EU Aims for Harmonized Sanctions Enforcement With Defined Criminal Offences and Penalties

European Union member states have until 20 May 2025 to transpose into their national legislation EU Directive (EU) 2024/1226 (the Directive), which establishes minimum rules on the definition of criminal offences and penalties for the violation of EU restrictive measures (sanctions).¹

The Directive, adopted on 24 April 2024, is part of the EU’s broader effort to signal to its member states the importance of sanctions enforcement. The lack of harmonization on penalty provisions for sanctions violations at the EU level has resulted in domestic penalty provisions that vary significantly among the EU member states. The Directive seeks to address this fragmentation and strengthen penalty provisions for sanctions violations across the EU.

In this alert, we provide an overview of the Directive and discuss the impact that the implementation of the Directive will have on French and German laws.²

The key aspects of the Directive are:

• Asset freeze violations. The Directive requires EU member states to criminalize misconduct that constitutes an intentional violation or circumvention of an EU asset freeze restriction. Under conditions set forth in the Directive, member states are not required to criminalize certain specific misconduct that breaches an EU asset freeze restrictions if it involves funds, economic resources, goods, services, transactions or activities that have a value of less than €10,000.
• Trade restrictions. For EU trade restrictions (i.e., sectoral sanctions) on the import, export, sale, purchase, transfer, transit or transport of covered goods, as well as related covered services (e.g., technical assistance, brokering services or other services), the Directive requires that misconduct be criminalized if it is carried out intentionally or with serious negligence.
• Restricted financial services. EU member states are required to criminalize an intentional violation of an EU restriction on providing financial services or performing restricted financial activities.
• Circumvention. The Directive sets forth a specific list of circumvention actions that must be treated as a criminal offence.
• Inciting, aiding and abetting. EU member states are required to criminalize inciting, aiding or abetting an offence to violate or circumvent EU sanctions.
• Attempted violation. EU member states are required to criminalize misconduct that qualifies as an attempt to violate or circumvent certain EU sanctions.
• Penalties for individuals. The Directive requires EU member states to implement effective, proportionate and dissuasive criminal penalties against individuals for a breach of EU sanctions, including fines and imprisonment.
• Liability and penalties for corporates. The Directive requires member states to establish corporate liability for any sanctions-related criminal offence that has been committed for the benefit of a corporate by any person who has a leading position in the relevant corporate entity. Member states are also required to implement effective, proportionate and dissuasive criminal or noncriminal penalties that apply to corporates for sanctions violations committed for their benefit, including fines and judicial winding-up.
• Aggravating circumstances. The Directive introduces the concept of aggravating circumstances for certain misconduct, including breaches committed within the framework of a criminal organization or by a professional service provider in the context of its professional obligations.
• Mitigating circumstances. The Directive also introduces the concept of mitigating circumstances if the offender cooperates with relevant competent authorities.
• Statute of limitations. Member states are required to implement a minimum five-year statute of limitation for sanctions violations that are punishable by a maximum term of imprisonment of at least five years. A derogation provides that member states may impose a statute of limitation that is not shorter than three years.

Criminal Offences

EU sanctions, which are generally adopted in the form of regulations, apply directly and have direct effect in all EU member states. Although EU sanctions are adopted by the Council of the EU (Council), their enforcement is the responsibility of the EU member states.

To this end, EU regulations implementing EU sanctions typically include a provision on penalties that requires member states to adopt national rules providing for effective, proportionate and dissuasive penalties if the provisions of such regulations are breached.

EU sanctions regulations typically include a standard of liability clause stating that an action by an individual or an entity does not give rise to liability if such person or entity did not know, and had no reasonable cause to suspect, that their actions would infringe EU sanctions.

Consistent with this general standard of liability, all criminal offences covered by the Directive require intent. For certain offences related to EU trade restrictions, however, the Directive has also introduced the concept of serious negligence as a standard for liability.

Asset Freeze Restrictions

Under EU sanctions rules, EU operators³ are required to freeze all funds and economic resources belonging to, owned, held or controlled by an EU-listed person or entity. EU operators are also prohibited from making any funds or economic resources available, directly or indirectly, to or for the benefit of such EU-listed person or entity, including cryptoassets.

