Penalty calculation methodology under EU: procedure and pitfalls

A cross-border business receives a formal inquiry from a national competent authority enforcing EU sanctions. The first question from the board is always the same: how bad could this get? Behind that question sits a methodology that is far more structured than most compliance teams realise – and far less predictable than most assume.

EU sanctions penalty calculation does not follow a single codified formula. Instead, national competent authorities in each member state apply the EU-level maximum thresholds established by the EU criminalisation directive – which sets out minimum standards including corporate fines expressed as a percentage of worldwide turnover or a fixed maximum – alongside their own national transposition rules, prosecutorial discretion, and aggravating or mitigating factors. As currently in force, verify the current position in the relevant member state before relying on it. Understanding this two-layer structure is the starting point for any realistic exposure assessment.

This guide addresses the questions practitioners and compliance teams most frequently ask: what drives the quantum of an EU penalty, how the methodology differs from OFAC and OFSI approaches, where the common calculation errors occur, and when to bring in specialist counsel.

What is the legal basis for EU sanctions penalties, and who has authority to impose them?

EU sanctions penalties are ultimately a matter of national law, applied within a minimum-standards floor set at EU level. The EU's criminalisation directive requires member states to establish criminal penalties for serious violations of EU sanctions, with maximum terms of imprisonment of at least five years for the most serious offences. For legal persons, the directive specifies corporate fines expressed as a percentage of worldwide turnover or a fixed maximum. Member states were required to transpose that directive by 20 May 2025. Infringement proceedings were opened against those that had not done so, and transposition continued through 2026.

Beneath the directive sits the primary sanctions architecture. EU sanctions are imposed by Council Regulation (directly applicable across all member states) and by Council Decision. The Regulation is self-executing. It does not require domestic legislation to take effect. But enforcement – the investigation, the decision to prosecute or to impose an administrative penalty, and the calculation of the amount – runs through the national competent authority of each member state where the violation occurred or where the legal person is established.

This means the same underlying breach – say, making funds available to a listed person in breach of an asset-freeze – can attract different penalty outcomes depending on the member state that acts on it. A business with operations in multiple EU jurisdictions should map each enforcement authority separately. That comparative analysis is one of the first exercises we conduct in any multi-jurisdictional EU enforcement matter.

How does EU penalty calculation methodology differ from OFAC and OFSI?

The contrast between the EU, OFAC, and OFSI approaches is not merely procedural – it reflects fundamentally different theories of what a penalty is designed to do. Understanding those differences tells you where the exposure sits and which regime poses the sharper risk for a given business.

Under OFAC, civil liability is strict: knowledge and intention are not required for the violation itself, though they are highly relevant to the penalty calculation. OFAC's Enforcement Guidelines set out a framework of egregious and non-egregious cases, with voluntary self-disclosure (a VSD, meaning a voluntary report to OFAC before it learns of the breach independently) recognised as a significant mitigating factor. Blocked-property reports are due within 10 business days. Records must be kept for five years. The transaction-level basis means a large volume of small transactions can rapidly multiply the nominal maximum, even for a single underlying programme. For a deeper analysis of the OFAC methodology, see our guide at https://caldervance.com/insights/guides/penalty-calculation-methodology-ofac-guide/.

Under OFSI, the position is equally strict at the liability stage. OFSI can impose monetary penalties on a strict-liability basis, in force since 2022. The maximum penalty is the greater of £1,000,000 or 50 percent of the value of the breach. OFSI's enforcement approach also recognises mitigating factors, and there is a legal obligation on relevant firms to report knowledge or suspicion of designated persons. Our OFSI-specific guide covers the calculation methodology in detail: https://caldervance.com/insights/guides/penalty-calculation-methodology-ofsi-guide/.

The EU approach diverges in one structurally important way. Because enforcement runs through national authorities, there is no single uniform penalty calculation guide equivalent to OFAC's Enforcement Guidelines. The directive sets the floor; national law and prosecutorial practice set the ceiling and the methodology. For a corporate, that means the percentage-of-worldwide-turnover basis can produce very large exposure numbers in jurisdictions whose national rules apply it broadly. Has your legal team modelled the turnover-based maximum alongside the fixed maximum? That comparison often changes the risk picture significantly.

What are the steps to model the penalty calculation under EU?

