Sanctions Regimes Compared: US, EU, UK and UN Rules and Who Enforces What
Sanctions are legal restrictions that stop people and companies from dealing with a named target: a government, a company, a ship, an individual. Four systems matter most for anyone doing business across borders. The United States runs the most powerful one, because so much of the world’s money moves in dollars. The EU and the UK run their own regimes, which overlap with Washington’s but are written and enforced differently. The UN Security Council sits above all three in law but has no enforcement arm of its own. This page explains how each system works, who enforces it, what breaches cost, and how far each one reaches outside its own borders. It reflects the rules and sanctions packages in force as of October 2026.
The four regimes at a glance
| United States | European Union | United Kingdom | United Nations | |
|---|---|---|---|---|
| Legal basis | IEEPA (1977), Trading with the Enemy Act, country statutes such as CAATSA; presidential executive orders | Council Decision under Article 29 TEU plus a Council Regulation under Article 215 TFEU | Sanctions and Anti-Money Laundering Act 2018 (SAMLA) and regulations made under it | Chapter VII of the UN Charter, Article 41; Security Council resolutions |
| Who decides | President and Treasury (OFAC), State Department | Council of the EU, unanimously | Foreign, Commonwealth and Development Office (FCDO) designates | Security Council; the five permanent members can veto |
| Main list | SDN List (Specially Designated Nationals and Blocked Persons) | EU consolidated financial sanctions list | UK Sanctions List | UN Security Council Consolidated List |
| Who enforces | OFAC (civil), Department of Justice (criminal); BIS for export controls | Each member state’s national authorities and courts | OFSI (financial), OTSI (trade, civil), HMRC (trade, criminal), National Crime Agency | No one directly; member states must implement in national law |
| Civil penalty | Greater of $377,700 or twice the transaction value, per violation (IEEPA) | Set nationally | Greater of £1 million or 50% of the breach value | None |
| Criminal penalty | Up to $1 million and 20 years in prison (IEEPA, wilful violations) | Set nationally, with EU minimum standards since 2024 | Up to 7 years in prison | None |
| Ownership rule | 50% Rule, aggregated across blocked owners | Ownership above 50% or control | Ownership above 50% or control | Varies by resolution |
| Reach outside its territory | Wide: US persons everywhere, anything in dollars, US-origin goods, plus secondary sanctions on foreigners | EU territory, EU nationals and EU companies anywhere, business done in the EU | UK territory, UK nationals and UK companies anywhere | Binding on all 193 UN members, through their own laws |
United States: OFAC and the SDN List
The Office of Foreign Assets Control (OFAC), part of the Treasury Department, administers most US sanctions. Its authority mostly comes from the International Emergency Economic Powers Act (IEEPA): the President declares a national emergency over a foreign threat, then issues executive orders that OFAC implements. Some programmes also rest on specific laws passed by Congress, such as CAATSA for Russia, Iran and North Korea.
The core tool is the SDN List. Anyone on it is “blocked”: US persons must freeze any of their property they hold and cannot deal with them at all, unless OFAC issues a licence. A general licence covers a whole category of activity (often a wind-down period); a specific licence covers one applicant. When OFAC added Rosneft and Lukoil to the SDN List on 22 October 2025, it issued a general licence to let counterparties wind down existing deals.
The 50% Rule. Any entity owned 50% or more, directly or indirectly, by one or more blocked persons is itself blocked, even if it is not named on the list. Ownership is added up across blocked owners: if two SDNs hold 25% each, the company is blocked. Control without ownership does not trigger the rule on its own, which is a key difference from the EU and UK.
Secondary sanctions. Primary sanctions bind US persons. Secondary sanctions threaten non-US persons who deal with a target, usually by cutting them off from the US financial system or adding them to the SDN List themselves. Russia’s Executive Order 14024 lets OFAC sanction foreign banks that facilitate significant transactions for Russia’s military-industrial base, and most Iran programmes carry similar threats. This is how US sanctions bite on Chinese refiners, Gulf traders and Indian banks that never touch US soil. In 2026 OFAC has also designated entities linked to Iran’s collection of transit fees from ships using the Strait of Hormuz.
