Corporate liability and attribution under EU: step by step

A multinational operating across EU member states receives a regulator's inquiry. The subject line names the company. Behind it sits a question that will determine whether a fine, a referral to criminal prosecutors, or a public notice follows: can the legal entity that signed the contract be held liable for what its employees, directors, or subsidiaries actually did? That question is the core of corporate liability and attribution under EU sanctions law – and getting it wrong at this stage rarely ends well.

Under EU sanctions, a company can face enforcement consequences when a prohibited act is attributed to it through its employees, officers, or controlled entities. The governing authority is the relevant Council Regulation, directly applicable across all member states, and – as of 2025 – an EU directive requiring member states to criminalise serious violations. Attribution analysis is fact-specific. It turns on who acted, on whose instructions, and within which legal structure. No numerical threshold governs attribution directly; the analysis is qualitative and contextual.

This guide walks through the attribution question as a decision sequence: who is the relevant actor, which entity does that conduct attach to, what is the scope of liability across member states and beyond, and when does the position require urgent external advice.

If the actor is an employee or officer – what attaches to the company?

When an individual who is an employee, director, or officer of a company carries out a prohibited act under the relevant EU Council Regulation, that conduct can be attributed to the company. The company does not need to have directed the breach for it to face enforcement consequences. The critical question is whether the individual was acting in their capacity as an employee or officer of that entity – and whether the act fell within the scope of their actual or apparent authority.

EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. A payment authorised by a finance director who failed to complete adequate screening is precisely the kind of act that a national competent authority will examine. In our experience, investigators focus first on the internal approval chain: who authorised the payment, who countersigned, and what information was available to them at the point of decision.

Attribution does not require proof of intent in every member state. The EU directive on criminalisation of sanctions violations sets minimum standards, but implementation differs. Where a national regime imposes strict liability at the corporate level, a company that cannot show it had adequate controls in place is exposed regardless of what individuals knew. That divergence between member states is a live risk for any group operating across borders within the EU.

Practically: if the employee acted within their role, attribution to the company is the starting point. The company then needs to establish what controls existed, whether the act was an isolated deviation or a systemic failure, and what steps it took once it became aware of the issue. Those three questions will drive every subsequent stage of the enforcement analysis.

If the actor is in a subsidiary or affiliated entity – how far does liability travel?

Attribution within a corporate group is one of the most consequential questions in EU sanctions enforcement, and one that EU sanctions lawyers encounter in almost every group-level investigation. The key issue is whether conduct within a subsidiary is attributable to the parent, and – separately – whether the parent's knowledge of a prohibited act and failure to prevent it creates its own liability.

The EU control test looks at control and an ownership criterion of more than 50 percent for asset-freeze purposes. That threshold matters for understanding which entities fall within the scope of a listed person's influence. It is distinct from, though related to, the attribution question. A parent that controls a subsidiary and directs its sanctioned conduct is in a materially different position from a parent that owned the subsidiary but exercised no operational oversight.

In practice, national competent authorities in the member states where enforcement action is most active have shown willingness to examine the group's governance structure as a whole. Can the parent demonstrate that the subsidiary operated under separate and genuinely independent compliance controls? Was there a group-wide policy that the subsidiary followed or disregarded? Were group-level officers aware of the transactions? These are the questions that determine how far up the corporate chain the attribution runs.

Cross-regime point: under OFAC, the 50 percent ownership rule is structural – an entity owned 50 percent or more in the aggregate by blocked persons is itself treated as blocked, and that rule operates mechanically regardless of control. The EU approach is more contextual, but that does not make it more lenient. EU investigators examine the economic reality of group relationships. A parent that benefits financially from a subsidiary's prohibited transactions will struggle to maintain that attribution stops at the subsidiary level.

The practical step at this stage is a group mapping exercise: which entities within the corporate structure had operational involvement in the transaction or relationship at issue, which had knowledge of it, and which benefited from it. That map becomes the architecture of the legal analysis.

If the breach spans multiple member states – which authority takes the lead?

