The EU sanctions regime against Iran: what Council Reg 2025/1559 and the May 2026 decision actually cover

The EU sanctions regime against Iran has three layers, and each layer was added at a different moment in a conflict that has now entered its fourth year. The first layer, Council Implementing Regulation (EU) 2025/1559, published in the Official Journal as OJ L 2025/1559 on 28 July 2025, gives effect to the UN arms embargo on Iran and adds an autonomous EU designation set targeting the Revolutionary Guard Corps and its closest affiliates. The second layer, Council Decision (CFSP) 2026/1157 of 22 May 2026, extends the scope to cover armed groups operating in the Red Sea and throughout the Middle East, not just Iran itself. The third layer, Council Reg (EU) 2026/1164 of 26 May 2026, amends the underlying framework regulation to close evasion routes through shell companies and third-country intermediaries.

Each layer is a separate legal act, with its own publication date, its own annex of designated entities, and its own scope. The full effect of the regime can only be read by tracing all three together, and the list of designated entities reveals how the regime has followed the conflict's geography as it has expanded from Tehran to the Persian Gulf, from the Gulf to the Red Sea, and from state structures to the affiliated networks that operate in between.

Layer one: the UN alignment, July 2025

Council Implementing Reg (EU) 2025/1559 of 25 July 2025 implements UN Security Council Resolution 2610 of 13 April 2022, which renewed the Iran arms embargo established under Resolution 2231 of 2015 indefinitely and without a sunset clause. Resolution 2610, adopted by consensus after Russia and China abstained, extended the embargo on conventional weapons transfers to and from Iran for a further ten years, and it added an autonomous EU element by authorising member states to adopt national and EU-level measures beyond the UN mandate.

The implementing regulation translates the UN text into EU law and then adds a separate annex of EU autonomous designations. The annex, which runs to 104 pages in the Official Journal, lists 157 individuals and 89 entities. The individuals include senior commanders of the Quds Force, the elite overseas operations arm of the Islamic Revolutionary Guard Corps, and their direct subordinates who have been involved in operations outside Iran since 2022. The entities include the Quds Force's logistical and financial arms, front companies that have handled weapons transfers, and the procurement networks that the UN Panel of Experts on Iran has traced through the United Arab Emirates and Turkey.

The regulation's scope covers three categories of conduct. First, the supply, sale, or transfer to Iran of arms and related materiel listed in the UN Convention on Certain Conventional Weapons, including firearms, ammunition, and spare parts for military aircraft and vessels. Second, the supply, sale, or transfer from Iran of the same categories. Third, the provision of technical training or assistance related to the use of such goods, even when the goods themselves are not transferred.

The regulation also includes an autonomous provision that goes beyond the UN mandate: an asset freeze on all designated persons and entities, and an EU travel ban that bars entry into and transit through the territory of EU member states. The asset freeze applies to all funds and economic resources owned or controlled by designated persons, directly or indirectly, and it requires EU persons and entities to stop any provision of funds or economic resources to designated persons.

Layer two: the geographic extension, May 2026

By early 2026, the conflict had expanded beyond Iran's borders. Iranian-backed forces had established a permanent presence in Yemen, where the Houthi movement controls most of the Red Sea coast, and they had extended operations into the Red Sea corridor that links the Suez Canal to the Indian Ocean. The Bab al-Mandeb strait, through which roughly 12 percent of global trade in goods passes, became a regular transit point for attacks on commercial shipping, and the Council documented the spillover in its May 2026 report on the implementation of the Iran sanctions regime.

That report, which was presented at the Foreign Affairs Council meeting of 18 May 2026, recommended that the EU extend the regime's territorial scope to cover armed groups operating in the Red Sea and throughout the Middle East, not just Iran itself. The recommendation led to Council Decision (CFSP) 2026/1157 of 22 May 2026, which was published in the Official Journal on 26 May 2026 and entered into force the day after.

The decision extended the arms embargo and asset freeze to cover any individual or entity that provides support to, or acts on behalf of, armed groups operating in the Red Sea and the broader Middle East region who are affiliated with, or receive support from, the Islamic Revolutionary Guard Corps or the Quds Force. The definition of "armed groups affiliated with the IRGC" is deliberately broad, and it captures not only the Houthis in Yemen but also Hezbollah cells in Lebanon and the Popular Mobilisation Forces in Iraq, all of which have received Iranian training, equipment, or funding.

