Russia’s military aggression in Ukraine. The piece emphasises that sanctions function as a long-term strategic tool rather than a short-term measure, with effectiveness dependent on international unity, consistent enforcement, and visible accountability. FIU Latvia notes that sanctions have significantly constrained Russia’s economic capabilities, including an estimated €100 billion in foregone energy revenues, and that centralised, coordinated enforcement regimes enhance compliance and deterrence. The article also highlights the importance of harmonising sanctions across jurisdictions and targeting intermediaries and entities involved in circumvention. While sanctions alone cannot resolve the conflict, sustained, consistently applied measures are essential to limit Russia’s economic base and support international security objectives.

The post RegRally Insights: Sanctions Essentials – January 2026 appeared first on ECOVIS ProventusLaw.

EU Expands Russia Sanctions and Extends Their Reach Beyond the Union

The EU has adopted Council Decision (CFSP) 2025/2032, introducing additional restrictive measures in response to actions by the Russian Federation destabilising Ukraine. The new measures include a ban on importing Russian LNG, transaction prohibitions targeting specified Russian energy companies, expanded restrictions on petroleum products and liquefied petroleum gas, sanctions against Russia-linked banks and payment systems, and limitations on certain crypto-asset and fintech services. Several non-EU countries — North Macedonia, Montenegro, Albania, Bosnia and Herzegovina, Iceland, Liechtenstein, Norway, Ukraine, Georgia and Moldova — have formally aligned with the Decision, committing to implement equivalent measures within their national legal frameworks. As a result, the territorial scope of the EU’s restrictive regime is significantly extended, with aligned third countries expected to enforce comparable prohibitions across the energy, financial and technology sectors connected to Russia.

EU Adds Ten Individuals to Russia Human-Rights Sanctions List

On 20 November 2025, the Council of the European Union adopted Council Decision (CFSP) 2025/2357, amending the existing Russia sanctions framework by adding ten individuals to the EU sanctions list. The newly designated persons are linked to serious human-rights violations in the Russian Federation, including torture and ill-treatment in detention facilities, repression of civil society and media, and politically motivated prosecutions of activists, journalists and opposition figures. The measures apply immediately and include an asset freeze, a ban on making funds or economic resources available to the listed individuals, and a travel ban covering entry into or transit through the EU. The decision forms part of the EU’s broader human rights sanctions regime, launched in 2024 and progressively expanded in response to ongoing violations of fundamental freedoms and the rule of law in Russia.

OFAC Sanctions Cyber-Crime Infrastructure and “Bullet-Proof Hosting” Providers

The U.S. Office of Foreign Assets Control has designated a network of entities and individuals across the United States, the United Kingdom and Australia for supporting cybercrime infrastructure, including ransomware operations. The action targets hosting providers and related IT infrastructure used to enable cyber-enabled crime, explicitly treating the provision of “bullet-proof hosting” and infrastructure relocation services to evade sanctions as sanctionable conduct. All persons designated under SB0319 are subject to U.S. asset freezes, and U.S. persons are broadly prohibited from engaging in any transactions with them. The designations confirm OFAC’s enforcement approach extends beyond core cybercriminals to include service providers, facilitators and enablers supporting illicit cyber activity.

Key compliance considerations:

• Update sanctions screening systems immediately to reflect all SB0319 designations.
• Ensure blocking of funds, services and indirect support, including IT hosting or infrastructure services.
• Review client and counterparty relationships involving hosting or IT services, particularly in high-risk or previously sanctioned contexts.
• Strengthen controls to detect and escalate requests that may support ransomware or cybercrime activity.

OFAC Imposes USD 4.68 Million Penalty for Dealing in Blocked Real Estate

OFAC has imposed a civil penalty of USD 4.68 million on a U.S. real-estate investor for willfully engaging in prohibited transactions involving property owned by a sanctioned individual. Despite a cease-and-desist order, the investor mortgaged, renovated and sold the blocked property and failed to comply with an OFAC subpoena. OFAC concluded that the conduct was willful and concealed, justifying the maximum statutory penalty. The case confirms that sanctions prohibitions apply fully to property transactions and that both individuals and companies can be held liable for dealing in blocked assets or attempting to obscure the involvement of designated persons.

Key compliance takeaways:

• Ensure sanctions screening covers not only counterparties but also underlying assets, including real estate and beneficial ownership.
• Apply enhanced due diligence to property-related transactions with any potential sanctions nexus.
• Maintain robust records to enable prompt responses to regulatory requests and subpoenas.
• Monitor transactions for indicators of concealed ownership, refinancing or resale of blocked property.
• Reinforce internal awareness that willful sanctions breaches can lead to severe financial and reputational consequences.

Latvia Convicts Travel Agency for Sanctions Breaches Related to Crimea Tourism

A regional Latvian court has convicted a travel consultant and her agency for organising tourist trips to Crimea, in violation of EU sanctions prohibiting tourism-related services to Crimea and Sevastopol. The individual was sentenced to 100 hours of community service, while the company was fined €10,500. The conviction followed an appeal by FIU Latvia, reversing an earlier acquittal, and confirms that both individuals and legal entities may face liability for sanctions violations. Since April 2024, FIU Latvia has been the competent authority for sanctions enforcement in Latvia, signalling heightened scrutiny and enforcement activity.

Market implications:

• Sanctions compliance must explicitly cover tourism, travel and related services linked to sanctioned territories.
• Any client or transaction connected to sanctioned jurisdictions should be treated as high-risk and subject to enhanced controls.
• Firms should have clear internal procedures to detect and block prohibited travel-related transactions.
• Staff training is critical to ensure awareness that sanctions breaches can result in criminal or administrative penalties for both employees and companies.
• Comprehensive documentation of due diligence and decision-making is essential to demonstrate compliance in investigations or appeals.

