This informal CPD article, ‘Beyond the Lists: The EU Sanctions Duties That Survive Every Package’, was provided by Nikolas Demetriades, CFA, holds the CySEC Advanced and AML certifications. He is the founder of CPDs.Academy, a CPD training platform delivering compliance education for professionals in EU-regulated financial services.
On 23 July 2026 the Council adopted the twenty-first package of measures against Russia. Council Regulation (EU) 2026/1848 was published the same day and entered into force on 24 July (1). Its Article 1 amends Regulation (EU) No 833/2014 in 39 numbered points, the last ten of which amend annexes, the remainder mostly adjusting derogations, customs codes, wind-down dates and listings (1). Articles 8, 8a, 10, 12 and 12g of Regulation (EU) No 833/2014 are not among them (1), (2). They are among the standing provisions that shape how a firm's sanctions exposure is managed, and they did not move. A compliance function that reads each package only as a fresh screening exercise works on the part that changes.
What a package changes and what it does not
Council Decision (CFSP) 2026/1849 was adopted under Article 29 of the Treaty on European Union. Regulation (EU) 2026/1848 gives effect to measures in that decision and was adopted under Article 215 of the Treaty on the Functioning of the European Union, on a joint proposal from the High Representative and the Commission, and it is what binds firms directly (1), (3).
It inserts a new Article 5bc prohibiting any transaction, direct or indirect, with an entity providing crypto-asset services or a platform enabling the exchange or transfer of crypto-assets established in a third country listed in a new Annex LVII. That annex is confined to countries the Council has identified as having systematically and persistently failed to prevent the provision of such services, or platforms exchanging or transferring crypto-assets, in frustration of Regulation (EU) No 833/2014 or Regulation (EU) No 269/2014 (1), (4). The recitals record that the accompanying decision adds 51 entities to the list subject to tighter export restrictions, including entities in third countries other than Russia that indirectly contribute to Russia's military and technological enhancement, thereby enabling circumvention of Union restrictive measures or frustrating their purpose (1). Article 11(4) is replaced with a derogation allowing competent authorities, case by case and until 31 December 2027, to authorise satisfaction of a claim by a claimant within Article 11(1), point (b), where strictly necessary for divestment from Russia or the wind-down of business activities there (1). Some of those changes affect what screening or transaction controls must identify. Others affect authorisation, escalation or claims handling. Each changes part of the compliance rule set without replacing the standing duties underneath.
The prohibition that needs no list
Article 12 prohibits participation, knowingly and intentionally, in activities whose object or effect is to circumvent prohibitions in Regulation (EU) No 833/2014. It extends expressly to participating in such activities without deliberately seeking that object or effect, where the participant is aware that its participation may have that object or effect and accepts that possibility (2). Deliberate evasion is not necessary, but suspicion is not sufficient either, and an unresolved red flag does not by itself establish the elements. The question is what the operator was actually aware of and whether it accepted that possibility, which is not the same question as whether it had reasonable cause to suspect something.
Article 10 does a different job and is protective rather than prohibitory. Actions do not give rise to liability of any kind where the person taking them did not know, and had no reasonable cause to suspect, that they would infringe the measures (2). Knowledge, reasonable cause to suspect and acceptance of a possibility are therefore not three elements of a single combined test but of two provisions with separate functions. Neither turns on whether a name is on a list. Screening can produce evidence relevant to the assessment, but it exhausts neither provision.
Ownership, control and entities outside the Union
Article 8a requires natural and legal persons, entities and bodies to undertake their best efforts to ensure that any legal person, entity or body established outside the Union that they own or control does not participate in activities that undermine the measures in the regulation (2). That class is narrower than the corporate group: the entity must be one that the operator owns or controls, and affiliation alone does not suffice.
