EU Sanctions Lists: Understanding and Overcoming Complexity with an Open-Source Solution

EU Sanctions Lists: Structure, Challenges and an Open-Source Solution

The EU sanctions lists are ubiquitous in business: they determine whom companies may and may not do business with. But what exactly is behind them, and why are these lists considered so complex to handle? Below, we take a detailed look at the structure and content of the current EU sanctions lists. We then examine why these lists are hard to use in practice and what challenges they create for companies, public authorities and compliance teams. In the second part, we present a new open-source initiative from handelsregister.ai that provides a simplified but complete version of the EU sanctions lists as open data, and explain which concrete problems this approach solves and what benefits it offers.

Structure and content of the EU sanctions lists

As part of its Common Foreign and Security Policy, the European Union imposes so-called restrictive measures (sanctions) on individuals, organizations or entire economic sectors. These measures serve to uphold international security and law, for example to prevent conflicts, punish human rights violations or combat terrorism. A central element is the sanctions lists of named individuals, groups and organizations whose assets are frozen and with whom no financial transactions of any kind may take place. All 27 EU member states implement these jointly adopted sanctions.

What is on the lists? The EU maintains a consolidated sanctions list that currently contains thousands of entries. Among them are almost 5,000 natural persons and more than 3,000 organizations or companies subject to various EU sanctions programs. Each entry typically lists the name (including aliases or spelling variants), identifying details (e.g., date of birth for individuals, known aliases or former names for organizations) as well as the date of and reason for the designation. High-ranking politicians, businesspeople and military personnel, for example, are listed if EU sanctions have been imposed on them, as are terrorist organizations or state bodies. Each entry is assigned to a specific sanctions program, such as the Russia sanctions, the North Korea program (PRK) or the counter-terrorism measures. The list is therefore a mix of very different targets and reasons. Its scope ranges from individuals to entire companies or banks, and the reasons for sanctions include human rights abuses, terrorism, cyberattacks, aggression against neighboring states and more. The measures vary accordingly: against individuals, the EU often imposes travel bans and asset freezes, while cyber threats are more likely to result in bans on technology exports. This diversity of content makes it clear that the EU sanctions list is not a simple directory but a complex instrument with many facets.

A living document: The EU sanctions lists are also dynamic. They are updated continuously whenever new geopolitical developments require it. In the course of the war in Ukraine, for example, the EU adopted numerous sanctions packages in quick succession and listed dozens of new individuals and companies. Conversely, entries are also removed, for example when individuals have died or political circumstances change. In practice, this means the list can change virtually overnight, and companies have to keep track of these changes. Continuous monitoring and regular data updates are essential to stay up to date.

Why the sanctions lists are so complex

Although the EU strives to structure its consolidated sanctions list as clearly as possible, several factors make these lists complicated and difficult to handle in practice:

• Multiple formats and sources: The official lists are provided through EU data portals and publications, often as XML files, PDFs in the Official Journal or entries in web databases. The EU does offer a detailed data structure with unique identifiers for each entry, but partly hampers access through technical hurdles. For example, you first have to create a user account before you can download the consolidated sanctions files. The official EU Sanctions Map tool is not particularly user-friendly either and offers only limited filtering options. Some list data comes in formats that are hard to process automatically; there are cases where list entries are formatted in such a way that you cannot simply extract or copy them. At times, deletions or changes are not clearly marked in the original sources, which makes them harder to trace.

• Multilingualism and spelling variants: The EU spans many languages, and sanctions lists often have a multilingual character. Names of listed individuals are frequently given both in Latin script and in their original script, e.g., Russian, Arabic or Chinese. This helps with identification, but makes automated matching more difficult. Different transcriptions of the same name can lead to inconsistencies. One and the same person may be listed as "Mohammed" or "Muhammad", depending on the source. Matching is further complicated by aliases: many listed individuals use cover names or alternative spellings, all of which are recorded in the data. Without a clear indication of which name is the primary one and which are aliases, matching becomes complex. The EU data itself does contain fields for "name" and "alias", but in unstructured publications (e.g., Official Journal lists as PDFs) this can be confusing.

