An international NGO distributes food aid in a region subject to comprehensive EU sanctions. Its supply chain runs through a local logistics firm whose ultimate beneficial owner appears on the EU Consolidated List. The NGO's legal team wants to know whether the transaction is prohibited, which authority to approach, and what documentation will satisfy the competent authority. As of June 2026, the answer turns on a layered set of authorisations and derogations that differ by regime and by the specific sanctions regulation in play.
Humanitarian and NGO authorisations under EU rules are derogations from the prohibitions contained in the relevant Council regulations. They permit otherwise prohibited transactions – transfers of funds, provision of services, release of frozen assets – where the purpose is to deliver humanitarian assistance or meet basic human needs. The authorisation is granted by the competent authority of the Member State in which the applicant is established, subject to conditions set in the applicable Council regulation. Strict documentation and reporting obligations attach to every authorisation granted.
This briefing sets out which authority administers the regime, what the prohibitions cover, how the authorisation procedure works in practice, where it diverges from comparable regimes – including OFAC and SECO – and what obligations arise once an authorisation is in hand.
Who governs humanitarian and NGO authorisations under EU sanctions?
Authority is divided between the Council of the EU, which legislates the regime, and the national competent authorities (NCAs) of each Member State, which administer authorisations on a case-by-case basis. The European Commission publishes guidance, but it does not grant authorisations itself. That means an NGO established in Germany applies to the relevant German NCA; one established in France applies to the French authority. There is no single EU-level licensing window.
The legal basis for each regime is the relevant Council Regulation, made under Article 215 of the Treaty on the Functioning of the European Union, accompanied by a Council Decision under the Common Foreign and Security Policy. The humanitarian derogations are written directly into those regulations. Their scope, the conditions attached, and the documentation requirements vary by thematic programme – so an organisation operating across multiple country contexts may find itself engaging with more than one regulatory text at the same time.
In our cross-border practice, organisations often underestimate how much the NCA varies in its procedural expectations. One Member State's competent authority may issue guidance templates; another may operate on a correspondence basis with no published form. That inconsistency is a practical reality counsel must map before the first filing.
What does EU sanctions law prohibit – and where do humanitarian derogations fit?
The core prohibitions in EU Council regulations cover making funds or economic resources available to designated persons or entities, dealing with assets that are frozen, and providing financial services, technical assistance, or other services that would benefit listed parties. These prohibitions apply to any person or entity within EU territory, to EU nationals and companies wherever located, and to transactions cleared in euros.
Humanitarian derogations sit as carved-out permissions within this structure. They typically permit the release of frozen funds or the conduct of otherwise prohibited transactions where the purpose is to meet basic human needs – food, medicine, shelter, healthcare – or to deliver humanitarian assistance through organisations acting in accordance with the principles of international humanitarian law. The derogation is not automatic. It must be applied for, it is granted subject to conditions, and it does not extend beyond the scope expressly stated in the authorisation.
What the derogation does not do is equally important. It does not suspend the prohibition on dealing with listed persons in their personal capacity beyond what the authorisation expressly covers. It does not protect associated commercial transactions – freight, insurance, banking fees – unless those are separately within scope. And it does not create a general licence: each authorisation relates to a defined activity, a defined counterparty structure, and a defined geography. Have you checked that every element of your proposed activity falls within the four corners of the authorisation you hold?
How does the authorisation procedure work in practice?
The procedure begins with an assessment of which Council regulation governs the relevant country context, followed by identification of the specific humanitarian derogation provision within that text. Not all EU sanctions regulations contain the same derogation language; some are more prescriptive than others about the conditions that must be satisfied.
The applicant then submits a request to the relevant NCA. In our experience, a well-constructed application will include at minimum: a clear description of the humanitarian activity, the parties involved in the supply chain, the nexus to the designated party or frozen asset, the funds or resources sought to be released or transacted, the beneficiary population, and the monitoring and reporting arrangements in place. NCAs increasingly expect evidence that the applicant operates a credible internal compliance programme – not merely a statement of intent.