The Directive requires EU member states to criminalize any misconduct that amounts to an intentional violation of an EU asset freeze restriction, or of an asset freeze measure implemented at the member state level pursuant to EU sanctions.

EU Trade Restrictions

Serious Negligence Standard

A key aspect of EU sanctions involve trade restrictions, so-called sectoral sanctions, that target specific sectors of a sanctioned country’s economy. These sanctions typically include restrictions to sale, supply, transfer, import, export, transit or transport of controlled goods and technology (Controlled Goods).

The EU’s trade restrictions also typically prohibit providing directly or indirectly technical assistance, brokering services or other services for Controlled Goods, or related to the provision, manufacture, maintenance and use of such goods. Furthermore, financing or financial assistance related to Controlled Goods, or for the provision of related technical assistance, brokering services or other services relating to such goods, is typically prohibited.

The Directive requires that member states extend the standard for liability to cover misconduct that constitutes serious negligence, the definition of which is left to member states, when it relates to certain violations of trade sanctions. Specifically, the Directive provides that the serious negligence standard should at least apply to offences involving items on the EU’s Common Military List or dual-use goods and technology listed in Annexes I and IV of the EU’s Dual-Use Regulation.

The EU Commission published a guidance note (Guidance) in 2023 that includes (i) enhanced due diligence measures that EU businesses should apply when conducting strategic risk assessments, and (ii) best practices when reviewing business partners, transactions and goods.

The Guidance is nonbinding, but the enforcement agencies in the member states likely will consider it when assessing potential violations. For example, law enforcement authorities could use the Guidance to determine whether a particular action by a company meets the serious negligence standard.

For more on the Guidance, see our 28 September 2023 client alert, “EU Commission Issues Guidance for EU Companies on Enhanced Due Diligence To Prevent Sanctions Circumvention.”

Financial Activities

The Directive requires member states to criminalize an intentional violation of EU restrictions on providing financial services or performing financial activities.

Circumvention

All EU sanctions programs include an anti-circumvention rule that prohibits participation, knowingly and intentionally, in activities the object or effect of which is to circumvent the relevant sanctions regulation (EU Anti-Circumvention Rule).

Under the EU Anti-Circumvention Rule, the key elements are:

• Acting with knowledge.
• Intent to circumvent a prohibition included in the regulations.

The Directive sets forth specific prohibited actions that must be considered as a criminal circumvention offence. See the table below for the list of circumvention offences.

Inciting, Aiding and Abetting, and Attempt

For member states that have not criminalized inciting or aiding and abetting the violation of EU sanctions, the Directive requires these member states to criminalize such offences.

The Directive also requires that member states criminalize any attempt to:

• Make funds or economic resources available to an EU-designated person.
• Enable an EU-designated person to enter into or transit through the EU.
• Transact with a non-EU country, body or entity subject to certain restrictions, including public or concession contract restrictions.
• Breach EU trade restrictions, including related restricted services.
• Circumvent EU asset freeze measures by using, transferring to a third-party or otherwise disposing of funds or economic resources owned, held or controlled by an EU-designated person to conceal such frozen assets, or by providing false or misleading information to conceal that an EU-designated person or entity is the ultimate owner or beneficiary of frozen assets.

Corporate Liability

The Directive requires EU member states to implement rules ensuring that corporations are held liable for violating EU sanctions when such offence is committed for the benefit of the corporation by any person who has a leading position in such corporation, whether such person is acting individually or as part of an organ of the corporate based on:

• a power of representation of the legal entity,
• an authority to make decisions on behalf of such legal entity, or
• an authority to exercise control within such legal entity.

The Directive also requires that a corporate liability offence be created when a lack of supervision or control by such leading person has made possible that a person (e.g., employee) under their authority violates EU sanctions for the benefit of the corporation.

Penalties for Violations of EU Sanctions

The Directive seeks to ensure that violations of EU sanctions have similar legal consequences across the EU, including imprisonment and fines. The Directive requires member states to implement effective, proportionate and dissuasive criminal penalties for individuals and corporations, and sets minimum standards in that regard.

Penalties for Individuals

The Directive sets forth a graduated system of maximum imprisonment penalties of one, three and five years, depending on the gravity of the offence when it involves good, services, transactions or activities that have a value of at least €100,000.