• Unclear matches and data quality: In practice, users often struggle with inaccurate or missing information. Not all list entries contain complete information. For some individuals, for example, dates of birth or passport details are missing, which makes unambiguous identification difficult. Such gaps mean that matching against customer data produces many false hits, for example when a listed name is very common but, without a date of birth, it is unclear whether it refers to the same person. Conversely, there are also errors in the lists themselves. Experts point out that official sanctions lists sometimes contain duplicates, outdated information or typos. In the past, there have even been cases where insignificant individuals were listed while key players were missing. This is partly because authorities do not always have enough resources to keep the lists completely consistent and error-free. Such quality deficiencies can reduce the effectiveness of sanctions and create additional uncertainty for companies.

In summary, the complexity of the EU sanctions lists stems from a combination of an extensive, heterogeneous data structure, linguistic challenges and quality issues. For outsiders (and even for professionals), it is not trivial to "just" download the current sanctions list and match it smoothly against your own data straight away. The reality is more likely to involve laborious conversions, interpretation and regular manual intervention.

Challenges for companies, authorities and compliance teams

Why is the complexity described above a practical problem? Because companies and authorities that have to apply these lists face considerable challenges as a result. Three core tasks in sanctions compliance are screening, matching and reporting, and all three are made harder by the problems mentioned.

• Screening (checking business partners): Companies are legally required to check their business partners, customers and transactions against the relevant sanctions lists. In theory, this means matching every name against the list to ensure that no sanctioned person or organization is involved. In practice, however, compliance teams have to make sure that the latest list data is always in their own system, despite weekly or even daily updates. Importing these updates from sometimes unwieldy formats is time-consuming and error-prone. Many companies therefore use external data providers or software solutions, which comes at a cost. Without such tools, screening quickly becomes overwhelming, because you would have to compile and monitor the various international lists (the EU's, but also US OFAC, UN, etc.) manually. The EU list alone already requires you to overcome the technical hurdles mentioned (registration, download, format conversion). If a company operates internationally, several sanctions lists come together, and list management becomes a challenge in its own right.

• Matching (comparison and hit review): Once the list is in the system, the real art begins: matching it against your own data. This is where the problems described earlier become clearly visible. Since names can vary (typos, transliteration, aliases), the matching algorithms have to be tolerant, which inevitably produces false positives, i.e., supposed hits that turn out to be false alarms. A completely uninvolved customer may be flagged merely because of a similar name and then has to be reviewed manually. Large financial institutions report thousands of alerts a day, the vast majority of which are false alarms. Reviewing them costs an enormous amount of time and staff resources. On top of that, if information is missing from the list (e.g., no date of birth), a compliance officer often cannot decide right away whether a hit really refers to the listed person or just to someone with the same name. Such unclear matches have to be researched internally or even clarified with the authorities. In the worst case, there is a risk of overlooking a genuine hit (a false negative) among all the false alarms, which can have serious consequences. Accordingly, a great deal of effort is being invested in better matching methods (e.g., AI-powered name-matching algorithms) to stem the flood of false positives.

• Reporting and follow-up processes: If a hit is found during screening, it often has to be reported to the authorities. Banks, for example, are required to report a so-called suspected sanctions breach and, where applicable, freeze assets. This requires legally sound documentation: you have to state exactly which list entry led to the hit and which measures were taken. Because of the complexity of the lists, however, it is not always clear how to reference the correct entry, especially when data has been matched across different list sources. Companies also have to define internal processes for handling hits (contact the customer? terminate contracts? inform the authorities?). The EU does provide best practices for this, but practical implementation is up to the company. Another problem: in addition to sanctions against named persons, there are sectoral sanctions (e.g., embargoes on certain goods or services to Russia or Iran). These do not exist as lists of names but in legal texts. Compliance teams therefore also have to check in parallel whether, for example, an export transaction is prohibited under such rules, which further increases complexity. Keeping track of all the different sanctions provisions requires training, up-to-date information and often legal advice. For small and medium-sized companies without large compliance departments, this is an enormous challenge.

Practical example: A fictitious example shows how serious gaps in sanctions screening can be: a German company signs a multimillion-euro contract with a new supplier. Shortly after the first payment, it turns out that this supplier was added to a sanctions list shortly before, and all of its accounts have been frozen. The German company's money is now stuck, and it faces legal consequences for having inadvertently violated sanctions law. Thorough screening before signing the contract would have prevented this debacle. This example underlines how important efficient and up-to-date sanctions list screening is, and why any improvement to the underlying data can make a big difference.

