EU: fixed penalties for procedural breaches

A cross-border trading company receives written notice from a national competent authority in an EU member state. The letter references a procedural breach of the applicable EU sanctions regulation – a late submission, a missing record, a delayed notification. No asset freeze. No allegation of a substantive violation. And yet the letter carries real legal consequences. Fixed penalties (flat-rate financial sanctions imposed for procedural failings rather than for substantive breaches of prohibitions) are one of the least understood enforcement tools in the EU regime, and one of the most administratively consequential for businesses that operate across borders.

As of January 2026, EU member states are required to maintain penalty regimes covering both substantive and procedural violations of EU sanctions, following transposition obligations under the EU directive on the criminalisation of sanctions violations. A fixed or administrative penalty for a procedural breach is a civil-administrative measure – not a criminal conviction – but it creates a public record, triggers reporting obligations under some financial-institution frameworks, and can be a precursor to a deeper investigation. The governing legal authority is the applicable Council Regulation and the transposing national legislation in each member state.

This guide walks through the steps a business should take when it receives – or anticipates – a fixed-penalty notice for a procedural breach under the EU regime: from initial triage and legal-privilege protection, through the substantive response, to the remediation steps that close the matter and reduce future exposure.

Step 1: understand what a procedural breach is and is not

A procedural breach in the EU sanctions context is a failure to meet an administrative or reporting obligation imposed by the applicable Council Regulation or by national transposing legislation, as distinct from a substantive violation such as dealing with a designated person's assets or making funds available to a listed party.

Common procedural breaches include: failure to file a mandatory report within the required window after identifying a match; failure to maintain adequate records of a transaction or screening decision; failure to notify a national competent authority of a suspicion or of the existence of frozen assets; and failure to cooperate with an information request. These are obligations that sit alongside the core prohibitions. They are often strict in nature – meaning that the authority does not need to prove that the breach caused harm or that the firm knew it was falling short.

Why does the distinction matter? Because the procedural category determines which penalty track applies, what the authority must prove, and what mitigating arguments are available to you. A firm that conflates a procedural notice with an allegation of substantive evasion will over-respond in some directions and under-respond in others. In our experience, the first analytical step is always to establish precisely which obligation has been breached, under which instrument, and whether that characterisation is correct.

Different member states have transposed procedural penalty regimes differently. Some apply graduated fixed amounts by category of breach; others apply a proportionality assessment even for nominally fixed penalties. The substantive content of the obligation – and the procedural penalty attached to it – must be read against the national legislation of the member state whose competent authority has issued the notice.

Step 2: triage the notice and preserve legal privilege

On receipt of any formal notice or inquiry from a competent authority, the immediate priority is to establish what the authority already knows, what it is asking for, and whether any response deadline is already running.

Legal privilege is established at the moment legally privileged communications are created. It is not retroactive. Instructions to external counsel should issue before internal communications begin to characterise the facts, assess legal exposure, or draft proposed responses. In a cross-border matter – where a French, German, Dutch, or Spanish authority may be involved – the scope of legal privilege differs from its scope under English law or US attorney-client doctrine. The EU regime does not harmonise privilege; each national system applies its own rules.

Alongside privilege, the triage should answer four questions. First, is the notice from a competent authority with jurisdiction over your legal entity, or over a different member-state subsidiary? Second, does the notice allege a procedural breach only, or does it suggest the authority is also examining whether a substantive violation occurred? Third, are there parallel proceedings in another jurisdiction – including the UK under OFSI or the US under OFAC – that mean any statement made to the EU authority carries risk in a second forum? Fourth, is the response window in the notice measured in calendar days or business days, and what is the correct deadline?

We regularly advise clients who have treated a procedural inquiry as a minor administrative matter and responded without counsel, only to find that their response has conceded facts that the authority then used in a subsequent investigation. The notice is the start of a formal record. Treat it as one from the outset.

Step 3: reconstruct the facts and assess the breach

A well-constructed factual record is the foundation of every effective response to a procedural-penalty notice. Before advising on the substantive reply, we work through the underlying transaction or event with the client in detail – establishing what happened, in what sequence, and why.