EU sanctions regulations are directly applicable in each member state, but enforcement is national. There is no single EU-level enforcement body equivalent to OFAC in the United States. A breach involving entities in three member states can in principle attract the attention of three national competent authorities, each applying its own national implementation of the EU rules. As of January 2026, the coordination mechanisms among national authorities have strengthened, but divergence in enforcement culture and penalty levels remains a real feature of the regime.

The EU directive on criminalisation requires member states to provide for criminal liability of legal persons for serious sanctions violations, with corporate fines expressed as a percentage of worldwide turnover or a fixed maximum. Member states were required to transpose that directive by May 2025; implementation continued through 2026, and the state of transposition varies. In jurisdictions where criminal liability has been implemented fully, a referral from a national administrative authority to a prosecutor is a realistic outcome for serious breaches. In others, the enforcement tool remains an administrative penalty.

What does this mean for a group with multi-member-state exposure? It means that the lead authority for any investigation may not be the authority in the member state where the parent is incorporated. It may be the authority in the member state where the transaction was executed, or where the funds moved, or where the sanctioned goods entered EU territory. Identifying the likely lead authority early – before responding to any inquiry – is a step we consistently advise clients to take.

A practical note on coordination: if one member state authority opens a formal inquiry and a second authority in a different member state makes initial contact about the same underlying facts, that is a signal that information is already moving across borders. Consistency in what is presented to each authority is essential. Inconsistency – even where it arises from genuine uncertainty about the facts – can be treated as aggravating.

How to handle corporate liability and attribution under EU: the compliance response sequence

Once a potential breach has come to light, whether through an internal audit, a transaction flagging, a counterparty notification, or a regulator's inquiry, the compliance response follows a defined sequence. Working through this sequence correctly establishes the foundation for whatever enforcement engagement follows.

The first step is fact-gathering under privilege where possible. Identify the transaction or conduct at issue. Map the internal decision chain: who approved, who executed, who had access to screening results, and what those results showed. Preserve relevant documentation. In our cross-border practice, we see cases where the documentation that would have defended the company was overwritten or deleted after a system migration – not deliberately, but without anyone thinking through the consequence. Document preservation is not optional once a potential breach is known.

The second step is a legal characterisation. Does the conduct constitute a violation of the relevant Council Regulation? This requires both sanctions analysis and factual analysis. The answer is rarely obvious on the face of the facts. A payment to a counterparty that later turns out to have been controlled by a listed person may or may not be a violation depending on the company's state of knowledge, the steps it took to screen, and the information that was publicly available at the time.

The third step is a voluntary disclosure assessment. Voluntary disclosure to the relevant national competent authority is a recognised factor in the enforcement assessment across most member states. It does not guarantee a reduced penalty or a decision not to prosecute. But it establishes a record of good faith and can materially affect how an investigation proceeds. The corporate liability and attribution compliance checklist at the heart of any investigation should treat voluntary disclosure not as a last resort but as an early decision point – one that closes if the regulator arrives first.

The fourth step is a cross-regime review. Does the same transaction or relationship create exposure under OFAC, OFSI, or another regime? A payment routed through a US correspondent bank, or a UK-incorporated subsidiary involved in the transaction, may create parallel exposure. Acting only in relation to the EU dimension while leaving US or UK exposure unaddressed is a pattern we regularly advise against. The stricter prohibition governs; where two regimes both apply, conduct lawful under one but prohibited under another requires the more restrictive position to be observed.

When the myth is wrong: silence is not a defence

One of the most persistent misunderstandings among companies facing a regulator's inquiry is that staying silent is safer than engaging. The reasoning seems intuitive: disclosing more gives the regulator more material to work with. In practice, the opposite is frequently true.

National competent authorities investigating sanctions violations have broad information-gathering powers. They can compel document production, request testimony, and access data held by financial institutions and counterparties. A company that has not engaged proactively will often find that the authority has already formed a view of the facts by the time any response is submitted. That view is shaped by the evidence the authority has gathered, not by the company's own characterisation of events.

Voluntary disclosure is a recognised mitigating factor in enforcement assessments. The EU directive on criminalisation contemplates cooperation with authorities as a factor relevant to penalty. In a number of member states, cooperation and early engagement with the authority have resulted in materially different outcomes compared with companies that contested every step of a formal investigation.

