The EU Moves To Harmonise Criminal Liability for Sanctions Breaches Across Member States

Geopolitical tensions and the resulting compliance risks remain on the forefront of executives’ agendas. European companies with global operations face major challenges including the rapid evolution of sanctions and trade restrictions, expanded measures targeting Russia and Belarus, and heightened regulatory efforts to combat sanctions circumvention.

As we have emphasized in a previous blog on what to expect in the area of sanctions in 2025, these pressures are further compounded by Directive (EU) 2024/1226 (the ‘Directive’), which provides for the partial harmonisation of sanctions enforcement across EU Member States, mandates the criminalisation of sanctions violations, and sets common minimum standards for penalties. EU Member States are required to transpose the Directive into national law by 20 May 2025.

In this blog post, we outline the Directive’s key provisions, highlight some particularly relevant changes, and provide an overview of its current implementation status in Germany, Austria, Spain, France, Italy, and the Netherlands.

1. Overview – Steps to a Uniform, Stricter Approach to Penalising Sanctions Violations

While EU sanctions are directly applicable in all EU Member States, their enforcement is regulated by each national competent EU Member State authority. As a result, each EU Member State determines the nature and severity of national penalties for EU sanctions breaches. This fragmented approach has led to (i) a lack of common minimum rules regarding the definition of criminal conduct in relation to breaches of EU sanctions and (ii) impacted their effective application – vis-à-vis individuals but also legal entities. 

Against this background, the Directive now:

• deems certain intentional sanctions violations, such as breaches of (i) asset freeze restrictions (e.g., making funds available to designated persons or failing to freeze assets), (ii) product trade restrictions (e.g., importing or exporting restricted products or providing prohibited ancillary services), and (iii) other conduct such as providing prohibited services under the EU Services Ban, to constitute criminal offences;
• extends this classification to include the incitement of, aiding, abetting, or attempting such violations;
• sets minimum thresholds for the maximum level of penalties to be implemented in each EU Member State;
• introduces common aggravating circumstances, which demand higher penalties, but also defines mitigating circumstances with the contrary effect;
• mandates expanded investigative tools for investigations into alleged sanctions violations, including intercepting communications, covert surveillance, and monitoring bank accounts; and 
• calls for increased cross-border cooperation between competent authorities of EU Member States, the Commission, Europol, Eurojust, and the European Public Prosecutor’s Office (EPPO).

2. Criminalisation of Sanctions Violations and Minimum Penalty Thresholds

Under the Directive, EU Member States are required to classify intentional breaches of EU sanctions as criminal offences (in certain cases even serious negligence may suffice to trigger criminal liability, see Section 3 below).

Examples of intentional conduct that must now be criminalised include:

• the provision of funds or economic resources to designated individuals or entities;
• conducting trade involving restricted goods, including brokering, technical support, or other related services;
• supplying restricted financial or other services; and 
• breaching conditions of authorisations granted by competent authorities required for activities prohibited under EU sanctions. 

In addition, acts aimed at circumventing sanctions related to asset freeze restrictions – such as intentionally failing to disclose frozen assets or concealing their status – must also be treated as criminal offences. 

The Directive further outlines mandatory minimum thresholds for the maximum level of penalties for sanctions violations, applicable to (i) individuals and (ii) companies:

i. Penalties for Individuals 

The Directive requires EU Member States to establish minimum thresholds for the maximum level of penalties for individuals that violate EU sanctions – ranging from at least one year to at least five years of imprisonment, depending on the severity of the offence. In particular, violations related to asset freeze restrictions or product trade restrictions may trigger a maximum sentence of at least five years of imprisonment if the offence involves funds with a value of at least EUR 100,000. However, the Directive, of course, does not prevent EU Member States from adopting stricter penalties.

In addition to criminal penalties, the Directive foresees non-criminal penalties for natural persons, such as the withdrawal of business licences or permits.

ii. Tougher Stand on Fines against Companies

The Directive also introduces changes to how companies may be penalised for sanctions violations. While the Directive does not introduce a general corporate criminal liability for EU sanctions breaches, it emphasises that EU Member States shall ensure that legal persons can be held liable for sanctions violations with criminal (for Member States with corporate criminal liability) and non-criminal penalties. In all cases, penalties—whether criminal or non-criminal—must be effective, proportionate, and dissuasive. The Directive requires fines to reflect the seriousness of the offence and the financial situation of the company. As observed in other areas of regulation, a key instrument for the EU in this respect is the use of turnover-based fines: Depending on the violation, EU Member States must set a maximum of fines of (i) not less than one percent of the worldwide annual turnover, or alternatively, EUR 8,000,000 for certain circumvention offences, or (ii) not less than  five percent of the turnover, or alternatively, EUR 40,000,000 for most other offences. EU Member States also have flexibility in defining the reference period for calculating turnover. This need not always be the previous financial year; it may instead refer to the year in which the offence occurred, or the year preceding the decision to impose a fine—allowing for more tailored and effective enforcement.

3. Stricter Rules for Serious Negligence as well as Inciting, Aiding, Abetting and Attempting

While the Directive primarily targets intentional sanctions violations, it also targets serious negligence in certain high-risk areas: This means that non-intentional breaches – if conducted with serious negligence (which is to be assessed in accordance with the respective relevant national law) – can be prosecuted as a criminal offense rather than only as a non-criminal administrative penalty. However, this only applies to sanctions breaches involving certain military and dual-use items. Activities such as trading, importing, exporting, selling, purchasing, transferring, transiting or transporting these goods, as well as providing certain ancillary services may give rise to criminal liability even in the absence of intent, where serious negligence is found.

