Which Sanctions Lists Does MiCA Require? EU, UN, OFAC, UK

Short answer: MiCA itself does not specify a sanctions list. The operative EU screening rule for transfers comes from EBA GL/2024/15 under Regulation (EU) 2023/1113: CASPs must screen against applicable Union and national restrictive measures. For EU financial sanctions, the European Commission consolidated financial sanctions data is the practical official source. MiCA and EBA do not universally require every EU CASP to screen an EU+UN+OFAC+UK bundle.

Why does sanctions list coverage matter?

When small CASPs set up sanctions screening, the first question is often "which lists does the tool cover?" That question is too blunt. The regulatory question is which restrictive measures apply to the firm and transfer, and whether the screening process can demonstrate that those measures were implemented.

EBA GL/2024/15 expects policies, procedures, list management, customer and transfer screening, alert handling, documentation of decisions, system testing, and oversight of outsourced providers. A tool can cover many lists and still be weak if those controls are missing.

The confusion is compounded because MiCA (Regulation (EU) 2023/1114) does not enumerate sanctions lists. The sanctions-screening control requirement for crypto-asset transfers sits in Regulation (EU) 2023/1113 and the EBA guidelines issued under it.

---

How does the regulatory chain flow from MiCA to specific lists?

Understanding which lists are required means following the regulatory chain from the framework regulation down to the operational guidance.

1. MiCA — the framework

Regulation (EU) 2023/1114 on Markets in Crypto-Assets created the CASP authorisation and operating framework. It does not contain a table of sanctions lists. Do not cite MiCA Article 72 for sanctions-list coverage: Article 72 concerns conflicts of interest. The specific screening controls for transfers are in the Transfer of Funds Regulation and EBA GL/2024/15.

2. EBA GL/2024/15 — the operative requirement

EBA Guidelines on internal policies, procedures, and controls to ensure the implementation of Union and national restrictive measures under Regulation (EU) 2023/1113 (GL/2024/15) apply from December 30, 2025. They are addressed to payment service providers and crypto-asset service providers performing transfers of funds or crypto-assets.

GL/2024/15 is explicit about the legal category, not a four-list vendor package: PSPs and CASPs must screen against applicable restrictive measures, including Union measures adopted under Article 29 TEU and Article 215 TFEU and, where relevant, national restrictive measures. The European Commission's consolidated financial sanctions data at sanctions.ec.europa.eu is the practical official source for EU financial-sanctions designations.

The guidelines also define procedural requirements: CASPs should screen crypto-asset transfers before making the crypto-assets available to the beneficiary, update their internal dataset immediately after a restrictive measure enters into force, is updated, or is lifted, and document alert decisions under their record-keeping policy.

3. National supervisors — additional expectations

National competent authorities can add supervisory expectations or point firms to national sanctions obligations. Cyprus is a useful example because CySEC Circular C685 applies to CASPs among other regulated entities, but it should not be read as an EU-wide MiCA rule.

C685 says CySEC's thematic inspections focused on legal requirements from UN Security Council resolutions and EU Council decisions and regulations, with relevant screening practices for US and UK sanctions lists also reviewed. It tells regulated entities to consider the guidance as a benchmark and implement best practices in a risk-based and proportionate manner.

---

What does each sanctions source contain — and why does it matter operationally?

The main sources are not duplicates of each other. Each belongs to a different legal regime, and the reason to screen it should be stated clearly.

EU Consolidated Financial Sanctions List

Published by the European Commission through the Financial Sanctions Files service, the EU consolidated financial sanctions data covers persons, groups, and entities subject to EU financial sanctions. The Commission describes the consolidated list as reflecting officially adopted texts published in the Official Journal and updated whenever necessary.

For an EU CASP, this is the core operational source for EU financial-sanctions screening. It does not remove the need to understand the underlying Council regulations, especially where sectoral measures, ownership and control rules, territorial restrictions, or service prohibitions require more than a name or wallet-address match.

Do not treat the EU Consolidated Financial Sanctions List as the whole sanctions control. EU Russia sectoral measures can prohibit transactions with categories of crypto providers or platforms even where no exact name-list match exists.

UN Consolidated List

Maintained by the UN Security Council, the UN Consolidated List covers individuals and entities subject to Security Council sanctions measures. EU law implements many UN measures through EU legal acts, and national law or supervisor guidance may also require direct UN-list screening.

Direct UN screening is therefore best framed as a national-law, supervisor, or risk-control question, not as a universal standalone MiCA/EBA list. It can be prudent where a firm wants to catch UN designations that have not yet been transposed into EU measures.

