Does Delisting End Syria's Digital Blocks?
Omar Albeik15 min readSyria was designated a state sponsor of terrorism on 29 December 1979. The World Wide Web did not exist yet; Tim Berners-Lee would not write his proposal for another nine years.
That is worth sitting with, because the designation has spent the last decade and a half being cited as a reason to keep Syrians off a thing that did not exist when it was written.
On 22 August 2026 that came to an end. On 8 July the President notified Congress of his decision to rescind the designation, which started the 45 days that U.S. law requires before a rescission can take effect. Congress could have blocked it with a joint resolution of disapproval and did not. The window closed on 22 August.
What remains is the final executive step: the Secretary of State signs the rescission and publishes it in the Federal Register. That is how it went with Sudan, where Congress was notified on 26 October 2020 and the rescission took effect on 14 December with the publication of Public Notice 11281. The step is administrative and expected within days, and this article is written on the understanding that it will be taken.
Syria was one of four countries carrying the label. Cuba, Iran and North Korea remain.
This is a real change, and it opens a real door. In July, while the outcome was still open, we published an explainer on how the removal works by Fadel Abdul Ghany, founder and president of the Syrian Network for Human Rights. This is the sequel.
It does not, on its own, open a single service.
We track one narrow thing: whether a person in Syria can open a website and use it. We have been measuring it since January, across 986 services. As of 22 August, 474 of them are still closed to someone in Damascus, for reasons that differ from one company to the next.
That gap is where our work starts.
If you are reading this from inside Syria, start here. Nothing switches on this week. The designation that ended never required any company to block you, so lifting it does not, by itself, restore a service. Access returns one company at a time, as each compliance team rereads rules that changed more than a year ago. Some will move within weeks. Many will move when someone asks them to, with evidence. That asking is something you can do, and this article ends with how.
Does the delisting unblock services in Syria? Five things people are getting wrong
"Sanctions on Syria were lifted in August 2026." They were lifted in 2025. Executive Order 14312 was signed on 30 June 2025 and terminated the comprehensive U.S. sanctions program effective 1 July, OFAC deleted the Syrian Sanctions Regulations from the Code of Federal Regulations that August, and Congress repealed the Caesar Act in December 2025. The terrorism designation was a separate matter running on its own legal track, which is exactly why the 2025 actions could not end it.
"Now the blocked services will come back." The designation never obliged any company to block a Syrian user. Not in any statute. It restricted U.S. foreign aid, defense exports and certain higher-grade technology licensing. A music app was never covered by it.
"Everything American is now allowed into Syria." Not yet. Syria remains in Country Group E:1 until the Commerce Department issues a rule removing it, remains listed under the arms-trafficking regulations at ITAR §126.1 until the State Department amends them, and targeted sanctions on Assad-era figures, Captagon traffickers and ISIS and al-Qaeda affiliates are untouched.
"Syria is off all the lists now." Syria remains on the Financial Action Task Force grey list, confirmed at the plenary of 19 June 2026, when Algeria and Namibia came off and Syria did not. That listing does more to obstruct a bank transfer today than the terrorism label did. The EU and UK also run their own regimes, which no U.S. decision touches.
"This is permanent." Largely. The FY2026 defense bill that repealed the Caesar Act also requires the President to certify to Congress every 180 days, for four years, on counterterrorism cooperation, foreign fighters, minority protection, restraint toward neighbors and several other conditions. There is no automatic snapback, only discretionary sanctions if conditions go unmet twice running. The relief is real, and it is reviewable.
The evidence: the label was not what was stopping you
Here is the part that comes from our own records rather than from anyone's analysis.
The legal authority to serve ordinary software and cloud services to Syria has existed since 2025. On 23 May 2025 OFAC issued General License 25. On 30 June, EO 14312 ended the sanctions program. Effective 2 September 2025, a Commerce Department rule created License Exception Syria Peace and Prosperity, codified at 15 CFR 740.5, which authorizes the export of all EAR99 items to Syria with no individual license. The overwhelming majority of commercial software and consumer cloud services are EAR99.
So if the law had been the barrier, the blocks should have started falling in autumn 2025.
