In brief: within three weeks, the Council of the EU has twice substantially amended the sanctions list under the Ukraine regulation (Regulation (EU) No 269/2014) and extended the regime by three years. In addition, a new US law creates secondary sanctions risk for banks. For institutions, this means: update lists, re-screen existing portfolios and document decisions.
1. 1,569 new listings in the Russian defence sector
By Implementing Regulation (EU) 2026/2281 of 12 October 2026, the Council added 743 individuals and 826 entities to Annex I of Regulation 269/2014. According to media reports, this is the largest single listing since the start of the war of aggression. The regulation entered into force on the day of its publication in the Official Journal.
The grounds for listing are noteworthy: the entities appear on a list established by the Russian government that classifies them as part of the military-industrial complex and entitles them to federal subsidies for their employees’ housing costs. The listed individuals are executives of these companies. In practice, this means that besides customers, in particular managing directors, authorised representatives and ownership and control structures need to be checked. The entries include tax ID, INN and OGRN numbers as well as Cyrillic spellings, which makes matching easier.
2. Delistings, updates and extension until 2029
By Council Decision (CFSP) 2026/2161 and Implementing Regulation (EU) 2026/2160 of 22 September 2026, the Council extended the measures against actions undermining the territorial integrity of Ukraine by 36 months until 22 September 2029. Previously, the regime had to be renewed every six months. At the same time, seven entries were deleted: three deceased persons as well as Alisher Usmanov, Mikhail Fridman, Andrey Falaleev and Redbird Corporate Services Ltd. The information on 104 individuals and 71 entities was updated.
For institutions this means: delistings should not automatically lead to the release of frozen assets, but should be implemented following review and with proper documentation. The longer duration reduces the review cycle, but not the obligation to keep up with list changes on an ongoing basis.
3. US Graham Act: secondary sanctions risk for banks
On 18 September 2026, the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 (Public Law 119-111) came into force. Key prohibitions and sanctions obligations take effect 30 days later, that is, around 18 October 2026. Sec. 103 provides for sanctions against Sberbank, VTB, Gazprombank and other Russian state-owned financial institutions, as well as against foreign financial institutions that engage in “significant transactions” with them. The US Treasury may refrain from this in individual cases. In addition, US banks may not process transfers to or from the Russian government and state-owned entities unless a licence is in place (Sec. 105). The Act is limited to five years, and the President may suspend individual measures by waiver. Implementing rules from the US Treasury are still pending.
4. What institutions should do now
- EU lists apply from publication in the Official Journal; the consolidated file can lag by up to 24 hours. Review your update frequency.
- Re-screen existing customers and payment flows against the new entries, including managing directors, beneficial owners and authorised representatives.
- Implement delistings following review and with documentation, not automatically.
- Reassess hits on amended entries, as identification data and grounds have changed.
- Review group and payment-flow links to the US: USD clearing, correspondent banks and business relationships with Russian state banks and state-owned entities. Clarify whether “significant transactions” within the meaning of Sec. 103 could be involved.
Conclusion
More frequent and larger list updates increase the pressure on currency and traceability. I would be glad to support you in reviewing your screening processes and controls.
As of: 13 October 2026. This article does not constitute legal advice.
Sources: Implementing Regulation (EU) 2026/2281, Implementing Regulation (EU) 2026/2160, Council Decision (CFSP) 2026/2161, Public Law 119-111 (H.R. 5334).
Image credit: AI-generated image (Gamma), 2026.