Enforcement. Civil liability is strict: OFAC does not have to prove a company knew it was breaching sanctions, though intent and cooperation heavily affect the size of the penalty. The maximum civil penalty under IEEPA is the greater of $377,700 or twice the value of the transaction, per violation, and that figure is adjusted for inflation every year. Wilful violations are crimes prosecuted by the Department of Justice, with fines up to $1 million and up to 20 years in prison. In April 2024 Congress doubled the statute of limitations for IEEPA and Trading with the Enemy Act violations from five years to ten. The largest OFAC penalty of 2026 so far is $275 million against Adani Enterprises in May.
Sanctions sit next to, but separate from, export controls run by the Commerce Department’s Bureau of Industry and Security (BIS). The Entity List restricts exports to named companies; it does not freeze assets. The difference between an SDN, an Entity List designation and a Military End User listing is set out in export control and sanctions acronyms explained, and the Huawei sanctions timeline shows how the two tools get used together on one target.
European Union: Council decisions and national enforcement
EU sanctions (officially “restrictive measures”) are made in two steps. First the Council of the EU adopts a Decision under the Common Foreign and Security Policy, which needs unanimity among all 27 governments. Then it adopts a Regulation under Article 215 of the Treaty on the Functioning of the EU, which applies directly in every member state. Because of the unanimity step, a single government can delay or water down a package, and renewals of existing sanctions also need every member’s agreement.
Russia packages. Since February 2022 the EU has adopted its Russia measures in numbered packages. As of October 2026 the latest is the 21st package, adopted on 23 July 2026. It listed 48 individuals and 170 entities, banned transactions with 33 more Russian banks and four banks outside the EU, closed EU ports to 41 more shadow fleet tankers, restricted 14 crypto platforms and paused the automatic adjustment of the oil price cap until 15 July 2027. The 20th package (23 April 2026) set up a framework for a ban on maritime services for Russian crude and oil products, and the 19th (23 October 2025) banned imports of Russian LNG. The EU’s economic sanctions on Russia now run to 31 July 2027, and in September 2026 the Council extended its Ukraine-related individual listings framework until 22 September 2029.
Who enforces. The EU has no sanctions enforcement agency. Each member state names its own competent authorities (often the foreign or finance ministry, the central bank and customs), grants licences and prosecutes breaches in its own courts. Penalties used to differ wildly. Directive (EU) 2024/1226 now makes sanctions violations a criminal offence everywhere in the EU, with minimum maximum penalties: prison terms of up to at least five years for the most serious offences by individuals, and fines on companies of at least 5% of worldwide turnover or €40 million for the most serious breaches. Most offences involving less than €10,000 can be left outside criminal law.
Ownership and control. EU guidance treats an entity as covered if a listed person owns more than 50% of it or controls it, for example by appointing most of its board. Because control counts, the EU test can catch companies that OFAC’s ownership-only rule misses.
Reach. EU sanctions apply on EU territory, to EU nationals and EU-incorporated companies wherever they are, and to any business done wholly or partly in the EU. They do not claim to bind non-EU companies abroad. The EU has gone further against circumvention, though: EU parents must use their best efforts to stop their non-EU subsidiaries undermining sanctions, and exporters of sensitive goods must put a “no re-export to Russia” clause in contracts with third-country buyers. The EU also keeps a Blocking Statute, which in principle bars EU companies from complying with certain US secondary sanctions, mainly on Iran and Cuba.
United Kingdom: OFSI, OTSI and the post-Brexit regime
Since leaving the EU the UK has run its own sanctions under the Sanctions and Anti-Money Laundering Act 2018. The FCDO designates people and entities under most regimes. Since 28 January 2026 the UK Sanctions List is the single official list of UK designations; the old OFSI consolidated list has closed.