They did not. Our register lists 986 services. As of 22 August 2026, 474 are fully blocked, 170 restricted, 118 limited, 223 accessible and one not yet tested. More than three quarters of the services Syrians told us they needed are still degraded or unavailable, almost a year after the last legal barrier came down.
The single most requested service on our platform is ChatGPT, with more than 3,400 votes. OpenAI has been contacted repeatedly, has acknowledged the requests, and points to its list of supported countries. It is still blocked. Behind it sit PayPal on about 2,700 votes, Google Gemini on about 2,000 and TikTok on about 1,670, all blocked.
Then look at how the successes actually happened. Thirty-nine services have reached a resolution. Thirty-five of them are fully accessible and four are working but still imperfect. A striking number were never unblocked by anyone in particular. Apple Music came back in July 2026 with no outreach from us at all. Brawlhalla, Crowdin and BOTIM restored access with no contact on record. Binance published a note titled "Binance Now Available to Syrian Residents" and simply dropped its regional restriction. AMBOSS wrote to a user to say access had been restored following its own compliance review.
That is the shape of the problem in one paragraph. When a company sits down and reads the current law, it usually concludes it can serve Syria. The blocks persist wherever nobody has sat down to read it.
What companies say when they say no
We have 24 services where a company explicitly refused. Their stated reasons sort into categories that respond very differently to the delisting, and only one of them is meaningfully helped by it.
Some cite sanctions that no longer exist. Udemy is the most requested of the services that have refused us, with 462 votes. It declined repeatedly through 2026, maintaining that sanctions remained in place months after they had been lifted. In one case it disabled a user's account after they asked about access from Syria.
Some cite U.S. export control. JetBrains told us in April 2026 that its export policy does not permit sales to Syria and had not changed. Its database tool DataGrip returns an HTTP 451, the status code reserved for content blocked for legal reasons, on every download path.
Some cite jurisdictions Washington does not control. Hack The Box pointed to EU and UK sanctions. Contabo, a German host, escalated our request to its legal department and came back reporting no change in policy.
Some cite operational capacity rather than law. Basecamp gave us the most candid answer we have had from anyone: 37signals told a volunteer in April 2026 that it has no way to screen individual users against U.S. sanctions lists, and will keep blocking Syria until a reliable method exists. That is an honest admission of a real problem, and it is a product problem rather than a legal one. No delisting fixes it.
Some were never about sanctions at all. Google Business Profile declined twice, in January and February 2026, on the ground that the service is "not launched" in Syria. That is a commercial decision, not a legal one. The consequence is that Syrian businesses cannot claim or edit their own listings, which leaves them effectively invisible on Google Maps.
And one company named something regulations do not cover. GitLab, on 173 votes, declined repeatedly, citing trade compliance and export control rules, and then added a further factor: considerations beyond regulations, including customer preferences. Geographic controls remain in place, and they remain in place partly because of what customers prefer. Removing a legal obstacle does not remove a preference, which is why this one is worth naming plainly rather than filing under compliance.
Add Back4App, which answered technical evidence of a blank page served to Syrian addresses by stating twice that its services were operating normally, and the categories of refusal are complete: sanctions that have already gone, current law, foreign law, missing tooling, commercial priorities, customer preference, and a disagreement about the facts.
One of those seven is improved by the delisting.
What the delisting legally changes: FAA §620A, AECA §40, ECRA §1754(c)
This is the detail behind everything above. It is the part most reporting gets wrong, and the part a compliance team will want to check.
The designation is not a sanctions program. It is a switch that activates provisions in three statutes.
Section 620A of the Foreign Assistance Act barred most U.S. assistance to the Syrian government, and obliged U.S. representatives at the IMF and World Bank to oppose loans to Syria. That is now lifted.
Section 40 of the Arms Export Control Act imposed an absolute prohibition on defense articles and services. Gone as a matter of the statute, though the implementing regulation at ITAR §126.1 has to be amended separately before anything changes in practice.