This does not mean that every potential issue should be disclosed immediately and unconditionally. What it means is that the disclosure question should be analysed carefully, at an early stage, with legal advice. The factors are: the severity of the apparent breach, whether it is systemic or isolated, which authority is likely to be involved, whether the company is already under examination, and what the company can demonstrate about its remediation steps. Treating disclosure as unambiguously negative – and silence as protective – is a mistake that companies at the enforcement stage often cannot correct once the window has passed.

Risk flags that require immediate external advice

Some facts patterns in corporate liability and attribution require external EU sanctions counsel to be engaged without delay. Identifying those patterns early reduces the risk that the position worsens before advice is obtained.

The first flag is a formal inquiry from a national competent authority. An information request, a letter of intent to investigate, or a formal notice under the national implementing legislation is not a matter for internal legal teams alone. It is a regulated step in an enforcement process, and the response will be on the record. It is also, in some member states, a step that starts a clock on response timelines.

The second flag is an apparent breach that has already been completed and that involved significant value. The EU directive provides for corporate fines calibrated to worldwide turnover. Even an isolated transaction of moderate size may expose a group-level entity to a penalty assessed against its global revenues. The scale of potential consequence makes early legal review proportionate.

The third flag is cross-border exposure. If the same transaction has a US-dollar element, a UK-incorporated party, or a connection to a non-EU sanctions regime, the analysis cannot be EU-only. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, and the most serious enforcement outcomes we have seen typically involve groups that managed the regimes in silos rather than as an integrated analysis.

The fourth flag is uncertainty about whether a voluntary disclosure has been triggered by what the company already knows. If the internal investigation has identified facts that a reasonable person would characterise as a potential breach, and those facts have not been disclosed, the passage of time is not neutral. In a number of member states, a decision not to disclose is itself a factor in the enforcement assessment. External advice on whether the disclosure threshold has been crossed, and on how to structure any disclosure, is the appropriate step.

How does EU corporate liability differ from OFAC and OFSI?

Understanding how the EU regime treats corporate liability and attribution differently from OFAC and OFSI is essential for any group operating across these jurisdictions. The differences are not cosmetic. They reflect genuinely different legal structures, and a compliance programme designed for one regime will not map neatly onto another.

Under OFAC, civil-penalty liability is strict: no knowledge or intent is required for the violation itself. The 50 percent ownership rule operates automatically. Voluntary self-disclosure is a recognised mitigating factor under OFAC's Enforcement Guidelines. Blocked-property and rejected-transaction reports are due within 10 business days, and sanctions records must be kept for five years. OFAC administers both list-based programmes and comprehensive or territorial programmes, which operate differently from each other.

Under OFSI, the UK regulator can impose monetary penalties on a strict-liability basis. The maximum civil penalty is the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force and subject to legislative change. There is a legal obligation on relevant firms to report knowledge or suspicion of designated persons to OFSI. The UK also permits a Ministerial review and then a judicial-review challenge to designations – a route not replicated in the EU administrative structure.

The EU regime is the most structurally fragmented of the three. Enforcement is national, criminal liability thresholds differ across member states, and the penalty frameworks are not uniform. The EU General Court provides an annulment route for listed persons, but that is a separate track from enforcement against companies that have committed violations. The EU control test – ownership of more than 50 percent and actual control – introduces a qualitative element that the US ownership test does not.

Where does that leave a group with EU, UK, and US exposure on the same set of facts? The answer is that each regime must be addressed on its own terms, with a clear record of what was done and when under each. The corporate liability and attribution compliance checklist must be regime-specific even where the underlying facts are shared. A group legal review that treats the EU, OFSI, and OFAC analyses as interchangeable is, in our experience, one of the most common and consequential mistakes in cross-border sanctions enforcement defence.

Related practices

• Corporate liability and attribution – OFSI – enforcement defence and liability analysis under the UK financial-sanctions regime
• Corporate liability and attribution under OFSI: step by step – practitioner guide to the UK attribution test and enforcement process
• Criminal liability for sanctions violations under EU – analysis of the EU criminalisation directive and member-state implementation

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.