After all this, it becomes clear that data formats, multilingualism, unclear matches and technical hurdles are not merely theoretical problems; they directly affect the workload and the risk in day-to-day compliance work. Many companies therefore want a simpler way to handle sanctions lists, without sacrificing currency or completeness.

handelsregister.ai's open-source offering: EU sanctions lists made easy

Against this background, the new open-source offering from handelsregister.ai is particularly interesting. At handelsregister.ai/open-data/eu-sanctions, a complete version of the EU sanctions lists is provided as open, machine-readable datasets. The offering aims to solve exactly the complexity problems described above, through a simplified approach that nonetheless contains all the necessary information. Let's take a detailed look at what handelsregister.ai offers here and what benefits it brings.

Simplified data format and access

One of the main problems with the official lists is their unwieldy data formats. This is exactly where handelsregister.ai comes in: the EU sanctions data is offered for download in machine-readable form, in the common formats CSV, JSON and XLSX. This means you can obtain the entire list as an Excel spreadsheet or as a structured JSON file, for example, formats that can be read and processed without specialized software. This eliminates the tedious step of combing through PDF documents or parsing complex XML structures. The data is ready for direct integration into your own systems, whether a database, an Excel sheet or a screening tool.

In addition, the datasets on handelsregister.ai are updated regularly. In May 2025, the persons dataset comprised around 4,850 entries and the organizations dataset around 3,200 entries, and both were kept fully up to date at that time. Updates are made promptly, so users can always work with the current sanctions situation. The tedious task of incorporating the changes yourself after every update in the EU Official Journal is taken off your hands.

Another plus: the registration hurdle is minimal. While obtaining the data directly through EU portals often requires a user account, a simple sign-up on the website is enough here to access the downloads. The openness of the offering is also reflected in its licensing: handelsregister.ai's sanctions list data is published under the Creative Commons Attribution 4.0 License (CC BY 4.0), so it may be freely used and redistributed (with attribution). This open-source license guarantees transparency and reusability: anyone can use, check and, if necessary, improve the data. Of particular interest to developers: there is GitHub access, i.e., an integration through which the datasets can be obtained. This lets you pull the latest version directly from the repository via a script, for example, enabling seamless integration into automated workflows.

Clear structure for better usability and matching

handelsregister.ai promises a simplified but complete data representation. In concrete terms, this means that all relevant information from the EU lists is included, but in a clear, structured form. The data is split into two tables, persons and organizations, which in itself is a sensible separation. Each table has clearly defined columns/fields that are filled in consistently. An excerpt from the field list shows what information is recorded for each entry:

• Source (source): Origin of the list entry, here always "EU".
• Source ID (source_id): The unique ID of the entry in the EU database (this lets you reference the original, for example).
• Reference (reference): An identifier or number under which the person/organization is listed in the EU documents.
• Type (subject_type): Indicates whether the entry is a person (P) or an entity (E).
• Name (primary_name): The main name of the person or company, in a uniform format (for persons: last name, first name).
• Aliases (aliases): Any alternative spellings, aliases or cover names, listed in one field.
• Designation date (designation_date): The date on which the sanction took effect.
• Program (program): The code of the sanctions program to which the entry is assigned (e.g., PRK for North Korea, TAQA for the terrorist list).
• Date of birth (birth_date): (for persons) the date of birth, if known.
• Nationality/country (nationality, or address_country for organizations): The person's nationality or the organization's country of domicile.
• (And further fields depending on the category, e.g., classification type for organizations.)

This clear tabular structure solves several problems at once. First, all entries now have a uniform structure, which makes further processing much easier. A matching algorithm can specifically use the "primary_name" field, knowing that it always contains the central name, and separately the "aliases" field with further variants that can also be matched against. Compared with an unstructured text list, this reduces the risk of overlooking something or making a wrong match. Second, the data has already been cleaned and normalized: e.g., consistent spelling of country names (in English), a uniform date format YYYY-MM-DD, and so on. This reduces technical sources of error and ensures that, for example, a German user and a French user have the same machine-readable content, without multilingualism in the dataset itself causing confusion. handelsregister.ai effectively delivers the essence of the EU list in a clear form: no substantive information is lost, but everything superfluous or complicating (such as different languages or unstructured free text) has been left out.