Section 1754(c) of the Export Control Reform Act triggered enhanced export licensing and congressional notification for certain licenses. This is the provision that touched technology, and it is why Syria sits in Country Group E:1. Delisting removes the legal predicate for that placement, but the Bureau of Industry and Security still has to issue a rule. When Sudan was delisted, that is precisely how it went, and the BIS rule followed the rescission by five weeks. Until BIS acts, the most consequential piece stays put: the minimum threshold of controlled U.S. content, known as de minimis, in goods manufactured outside the United States remains at 10 percent rather than rising to 25. That threshold decides whether a phone assembled in Vietnam or a server built in Taiwan can lawfully ship to Syria.
There is also one consequence running the other way. Under the terrorism exception to the Foreign Sovereign Immunities Act, U.S. victims of acts attributed to Syria during the designation period have six months from the rescission taking effect to file damages claims. Expect litigation headlines between now and late February 2027. It is a predictable artifact of the process rather than a sign that something has gone wrong.
Will banking and payments in Syria get easier now?
Yes, though not immediately. Finance is the one area where the label did heavy lifting, because its effect was reputational and travelled through risk committees rather than through statute. It made correspondent banking relationships hard to open and pinned Syria at the worst available country-risk rating inside every compliance department that scored it. Removing it lets institutions re-rate Syria, and several large U.S. banks had signalled they were waiting for exactly that.
Some of the movement started earlier. Syria's Central Bank authorized licensed banks and payment companies to work with international card networks on 4 May 2026. The first live Visa and Mastercard test transactions ran in Damascus on 9 May, after fifteen years of disconnection. QNB launched card acceptance. The stated target is to grow POS terminals from about 4,200 to 50,000 by the end of this year.
Our numbers show how uneven it still is. Of the five card network services we track, none is fully blocked. But of 39 money transfer services, 21 are blocked and only 3 are fully accessible. Of 24 payment processing services, 15 are blocked. Of 27 digital wallets, 14. Of 25 banking services, 10. Services can belong to more than one category, so these do not sum to a single figure.
The binding constraint here is no longer designation. It is the FATF grey listing, the weakness of correspondent relationships, and the plain fact that opening a country is an operational undertaking involving onboarding, settlement and fraud infrastructure. A remittance company can read the news and still take a year, for reasons that are entirely legitimate.
If you are waiting for money to move more easily, the sequence to watch is FATF grey list exit, then correspondent banking depth, then consumer products. The delisting helps the first indirectly, by making Syria a more normal counterparty. It delivers none of them on its own.
What happens next for Syria sanctions, and when
Weeks to a few months. The Federal Register notice formalising the rescission. A BIS rule moving Syria out of Country Group E:1 and lifting the de minimis threshold to 25 percent. A State Department amendment to ITAR §126.1. FSIA claims filed before the six-month window closes. A wave of law firm client alerts, worth reading closely for what they say has changed and what they say has not.
Six to eighteen months. The FATF assessment process advancing, with an on-site visit reported as likely in early 2027 and grey list exit some time after. Correspondent banking deepening slowly. The first large technology companies updating their country lists, now that the clearest reason not to has gone.
And the part with no scheduled fix. Blocks held in place by customer preference, by absent screening tooling, by market prioritization, or by a decision taken in 2011 that nobody has revisited. No regulatory event is coming for these. They come down when somebody asks, with evidence, and keeps asking.
That last category is most of our work, and it is the reason this article exists.
Three cases, from inside Syria
All three are from our own pages this year.
A Syrian medical student needs a two-minute online identity check to have his degree certified for practice abroad. The platform that runs the check does not serve Syria, so the two minutes become a border crossing, days in Amman and at least $260. A portal glitch voided his first attempt and pushed his bill toward $800.
Someone signs up for Toptal and has the account suspended the moment they select Syrian nationality. Nothing about them changed. Only the disclosure did.
A computer science student goes home for ten days after thirteen years away, to test whether he could build a career there. He reports that the hardest obstacle was not electricity. It was the blocked services.
None of those three was resolved by anything that happened in Washington this month. Each of them is resolved by one company changing one setting.
What you can do
If you are inside Syria: test the services you need and report what you find, especially anything that changes this week. A restoration nobody records is a restoration we cannot cite to the next company. Tell us the failure point as well as the failure: whether it broke at sign-up, at verification, at download or at payment.