For violations of sectoral sanctions involving items on the EU’s Common Military List or dual-use goods and technology listed in Annexes I and IV of the EU’s Dual-Use Regulation, such violations are punishable by a maximum term of at least five years’ imprisonment regardless of the value of the items involved.

The Directive also requires member states to take necessary measures to impose accessory criminal or noncriminal penalties for sanctions violations, including:

• Fines.
• Withdrawal of permits or authorizations.
• Disqualification that bars the person from serving a leading position.
• Temporary bans on running for public office.
• Publication of the judicial decision, including the personal data of the convicted individual if there is a public interest.

Penalties for Corporations

The Directive requires member states to implement fines as the main penalty against corporations for sanctions violations. To this end, the Directive sets forth a calculation method for settings fines at the national level, which is based on:

• 1% or 5% of the annual worldwide turnover generated by the legal entity in the business year preceding the fining decision or the sanctions violation, or
• a fixed amount corresponding to €8 million or €40 million, depending on the offence.

In addition to fines, member states may also impose other criminal or noncriminal penalties, including, amongst other penalties:

• Exclusion from entitlement to public benefits, aid or public funding.
• Disqualification from the practice of business activities (e.g., tender procedures, grants, concessions).
• Withdrawal of permits and authorizations.
• Placement under judicial supervisions.

Confiscation

The Directive has introduced a new freezing and confiscation regime targeting instrumentalities and proceeds of EU sanctions violations.⁴ Moreover, in specific cases involving circumvention of EU sanctions, the confiscation regime applies even where such assets might not be considered as proceeds or instrumentalities.⁵

Aggravating and Mitigating Circumstances

The Directive requires member states to include in their national laws one or more of the listed aggravating factors to consider when determining the penalty for a breach of EU sanctions, for example, if the:

• Offence was committed in the framework of a criminal organization.
• Offence involved the use by the offender of false or forged documents.
• Offence was committed by a public official when performing his or her duties, or by another person performing a public function.
• Offender destroyed evidence, or intimidated witnesses or complainants.

In the same vein, the Directive also requires that member states ensure that their laws provide for specific mitigating factors when considering the penalty to apply, including when the offender provides competent authorities with information that they would not have otherwise obtained if such information helps the authorities (i) identify or bring to justice other offenders or (ii) find relevant evidence.

Statute of Limitations

Member states are required to adopt a statute of limitations of at least five years for most of the sanctions offences. However, the Directive provides a derogation allowing member states to implement a statute of limitations that is not shorter than three years.

Key Considerations in France and Germany

France

France already maintains a legal framework that criminalizes violations of EU sanctions. France’s existing framework is generally consistent with the objectives of the Directive, although certain amendments to French law will be needed to fully comply with the Directive.

France’s Current Framework

In France, Article 459 of the French Customs Code (FCC) is the primary legal basis for prosecuting the violation or the attempted violation of EU economic and financial sanctions. Article 574-3 of the French Monetary and Financial Code, which applies to financial institutions, their management and employees, criminalizes violations related to asset freezing measures and prohibitions on making funds available, including interference with the implementation of these measures.

The set of penalties for sanctions violations include:

• Imprisonment for up to five years.
• A fine of up to two times (for individuals) or up to 10 times (for entities) the economic value of the violation.
• Confiscation of assets related to the offence (corpus delicti).

Article 350 of the FCC authorizes the customs administration, which is a competent administration that investigates sanctions violations, to enter into settlements, under certain conditions, with persons involved in sanctions violations, whether before or after the commencement of any legal action by the prosecutor (in the latter case, as long as the judicial authority accepts the principle of a settlement).

Article 459 3° of the FCC further states that incitement to commit any of the aforementioned offences is punishable by up to five years’ imprisonment and a fine ranging from €450 to €225,000, whether or not the incitement led to an actual violation.

While there is no statute of limitations specific for sanctions violations in France, these violations are subject to the six-year statute of limitations applicable to criminal offences, which is consistent with the requirements of the Directive to establish statutes of limitations of at least five years.

Despite this framework, prosecutions related to sanctions violations have been relatively rare in France, which can be attributed to several factors.