Processing timelines are not uniform. They depend on the complexity of the application, the regime in question, and the capacity of the relevant NCA. Applicants should plan for the process to take several weeks, and in complex cases longer. Interim operations during the review period carry legal risk unless a separate temporary permission exists.
Once granted, an authorisation typically specifies the permitted transaction, the permitted parties, a validity period, and a set of reporting conditions. Breach of those conditions – including using the authorisation for activity that goes beyond its terms – does not merely invalidate the authorisation. It may give rise to a separate liability for breach of the underlying sanctions regulation.
How does the EU humanitarian authorisation regime compare with OFAC and SECO?
The EU regime distributes administration across 27 NCAs; OFAC operates as a single federal licensing authority for US sanctions purposes. That difference has a direct practical effect. An EU-based organisation conducting activity that also touches US-dollar clearing or involves US-person counterparties must assess both regimes independently – and an OFAC specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) does not substitute for an EU NCA authorisation, nor vice versa.
Under OFAC, a separate general humanitarian exemption applies to certain categories of personal remittances and basic services in some programmes, but its scope is programme-specific and has changed over time. Organisations should verify the current OFAC position before assuming that an activity permitted under an EU authorisation is equally permitted under US sanctions – the perimeter of each regime is drawn differently. Our analysis of the comparable OFAC position is set out in our briefing on humanitarian authorisations under OFAC.
The Swiss regime, administered by SECO (the State Secretariat for Economic Affairs), similarly provides for humanitarian derogations in its autonomous sanctions ordinances. Switzerland's approach to the ownership and control test and to the documentary requirements for humanitarian authorisations differs in certain respects from the EU position. For organisations operating across the EU/Switzerland corridor, those differences can produce conflicting compliance obligations. A separate analysis is available in our briefing on humanitarian authorisations under SECO.
Cross-border programme coordinators also need to consider the UK regime. Since the UK implemented its own autonomous sanctions regime under the Sanctions and Anti-Money Laundering Act (SAMLA), OFSI administers UK humanitarian licensing independently of the EU. A transaction that requires EU NCA authorisation may equally require an OFSI licence – and the two authorisations do not automatically align in scope or timing.
What ongoing obligations attach to an EU humanitarian authorisation?
Holding an authorisation creates a continuing compliance obligation, not a one-time permission. The competent authority that granted the authorisation typically requires periodic reporting – which may include financial reporting on funds disbursed, evidence of compliance with the stated purpose, and notification of any material change in the counterparty structure or the operational arrangements covered by the authorisation.
Record-keeping obligations run alongside the reporting requirement. The relevant Council regulations, and the NCA conditions attached to the authorisation, will specify the period for which records must be retained and the form in which they must be maintained. In practice, organisations should expect to retain documentation – including banking records, delivery confirmations, and beneficiary data – for at least as long as the statute of limitations applicable to sanctions enforcement in the relevant Member State.
Where a material change occurs – a change in the identity of a counterparty, a change in the destination of goods or funds, a change in the structure of the humanitarian programme – the holder must consider whether the existing authorisation continues to cover the revised activity. Operating outside the terms of an authorisation is not a technical irregularity; it is a potential sanctions violation. Notification to the NCA, and in some cases an amendment application, is the correct course.
There is also an obligation to report suspicions. EU sanctions regulations and the relevant AML framework impose an obligation to report to the competent authority where a person holds or controls funds belonging to a designated person, or where a transaction is suspected to involve a designated party. An NGO that discovers, after the fact, that a counterparty is listed must take immediate action – including notifying the relevant NCA and freezing any assets under its control that may be attributable to the listed party.
What are the principal risk flags for NGOs and humanitarian organisations?
The most common risk in our experience is scope creep: an authorisation is granted for a defined activity, and the programme subsequently expands – new delivery routes, new local partners, additional categories of goods or services – without a corresponding amendment to the authorisation. Each extension of programme scope should trigger a fresh legal assessment.