The key questions at this stage are: Was the obligation triggered at all, on the facts? If so, when was it triggered – and was the firm's response within the required window? What was the firm's state of knowledge at the relevant time? Were there compliance controls in place that failed, or was there a gap in the control design? Is there documentary evidence of the steps taken?

The strict liability nature of many procedural obligations means that absence of intent is not a defence to the breach itself. It may, however, be directly relevant to whether the authority exercises a discretion to issue a fixed penalty at all, to whether a higher discretionary penalty is imposed instead, and to whether the matter is referred for criminal investigation. The EU directive on sanctions criminalisation sets minimum standards for when conduct becomes criminal, including a requirement of intent for the most serious offences. A procedural breach without intent is unlikely to cross that threshold – but the assessment must be made explicitly, not assumed.

Document preservation is non-negotiable at this stage. Nothing should be altered, deleted, or overwritten. If the firm's records are incomplete – because the procedural failure itself consisted of inadequate record-keeping – that gap must be documented as such, not filled retrospectively.

Step 4: assess the cross-regime dimension

The EU regime does not operate in isolation. A procedural breach in an EU member state frequently has a cross-border dimension that changes the risk picture materially.

Consider a financial institution headquartered in the Netherlands, with a London branch and a US dollar correspondent account. A failure to file a mandatory report with the Dutch authority concerning a customer who also appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) creates obligations simultaneously under the EU applicable Council Regulation, under the UK OFSI reporting requirement for relevant firms, and under OFAC's blocked-property and rejected-transaction reporting rules. Under OFAC's rules, blocked-property reports are due within 10 business days of the blocking event. Missing the EU procedural window is one problem. Missing the OFAC window at the same time is a separate, independent violation in a jurisdiction that applies strict civil liability with no knowledge requirement.

Under OFSI, the UK financial-sanctions regime imposes a legal obligation on relevant firms to report knowledge or suspicion of designated persons. That obligation operates independently of the EU requirement. The UK and EU ownership-and-control tests are broadly similar in structure – both look at ownership thresholds and actual control – but the national competent authorities administer them separately. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both; the obligations do not cancel each other out.

Swiss SECO, Canadian GAC, and Australian DFAT each maintain their own procedural reporting frameworks that may also be engaged. In our cross-border practice, multi-regime exposure is the rule rather than the exception for any financial institution or multinational with operations across more than one jurisdiction. Mapping the full cross-regime exposure at Step 3 – before drafting any response – is essential to avoid inadvertently waiving a privilege or making an admission that prejudices proceedings in another forum.

Does your response to the EU authority need to be coordinated with a parallel disclosure to OFSI or OFAC? That question must be answered by external counsel who can advise across all three regimes simultaneously.

Step 5: evaluate voluntary disclosure and the response strategy

Having established the facts and the cross-regime picture, the next decision is the response strategy. The central choice is between a reactive response – addressing the notice as framed by the authority – and a proactive posture that may include voluntary disclosure of related matters not yet known to the authority.

A common misconception is that staying silent is safer than disclosing. In practice, the opposite is frequently true. Regulators across the EU, the UK, and the US treat voluntary disclosure as a meaningful mitigating factor. Under OFAC's Enforcement Guidelines, voluntary self-disclosure (VSD – a proactive report of an apparent violation before the regulator identifies it) is a recognised mitigating factor that can materially reduce the civil penalty assessment. While the EU regime does not operate a single harmonised VSD scheme, many member-state competent authorities maintain their own cooperation and early-disclosure mechanisms, and the EU directive on sanctions criminalisation provides for cooperation as a mitigating factor in the criminal framework.

The EU directive – which member states were required to transpose by 20 May 2025 – sets minimum standards for criminal penalties, including maximum terms of imprisonment of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover or a fixed maximum. Procedural breaches without intent are unlikely to attract criminal penalties, but the existence of the criminal framework means that every procedural inquiry carries a residual risk assessment: could the authority, on seeing the full facts, form the view that the breach was wilful or repeated?