Penalty modelling for an EU sanctions matter follows a sequence. Each step narrows the range; skipping a step leaves a gap that the regulator will fill less favourably than you would.

Step 1: Identify the member state or states with enforcement jurisdiction. Jurisdiction can rest with the state where the legal person is established, where the funds or assets were held, where the transaction was processed, or where the beneficiary is located. In a cross-border group structure, more than one authority may have a legitimate claim. Early in an investigation, this question can be as consequential as the substance of the breach itself.

Step 2: Establish which national transposition framework applies. Member states have transposed the criminalisation directive at different speeds and with varying degrees of fidelity. Some have existing administrative-penalty regimes that pre-date the directive. Others have layered criminal liability on top. Knowing which framework governs the alleged breach – administrative, criminal, or both – determines the applicable maximum and the procedural rights available to your client.

Step 3: Identify the base metric. Under the directive, for legal persons the fine can be calculated as a percentage of worldwide annual turnover. Alternatively, a fixed maximum may apply. The choice between these bases usually turns on national transposition; in some systems, the prosecutor may have discretion. Where the turnover base is available, the relevant figure is typically the group's consolidated worldwide turnover in the preceding financial year – not the revenue of the subsidiary that committed the breach. That distinction drives a material difference in the maximum.

Step 4: Apply aggravating factors. These typically include: duration of the violation; its systematic or repeated character; the seniority of personnel involved; deliberate concealment; and the financial benefit obtained. A violation that continued after the business became aware of it is almost always treated as an aggravated case.

Step 5: Identify mitigating factors and early co-operation opportunities. Voluntary disclosure, early co-operation with the investigation, prompt remediation, and absence of prior enforcement history all bear on the final figure. The weight given to each factor varies by jurisdiction. In our cross-border practice, we see significant divergence between member states in how heavily they credit a well-prepared disclosure – making early advice on how and where to disclose a genuinely consequential decision.

Step 6: Consider criminal exposure alongside administrative liability. The directive requires member states to establish criminal liability for natural persons, with maximum terms of at least five years for the most serious offences. Where the breach involved senior management, or where concealment is alleged, criminal exposure may sit alongside the corporate administrative penalty. These two tracks require different legal strategies and should not be handled as a single matter.

Step 7: Map secondary exposure under other regimes. An EU enforcement inquiry rarely operates in isolation. A breach of an EU asset-freeze that also involves a US-nexus transaction may simultaneously attract OFAC attention. OFSI has its own reporting obligations and its own penalty track. Where the goods involved are dual-use items, export-control liability under the recast EU Dual-Use Regulation may arise in parallel. The interaction between these regimes is not automatically managed by resolving one; each must be assessed on its own terms. For questions on the OFSI dimension of a parallel matter, our team's work is described at https://caldervance.com/services/enforcement-investigations/corporate-liability-attribution-ofsi-service/.

What are the most common pitfalls in EU penalty calculation methodology?

The most persistent mistake is treating the maximum penalty as a ceiling rather than a reference point, and then assuming the actual penalty will land well below it. That assumption often fails in EU matters for two structural reasons. First, where the turnover-based maximum applies, the absolute figure can be very large even at a modest percentage. Second, national authorities in some member states have signalled a move toward higher-value enforcement as a policy priority, which means historical enforcement patterns are not a reliable guide to current practice.

A second common error is scoping the breach too narrowly. EU asset-freeze prohibitions extend not only to direct transfers but to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. A transaction that did not involve a direct payment to a listed person may still fall within scope if it made economic resources available for the benefit of such a person. Compliance teams that apply a "payment screening only" logic miss exactly this exposure.

A third pitfall is applying the ownership-and-control test incorrectly. The EU control test looks at both direct and indirect ownership above fifty percent and at the concept of control more broadly. An EU court ruling addressed in September 2026 reaffirmed that control must be proved by objective and sufficiently weighty evidence. That ruling matters for businesses trying to assess whether a counterparty is captured through a listed shareholder: the standard is evidentiary, not merely structural. We regularly advise clients on how to build and document that analysis.

A fourth area of error: the myth that silence is strategically preferable to disclosure. We address that directly below.

Is staying silent safer than self-disclosing to an EU authority?

