Who is covered by EU sanctions — individuals, companies, vessels and the ownership rule

The question “who is covered by EU sanctions” has two entirely different answers — and most SMEs know only one of them. The first concerns who is listed on sanctions lists (individuals, companies, vessels, aircraft). The second — who must respect those lists and apply restrictive measures. Both are equally important for your business. Council Regulation (EU) No 269/2014 of 17 March 2014¹ and Council Regulation (EU) No 833/2014 of 31 July 2014² are directly applicable in every Member State without any transposition³ — including Poland.

Legal status as of: 2026-05-20.

TL;DR — key points in 60 seconds

• Who is on the lists — those listed include: natural persons (oligarchs, officials, military personnel), legal entities (companies, banks, organisations), vessels and aircraft linked to sanctioned regimes.
• The ownership rule — a company in which a sanctioned person or entity holds more than 50% of shares or over which it exercises control is subject to sanctions even if it does not itself appear on any list.⁴
• Ultimate beneficial owner — verification should reach the ultimate owner; an opaque holding structure does not exempt a company from liability.
• Who must apply sanctions — every natural and legal person operating in the territory of the EU, regardless of sector or company size.³
• No name on the list is not enough — your counterparty may be subject to sanctions through its owner, not through a direct listing.
• Penalty in Poland — up to PLN 20 million administratively for breaching asset-freeze provisions (Art. 6(2) of the Act of 13 April 2022).⁵

Two questions, one answer

When the question “who is covered by sanctions” arises, it is in practice about two different matters. It is worth separating them, because confusing them is the most common cause of gaps in sanction screening.

Question A: Who is listed on sanctions lists? This question concerns the categories of addressees of restrictive measures — that is, the specific persons, companies, vessels and aircraft that have been made subject to prohibitions and obligations (asset freezes, transaction bans, travel bans, etc.). These categories are discussed in detail below.

Question B: Who must apply sanctions? This is an entirely different question — and it concerns your company. The addressees of EU sanctions regulations are every entity operating in the territory of the European Union, regardless of sector, legal form or size. EU regulations are directly applicable without any national implementation³ — which means you do not need to wait for a Polish statute to have an obligation.

Listing categories — who ends up on sanctions lists

EU sanctions lists — maintained and consolidated by DG FISMA (the Directorate-General for Financial Stability, Financial Services and Capital Markets Union)⁶ — contain four main categories of entries. Each works somewhat differently and requires a different approach to verification.

Natural persons

This is the broadest and most varied category. EU sanctions lists include oligarchs linked to the Kremlin, senior Russian and Belarusian state officials and military personnel, propagandists, as well as persons financing or supporting actions that undermine the sovereignty of Ukraine. Each natural person is described by a set of identifiers: full name (often in multiple transliterations), date of birth, nationality, passport or identity document number, and sometimes also a residential address or place of birth.

Verifying natural persons is the most difficult precisely because of the risk of false positives — common names, different renderings of Cyrillic script in the Latin alphabet, matching dates of birth. This is why checking only a name is never sufficient when verifying a counterparty — at least two identifiers are needed.

Legal entities — companies and organisations

Legal entities are the second-largest type of listing by volume. They include limited liability and joint-stock companies (and their foreign equivalents), banks, funds, non-profit organisations, governmental and quasi-governmental institutions — where they meet the criteria set out in the relevant regulations. Examples include Russian state-owned banks and arms companies subject to sanctions under Regulation No 833/2014² and its successive amendments.

Each legal entity is described by its full name (often in several language versions and transliterations), country of registration, registration identifiers (the equivalent of a KRS or tax number) and registered address. Changing a name or registering a subsidiary in another country does not remove the sanctions — the listing applies to the identity of the entity, not a specific registration.

Vessels

This is a category that many companies outside maritime logistics are not even aware of. EU and UN sanctions lists⁷ include specific vessels — identified by IMO (International Maritime Organization) number, vessel name, flag and owner. These are primarily vessels used to circumvent sanctions: tankers transporting Russian oil, units providing logistical support to aggression, or those carrying goods subject to export or import bans.

If your company operates in freight forwarding, importing, or chartering, verifying the vessel and its ultimate beneficial owner is a screening element that cannot be omitted.

Aircraft and other airborne craft

Analogously to vessels, sanctions lists include private and charter aircraft — identified by registration number (side number) and the data of the owner or operator. This category is particularly relevant for the aviation, cargo and charter tourism sectors. Aircraft listed on sanctions lists are banned from landing at EU airports, which has a direct bearing on route planning and agreements with carriers. If you operate in tourism and use external charter flights, verifying the operator and the aircraft being used is part of your screening obligation — you can find more about this on our page for the tourism industry.

The ownership and control rule — “more than 50%” is not the whole story

The list of entries alone is not enough. Council Regulation (EU) No 269/2014¹ extends the scope of sanctions to entities in which a sanctioned person or entity holds more than 50% of shares or over which it exercises control.⁴ This is the so-called ownership and control rule.

