EU Member States must transpose a directive establishing minimum rules on criminal offences and penalties for violating sanctions by next month. What should businesses consider?
EU Member States have until 20 May 2025 to transpose Directive 2024/1226, which lays out bloc-wide minimum rules for prosecuting EU sanctions violations and aligns penalties for non-compliance by individuals and companies.
Under the directive, Member States must criminalise intentional sanctions violations. Businesses face increased liability if employees violate the EU’s sanctions regime.
Ireland is drafting a bill that will transpose the directive into law, Germany has published a draft bill to implement the directive, and Denmark has proposed legislation (Danish language only) – but many Member States are not expected to meet next month’s deadline.
Despite their tardiness, businesses in the EU should prepare to comply with the directive and its key provisions.
Criminalisation and consistent penalties
The directive requires Member States to criminalise intentional violations of EU sanctions.
The offences include illicit transactions with sanctioned entities or countries, false declarations to evade sanctions, failing to freeze funds of designated persons, participating in evasion schemes, and aiding designated persons to enter or transit EU territory.
Under the directive, Member States must also criminalise inciting, aiding and abetting of an offence.
Member States are not required to criminalise violations or circumvention if they involve funds, goods, services, or transactions worth less than €10,000 (US$10,900).
The directive defines situations of circumvention which Member States must punish criminally, such as designated entities transferring economic resources to a third party to conceal funds.
The directive establishes base line penalties that Member States can levy against individuals and companies that violate EU sanctions.
Penalties against legal entities
Legal entities will be liable if their employees commit offences that benefit the business, especially if these are committed by individuals in a leading position – including CEOs, directors, and those authorised to make decisions on behalf of the company – or who are responsible for managing and controlling the company.
Penalties for businesses include exclusion from entitlement to public aid; exclusion from access to public funding, tender procedures, grants and concessions; and the closure of locations used for committing the criminal offence.
Members States can fine companies between 1% and 5% of their total worldwide turnover or a lump sum from €8 million (US$8.7 million) and €40 million (US$43 million).
Penalties against individuals
Member States must ensure that criminal offences are punishable with prison sentences.
When an offence involves funds worth less than €100,000 (US$109,000), the maximum term in prison is one year. For offences worth more than that figure, the maximum prison sentence increases to five years.
Enabling a designated person to violate travel bans will result in a maximum prison term of three years, whilst offences involving specific military items or dual-use items require a maximum term of imprisonment of at least five years.
Sanctions compliance considerations for businesses
The ramped up legal liability increases the need for businesses to protect themselves from being used as vehicles for sanctions circumvention or violation.
As the EU and other nations continue to issue sanctions against Russia for its military activity in Ukraine, in-house teams must bolster compliance measures and prioritise best practices to avoid costly penalties under the new EU directive.
Adopt strong internal controls
Sanctions screening systems for new customers and transactions can help prevent companies from breaching sanctions regimes.
In addition to rigorous screening processes when onboarding customers, in-house legal and compliance staff should use screening systems to check whether their business has any accounts or holds any funds or economic resources for the persons or entities set out in EU sanctions.
Identify reporting obligations for breaches
Businesses should identify the authority to which they are required to report breaches of EU sanctions as each Member State will differ. In some states there may be several authorities for different offences.
For instance, France’s the Directorate-General of the Treasury is the national competent authority for sanctions and licensing, whilst the Ministry of Foreign Affairs is responsible for sanctions related to military equipment.
In addition to reporting to local authorities, EU businesses and their employees can use the bloc’s sanctions whistleblower tool to share information on sanctions violations, including the individuals, companies and third countries involved.
Implement training and awareness programmes
Providing employees with comprehensive sanctions training is a key compliance measure for businesses. Training should clarify the sanctions compliance responsibilities of each employee and build a deeper knowledge base across the business on sanctions compliance expectations and accountability.
Companies should also tailor the training to each unit of the business to ensure that the advice is specific to roles and responsibilities.
Cooperate with authorities
Under the directive, Member States are required to consider mitigating factors, including cooperation with local competent authorities.
Businesses should be aware that self-disclosure of violations may count as a mitigating factor and result in reduced penalties if investigated for sanctions violations.