This is the most frequently misunderstood point in EU sanctions enforcement, and the misunderstanding consistently produces worse outcomes for the businesses that hold it. The argument for silence usually runs: voluntary disclosure tells the regulator something it might not otherwise know, and that cannot be undone. That logic is operationally correct but strategically backwards for most EU matters.

Consider what the counterfactual looks like. EU authorities have access to financial intelligence, suspicious transaction reports, and information shared across member-state networks. Detection rates for significant violations are not low. An authority that discovers a breach independently – before your disclosure – is far less likely to weight co-operation heavily in the penalty calculation, and is more likely to treat concealment as an aggravating factor. In several member states, the window within which a disclosure qualifies as voluntary is explicitly time-limited once an investigation is opened.

The better framing is not "disclose or do not disclose" but "prepare to disclose, or be caught unprepared." A well-prepared disclosure is an evidential exercise: it identifies the scope of the breach, demonstrates the causal factors, shows what has been remediated, and presents the mitigating case in its strongest form. That preparation takes time. An unplanned, reactive disclosure – made after the authority has already made inquiries – carries significantly less mitigating weight than one that arrives before the inquiry begins.

We have acted for businesses that came to us having already decided to disclose and needed help constructing the disclosure package, and for businesses that were uncertain whether the conduct in question was a breach at all. The analysis in each case begins with the facts, not with a presumption about strategy.

What risk flags indicate that EU penalty exposure is likely to be higher?

In our experience advising on EU enforcement matters, the following factors consistently push penalty exposure upward, and each of them is worth assessing at the earliest stage of an inquiry.

Duration and volume. A breach that continued over an extended period, or that involved a pattern of transactions rather than a single event, will typically attract a higher base penalty. Regulators tend to view a sustained pattern as evidence that the compliance programme was systematically inadequate rather than transiently overwhelmed.

Senior management involvement. Where a natural person in a management position was aware of or directed the conduct, the authority has grounds to pursue both corporate and individual liability. Individual criminal exposure changes the strategy for the matter fundamentally: the interests of the company and of the individual may not be aligned, and separate representation should be considered early.

Obstruction or concealment. Any step that creates the appearance of managing or disguising a transaction to avoid detection – including routing payments through additional layers without commercial justification – is treated as seriously aggravating. This is not only an ethical boundary; it is a practical risk-multiplier that no well-advised business should approach.

Repeated or prior conduct. Prior enforcement history, including in other jurisdictions, can be considered by a national authority assessing proportionality. A business with a prior OFAC or OFSI penalty should flag that history early when assessing EU exposure.

Failure to remediate promptly. A breach that the business identified internally and then allowed to continue without prompt action to stop it is treated differently from a breach that was stopped the moment it was discovered. Internal records that demonstrate when the issue was first identified, and what was done and when, are therefore evidence in both directions. Preserve them carefully.

Cross-regime exposure. Where the facts that constitute the EU breach also engage OFAC's jurisdiction – through a US-person nexus, a US-dollar transaction, or a technology controlled under the EAR – the total exposure picture is materially more complex. Each regime will assess the conduct under its own rules, and a settlement under one does not provide cover under the other. Sanctions records should be kept for five years under OFAC rules; equivalent obligations under EU and national law run on their own timelines.

When should a business involve sanctions counsel in an EU penalty matter?

The short answer is: before it prepares any written communication with the authority. The slightly longer answer is worth setting out, because the timing question is genuinely consequential.

A formal inquiry from a national competent authority will typically set a response deadline. That deadline frames everything that follows. The response the business files – its characterisation of the breach, the evidence it produces or withholds, the representations it makes about mitigating factors – becomes the foundation of the authority's enforcement analysis. Inconsistencies between the initial response and later representations are exploited in any subsequent proceeding. Getting the first response right matters more than getting it fast.

At the same time, earlier involvement allows counsel to assess whether the conduct constitutes a breach at all, whether reporting obligations are already running in parallel (under OFSI, OFAC, or another regime), whether internal records need to be preserved under litigation hold, and whether the business has an interest in getting ahead of the inquiry through a voluntary disclosure package. All of these questions are easier to answer before formal proceedings are opened than after.

We regularly advise multinationals, financial institutions, and exporters at precisely this juncture – the point at which the regulatory inquiry has arrived but the company's position is not yet fixed. The decisions made in that window typically have the largest bearing on the eventual outcome.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.