The verb differs from Article 12's, and that matters. Article 12 targets activities whose object or effect is to circumvent prohibitions in the regulation, pointing at arrangements built around the constituent elements of a particular prohibition. Article 8a is directed at activities that undermine the restrictive measures, which is not tied to the elements of any single prohibition. Such activities are those resulting in an effect the measures seek to prevent, for example a recipient in Russia obtaining goods, technology, financing or services of a type the regulation prohibits (2), (5). Best efforts is an obligation of conduct, not a guarantee of result. It comprises the actions suitable and necessary to achieve the result of preventing that undermining, and only those feasible for the operator in view of its nature, its size and the relevant factual circumstances, in particular the degree of effective control it has over the entity concerned (5). Keeping a record of the measures taken is prudent rather than something Article 8a expressly requires.
Regulation (EU) No 833/2014 carries no single general operative definition of ownership and control, but for Article 8a recital 28 of Regulation (EU) 2024/1745 supplies guidance on both. Ownership means possession of 50% or more of the proprietary rights of a legal person, entity or body, or a majority interest in it. Control is indicated by matters such as the power to appoint or remove a majority of the administrative, management or supervisory body, the right to use all or part of the assets, managing the business on a unified basis while publishing consolidated accounts, or the right to exercise a dominant influence (5). The thresholds in individual provisions are separate, and not uniform. Article 11 denies claims made by non-Union entities whose proprietary rights are directly or indirectly owned for more than 50% by listed legal persons, entities or bodies, while Article 5r imposes reporting on Union entities more than 40% owned by a Russian-established legal person, a Russian national or a person residing in Russia (2). One mechanical group-wide percentage will therefore not serve every sanctions rule.
The asset-freeze regime under Regulation (EU) No 269/2014 also turns on ownership and control, but it is not identical, because that regulation now defines owning and controlling expressly, owning on the same 50% or majority-interest basis and controlling through a non-exhaustive list of indicators. Article 2 freezes funds and economic resources belonging to, owned, held or controlled by listed persons, and prohibits them being made available, directly or indirectly, to or for their benefit (4). The words directly or indirectly extend it beyond the obvious case, since value can reach a listed person through an unlisted intermediary.
Annex I to Regulation (EU)
Duties that travel down the contract chain
Since 20 March 2024, and where Article 12g applies, an exporter selling, supplying, transferring or exporting certain goods to a third country other than a partner country listed in Annex VIII must contractually prohibit re-exportation to Russia and re-exportation for use in Russia. The goods concerned are those listed in Annexes XI, XX and XXXV, the common high priority items in Annex XL, and firearms and ammunition listed in Annex I to Regulation (EU) No 258/2012 (2). The obligation is not universal. It does not reach the execution of contracts for goods under CN codes 8457 10, 8458 11, 8458 91, 8459 61 and 8466 93 in Annex XL, nor public contracts concluded with a public authority in a third country or with an international organisation. An exporter relying on that public-contract exception must inform the competent authority of the Member State where it is resident or established within two weeks of the contract's conclusion (2).
Article 12g also requires the exporter to ensure the agreement with the third-country counterpart contains adequate remedies in the event of a breach of that obligation, and to inform the competent authority of its Member State as soon as it becomes aware of a breach (2). A parallel obligation has applied since 26 December 2024 to relevant sales, licences or other transfers of intellectual property rights and trade secrets, as well as relevant rights of access or re-use, connected with the common high priority items in Annex XL (2). These are drafting and monitoring duties rather than screening duties, and the regulation does not say who inside a firm discharges them. Responsibility has to be allocated deliberately across the sanctions, legal, commercial and other functions involved.
Reporting is not screening
Article 5r imposes two reporting duties independent of any list. Union-established legal persons, entities and bodies whose proprietary rights are directly or indirectly owned for more than 40% by a Russian-established legal person, a Russian national or a natural person residing in Russia have had to report, since 1 May 2024, any transfer of funds exceeding EUR 100,000 out of the Union made during a quarter, directly or indirectly and in one operation or several, to the competent authority of the Member State where they are established, within two weeks of the quarter's end (2).
Credit and financial institutions carry a matching duty from 1 July 2024, reporting within two weeks of each semester's end transfers out of the Union of a cumulative amount over that semester exceeding EUR 100,000 that they initiated, directly or indirectly, for those entities. It applies notwithstanding the rules on reporting, confidentiality and professional secrecy (2). Neither duty depends on a counterparty being designated.