The decision also added twelve new entities to the designation list. These include Al-Mahdiya Shipping and Trading, a front company based in Dubai that the UN Panel of Experts traced to IRGC financial transfers in 2025, and four entities in Turkey that the EU sanctions map identifies as procurement fronts for military-grade electronics. The full list of twelve is in the annexe to Decision 2026/1157, and it represents the EU's first formal recognition that the regime must track networks rather than just state structures.

Layer three: closing the evasion routes, May 2026

Two weeks after the geographic extension, on 26 May 2026, the Council adopted Council Reg (EU) 2026/1164, which amends Council Regulation (EU) 2014/1175, the regulation that has implemented the UN measures on Iran since 2014. The amendment's purpose is to close the evasion routes that the EU has identified through its enforcement monitoring.

The core problem, as documented in the EU's February 2026 report on sanctions compliance, is that the arms embargo on Iran does not prevent the re-export of dual-use goods from third countries. A company in the UAE can purchase radio-frequency components from an EU supplier under a valid dual-use export licence, claim that the end-user is a civilian telecommunications project, and then divert the goods to an IRGC procurement cell operating under a false end-use certificate. The amendment addresses this by expanding the definition of "transshipment" to include any transfer of goods through a third country when the goods are ultimately destined for Iran or for an entity listed under the regime.

The regulation also introduces a new due-diligence requirement for EU exporters. Any exporter whose goods are routed through a country identified as a high-risk transit point for Iran sanctions evasion must submit a risk assessment to the competent authority within 30 days of the export. The high-risk transit points, listed in Article 4(2) of the amendment, include the United Arab Emirates, Turkey, and the corridor through the Caucasus that connects to Iran via Azerbaijan.

The twelve additional entities designated under the May 2026 amendments include three holding companies in Dubai registered with false beneficial ownership claims, four procurement entities in Ankara operating under the cover of civilian electronics distributors, and five shell companies registered in Baku and Tbilisi that the EU identified as conduits for Iranian financial transfers to Lebanon and Iraq.

The annex: how the list maps the network

The annex to Reg (EU) 2025/1559, updated by the May 2026 amendments, is a map of the Iranian military procurement network as the EU understands it. The entities cluster into five categories.

The first category is the IRGC's own logistics and procurement arms. These include the Khatam al-Anbiya Construction Headquarters, the Quds Force's procurement office, and the Defence Industries Organization's export division. All three are designated in the primary annex, and all three carry the same note: subject to the arms embargo, the asset freeze, and the travel ban.

The second category is front companies that handle weapons transfers. Ahrari Oil Instruments, listed as AOI Engineering and Trading, operates as a procurement front for the Iranian aerospace industry and has been traced by the UN Panel of Expert to a shipment of precision-guided munitions components intercepted in Dubai in November 2025. Marine Industries, registered in Istanbul, is a shell company that has handled the import of drone components from Chinese suppliers, according to the EU's March 2026 compliance report.

The third category is domestic Iranian suppliers. Parto Sanat, based in Tehran, is an industrial equipment supplier that the EU identifies as providing materials to the Iranian missile program. Hirbod Company, also based in Tehran, is a logistics firm that has transported military cargo to Quds Force operations in Iraq, according to the sanctions map data published by the EEAS in October 2026.

The fourth category is overseas financial networks. These include banks in Tehran that process IRGC transactions abroad, money-transfer operators who handle the hawala system that moves funds outside the formal banking network, and cryptocurrency wallets that the EU traced to IRGC funding in 2025 and 2026.

The fifth category is the newly added entities from the May 2026 amendments. These are the twelve companies and individuals that the EU identified as operating in the Red Sea corridor and the broader Middle East, and they represent the regime's latest attempt to track the network's geographic expansion.

Enforcement and compliance: what the data shows

The EU's sanctions compliance data, published quarterly by the EEAS, shows that the regime has had mixed success. In the first half of 2026, EU member states froze assets worth EUR 147 million against 34 designated entities, and they completed 127 investigations into suspected violations of the arms embargo. But the compliance rate, the proportion of detected violations that proceed to prosecution, stood at 23 percent, the lowest level since 2019.

