EU adds eight persons and four entities to cyber-attacks sanctions list
Screening and payment teams at EU-obligated firms must freeze funds of eight newly listed persons and four entities under the cyber-attacks regime
Change
On 13 July 2026, the Council of the European Union, by Implementing Regulation (EU) 2026/1714 implementing Regulation (EU) 2019/796, added eight persons and four entities to the asset-freeze list under the EU cyber-attacks sanctions regime, freezing their funds and prohibiting making funds available to them, directly applicable in all Member States on publication.
Why it matters
The listings make the asset freeze and the prohibition on making funds or economic resources available binding and directly applicable across all Member States from publication. Firms under EU jurisdiction must treat funds, accounts and resources linked to the twelve newly designated targets as frozen from the effective date, including indirect exposure through owned or controlled entities.
Implications
- — Sanctions-screening teams at EU banks, payment institutions and obliged entities must load the eight persons and four entities into screening systems and freeze matching funds immediately — settling any payment to or for them after publication breaches Regulation (EU) 2019/796.
- — Cybersecurity vendors and IT-service providers under EU jurisdiction must check customer and counterparty records against the new listings before continuing service, because making economic resources available to a designated entity is prohibited regardless of contract.
Who is affected
- — Sanctions-screening teams at EU banks, payment institutions and obliged entities
- — Cybersecurity vendors and IT-service providers under EU jurisdiction