1. There are currently no specialized courts or prosecutors responsible for sanctions enforcement. Criminal proceedings for sanctions violations are conducted under the general criminal law framework. In instances where an investigation conducted under the authority of a specialized prosecutor, such as the French financial prosecutor (Parquet National Financier), involves multiple offences — including sanctions violations — that are connected to one another, the specialized prosecutor may also be competent to investigate and prosecute such offence.
2. The initiation of criminal proceedings is contingent upon the filing of a formal complaint by the Minister of Economy and Finance with the relevant public prosecutor’s office. This process, known as the “Verrou de Bercy”⁶ mechanism, has faced criticism for its complexity and the potential for political interference, both of which may undermine the effectiveness of the sanctions enforcement framework.
3. Recent developments have affected the interpretation of Article 459 of the FCC. On 12 June 2024, the French Constitutional Council (Conseil Constitutionnel) declared certain provisions of this article, including those on the automatic nature of accessory penalties, noncompliant with the French Constitution. The Directive’s requirement to introduce accessory penalties will likely create tensions with the French principle of individualized penalties that the French legislative body will have to resolve.

Key Considerations for Transposing the Directive Into French Law

Updates to the existing criminal legal framework will likely be necessary to fully comply with the Directive, particularly regarding fines for legal entities and the introduction of criminal liability for serious negligence.

• Criminal liability for serious negligence. The introduction of criminal liability for serious negligence is a significant potential change, particularly in relation to the import and export of dual-use goods, to account for the Directive’s emphasis on holding individuals and entities accountable for negligent violations of sanctions.
• Fines. The current fine for sanctions violations is not based on the turnover of the company but rather on the value of the impermissible transaction. French law will therefore need to be amended to align with the Directive’s requirement that EU member states implement maximum fines of at least 1% or 5% of the total worldwide turnover of the legal person in the business year preceding the fining decision.
• Mitigating circumstances. Another important change to the French sanctions framework will be that French authorities will have to include provisions for mitigating circumstances at the sentencing stage, specifically addressing cooperation with authorities in sanctions violation cases and to include the aggravating circumstances discussed above.
• Criminal liability of legal persons. While Article 121-2 of the French Criminal Code already provides that a legal person can be held criminally liable for acts committed on its behalf by its representatives or bodies, the criteria for invoking the criminal liability of legal persons under French law will likely need to be relaxed to comply with Article 6(2) of the Directive. This article requires EU member states to ensure that legal persons can be held liable “where the lack of supervision or control by [any person who has a leading position]”⁷ has made possible the sanctions violation by a person under its authority for the benefit of that legal person.⁸
• Circumvention. While French law already covers some aspects of sanctions circumvention under Article 459, it may need to be updated to cover more explicitly various forms of circumvention, including the use of complex ownership structures or intermediaries.
• The “Verrou de Bercy” mechanism. The mechanism, with its discretionary nature, may need to be loosened, as it could potentially be viewed as undermining the effective enforcement of sanctions required by the Directive. The approach could be similar to the 2018 reform for tax fraud matters. Previously, only the tax administration had the authority to file tax fraud complaints with the public prosecutor’s office. The reformed mechanism now provides for an automatic referral to the public prosecutor for tax fraud cases involving specific thresholds. A report submitted by the French Parliament in October 2022 estimates that the 2018 reform is responsible for almost doubling the number of tax fraud cases referred to the public prosecutor.
• Sanctions violations committed abroad. The French Criminal Code may also need to be updated to allow prosecution of French nationals for sanctions violations committed abroad without requiring a formal denunciation by the state where the offence occurred, as required by Article 12 4° of the Directive.
• Minor violations. It remains to be seen if France will adopt the €10,000 threshold to exclude certain minor violations of EU asset-freezing measures from criminal liability.

Germany

In Germany, sanctions violations are criminalized under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG) and the Foreign Trade and Payments Ordinance (Außenwirtschaftsverordnung, AWV). The existing German criminal law framework for sanctions violations largely aligns with the Directive’s standards, requiring only selective adjustments rather than comprehensive reforms for full compliance.

On 11 October 2024, the German government published a draft bill for transposing the Directive into national law (the AWG Bill).⁹ Under the AWG Bill, the proposed amendments are scheduled to take effect on 20 May 2025.