For matching, this means a considerable improvement: by separating the primary name from aliases, a screening system can match more precisely without creating duplicates. The separation between persons and companies also helps, because you can apply different matching strategies to different categories (for persons, also taking the date of birth into account; for companies, assessing the similarity of company names). The ID numbers and references also make it possible to look up the original source directly in the event of a hit, which makes verification (due diligence) easier. Overall, this dataset makes sanctions screening faster and more precise, because the input data is more reliable. The result is fewer false alarms and less manual rework.

Benefits for companies, authorities and developers

The complete open-source publication of the EU sanctions list by handelsregister.ai brings a number of benefits for different target groups:

• Transparency and trust: Because the data is openly accessible, all users can satisfy themselves that it is complete and correct. Any errors would quickly be noticed and could be discussed or fixed. This transparency builds trust, unlike some proprietary databases where it remains unclear how current or accurate they are. Authorities could use the open data, for example, to supplement their own sanctions registers or to get an overview of the sanctions landscape without first having to convert internal formats.

• Simpler compliance for companies: Companies that don't want to buy expensive compliance data feeds get a free alternative here that covers most of their needs. The data can be redistributed internally and used as often as needed, since the license is very open. Smaller companies or associations that have to carry out sanctions screening in particular can work with the CSV/XLSX dataset right away, for example by running their customer database against it. For ad hoc research (e.g., "Is person X on the EU list?"), a quick search through the table is enough, instead of a cumbersome search on the EU website.

• Integration into IT systems: For IT teams and developers, the offering provides ideal interfaces. Using the JSON dataset or the GitHub repo, you can integrate the sanctions list directly into your own applications. One option would be to fetch the dataset regularly via a script and load it into your company's compliance system, entirely without manual intervention. Since the data is structured and standardized, connecting it to KYC tools (Know Your Customer) or ERP systems is straightforward. Developers can also follow the version history on GitHub, i.e., see exactly when which entries were added or changed. This can be helpful for historical comparisons or for checking whether you have missed an update. The open nature also allows third parties to develop additional tools, such as filters, visualizations or API access, which ultimately benefits the entire community.

• Time and cost efficiency: By using the prepared open-data lists, organizations save time on list maintenance and money that would otherwise be spent on commercial list providers or external compliance services. Of course, the offering does not replace due diligence obligations: the responsibility for actually using the data and interpreting the results correctly remains with the user. But it ensures that the foundation (the list data) is no longer a bottleneck. A compliance team can then focus its resources more on analysis and risk management instead of on data procurement and formatting.

In summary, handelsregister.ai's open-data offering solves many of the practical problems mentioned at the beginning: the EU sanctions list becomes more accessible, easier to understand and technically easier to integrate. Companies and authorities get a tool that can make their work considerably easier, without license fees or lack of transparency.

Conclusion: mastering complexity through open data

EU sanctions lists remain a complex but crucial instrument in economic life. Their content, from sanctioned oligarchs to groups suspected of terrorism, directly affects whom we may do business with. But as we have seen, the official lists are difficult to handle in practice because of their data formats, multilingualism and constant change. Compliance teams face the challenge of preventing prohibited transactions from slipping through despite confusing data, while keeping the workload under control.

Initiatives such as handelsregister.ai's open-source offering point the way forward: through openness and standardization, complex content can be prepared in a user-friendly way without losing substance. The simplified, downloadable EU sanctions list offers everyone interested, from small businesses to supervisory authorities, a common denominator they can refer to. This considerably improves the options for screening and matching, and increases the likelihood that genuine hits are detected and false alarms are reduced.

For a general audience, especially in business, IT, compliance and public administration, this means: you have to take the complexity of the sanctions lists seriously, but you are not helpless in the face of it. With the right data sources and tools, the challenge can be met. In this way, the EU sanctions lists turn from a hard-to-access set of rules into a transparent, manageable tool that can fulfill its purpose, namely promoting security and the rule of law, all the more effectively.

Sources: This overview is based on current official EU publications, specialist articles and expert assessments.

Related guides

• Due Diligence with German Commercial Register Data: How to Systematically Vet a Target Company – Before You Invest, Acquire, or Partner
• Monitor German company changes with webhooks and the Signals API