If you want to help push: our advocacy toolkit carries a ready-to-send email and a LinkedIn message that anyone can copy, both rewritten this week. They are short, they lead with the delisting, and they ask the one thing a support agent can actually do: forward the message to legal or compliance. Each closes with the question our refusals answer worst, which is which specific regulation is this restriction based on? Take one and send it to a company on our list. One email from a real person is what moved several of those thirty-nine services.
If you work at one of these companies: the question for your compliance team is narrow. For an EAR99 service, with ordinary screening in place, and with Syria no longer designated, what is the remaining legal basis for a country-level block? If nobody has looked since 2011, that is a finding worth writing down. Our regulatory FAQ is current as of 22 August in English, Arabic and Kurdish, and the underlying government documents sit on our resources page. Both are written to be forwarded.
If you are a journalist: the delisting is one story. The gap between the delisting and the 474 services still blocked is another, and it is measurable.
Questions we are being asked
Is Syria still under U.S. sanctions? The comprehensive program ended in 2025. Targeted sanctions remain on Assad-era figures, Captagon traffickers, and ISIS and al-Qaeda affiliates, and export controls remain in place until the Commerce and State Departments amend their regulations.
Does the delisting mean ChatGPT works in Syria? Not automatically. ChatGPT is blocked by OpenAI's own policy on supported countries rather than by the designation, and it remains blocked. The same is true of most consumer services.
Can Syrians use PayPal now? No. As of 22 August 2026 nothing had changed: PayPal declined in March 2026, citing sanctions, and has not publicly revisited the decision.
Is Syria still on the FATF grey list? Yes. It was retained at the plenary of 19 June 2026. That listing, rather than the terrorism designation, is now the main obstacle to a routine bank transfer.
Was Syria removed from the terror list in 2025 or 2026? Two different things happened. The comprehensive sanctions program ended in 2025. The state sponsor of terrorism designation is separate: the President notified Congress on 8 July 2026, and the congressional review window closed on 22 August 2026.
How long was Syria designated a state sponsor of terrorism? Since 29 December 1979, which is 47 years, longer than any other country then on the list.
Which services are still blocked in Syria? Our register tracks 986 and is updated as they are retested. As of 22 August 2026, 474 were fully blocked, including ChatGPT, PayPal, Google Gemini and TikTok.
The label came off after 47 years. What happens next rests on several hundred separate commercial decisions, and every one of them is a decision that someone can be asked to make.
We will keep the count.
Last updated 22 August 2026. Platform figures are from the Unblock Syria service register on that date and change as services are retested.
Sources
- Initiating Rescission Process of Syria's Designation as a State Sponsor of Terrorism, U.S. Department of State, 8 July 2026
- U.S. Government Removes Syria From List of State Sponsors of Terrorism, Cleary Gottlieb
- Caesar Act Repeal and the Syria Sanctions Removal Report Card, Just Security
- US Initiates Process to Rescind Syria's State Sponsor of Terrorism Designation, Baker McKenzie
- Removing Syria's Designation as a State Sponsor of Terrorism: Retaining Leverage and Ensuring Accountability, The Washington Institute
- Implementation in the Export Administration Regulations of the Rescission of Sudan's Designation as a State Sponsor of Terrorism, Federal Register, 19 January 2021, the precedent for the separate BIS rule
- Relaxing Export Controls for Syria, Federal Register, effective 2 September 2025
- Syria export controls guidance, Bureau of Industry and Security
- Syria Sanctions Subside; Software, Cloud Service, and Other Export Concerns Remain, Goodwin
- U.S. Relaxes Export Controls on Syria: What Has Changed and What Remains?, Morrison Foerster
- Jurisdictions under Increased Monitoring, 19 June 2026, FATF
- A New Digital Dawn for Syrian Tech Users, Electronic Frontier Foundation
- U.S. must lift sanctions blocking Syria's digital recovery, Access Now
- Syria Tests Visa and Mastercard Payments After 15 Years, Enab Baladi
- Syria's Central Bank Allows Banks to Work with Global Payment Companies, Enab Baladi