US OFAC SDN List

The OFAC Specially Designated Nationals list is maintained by the US Treasury Department. OFAC may include digital currency addresses on the SDN List, but OFAC also states that those digital-currency address listings are not likely to be exhaustive.

OFAC screening is not an EU MiCA/EBA requirement by itself. It may be legally required where there is a US nexus, commercially required by counterparties, or justified by the CASP's risk assessment. It does not substitute for screening applicable EU and national restrictive measures.

UK Sanctions List

As of January 28, 2026, the UK Sanctions List is the single source for current UK sanctions designations. The former OFSI Consolidated List of Asset Freeze Targets has closed and is no longer updated.

UK screening is a UK-law, UK-nexus, contractual, or risk question for an EU CASP. It is not a universal MiCA/EBA requirement, but it can be mandatory or commercially unavoidable for firms with UK customers, UK entities, UK banking exposure, or UK-regulated partners.

---

Where do third-party screening tools fit?

The official legal sources do not certify a particular free oracle, API, or vendor as sufficient. A third-party tool can be useful, but the CASP remains responsible for compliance with applicable restrictive measures even when screening or data enrichment is outsourced.

Under EBA GL/2024/15, a defensible setup should let the CASP demonstrate:

• which Union, national, and any third-country measures are in scope;
• how the screening dataset is updated when measures enter into force, change, or are lifted;
• which customer and transfer data fields are screened, including wallet addresses where available in official lists;
• the screening system's capabilities, limitations, calibration, and testing results;
• how potential matches are investigated, decided, documented, escalated, frozen, or reported;
• what controls govern any outsourced provider or vendor feed.

A binary "hit/no hit" result is therefore not enough on its own unless the surrounding process preserves the evidence your regulator will ask for.

---

What sanctions list coverage do the regulations require?

"Not an EU/MiCA list" does not mean "ignore it." It means the legal basis is different. A CASP may still need UN, OFAC, or UK screening because of national law, extraterritorial exposure, banking or issuer relationships, customer geography, contractual covenants, or its own restrictive-measures exposure assessment.

---

What is the timeline — when did these requirements take effect?

A common misunderstanding was that sanctions screening could wait until the end of the MiCA transition. That was incorrect before July 2026 and is now outdated.

EBA GL/2024/15 applies from December 30, 2025. The maximum MiCA Article 143 transitional period for existing CASPs ended on July 1, 2026, although Member States could choose shorter transitional periods. As of July 10, 2026, the EBA application date and the maximum MiCA transition date have both passed.

If a screening tool gives you only a binary result without evidence of list management, calibration, alert handling, and documented decisions, the issue is not solved by adding more list names. The EBA requirement is controls for applicable restrictive measures, backed by evidence.

---

What are the practical steps to meet the requirement?

Closing the gap starts with a legal inventory, not a vendor checklist. Identify the Union restrictive measures, national restrictive measures, and any third-country regimes that actually apply to your business.

A minimum viable EBA-aligned setup includes:

• An inventory of applicable Union and national restrictive measures, with official sources for each;
• an up-to-date EU financial-sanctions data source, such as the European Commission Financial Sanctions Files;
• a documented basis for any UN, OFAC, UK, or other third-country list coverage;
• screening of customers at onboarding and relevant trigger events;
• screening of crypto-asset transfers before making crypto-assets available to the beneficiary;
• screening of wallet addresses where available in official restrictive-measures lists;
• documented alert investigation, decision, escalation, freezing, and reporting procedures;
• documented system capabilities, limitations, calibration, testing, and vendor controls.

Treat list additions as documented decisions. Adding OFAC or the UK Sanctions List may be the right call, but the article should say why: US or UK nexus, partner requirements, national supervisor expectations, or risk appetite.

---

Bottom line

MiCA does not contain a universal sanctions-list checklist. EBA GL/2024/15 requires CASPs to maintain controls for applicable Union and national restrictive measures and to screen crypto-asset transfers before making crypto-assets available to the beneficiary.

For EU financial sanctions, the European Commission consolidated financial sanctions data is the practical official source. UN, OFAC, and UK screening can be necessary, but the legal basis is not "MiCA requires all four." The basis is national law, supervisory guidance, legal nexus, contractual commitments, or documented risk assessment.

As of July 10, 2026, the EBA application date and the maximum MiCA transitional period have both passed. The remaining compliance question is whether your process can show which measures applied, which data was screened, what the result was, and how alerts were handled.