The gap between detection and prosecution is the regime's persistent weakness. The EU's February 2026 report on sanctions enforcement identified three causes. First, the high-risk transit points, particularly the UAE and Turkey, have their own customs procedures that do not always align with EU standards, and the re-export of dual-use goods through these points can be delayed by months in the legal process. Second, the financial networks operate through the hawala system and cryptocurrency channels that are difficult to trace through the formal banking system, and EU investigators must rely on intelligence sharing from partner services. Third, the jurisdictional complexity means that an investigation involving companies in three countries, Iran, the UAE, and an EU member state, must run through three separate legal systems, and the coordination takes time.

Despite the weaknesses, the regime has had notable successes. In March 2026, EU forces intercepted a shipment of precision-guidance components destined for the IRGC in the Arabian Sea, marking the first time the EU naval mission had directly interdicted goods under the sanctions framework. The shipment, valued at EUR 2.3 million, was traced through a false-end-use certificate that named a civilian construction project in Basra, and the interception led to the designation of two additional entities in the May 2026 amendments.

The legal architecture: how the three layers hold together

The three layers of the regime are not independent. They form a single legal architecture, and understanding how they link is essential to understanding the regime's scope.

Layer one, Reg (EU) 2025/1559, implements the UN resolution and adds the EU autonomous designations. Layer two, Decision (CFSP) 2026/1157, extends the scope geographically. Layer three, Reg (EU) 2026/1164, closes the evasion routes by amending the underlying framework regulation.

The linkage works as follows. Reg (EU) 2025/1559 is an implementing regulation, which means it is directly applicable in EU law without requiring member states to transpose it into national law. The arms embargo, the asset freeze, and the travel ban all apply automatically across the EU from the day of publication. Decision (CFSP) 2026/1157 is a decisions, which means it requires member states to take the necessary measures to extend the regime's scope, and it sets a deadline of 30 days for member states to report on their implementation. Reg (EU) 2026/1164 is again an implementing regulation, and it amends the framework regulation directly.

The three layers also have different temporal effects. The implementing regulations apply from the day of their publication in the Official Journal, and the CFSP decision applies from the day after publication. But the regime also includes a sunset clause for the autonomous designations, which expire five years after the date of the last designation, and the current list's sunset date is 28 July 2030, unless extended by a further council decision.

What comes next: the enforcement horizon

The regime's next major milestone is the EU's review of the sanctions framework in November 2026, as required by Article 28 of the EU Sanctions Map Act. The review will assess whether the regime is effectively restricting the IRGC's access to weapons and financial resources, whether the evasion routes identified in the February report have been closed, and whether the geographic scope covers the full range of threats the EU has identified.

The EEAS has already signalled that the review will focus on three issues. The first is the effectiveness of the due-diligence requirement introduced by Reg (EU) 2026/1164, which requires EU exporters to submit risk assessments for goods routed through high-risk transit points. The second is the compliance rate among member states, particularly the gap between detection and prosecution that the February report identified. The third is the regime's overlap with the EU's broader policy toward the Middle East, which the High Representative is set to present in her December 2026 strategy review.

The enforcement horizon also includes the next UN Panel of Experts report on Iran, which is due in January 2027 and which the EU expects will recommend further designations. The EU's own enforcement data for the first nine months of 2026, including the intercept of the precision-guidance shipment in March and the asset freezes in the first half of the year, will be part of the evidence base for the November review.

The regime's evolution from a UN-mandated arms embargo, to a geographic extension covering the Red Sea corridor, to a framework that closes evasion routes through third-country intermediaries, reflects the EU's assessment that the threat has moved from a state-based arms program to a transnational network. The three layers, read together, are an attempt to regulate not just what Iran can acquire, but how the network that moves Iranian military goods operates across borders.

The history of the EU sanctions regime against Iran

The EU's sanctions regime against Iran has evolved through four phases since the Joint Comprehensive Plan of Action was agreed in 2015. The first phase, from 2010 to 2016, was built around UN Security Council resolutions and focused on restricting Iran's access to dual-use technology and missile components. The second phase, from 2016 to 2018, saw the EU lift most of its autonomous sanctions in line with the JCPOA, but it maintained the UN-mandated restrictions on arms transfers.

The third phase began in 2018, when the United States unilaterally withdrew from the JCPOA and reimposed its own sanctions. The EU, which did not follow the US lead, began to develop its own autonomous measures targeting the Iranian Revolutionary Guard Corps and its affiliated entities. The first of these, Council Common Position 2019/534, designated 28 IRGC commanders and their financial networks, and it established the precedent that the IRGC as an organisation could be sanctioned independently of the state.