Why does this matter? Imagine your counterparty — a Polish limited liability company — does not appear on any list. But its sole shareholder is a Russian holding company that is listed on the EU sanctions list. In that case, the Polish company is subject to sanctions in exactly the same way as its owner. A transaction with it is prohibited, and the asset freeze also covers funds held in that Polish company’s accounts.

A detailed discussion of the ownership rule — including cases where shares are accumulated by several listed entities, control through voting rights, and examples of holding structures — can be found in our dedicated article on the ownership rule of over 50% in EU sanctions.

One detail worth remembering: the threshold is more than 50%, not “at least 50%”. Exactly half of the shares does not trigger the rule — it takes one share above that boundary. The same principle applies to control — what matters is the right to determine the entity’s actions, not merely formal share percentages.

Ultimate beneficial owner — why you need to look deeper

The ownership and control rule leads directly to a further requirement: verifying the ultimate beneficial owner (UBO). Even if your counterparty’s direct owner is not on the sanctions list, the owner’s owner may be — or an entity three levels up in the holding structure.

An opaque ownership structure does not exempt your company from liability. If a sanctioned entity can be reached through a chain of controlling interests, the transaction is prohibited regardless of how many layers of intermediaries separate you from the name on the list. The due diligence obligation lies with you — not with an authority that would have to prove it to you after the fact.

In practice, this means that for counterparties from high-risk jurisdictions (Russia, Belarus, Iran, certain tax havens) you should request ownership documentation, extracts from corporate registries and — where possible — declarations regarding the UBO structure. The Act of 1 March 2018 on Countering Money Laundering and Terrorist Financing⁸ imposes similar requirements on obligated institutions in the AML sphere — sanction screening for companies outside the financial sector follows the same logic, though on a different legal basis.

Who must apply sanctions — every entity in the territory of the EU

There are no exceptions here. EU regulations — including No 269/2014¹ and No 833/2014² — are directly applicable throughout the European Union without the need for transposition into national law.³ This means that the obligation to apply restrictive measures falls upon:

• every legal person — company, association, foundation, cooperative, regardless of sector,
• every natural person conducting a business activity,
• every person present in the territory of the EU — including foreign nationals.

It does not matter whether your company is large or small. It does not matter whether you operate in financial services, tourism, real estate or e-commerce. The Act of 13 April 2022 on Special Solutions for Countering the Support of Aggression against Ukraine and Protecting National Security (Journal of Laws 2022 item 835)⁹ — supplementing the EU regulations — confirms the obligations of entities operating in Poland and designates the Head of the National Revenue Administration (KAS — Krajowa Administracja Skarbowa) as the authority empowered to impose penalties.¹⁰

The Polish sanctions list is maintained by the Minister of Internal Affairs and Administration (MSWiA — Ministerstwo Spraw Wewnętrznych i Administracji)¹¹ and constitutes a separate layer that must be checked in parallel with EU lists. If you want to know which lists specifically apply to your company and how to access them, read our article on sanctions lists — what they are and why they apply to your company.

It is also worth bearing in mind the criminal dimension: Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024¹² required Member States to introduce criminal provisions for violations of EU restrictive measures, providing for custodial sentences for natural persons and financial penalties for legal persons. The specific penalty ranges for individual types of violation are set out in the Directive and in national implementing legislation.

Why the absence of a name on the list does not mean you are safe

This is perhaps the most important takeaway from the entire article. You may thoroughly check your counterparty’s company name against all available databases — the EU Consolidated List¹³, the EU Sanctions Map¹⁴, the UN list⁷, the OFAC SDN¹⁵ and the Polish MSWiA list¹¹ — and find no match at all. And yet the transaction may still be prohibited.

This happens for several reasons:

1. The ownership rule is not disclosed on the list. The sanctions list contains entries for directly listed entities and persons. It does not contain a list of all companies that are subject to sanctions through the ownership rule — it is up to you to establish this by verifying the ownership structure.

2. The list is updated frequently. The EU Consolidated List is regularly supplemented — new entries are added, existing ones are modified, successive sanctions packages are imposed. A check carried out six months ago may already be out of date. It is essential to check counterparties at each transaction or periodically for ongoing relationships, not just once at onboarding.

3. Other lists may cover your counterparty. If you have relationships with entities from the USA or the United Kingdom, you must take into account the OFAC SDN list¹⁵ and the British OFSI list¹⁶. A listing on the OFAC list without a corresponding EU listing is a common scenario for contractors from jurisdictions linked to Russia or Iran.

4. Changing a name or registration does not remove sanctions. Entities on sanctions lists frequently attempt to circumvent restrictive measures through restructuring — changing their name, relocating their registered office, or creating subsidiaries in neutral jurisdictions. Sanctions track the identity of the entity, not its formal registered name.

A precise description of the counterparty verification process — step by step, with examples of identifiers and a procedure for handling hits — can be found in our article on verifying counterparties for sanctions compliance.

FAQ — frequently asked questions

Does a sole trader (single-person business) also have to check sanctions lists?

Yes. EU regulations apply to every natural person conducting an activity in the territory of the EU³ — a sole trader is not exempt. The scope of the obligation depends on the business profile and commercial relationships, but the obligation itself exists.