The Directive further seeks to reinforce criminal liability in relation to considering inciting, aiding, and abetting, i.e. forms of conduct that require a separate primary offence covered by the Directive as a criminal offence. In this context, it is noteworthy that the Directive aims to target the potential misuse of professional services – such as legal, financial, or trade services – for the purpose of violating or circumventing sanctions. Similarly, EU Member States must ensure that attempting to commit the listed offences is punishable as a criminal offence.

4. Some Leeway for a Customized National Approach

The Directive sets out a harmonised framework but leaves room for EU Member States to impose stricter rules. This includes criminalising conduct that is not covered by the Directive or imposing heavier fines. Conversely, the Directive permits EU Member States to exclude minor offences – specifically those of a value less than EUR 10,000 – from criminal liability, provided that penalties remain effective, proportionate, and dissuasive.

5. Status Quo of Implementation of Directive 

With the 20 May 2025 deadline fast approaching, EU Member States are now under pressure to transpose the Directive into national law. While the Directive lays down harmonised minimum standards, its full impact will depend  on how each EU Member State implements the rules in practice. Progress varies significantly across the EU—both in terms of legislative readiness and the scope of national measures adopted. 

i. Germany

In Germany, the government had prepared to implement the Directive in time. However, Germany held a snap election in February 2025. This changed the parliamentary majority. Coalition negotiations have just concluded to form a new government. Nevertheless, there is no reason to assume that the designated new government will not implement the Directive in a timely manner, even if the deadline of May is getting close. According to its coalition agreement, it plans to undertake a more extensive reform of foreign trade legislation.

Also, this snap election gave the (soon-to-be) new German government the opportunity to make decisive changes to the previously submitted draft. After all, the draft failed to include the value limit of EUR 10,000 the Directive proposed for minor offences. Instead, all relevant violations would become criminal offenses. While legally possible, this would defy the sound EU approach for achieving a uniform framework for criminal liability for sanction violations among member states. Furthermore, professional organizations have criticized the proposed substantial penalties of three months to five years for abusive legal advice whose unlawfulness only becomes apparent in the context of other EU legal acts that are subject to regular change. 

ii. Austria

In Austria, the recently amended National Sanctions Act (SanktG 2024), inter alia, introduced increased penalties for sanctions violations. The SanktG 2024 provides for criminal penalties for natural persons violating asset freeze restrictions, notably increasing the previous penalty range for violations from a maximum of one to two years to up to five years of imprisonment, therefore complying with the Directive’s requirements. Under the Austrian Corporate Liability Act (VbVG), legal entities can also be held liable under this criminal provision with fine based penalties linked to their annual turnover. 

Administrative fines for violations of asset freeze restrictions are capped at EUR 150,000. The same applies to the deliberate submission of incorrect or incomplete information to obtain an exemption or derogation, as well as non-compliance with reporting or documentation obligations. In cases of serious, repeated, or systematic violations – particularly by financial market participants – fines can be increased to up to EUR 5,000,000 or twice the financial benefit obtained from the violation. However, these penalties fall short of the minimum thresholds for the maximal levels of penalties set by the Directive (i.e. 1% of the worldwide turnover or EUR 8,000,000, and 5% of the worldwide turnover or EUR 40,000,000).

iii. Spain

The Spanish Council of Ministers has given its approval to a draft law aimed at transposing the Directive into national legislation. The proposed legislation introduces changes to the Spanish Criminal Code, including the establishment of criminal offences related to breaches of EU sanctions, in accordance with the Directive. The draft was open for public consultation until 9 April 2025 and must subsequently pass through the Spanish legislative chambers before it can be enacted.

iv. France

As of now, there are no proposals or announcements in relation to the transposition of the Directive into French law. At first glance, this might be because certain elements of French legislation (such as the existing penalty of imprisonment of up to five years) already align with the Directive’s requirements. However, France is currently facing delays in implementing several EU directives (such as the NIS 2 Directive). 

v. Italy

Italy has already initiated the legislative process to implement the Directive into national law, which is currently being reviewed by the Italian Parliament. Once this law is approved, it will grant the government authority to issue a legislative decree establishing new criminal offences related to sanctions breaches. 

vi. Netherlands

To date, the Netherlands has not formally transposed the Directive into national law, nor has a legislative proposal been introduced for this purpose. This is likely because the existing Dutch legal framework already largely aligns with the Directive’s core requirements. In particular, Dutch enforcement of sanctions is primarily governed by the Sanctions Act 1977 (Sanctiewet 1977) and the Economic Offences Act (Wet op de economische delicten – WED), which together already provide a comprehensive legal basis for the criminalisation of sanctions violations, including adequate penalty thresholds. As a result, no substantial legislative amendments appear to be required in the Netherlands. Separately, a new law – the International Sanctions Enforcement Act (Wet internationale sanctiemaatregelen) – is currently being drafted to establish a more unified general enforcement structure that combines administrative and criminal approaches, though it is not directly linked to the Directive.

6. Conclusion

The Directive marks a significant step toward a harmonised and more stringent enforcement framework for EU sanctions. By criminalising core types of sanctions violations and introducing minimum penalties for both individuals and legal entities, it aims to ensure more consistent and effective enforcement across the EU.

EU Member States must implement the Directive into national law by May 2025. Non-compliance within this timeframe may lead to the initiation of infringement proceedings by the European Commission. 

The implementation status across EU Member States is progressing at different speeds: While some have already taken legislative action, such as publishing drafts or initiating parliamentary procedures, others are still at a preliminary stage or have yet to take concrete steps.

Even before full transposition at the national level, the Directive signals a clear shift towards stricter enforcement of EU sanctions. With the Directive likely to trigger increased enforcement activity across EU Member States, businesses should expect a rise in criminal investigations. This reinforces the importance of having a robust sanctions compliance framework, underpinned by effective internal processes and continuous risk monitoring.