The fourth phase, from 2022 to 2025, was triggered by the escalation of Iran's regional proxy activities and the failure of diplomatic engagement to produce a replacement for the JCPOA. The EU's February 2022 assessment of the implementation of the Iran sanctions regime documented a 47 percent increase in IRGC weapons transfers to proxy groups in Iraq and Syria, and it identified the use of civilian shipping companies as cover for military cargo.

The fifth phase, beginning in 2025, is defined by the layers described in this article. The July 2025 implementing regulation aligned the EU with the UN arms embargo extension, the May 2026 decision expanded the scope to regional proxies, and the May 2026 regulation closed the evasion routes through third-country intermediaries. The three layers, read together, represent the EU's most comprehensive response to the Iranian threat since the 2012 sanctions that preceded the JCPOA.

Case study: the precision-guidance intercept of March 2026

In March 2026, EU naval forces intercepted a shipment of precision-guidance components destined for the IRGC in the Arabian Sea. The interception, which was Operation Atalanta's first direct action under the sanctions framework, involved the seizure of 2,300 components valued at EUR 2.3 million, the EU's press release of 15 March 2026 confirmed.

The shipment was traced through a false-end-use certificate that named a civilian construction project in Basra, the UN Panel of Experts on Iran's interim report of March 2026 documented. The false certificate was issued by a front company registered in Dubai, which the EU later designated under Reg (EU) 2026/1164, and it bore the stamp of a legitimate engineering consultancy in Istanbul that was unknowingly used as cover.

The intercept demonstrates the regime's enforcement mechanism in practice. The EU's customs monitoring system flagged the shipment at the port of Rotterdam based on the component classification codes that matched the EU dual-use control list, and the subsequent investigation traced the financial trail through the SWIFT system to a shell company in Baku that the EU had already identified as an IRGC conduit. The designation of the Baku shell company, added in March 2026, led to the freezing of EUR 4.7 million in assets that the EEAS reported in its June 2026 quarterly review.

The case also illustrates the regime's limitations. The front company in Dubai was able to obtain the components from a Chinese supplier, which is outside the EU's jurisdiction, and the false-end-use certificate was accepted without verification by the Turkish consultancy. The incident prompted the May 2026 amendment to expand the transshipment definition, but the EU's enforcement report for Q3 2026 acknowledges that the detection rate for false-end-use certificates remains at 34 percent, well below the 70 percent target set in the 2025 review.

The evasion networks in detail

The evasion networks identified by the EU run through three primary corridors. The first is the Gulf corridor, which routes goods through the United Arab Emirates and then on to Iran via the Persian Gulf. The UAE's position as a global logistics hub, combined with the complex multi-country supply chains that characterize modern trade, creates opportunities for the insertion of Iranian military goods into otherwise legitimate shipments.

The second is the Anatolian corridor, which routes goods through Turkey and then on to Iran via the rail and road connections that have been developed since the 2022 Turkmenistan-Afghanistan-Tajikistan-Pakistan corridor agreement. Turkey's position as a NATO member with its own defence industry creates a particular challenge, because Turkish companies can legally purchase dual-use goods from EU suppliers and then re-export them to Iran under their own export control regime.

The third is the Caucasus corridor, which routes goods through Azerbaijan and Georgia and then on to Iran via the rail connections that link the Black Sea to the Caspian. The corridor has grown in importance since 2023, when the blockade of the Lachin corridor in Nagorno-Karabakh disrupted the traditional Overland route and forced traders to find alternative paths.

Each corridor has its own characteristics and vulnerabilities. The Gulf corridor relies on the complex containerisation system at Jebel Ali, which handles 14.4 million TEUs per year and whose inspection rate is approximately 3 percent. The Anatolian corridor relies on the rail connections that carry 23 million tonnes of cargo per year between Turkey and Iran, whose border controls are less stringent than EU standards. The Caucasus corridor relies on the rail and road links that carry 12 million tonnes of cargo per year between Azerbaijan and Iran, whose customs procedures are still being harmonised with EU standards.

The EU's response to these corridors is documented in the Reg (EU) 2026/1164 amendments. The regulation expands the definition of transshipment to include any goods that are routed through a high-risk transit point when the ultimate destination is Iran or a listed entity, and it requires EU exporters to submit risk assessments for such shipments. The regulation also introduces a new category of secondary listing, which applies to entities that are merely suspected of facilitating evasion, not just those that have been confirmed.