What a breach costs
Article 8 requires Member States to lay down rules on penalties, including as appropriate criminal penalties, for infringements of the regulation, and to ensure they are implemented. Those penalties must be effective, proportionate and dissuasive. Member States may take the voluntary self-disclosure of infringements into account as a mitigating factor in accordance with their national law, and must also provide for appropriate measures of confiscation of the proceeds (2).
Self-disclosure is expressly recognised as a factor that national law may treat as mitigating, so it belongs in the frame once a possible breach is identified. The regulation does not prescribe the point in an internal investigation at which disclosure should be made, and its availability, timing and effect depend on the national regime and the facts. Confiscation of proceeds is separate from any fine, so the gain on a breached transaction is not a ceiling on what it costs.
Article 11 runs the other way, and is easily overlooked. Where the performance of a contract or transaction has been affected, directly or indirectly and in whole or in part, by the measures, claims arising from it are not to be satisfied if made by several categories of claimant: persons, entities and bodies listed in the annexes to the regulation and non-Union entities whose proprietary rights are directly or indirectly owned for more than 50% by them, any other Russian person, entity or body, anyone acting through or on behalf of those claimants, and the third-country persons and entities, other than those in partner countries listed in Annex VIII, falling within Article 11(1)(d) (2). In enforcement proceedings the onus of proving that satisfaction is not prohibited lies on the person seeking to enforce it (2). The provision can therefore give a Union operator a defence against specified sanctioned or Russian-related claims arising from a contract whose performance has been disrupted by the measures.
Closing thoughts
Sanctions compliance is usually resourced as a screening problem, because screening is the part that visibly changes. Every package produces new names, codes and annexes, and a task that can be completed and recorded. The standing obligations produce no such task. Article 12 asks what the firm was aware of and accepted. Article 8a asks what it did about entities it controls abroad. Article 12g asks what its contracts say. Article 5r asks whether a report was filed on time. None of those questions is answered by a screening system, and none changed on 24 July 2026. That is what makes them worth building to.
We hope this article was helpful. For more information from CPDs.Academy, please visit their CPD Member Directory page. Alternatively, you can go to the CPD Industry Hubs for more articles, courses and events relevant to your Continuing Professional Development requirements.
References
(1) Council Regulation (EU) 2026/1848 of 23 July 2026 amending Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine, OJ L, 23.7.2026. Article 2 provides that it enters into force on the day following publication. Article 1 amends Regulation (EU) No 833/2014 in 39 numbered points, of which points (30) to (39) amend annexes. Point (19) inserts Article 5bc and point (25) replaces Article 11(4).
(2) Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine, consolidated text as at 24 July 2026, including Article 5r on reporting of transfers of funds, Article 8 on penalties, Article 8a on best efforts in relation to entities established outside the Union, Article 10 on absence of liability, Article 11 on claims, Article 12 on circumvention, Article 12g on the contractual prohibition of re-exportation to Russia and Article 12ga on intellectual property rights and trade secrets.
(3) Council Decision (CFSP) 2026/1849 of 23 July 2026 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine, OJ L, 23.7.2026, adopted under Article 29 of the Treaty on European Union on a proposal from the High Representative of the Union for Foreign Affairs and Security Policy. Regulation (EU) 2026/1848 was adopted under Article 215 of the Treaty on the Functioning of the European Union, on a joint proposal from the High Representative and the European Commission, to give effect to measures in that decision.
(4) Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine, OJ L 78, 17.3.2014. Article 2(1) provides for the freezing of funds and economic resources and Article 2(2) prohibits funds or economic resources being made available, directly or indirectly, to or for the benefit of listed persons. Council Regulation (EU) 2025/2037 of 23 October 2025 added to Article 1 of that regulation the definitions of owning and controlling a legal person, entity or body.
(5) Council Regulation (EU) 2024/1745 of 24 June 2024 amending Regulation (EU) No 833/2014, in particular recitals 28 to 30 concerning ownership and control, activities that undermine restrictive measures, and the meaning of the Article 8a best efforts obligation.