FIU Latvia: Centralised and Enforceable Sanctions Are Essential for Effectiveness

FIU Latvia has underlined that sanctions are effective only when applied through unified action, consistent implementation and clear accountability. Latvia operates a centralised sanctions-enforcement model under FIU Latvia, which coordinates asset freezes, maintains a verified sanctions register, and works closely with financial supervisors, customs, the central bank and other competent authorities. Speaking at an international conference, Latvian authorities emphasised that sanctions are not merely political instruments, but a critical tool for restricting aggression, safeguarding international security, and preventing illicit financial flows. FIU Latvia also emphasised that transparency and tangible consequences for breaches are essential to preserve the credibility and deterrent effect of the sanctions regime.

Key compliance takeaways:

• Apply a conservative approach to ownership and control, treating entities linked to sanctioned persons as high-risk even if not expressly listed.
• Strengthen internal processes for identifying, freezing and reporting transactions connected to sanctioned persons, jurisdictions or circumvention patterns.
• Maintain detailed and well-structured documentation to demonstrate compliance and ensure readiness for sanctions-related audits or investigations.

The post RegRally Insights: Sanctions Essentials – December 2025 appeared first on ECOVIS ProventusLaw.

EU Adopts 19th Sanctions Package Targeting Russia’s Energy, Financial and Tech Sectors

The EU has approved its 19th package of sanctions against Russia, introducing the most comprehensive measures since 2023. The package includes a phased ban on Russian LNG, ending short-term imports within six months and terminating all long-term contracts by 2027.

The update extends asset freezes and restrictions to additional Russian banks, crypto service providers, and third-country actors involved in sanctions evasion. It also tightens controls on the movement of Russian diplomats and strengthens EU coordination on the enforcement and monitoring of circumvention. The measures target critical revenue streams of Russia’s wartime economy and signal increased EU scrutiny of financial flows and crypto-linked transactions.

ESMA Releases Second Consolidated Report on Sanctions, Highlighting 2024 Enforcement Trends

On 16 October 2025, the European Securities and Markets Authority (ESMA) published its Second Consolidated Report on Sanctions, summarising enforcement actions taken by EU national securities regulators in 2024. The data shows that more than 970 administrative sanctions and measures were issued—broadly in line with 2023—while total fines exceeded €100 million.

The most significant sanctions stemmed from breaches of the Market Abuse Regulation (MAR) and MiFID II. Over 60% of all measures involved financial penalties, and approximately 10% were resolved through settlement procedures, collectively accounting for more than €20 million in fines.

ESMA highlights substantial differences in sanctioning approaches across member states and reiterates the need for greater supervisory consistency. It also emphasises that sanctions represent just one component of the broader enforcement toolkit used to maintain market integrity across the Union.

OFAC Issues New Russia-Related General Licenses and Expands SDN Listings

On 22 October 2025, the U.S. Office of Foreign Assets Control (OFAC) issued several new Russia-related General Licenses, providing limited authorisations for certain transactions involving major Russian energy companies and infrastructure:

• General License 124A – Authorises petroleum services and transactions linked to the Caspian Pipeline Consortium and Tengizchevroil projects.
• General License 126 – Permits the wind-down of transactions involving Rosneft or Lukoil.
• General License 127 – Allows certain dealings in debt, equity, or derivative contracts involving Rosneft or Lukoil.
• General License 128 – Authorises specific transactions involving Lukoil retail service stations located outside Russia.

OFAC also updated its Specially Designated Nationals (SDN) List, adding a wide range of Russian oil and gas entities, including AO Kuibyshevsky Oil Refinery, Bashneft Dobycha, CJSC Vankorneft, JSC Vostsibneftegaz, JSC Rosneft International, OJSC Samotlorneftegaz, PJSC Verkhnechonskneftegaz, and others.

These additions carry a risk of secondary sanctions under Executive Order 14024, signalling heightened U.S. scrutiny of Russian energy sector activities and associated international transactions.

OFAC Updates Counter-Terrorism and Balkans Sanctions, Adds New Designations and Removes Four Individuals

On 17 October 2025, the U.S. Office of Foreign Assets Control (OFAC) announced updates to its counter-terrorism and Balkans-related sanctions programmes. The action includes the designation of two Haitian nationals linked to the terrorist organisation Viv Ansanm under Executive Order 13224, and the delisting of four individuals previously sanctioned under EO 14033.

Key implications for compliance teams:
• Update screening systems to include newly designated individuals and remove delisted ones to avoid false positives and missed matches.
• Review transactions and client relationships involving Haiti for potential terrorist financing exposure.
• Ensure internal sanctions lists, monitoring tools, and customer risk assessments reflect the latest OFAC changes.

OFAC Targets Iran-Backed Militia Networks and Adds New Energy and Shipping Sanctions

The U.S. Office of Foreign Assets Control (OFAC) has designated multiple individuals associated with Iran-backed militia groups under Executive Order 13224, expanding pressure on networks involved in terrorism and regional destabilisation. The action also introduces new entity listings tied to Iran’s energy export and shipping operations, signalling continued U.S. focus on disrupting revenue channels that support sanctioned groups.

In parallel, OFAC removed a Turkish shipyard from the Specially Designated Nationals (SDN) List in connection with Russia-linked activities, reflecting updated assessments of its involvement.

The post RegRally Insights: Sanctions Essentials – November 2025 appeared first on ECOVIS ProventusLaw.