A second risk flag is the ownership and control test (the EU and UK standard for assessing whether a non-listed entity is caught through a listed person's ownership or control over it). EU Council regulations apply an ownership threshold and a control test. An NGO's local implementing partner may not be listed, but if a listed person holds sufficient ownership or exercises decisive influence, the partner may be treated as a listed entity for the purposes of the prohibition. Screening that looks only at the immediate contractual counterparty without tracing the ownership chain is not adequate.
Third: banking access. Correspondent banks and payment processors apply their own internal compliance controls, which are frequently more conservative than the regulatory floor. An NGO holding a valid EU NCA authorisation may still find that its banking partner declines to process the relevant transaction – a phenomenon sometimes called de-risking (where a financial institution exits or restricts a relationship to limit its own sanctions exposure). The authorisation does not bind private actors. Addressing this requires proactive engagement with banking partners before the transaction, not after a payment is rejected.
Fourth: multi-regime exposure. An EU NCA authorisation does not resolve exposure under US, UK, Swiss, or any other sanctions regime. An organisation that sources equipment from a US supplier, clears funds in US dollars, or involves a US-person counterpart anywhere in its structure must separately assess OFAC compliance. Where the organisation has UK-connected counterparties or funding flows, the OFSI regime applies in parallel. No single authorisation covers all of this.
A common misconception worth addressing directly: some organisations believe that a humanitarian mandate is itself a defence to a sanctions enforcement action – that acting in good faith to deliver aid insulates the organisation from liability. This is incorrect as a legal matter. Good faith may be relevant to the assessment of a penalty, but it does not negate a breach. The EU enforcement regime holds organisations to the standard of what they knew or should have known, and a credible compliance programme is the primary mitigant.
When should an NGO or humanitarian organisation involve external sanctions counsel?
Counsel should be involved before the first filing, not after the first problem. The earlier in the programme design phase that counsel reviews the counterparty structure, the funding flows, and the goods or services involved, the more options remain open. Post-facto analysis of a live programme running on an underpowered authorisation – or no authorisation at all – is a more constrained and more expensive exercise.
Specific triggers for early instruction include: any counterparty – whether a logistics firm, a bank, a local partner, or a beneficiary organisation – that appears on any EU Consolidated List; any programme operating in a jurisdiction subject to comprehensive EU sanctions; any funding stream that passes through a bank or a financial intermediary with its own independent sanctions-compliance obligations; and any activity that could be characterised as providing a service of value to a designated entity, even indirectly.
If a transaction has already been flagged by a correspondent bank, or if an NCA has raised a question about an existing authorisation, immediate legal review is warranted. Timelines for response can be short. Early advice on the options – including whether a voluntary self-disclosure (VSD, a proactive report of a potential breach to the competent authority before enforcement action) is appropriate – preserves choices that narrow with delay.
In a recent matter, a development-sector organisation conducting a multi-country food-security programme discovered that a logistics sub-contractor had been designated under the applicable Council regulation midway through the programme cycle. We assessed the scope of the existing authorisation, identified the transactions affected, advised on the notification obligation to the relevant NCA, and prepared a supplementary authorisation application to cover the programme's remaining phase. The matter was resolved without enforcement action. No outcome can be guaranteed in any such matter, but early and structured engagement with the competent authority materially affects the trajectory.
Related practices
- Frozen account management under BIS/EAR – managing frozen assets and access requests under US export-control rules
- Humanitarian authorisations under OFAC – scope, procedure, and obligations under the US sanctions regime
- Humanitarian authorisations under SECO – Switzerland's autonomous sanctions derogation regime for humanitarian actors
The position above covers the standard case. Your facts – the counterparty structure, the country context, the goods or services involved, and the regimes in play – change the analysis materially. To discuss an authorisation application or a compliance review, contact Calder & Vance at info@caldervance.com.