What does “more than 50% of shares” mean in practice — does every type of share count?

The ownership rule concerns equity ownership, but in the meaning of EU sanctions regulations it also covers control through voting rights and other decision-making mechanisms.⁴ If a sanctioned person is able to determine the actions of a company — regardless of the formal percentage of shares — the rule may apply. Where there is any doubt about a specific ownership structure, it is advisable to consult a lawyer.

Is it enough to check a counterparty once, at the time of signing a contract?

No. Sanctions lists are updated regularly. An entity that was clear at onboarding may be listed in the course of the relationship. Good compliance practice requires verification at each new transaction and periodic reviews of existing counterparties — particularly those from elevated-risk areas.

Do sanctions only apply to counterparties from Russia and Belarus?

No. The EU sanctions systems cover dozens of countries and regimes — from Iran through Syria to North Korea and others. Council Regulation (EC) No 765/2006 of 18 May 2006¹⁷ concerns Belarus. There are separate regimes for Iran, Syria, Libya, Myanmar and many others. The EU Sanctions Map¹⁴ at sanctionsmap.eu allows you to browse active sanctions regimes. The full scope of applicable lists is covered in the article on EU and MSWiA sanctions lists.

As an insurance broker, do I have the same obligations as an importer?

The obligation derives from a regulation that is the same for everyone — there are no sector-specific exemptions beyond a small number of humanitarian exceptions. The specifics of the insurance sector lie rather in which entities you verify (policyholders, beneficiaries, assignees) and how frequently verification should be carried out. You can read more about what sanction screening looks like in insurance practice on the insurance industry page.

If my counterparty holds a certificate or import licence, can I skip the sanctions check?

No. No certificate, import licence or official authorisation replaces the obligation to check against sanctions lists. EU sanctions operate in parallel to customs and trade regulations — and are independent of them. The check is your company’s responsibility, not the customs authority’s.

Concrete steps — what to do in your company

1. Determine which lists apply to you. The minimum is the EU list (Consolidated List, DG FISMA¹³) and the Polish MSWiA list¹¹. If you have transactions with the USA or entities connected to it — add the OFAC SDN list¹⁵.

2. Take stock of your counterparties. Draw up a register of active suppliers, customers and business partners, with particular attention to entities from Russia, Belarus, Iran and other sanctioned regimes.

3. Check the ownership structure. For each elevated-risk counterparty, identify the owner — and the owner’s owner. Apply the ownership rule: more than 50% of shares or control by a sanctioned entity means the counterparty is subject to sanctions.

4. Identify the ultimate beneficial owner (UBO). Request ownership documentation from counterparties in high-risk jurisdictions. An opaque structure is a red flag.

5. Implement regular verification. A one-off check is not enough. Establish a procedure for checking at each transaction and periodic reviews (e.g. quarterly) of active relationships.

6. Document screening results. Record the date of verification, the lists checked, the outcome and the person responsible. In the event of an inspection by the Head of KAS¹⁰, documentation is your evidence of due diligence.

7. Define a procedure for handling hits. Before a hit occurs, your company should know what to do: suspend the transaction, report the hit, and who makes the decision. The absence of a procedure is not a mitigating factor — it is an aggravating one.

How Sanqto can help

Sanqto is sanction screening software installed within your company’s own network — data does not leave your infrastructure (on-premise). The system returns a result in three states: MATCH, POSSIBLE or CLEAR, with a response time of under 30 ms. It helps automate the repetitive part of verification: comparing identifying data against current sanctions lists, flagging cases that require manual review, and building a hit register that documents due diligence. If you run a travel agency, an insurance company or another obligated entity, see how to tailor screening to your sector’s specific requirements — on the tourism and insurance pages. The sanction screening obligation and the scope of entities required to carry it out are described in detail in our article on the sanction screening obligation.

Legal basis

• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine — CELEX 32014R0269
• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — CELEX 32014R0833
• Council Regulation (EC) No 765/2006 of 18 May 2006 concerning restrictive measures in respect of Belarus — CELEX 32006R0765
• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures — CELEX 32024L1226
• Act of 13 April 2022 on Special Solutions for Countering the Support of Aggression against Ukraine and Protecting National Security (Journal of Laws 2022 item 835) — ISAP
• Act of 1 March 2018 on Countering Money Laundering and Terrorist Financing (Journal of Laws 2018 item 723) — ISAP
• Polish sanctions list maintained by MSWiA — gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami
• EU Consolidated List (Consolidated List / FSD) — DG FISMA — finance.ec.europa.eu
• EU Sanctions Map — sanctionsmap.eu
• OFAC SDN List — ofac.treasury.gov
• UK OFSI Consolidated List — gov.uk
• UN Security Council Consolidated List — un.org

Footnotes

Information, not legal advice. This article is for informational and educational purposes only. It does not constitute legal advice. Legal status as of: 20 May 2026. Your company’s specific obligations depend on its business profile and require individual assessment — if in doubt, consult a lawyer or compliance adviser.