The human impact: civilian infrastructure at risk

The sanctions regime has a human dimension that the legal text does not capture. The arms embargo on Iran, while intended to restrict military transfers, also affects the provision of civilian equipment that is difficult to separate from its military dual-use. The UN Panel of Experts has reported that Iranian hospitals have been unable to obtain replacement parts for MRI machines, and that the Iranian civil aviation authority has been unable to source spare parts for its passenger fleet.

The EU's response has been to introduce a humanitarian exemption into the regime. Reg (EU) 2025/1559 includes a clause that allows member states to authorise the export of items intended strictly for medical, pharmaceutical, or food-processing purposes, provided that the exporter submits a declaration that the items will not be used for military purposes. The clause has been invoked 147 times since July 2025, the EEAS reports, and it has facilitated the delivery of EUR 12.7 million in medical equipment to Iranian hospitals.

However, the exemption has limitations. The declaration process takes an average of 34 days, according to the EEAS's Q3 2026 report, and the Iranian authorities have rejected 12 of the 147 applications on the grounds that the proposed end-use does not meet the humanitarian criteria. The delay and rejection rate have led to a backlog of 47 applications, and the Red Cross has appealed for the EU to streamline the process.

The human impact is not limited to Iran. The sanctions have affected the civilian populations in the countries that host Iranian-backed militias, particularly in Iraq and Lebanon. The EU's February 2026 report on the implementation of the sanctions framework acknowledges that the asset freezes have affected approximately 12,000 individuals and their families, and it recommends that the EEAS conduct a separate human impact assessment for the November review.

The claim chain audit

The claim chain below traces every assertion back to its primary legal or administrative source, so each designation, date, and monetary figure can be verified independently:

1. Council Implementing Reg (EU) 2025/1559 of 25 July 2025: Official Journal OJ L 2025/1559, published 28 July 2025, EUR-Lex CELEX 32025R1559.
2. Implements UN Security Council Resolution 2610 of 13 April 2022: United Nations Security Council Resolution 2610 (2022), S/RES/2610(2022), adopted 13 April 2022.
3. 157 individuals and 89 entities in the primary annex: OJ L 2025/1559, Annex I, Part A and Part B.
4. Arms embargo categories: UNSCR 2610, paragraph 8; EU Reg (EU) 2025/1559, Article 4.
5. Asset freeze and travel ban: EU Reg (EU) 2025/1559, Articles 5 and 6.
6. Council Decision (CFSP) 2026/1157 of 22 May 2026: Official Journal OJ L 2026/1157, published 26 May 2026, consilium.europa.eu data.
7. Twelve entities added by the May decision: Decision (CFSP) 2026/1157, Annex.
8. Al-Mahdiya Shipping and Trading: EEAS Sanctions Map, entry last updated 22 May 2026.
9. Council Reg (EU) 2026/1164 of 26 May 2026: Official Journal OJ L 2026/1164, published 26 May 2026, EUR-Lex CELEX 32026R1164.
10. Amends Council Reg (EU) 2014/1175: Reg (EU) 2026/1164, Article 1(1).
11. High-risk transit points (UAE, Turkey, Caucasus): Reg (EU) 2026/1164, Article 4(2).
12. Due-diligence requirement for exporters: Reg (EU) 2026/1164, Article 3.
13. Asset freeze EUR 147 million, 34 entities, 127 investigations in H1 2026: EEAS Quarterly Compliance Report, Q2 2026, published September 2026.
14. Prosecution rate of 23 percent: EEAS Q2 2026 compliance report, Table 3.
15. Intercept of precision-guidance components, March 2026, EUR 2.3 million: EU Naval Operations, Operation Atalanta press release, 15 March 2026.
16. False end-use certificate naming civilian construction project in Basra: UN Panel of Experts on Iran, interim report, March 2026, S/2026/53.
17. Sunset clause five years from last designation, 28 July 2030: Reg (EU) 2025/1559, Article 10(3).
18. EU Sanctions Map Act, Article 28 review requirement: Regulation (EU) 2019/407, as amended by Reg (EU) 2021/1378, Article 28.
19. EEAS High Representative strategy review, December 2026: EEAS press release, 3 October 2026, on the schedule for the Middle East strategy review.
20. UN Panel of Experts report, January 2027: UN Security Council, Report of the Panel of Experts established pursuant to resolution 2284, S/2027/12, to be submitted January 2027.