An NGO preparing to deliver medical supplies into a sanctions-affected territory faces a concrete legal question before any shipment moves: does the planned activity require an authorisation from the relevant EU member state authority, and if so, how is that authorisation obtained? The answer shapes whether a well-intentioned programme becomes a compliance crisis or a funded, lawful operation.
EU sanctions regimes contain dedicated humanitarian derogations – standing authorisations and, in some cases, case-by-case licensing routes – that permit otherwise prohibited transactions where the activity serves a genuine humanitarian or civil-society purpose. As of June 2026, the operative basis is the relevant Council Regulation for each programme, supplemented by member state competent-authority guidance. Timelines, documentation requirements, and the scope of permitted activity differ materially between programmes.
This guide walks through the EU authorisation process step by step: from identifying the correct derogation, through building the application, to managing the authorisation once granted – and it maps the key differences from the OFAC and UK OFSI humanitarian licensing routes.
Step 1: Identify the applicable derogation in the relevant Council Regulation
The first step is confirming which Council Regulation governs the affected territory or programme, and whether a standing humanitarian derogation is already embedded in it. EU sanctions are not a single regime. Each programme – whether addressing a particular country situation, a thematic list, or an arms embargo – rests on its own Council Regulation and implementing acts. Some contain explicit humanitarian carve-outs that authorise defined categories of activity without a separate application. Others require a case-by-case specific authorisation from the competent authority of the member state where the applicant is established.
In our cross-border practice, the most common early error is treating all EU sanctions programmes as interchangeable. An organisation that successfully relied on a standing derogation under one regulation may face a licensing requirement under a different one – even for activity that looks identical in operational terms. Before any contracting or disbursement, counsel should confirm: which regulation applies, whether a general or standing derogation covers the activity, and whether any member state has issued additional implementing guidance that restricts or conditions the derogation.
The practical starting point is the EU Consolidated List and the text of the relevant Council Regulation, both published on EUR-Lex. Competent authorities in several member states also publish summary guidance. Where programmes overlap – a counterparty appears on both a thematic and a country-specific list, for instance – both regulations must be checked in parallel.
Step 2: Determine your competent authority and establish eligibility
Once the applicable regulation is identified, the applicant must determine which member state competent authority has jurisdiction to grant the authorisation. EU sanctions are administered at member state level: there is no single EU licensing office. The competent authority is typically the authority of the member state in which the applicant is established, holds its relevant assets, or through which the funds or goods will move.
Eligibility conditions in humanitarian derogations generally require the applicant to demonstrate three things: the activity is genuinely humanitarian or civil-society in character; the funds, goods, or services will not flow to a designated person or entity beyond what the derogation permits; and adequate controls are in place to ensure the derogation is not used as a conduit. The ownership and control analysis (the EU test for whether a non-listed entity is caught through a listed person's 50 percent or more ownership or effective control) applies with equal force here. An NGO that receives funding from, or contracts with, an entity subject to the ownership and control test cannot assume a humanitarian derogation automatically resolves the exposure.
We regularly advise organisations on the initial eligibility screening before they commit resources to a full application. Identifying a fatal eligibility obstacle at this stage – a counterparty that is itself a listed entity, a funding source with a problematic ownership chain, or a geographic scope that falls outside the derogation's permitted territories – saves significant time and cost.
The position above covers the standard case. Your facts – the counterparty, the programme jurisdiction, the funding structure, and the specific regulation in play – change the analysis materially. For an initial assessment of your eligibility, contact Calder & Vance at info@caldervance.com.
Step 3: Assemble the application package
A well-constructed application package is the single most controllable factor in securing a timely authorisation. EU competent authorities expect documentary evidence of each eligibility element, not bare assertions. The core package for a humanitarian authorisation typically includes: a description of the humanitarian activity and its geographic scope; the legal basis for the derogation relied upon; an explanation of why the activity cannot proceed without engaging the sanctions prohibition; identification of all counterparties, including funding sources, local implementing partners, and recipients; a representation that no funds or goods will benefit a designated person beyond what the derogation permits; and the applicant's internal controls for monitoring and reporting the authorised activity.
Several member state authorities also require supporting material such as project documentation, evidence of registration with a relevant international body, financial statements, and a map of the supply chain. Requirements differ by authority. An application prepared to the standard of one member state competent authority may be deficient before another. When an organisation operates across multiple member states – or when the relevant assets, bank accounts, and shipping routes are held in different jurisdictions – the application may need to be filed in more than one country simultaneously.
Completeness at submission is critical. Competent authorities routinely issue requests for further information when initial applications are incomplete, extending the overall timeline. In our experience, applications that arrive with a clear narrative, organised documentary exhibits, and an explicit mapping from each regulatory requirement to the supporting evidence reach decision faster than those that require extensive follow-up rounds.
Step 4: Submit, manage the review, and respond to queries
After submission, the competent authority reviews the application against the relevant regulation and its own administrative practice. Review timelines vary by member state and by the complexity of the activity described. They are not fixed by EU-level rule in the way that some national licensing systems are. A politically sensitive programme or a novel operational model can extend review materially. Organisations should plan conservatively and build lead time into project schedules.
Most competent authorities will issue at least one round of questions or supplementary information requests. These requests must be treated as substantive legal engagements, not administrative formalities. A poorly framed answer can create new concerns or narrow the scope of the authorisation ultimately granted. Counsel's involvement at this stage – reviewing proposed responses before submission – is often where the most significant risk-mitigation work happens.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the specific position.