Enforcement is split by type:
- OFSI (Office of Financial Sanctions Implementation), part of HM Treasury since March 2016, handles financial sanctions: asset freezes, licences, breach reporting and the Russian oil price cap.
- OTSI (Office of Trade Sanctions Implementation), part of the Department for Business and Trade, launched in October 2024. It enforces trade sanctions on services and on overseas trade with a UK link through civil penalties.
- HMRC enforces trade sanctions on goods crossing the UK border and handles criminal investigations of export breaches.
- The National Crime Agency and prosecutors take criminal cases.
Civil penalties from OFSI and OTSI follow the same cap: the greater of £1 million or 50% of the estimated value of the breach. Since 15 June 2022 OFSI has been able to impose penalties on a strict liability basis, without proving the person knew or suspected a breach. OTSI works the same way, on the civil balance of probabilities. Criminal breaches of financial sanctions carry up to seven years in prison. OFSI’s 2026 guidance added discounts for early admission, settlement and voluntary disclosure.
UK sanctions apply in the UK and to UK nationals and UK companies anywhere. Like the EU, the UK uses a “more than 50% or control” ownership test. London’s Russia measures closely track Brussels and Washington, but listings do not line up one for one, so a person can be designated in one system and not another.
The UN Security Council: committees and snapback
UN sanctions are adopted by Security Council resolution under Article 41 of the UN Charter and bind every UN member. The Council has set up 31 regimes since 1966, and 15 are active, including North Korea (resolution 1718), ISIL and al-Qaida (1267), Libya, Yemen, Haiti and, again, Iran (1737). Each is run by a committee of all 15 Council members, chaired by one of them, which decides by consensus. Most committees are supported by a panel of experts that tracks violations.
The UN has no police. States must write the measures into their own law: the EU does this through Council regulations, the UK through SAMLA regulations, the US through executive orders. Enforcement is therefore only as strong as each member’s will. Vetoes also bite: Russia vetoed the renewal of the North Korea panel of experts in March 2024, so that regime has had no UN monitors since.
Snapback. The 2015 Iran nuclear deal, endorsed by resolution 2231, came with a mechanism that let any original participant restore earlier UN sanctions without a veto. France, Germany and the UK triggered it on 28 August 2025. After a 30-day window in which the Council did not vote to keep sanctions relief in place, all measures from six earlier resolutions were reapplied from 8 p.m. New York time on 27 September 2025: an arms embargo, a ban on enrichment-related activity, asset freezes and travel bans. The 1737 sanctions list was re-established. The EU reinstated its own nuclear-related sanctions on Iran on 29 September 2025. Russia and China rejected the snapback as invalid, and as of October 2026 the Council has not elected a chair for the revived 1737 committee, which shows how a regime can be legally in force and politically stalled at the same time.
Where the regimes collide
Most compliance problems come from the gaps between these systems. A Dubai trader might be clean under EU and UK law and still be an SDN. A company 40% owned by one SDN and 15% by another is blocked under US rules even though no single owner holds a majority. A company controlled by a listed person through board seats, with no majority stake, can be caught in the EU or UK and missed by OFAC’s rule. A European bank processing a payment in euros for an Iranian-linked customer is outside OFAC’s primary jurisdiction, but faces secondary sanctions if the trade is large enough to matter. In trade finance, sanctions clauses in letters of credit and standby letters of credit now routinely let banks refuse payment where any of these regimes is engaged.
Three practical points follow. Screen against all four lists, not just the one for your home country. Check ownership with both the US aggregation rule and the EU/UK control test. And watch the shadow fleet: after Iranian toll collection at Hormuz and the EU’s expanding tanker listings, shipping is where the four regimes are most active and where they disagree most. For the wider vocabulary of economic statecraft, see the Referently glossary of geopolitics terms; for the alliance tools that sit alongside sanctions, see NATO Article 4 vs Article 5 explained.