Criminal liability for sanctions breaches under EU: a compliance guide

A European trading house receives a regulator's letter. Its compliance team has flagged a transaction. A counterparty appears to have been listed at the point of payment. The question the General Counsel asks is not whether there is a civil exposure – it is whether a criminal investigation could follow. That question has become considerably sharper since EU criminal liability for sanctions breaches acquired a mandatory minimum structure applicable across all Member States.

Criminal liability for sanctions breaches under EU law is now governed by a directive that requires Member States to criminalise intentional violations of EU sanctions, with maximum imprisonment terms of at least five years for the most serious offences and corporate fines expressed as a percentage of worldwide turnover. The directive set a transposition deadline of 20 May 2025, and infringement proceedings were opened against states that had not complied; transposition continued through 2026. The result is a patchwork in which the offences are common but the procedural machinery remains national.

This guide walks through that regime from the moment a potential breach surfaces, through the internal response, the interaction with national authorities, the cross-regime comparison a multinational must run, and the point at which external counsel needs to be in the room.

How did a single European transaction lead to criminal exposure? The regulatory backdrop

EU sanctions are imposed by Council Regulation, directly applicable in every Member State, and give effect to Council Decisions. Until the directive on criminalisation, enforcement was a matter for national law alone. Some Member States provided robust criminal sanctions; others treated violations largely as administrative matters. A business transacting across multiple EU jurisdictions faced a genuinely fragmented risk picture.

The directive changed that baseline. It requires Member States to criminalise a defined catalogue of intentional acts – making funds available to a listed person, dealing with frozen assets, breaching travel bans, facilitating prohibited transactions, and circumventing measures. Negligent or reckless conduct is addressed at Member State level, though the directive sets the floor at intention. In our experience, clients underestimate how quickly a regulator characterises what began as a process failure as evidence of intent.

Legal persons are expressly within scope. Corporate liability does not require proof of individual intent at board level; it can attach where a person in a senior management role – or any person acting under their authority – commits the offence for the benefit of the corporate. That is the provision that keeps general counsel awake. The directive is not an abstract harmonisation exercise. It is an enforcement tool.

Stage one: the first hours after a potential breach surfaces

When a possible EU sanctions breach comes to light, the first priority is preserving the position, not resolving it. Acting without legal advice in the immediate period can narrow options that remain open at this point but close quickly.

Three actions should happen within the first working day. First, the compliance team should freeze the relevant transaction records, communications, and screening outputs. Destruction or alteration of records – even inadvertent overwriting from a routine system refresh – can itself become an obstruction issue in some Member State jurisdictions. Second, the scope of the potential breach should be mapped: which entity, which counterparty, which listed person or programme, which dates. Third, the question of whether any EU Member State authority already has visibility should be assessed.

The reporting position varies by Member State and by the type of institution. For regulated financial firms there may be an existing obligation to report knowledge or suspicion to a competent authority. Identifying whether that clock is already running is not a stage-two task.

A point that often surprises clients: the EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. A payment settled through an intermediary – where the corporate's treasury team had no direct interaction with the listed entity – can still be within scope if the funds were routed for a listed person's benefit. Have you mapped the actual benefit flow, or only the named counterparty?

Stage two: the internal investigation – what the EU criminal test requires

The EU directive criminalises intentional conduct. That means the internal investigation must assess, at an early stage, what the relevant individuals knew, what they were told, and when. This is different from civil sanctions enforcement, which in several Member States operates on an objective basis similar to OFSI's strict-liability civil regime in the UK.

The investigation should reconstruct the decision sequence. Who approved the transaction? What screening was run, and against which lists? What was the ownership-and-control analysis of the counterparty? Did anyone raise a concern internally that was not escalated? The paper trail answers all of these questions – one way or the other.

The EU ownership-and-control test for asset-freeze purposes applies a criterion of more than 50 percent for direct ownership, and an assessment of control that looks beyond legal form to practical reality. A transaction with a non-listed counterparty is not automatically safe if a listed person controls it through indirect ownership or through board appointment and veto rights. In our cross-border practice, the control leg of the analysis is where previously undetected exposure most often surfaces.

Document the investigation methodology. If the matter proceeds to a national prosecutor, the quality and candour of the internal investigation will be visible. An investigation that appears designed to establish innocence rather than establish facts is not an asset in an enforcement context.

Stage three: voluntary disclosure and co-operation – does silence protect you?

A persistent assumption among clients facing potential criminal exposure is that staying silent is the safer course. It is the single most costly error we see in this area. The assumption is wrong for at least three reasons.

First, other parties to the same transaction – a bank, a freight forwarder, an insurer – may already be reporting to their own national competent authority. The EU transfer-of-funds and AML regimes generate reporting obligations across the transaction chain. A corporate that holds back while its counterparties report is not invisible; it is late.

Second, voluntary disclosure and co-operation are recognised mitigating factors in most Member State enforcement regimes. The UK and US equivalents are explicit on this point: OFAC's Enforcement Guidelines treat voluntary self-disclosure as a significant mitigant, and OFSI's enforcement approach assigns weight to co-operation. The EU directive does not mandate a uniform voluntary-disclosure credit, but national implementing legislation in most Member States provides for mitigating effect. Early disclosure preserves that credit; delay erodes it.