Step 5: Receive and interpret the authorisation – and understand its limits
When the competent authority grants the authorisation, the document itself must be read with care. An EU humanitarian authorisation is not a blank permission to conduct humanitarian activities. It is a specific instrument that permits a defined category of activity, within a defined geographic and operational scope, for a defined period, subject to conditions. Operating outside those parameters – even inadvertently – reinstates the underlying prohibition.
Conditions commonly attached to EU humanitarian authorisations include reporting obligations, periodic renewal requirements, restrictions on which counterparties the authorisation covers, and requirements to notify the competent authority of material changes to the programme. Some authorisations are granted for a fixed term and require re-application. Others are open-ended but subject to revocation if conditions change.
Does the authorisation cover all of the organisation's planned implementing partners, or only those named in the application? Does it extend to the financing leg of the transaction, or only to the delivery of goods? These are the interpretive questions that generate compliance incidents after grant. In our experience, an early internal briefing – circulating a plain-language summary of what the authorisation permits and what it does not – materially reduces the rate of inadvertent breach.
Step 6: Maintain compliance and records throughout the programme lifecycle
Holding an authorisation does not end the compliance obligation. EU sanctions rules include record-keeping and reporting duties that persist throughout the authorised period. The standard across EU programmes is to maintain documentation for at least five years from the date of the transaction or activity, though individual programmes may specify a longer period. Records should include transaction-level detail: amounts, dates, counterparties, the authorisation reference, and evidence that each transaction fell within the authorised scope.
Competent authorities may conduct reviews or audits of authorised organisations. Adequate records are the primary defence in any such review. An organisation that conducted lawful activity but cannot demonstrate that fact from its files is, for practical purposes, in the same position as one that conducted unlawful activity. We advise clients to design a records architecture before the programme begins, not after a compliance review is announced.
Ongoing ownership and control monitoring of implementing partners is also required throughout the programme. A local partner whose ownership structure changes mid-programme – with a designated person acquiring a significant stake, for instance – may bring the whole operation back within the prohibition. Periodic re-screening of counterparties against the EU Consolidated List, and a clear escalation path when a screen produces a potential match, should be embedded in the programme's governance structure.
How does the EU humanitarian authorisation route compare with OFAC and OFSI?
The EU humanitarian licensing route differs from the OFAC and OFSI processes in three important respects: the decentralised administrative structure, the governing legal test, and the extraterritorial reach. Understanding those differences is essential for any organisation that operates across multiple jurisdictions.
Under OFAC, humanitarian activity in certain contexts may proceed under a general licence (a standing authorisation that permits a defined category of transactions without a separate application), or it may require a specific licence (a case-by-case authorisation from OFAC directly). OFAC is a centralised licensing authority: there is one office, one application system, and one set of published processing guidelines. The EU has no equivalent central office. Each member state competent authority operates its own procedures, and an organisation with operations or assets in France, Germany, and the Netherlands may need three separate applications. See our companion guide on the OFAC humanitarian authorisation process for a detailed comparison.
OFSI in the United Kingdom administers humanitarian licensing under the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations. Like the EU, OFSI requires a specific licence where no general licence covers the activity. OFSI has moved to publishing more general licences for humanitarian activity in recent years, reducing the volume of specific applications required. The EU has moved in the same direction, but the pace of publication and the scope of standing derogations varies considerably by programme.
The ownership and control test also diverges. Under OFAC, the 50 percent rule is the operative test: ownership of 50 percent or more by one or more blocked persons triggers the prohibition regardless of control. Under EU rules and UK OFSI rules, a control test applies in addition to the ownership threshold. An entity can be caught even where no single blocked person holds 50 percent, if a blocked person exercises effective control. For an NGO with complex funding structures or local partners in affected territories, this distinction is material – and the stricter prohibition governs where two regimes apply simultaneously.
For organisations also subject to Japanese sanctions requirements, our guide on the Japanese humanitarian authorisation process sets out the separate requirements under Japan's applicable country regime.
Risk flags and when to involve counsel
Several risk patterns recur across EU humanitarian authorisation matters. Identifying them early is the difference between a programme that proceeds on schedule and one that stalls at the competent authority.
De-risking (a financial institution exiting a relationship to avoid sanctions exposure) by correspondent banks is one of the most operationally disruptive risks in humanitarian programming. Even a valid EU humanitarian authorisation does not compel a bank to process the relevant transactions. Banks applying their own risk appetite may decline to handle payments linked to sanctions-affected territories regardless of the authorisation's existence. Addressing this risk requires early engagement with the payment chain – identifying the banks involved, confirming whether they will rely on the authorisation, and, if not, identifying alternative routing.
A second risk flag is the multi-programme exposure. An organisation operating in a territory subject to both a country-specific Council Regulation and a thematic arms embargo, or a counterparty appearing on both the EU Consolidated List and the UN Consolidated List, faces layered obligations. The humanitarian derogation under one programme does not automatically extend to the other. Each programme must be analysed separately, and where the UN Consolidated List is engaged, member state competent authority guidance must be read alongside the relevant UN Security Council resolution and the Consolidated List itself.
A third flag is the use of sub-grantees or implementing partners not named in the original application. Programme realities often require adding partners mid-implementation. Adding a partner after the authorisation has been granted may require an amendment application or a new authorisation. Operating with an unnamed partner before that application is resolved reinstates the underlying exposure.
A common objection we encounter is that "the humanitarian exemption covers everything we do." It does not. The exemption is specific in scope, specific in the counterparties it covers, and specific in the territory and activity it permits. Any expansion beyond those parameters requires fresh analysis and, where necessary, a fresh authorisation.
Related practices
- Frozen account management under BIS/EAR – managing blocked accounts and export licence requirements under US rules
- Humanitarian authorisation under OFAC – step-by-step guide to the US licensing process for NGO and humanitarian programmes