The response strategy should also address remediation. Competent authorities across the EU are more likely to treat a fixed-penalty notice as a closed matter – rather than an investigation trigger – where the firm can demonstrate that it has identified the root cause of the breach, corrected it, and put in place controls that make recurrence unlikely. A bare factual response without a remediation narrative leaves the authority's question unanswered: what confidence should we have that this will not happen again?

Step 6: draft the response and implement remediation

The written response to a procedural-penalty notice is a formal legal document. It should be precise, factually supported, and consistent with every other communication the firm has made or will make to any regulator about the same events.

An effective response addresses five elements. First, the factual account: a chronological narrative of the events giving rise to the alleged breach, supported by contemporaneous documents. Second, the legal characterisation: whether the authority has correctly identified which obligation was breached and whether that characterisation is contested. Third, the mitigating factors: the firm's compliance record, the absence of intent, any steps taken before the notice was received, and any cooperation offered. Fourth, the remediation already implemented: what controls have been changed, who is responsible, and what monitoring is in place. Fifth, any procedural objections: whether the notice was issued within any applicable limitation period, whether the authority has jurisdiction over this entity, and whether the penalty calculation methodology is correct.

Remediation in the EU sanctions context typically involves three workstreams running in parallel. The first is control redesign: reviewing the specific process that failed and replacing it with one that is documented, tested, and assigned to a named owner. The second is training: ensuring that the relevant staff understand the obligation and the revised process. The third is governance: reporting the breach and the remediation to the firm's compliance committee or board, and recording that report.

Sanctions screening obligations attach on a risk basis; a response that demonstrates only that the firm screened a name is not, by itself, a complete control. The authority will want to see that the screening logic was correctly configured, that it covered the relevant lists, and that the workflow for handling a potential match was designed to produce a compliant outcome within the required timeframe.

In a recent matter, a multinational trading firm received a procedural-penalty notice from a member-state competent authority following a delayed notification concerning a customer account. We reconstructed the full event record, confirmed that the breach was procedural and not substantive, mapped the parallel obligations in two other jurisdictions, and prepared a coordinated response that addressed each authority's specific requirements. The firm provided a detailed remediation plan alongside the response. The matter was treated as closed on the procedural track without further investigation.

Step 7: build the compliance-readiness checklist

The final step – and the one that prevents the cycle from repeating – is to convert the lessons from the inquiry into a standing compliance checklist. A fixed-penalty notice for a procedural breach is, in most cases, a signal that a control has failed. The question is whether the firm treats it as an isolated event or as diagnostic information about a systemic gap.

A practical EU procedural-compliance checklist covers the following areas. Reporting triggers: have you mapped every obligation in the applicable Council Regulation and the relevant national transposing legislation that requires a notification or report, and do your internal procedures specify who receives that trigger, who takes action, and within what timeframe? Record-keeping: are transaction records, screening decisions, match-resolution records, and ownership-chain documents retained for at least five years, consistently with the record-keeping period applicable across the major regimes? Ownership and control: does your screening programme extend beyond name matching on the designated-person lists to cover the ownership and control test (the EU test for whether a non-listed entity is caught through a listed person's ownership or actual control)? Cross-regime mapping: have you identified every jurisdiction in which your firm has procedural obligations arising from the same factual triggers, and are the response windows tracked centrally? Escalation path: is there a documented escalation route from the desk-level staff who identify a potential breach to the compliance officer, legal counsel, and board, with clear timeframes at each step?

The EU control test – which looks at ownership above fifty percent and at actual, practical control – requires active monitoring, not just a one-time assessment at onboarding. Counterparty ownership structures change. A firm that was not caught at the time of onboarding may become caught following a corporate restructuring. Your monitoring programme needs to be configured to detect that change.

Two questions drive the readiness assessment: does your compliance programme detect a procedural trigger in real time, or only in retrospect? And does your escalation path compress the time between detection and compliant action to within the required window? If the honest answer to either question is uncertain, a compliance review before the next notice arrives is the right course of action.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.