Third, and most practically: a national authority that discovers a breach through its own investigative resources, rather than through disclosure, will approach the matter differently. The narrative of the enforcement action changes. That change matters for penalty levels, for decisions about whether to prosecute a legal person as well as individuals, and for the broader regulatory relationship.

Voluntary self-disclosure – a VSD (a disclosure made to the competent authority before or without enforcement action being initiated) – should be prepared carefully. The content and timing of a VSD are legal decisions. The scope of what you disclose, the legal characterisation you attach to the facts, and the remediation steps you commit to are all elements that counsel should review before submission.

Stage four: the national authority process and cross-border exposure

Once a national competent authority is engaged – whether through disclosure or through its own investigation – the process becomes national. The EU directive sets the offences; national criminal procedure governs everything else: arrest powers, search and seizure, legal privilege, and the procedural rights of the accused entity and its officers.

A multinational must run the cross-regime comparison at this stage, not later. The same transaction will often engage more than one jurisdiction's criminal liability rules.

Under OFAC, civil liability is strict – no knowledge or intent is required for the violation itself – but the criminal exposure under IEEPA requires a wilful violation. OFAC's blocking and rejection report obligations run within 10 business days and are independent of any criminal investigation. A business that has blocked property and has not reported has a separate, running exposure. Sanctions records must be kept for five years under OFAC rules.

Under OFSI, the civil regime is strict-liability, and the maximum monetary penalty is the greater of £1,000,000 or 50 percent of the breach value, as currently in force. There is also a legal obligation on relevant firms to report knowledge or suspicion of a designated person to OFSI. A business that has EU criminal exposure and UK civil exposure from the same transaction is managing two enforcement timelines, often with different privilege and disclosure rules.

The broader point: where two or more regimes both apply, the stricter prohibition governs conduct for a person subject to both. A business that has analysed only the EU position and overlooked its US dollar-clearing exposure has not done the analysis.

In a recent matter, a manufacturing group with EU and US operations identified that a counterparty in a third market was listed under an EU programme at the point of settlement. We mapped the ownership chain, identified that the US dollar-clearing bank had a separate OFAC reporting obligation already running, co-ordinated the disclosure strategy across the two regimes, and prepared the VSD submissions. The matter was resolved without criminal referral. We set that out not as a guarantee of outcome but as an illustration of what co-ordinated, early action can achieve.

Stage five: after the enforcement interaction – the compliance remediation

An enforcement interaction – whether it ends in a formal penalty, a warning, or a closure decision – generates its own compliance requirements. The authority will expect remediation. The board will require it. Regulators in neighbouring jurisdictions may ask about it.

Effective remediation after a criminal-adjacent EU sanctions matter has five elements. First, a root-cause analysis of the breach: not a process description, but a causal account of why existing controls did not prevent it. Second, a redesign of those controls – screening logic, ownership-chain mapping, escalation procedures, and the training that supports them. Third, testing the redesigned controls against the facts that produced the breach. Fourth, documentation that the redesigned programme has been approved at board level. Fifth, a review cycle date that is binding, not aspirational.

Sanctions screening obligations attach on a risk basis. The legal standard is not that a name was run through a tool; it is that the programme was calibrated to the actual risk posed by the business's counterparties, sectors, and transaction types. "We screened the name" is not by itself a complete control. The calibration question – whether the screening thresholds, the list coverage, and the ownership-chain depth were adequate for the risk – is the question an authority will ask.

We regularly advise on compliance-programme redesign following enforcement interactions. The starting point is always the root-cause analysis; a programme rebuilt without it will fail at the same point again.

Common risk flags and when to involve counsel

The risk flags that precede criminal exposure under the EU regime follow a recognisable pattern. Identifying them early is the purpose of a functioning compliance programme.

Ownership-chain opacity is the single most common precursor. A counterparty whose ownership cannot be established beyond the first corporate layer is not automatically a prohibited counterparty, but it is one where the business bears an elevated burden of establishing that no listed person is caught by the EU control test. A sharp change in trade flows through a third-country jurisdiction that was not previously used is treated as a diversion red flag and should prompt a full re-screening.

AIS transmission gaps in maritime transactions, unusual payment routing through intermediary jurisdictions, and requests to re-invoice or re-route goods are all documented red flags in enforcement practice. Their presence does not establish intent, but their presence combined with a failure to escalate and record the escalation is the factual pattern that most closely resembles wilful blindness – the mental state that brings a person close to the intentional-conduct threshold.

Counsel should be instructed before the business responds to any regulatory communication, before any voluntary disclosure is made, and before any employee gives an account to an investigator. The decision about whether to disclose, what to disclose, and when is not a decision a compliance team should take without legal advice. Privilege considerations are complex in a cross-border context and differ by Member State.

The myth that silence is protective is particularly dangerous in the EU criminal regime precisely because the directive is designed to increase effective enforcement. A business that holds back while a national authority builds its own picture will find that the mitigation credit it declined to take has instead become evidence of deliberate non-co-operation. We have acted in matters where that shift was the single most consequential factor in the outcome.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.