Key adjustments include:

• Criminalization of serious negligence. Sections 17 and 18 of the AWG criminalize intentional sanctions violations, while negligent violations are generally handled as administrative offences under German law. An exception is Section 17(5) AWG, which imposes criminal liability for reckless (“leichtfertig”) conduct involving the export of certain listed goods and technologies, including several items on the EU’s Common Military List. German criminal law has two degrees of negligence, simple negligence and recklessness. Recklessness is an elevated (or “serious”) degree of negligence, depending on the personal abilities and knowledge of the offender, where the offender ignores what is obvious to everyone.¹⁰ The Directive provides that the standard of “serious negligence” should at least apply to offences relating to dual-use goods and technology listed in Annexes I and IV of the EU’s Dual-Use Regulation, which are not yet entirely covered by Section 17(5) AWG. The AWG Bill now includes Section 18(8a) to meet the Directive’s requirement, making reckless violations involving dual-use goods and technologies in Annexes I and IV of the EU’s Dual-Use Regulation punishable by up to three years in prison or a fine.
• Criminal offence for financial activities. Section 18 AWG lists several criminalized activities that mirror prohibitions set forth by Council Regulation (EU) No 833/2014 of 31 July 2014 (Regulation 833).¹¹ These activities include violations of export, services or transportation bans. However, Section 18 AWG does not yet criminalize certain financial activities falling within the scope of the Directive.¹² Some of the financial activities prohibited under Regulation 833 currently constitute administrative, not criminal, offences under German law.¹³ This includes transactions with entities under the EU transactions ban in Article 5aa(1) of Regulation 833 and registering a trust or similar legal arrangement referenced in Article 5m(1) of Regulation 833.¹⁴ Section 18(1) of the AWG Bill now criminalizes additional sanctions violations within the financial sector, including breaches of the EU transactions ban and EU trust services prohibitions.¹⁵ Other financial activities that currently constitute administrative offences but are proposed to be reclassified as criminal offences under Section 18(1) of the AWG Bill include violations of the prohibition to invest in projects co-financed by the Russian Direct Investment Fund under Article 2e(3) of Regulation 833, breaches of the EU investment ban in the energy, mining and quarrying sector under Article 3a of Regulation 833, and violations of debt/equity restrictions under Article 5 and Article 5a of Regulation 833.¹⁶
• Circumvention. In 2013, following a decision by the German Federal Court of Justice (Bundesgerichtshof, BGH), the German Legislature repealed the criminal offence for sanction circumvention from the AWG.¹⁷ The BGH had criticized the previous statute as overly broad and excessive.¹⁸ However, the 2013 draft bill of the AWG amendment clarified that certain acts of circumvention may still be subject to German criminal sanctions, as aiding and abetting these offences are also criminalized under German law, thereby making a separate circumvention offence unnecessary.¹⁹ As explained above, the Directive requires that certain circumvention actions (listed in the table above) must be treated as criminal offences. While the AWG Bill does not propose a comprehensive offence for sanctions circumvention, it introduces targeted adjustments to explicitly penalize specific acts of sanctions circumvention. Section 18(1) of the AWG Bill now criminalizes the circumvention of sanctions aimed at concealing frozen funds or economic resources, including by providing false or misleading information. Additionally, Section 18(6a) of the AWG Bill classifies providing false information to a public authority regarding the end use of a product, with the intent to conceal a sanctions violation, as a particularly serious case of prohibited or unauthorized trade, punishable by imprisonment ranging from six months to 10 years.
• Extended criminalization of reporting obligations. The AWG Bill proposes to broaden the scope of criminalized sanctions reporting violations under Section 18(5a), with penalties of up to one year of imprisonment or a fine. Currently, Section 18(5a) AWG penalizes only the failure to report or the provision of false information as specified under Article 9(2)(a) of Council Regulation (EU) No 269/2014 of 17 March 2014 (Regulation 269). Noncompliance with Articles 8(1) of Regulation 269 or Article 6b(1) of Regulation 833 is treated as an administrative offence under Section 19(5) AWG, subject to a maximum fine of €30,000. Under the AWG Bill, however, all breaches of asset freeze-related reporting obligations will be criminalized, with penalties of up to one year of imprisonment or a fine. This expanded scope also covers reporting obligations concerning information acquired in the course of professional duties related to funds or economic resources subject to EU reporting requirements. Exemptions apply to legal professionals, including lawyers, patent attorneys, notaries, auditors, tax advisers and tax agents, provided that the information was either entrusted to them in their professional capacity or came to their knowledge in this role.
• Turnover-based fines. German criminal law is based on the principle of individual responsibility and does not recognize the concept of corporate criminal liability. Under the German Administrative Offences Act (Gesetz über Ordnungswidrigkeiten, OWiG), German enforcement agencies can impose administrative fines on companies if an authorized representative or a person responsible on behalf of the management of the company violates EU sanctions law, thereby committing criminal or administrative offences under German law.²⁰ Moreover, a company can be held liable if it fails to implement adequate supervisory measures to prevent violations.²¹ Sections 19(7) and (8) of the AWG Bill increase the maximum administrative fine for companies for sanctions violations from €10 million to €40 million. However, the AWG Bill does not adopt the Directive’s option to base fines on the entity’s global annual turnover.

_______________

1 Such sanctions include asset freeze obligations, travel bans, sectoral economic and financial measures, and arms embargoes.

2 This client alert is for informational purposes only and does not constitute legal advice. Complex assessments often have to be made as to which sanctions regime applies in any given instance, given the multinational touch points of many entities and individuals. In that regard, given the complex and dynamic nature of these sanctions regimes, there may be developments not captured in this summary. Moreover, while the summary was accurate when written, it may become inaccurate over time given developments. For all of these reasons, you should consult with a qualified attorney before making any judgments relating to sanctions, as there are potentially severe consequences of failing to adhere fully to sanctions restrictions.

3 An EU operator is an entity that is subject to EU jurisdiction as defined by EU sanctions rules.

4 See Directive 2014/42/EU on the freezing and confiscation of instrumentalities and proceeds of crime in the European Union. “Instrumentalities” means any property used or intended to be used, in any manner, wholly or in part, to commit a criminal offence or criminal offences.

5 See Directive (EU) 2024/1260 on asset recovery and confiscation.

6 “Bercy lock” is an expression derived from the name of the Paris neighborhood where the tax authorities are headquartered.

7 A leading position within a legal person is defined as someone who acts either individually or as part of an organ of the legal person and has at least one of the following: (i) a power of representation of the legal person, (ii) an authority to make decisions on behalf of the legal person, or (iii) an authority to exercise control within the legal person.

8 The objective of the transposition would therefore be to exposure legal persons to criminal liability without having to demonstrate that the conditions of the first paragraph of Article 121-2 of the French Criminal Code are met (namely, the commission of the offence by a representative or body of the legal person and on behalf of the legal person).

9 BR Drs. 498/24.

10 Fischer, in: Beck’scher Kurzkommentar StGB, 2023, § 15 Rn. 35.

11 Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine, as last amended by Council Regulation (EU) 2024/1745 of 24 June 2024.

12 See Article 3(f) of the Directive providing that EU member states shall ensure that providing financial services or performing financial activities, where the prohibition or restriction of that conduct constitutes an EU restrictive measure, also constitutes a criminal offence. Recital 11 of the Directive stipulates that financial activities include but are not limited to sectoral sanctions such as financing and financial assistance, providing investment and investment services, issuing transferable securities and money market instruments, accepting deposits, providing specialised financial messaging services, dealing in banknotes, providing credit rating services, and providing cryptoassets and wallets.

13 See Section 82(9) AWV.

14 See Section 18(1)(c), (e) of the AWG Bill.

15 BR Drs. 498/24, p. 16.

16 BR Drs. 498/24, p. 22 et seq.

17 German Federal Court of Justice, Decision of 23 April 2010 – AK 2/10 (BGH NJW 2010, 2370).

18 German Federal Court of Justice, Decision of 23 April 2010 – AK 2/10 (BGH NJW 2010, 2370, 2374).

19 BT-Drs. 17/11127, p. 27.

20 Section 30(1) OWiG.

21 Section 130(1), 30(1) OWiG.

Download PDF

[View source.]