Penalty calculation methodology under EU: step by step

A compliance officer at a European subsidiary receives a letter from the relevant national competent authority. It references a transaction that cleared eighteen months ago. A question sits at the bottom of the letter: how will the penalty be calculated if the inquiry turns into a formal finding? The answer is not arbitrary. EU sanctions enforcement follows a structured methodology – and understanding that methodology before the process reaches its conclusion is the difference between a defensible position and a preventable escalation.

The EU penalty calculation methodology under the major Council regulations begins with establishing the legal basis for the finding, then moves through a sequence of aggravating and mitigating factors that determine the final figure. The regime is strict-liability in character: the absence of intent does not eliminate the violation, though it affects the severity of the sanction. As of January 2026, the EU's criminalisation directive requires member states to set minimum penalties – with maximum imprisonment terms of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover – though transposition across member states continues at different speeds. Where the UK and US regimes follow their own distinct methodologies, the EU approach is notable for operating through national enforcement authorities rather than a single central body.

This guide walks one representative engagement from the moment a potential violation surfaces through to the final enforcement outcome, identifying the key decision points, the analytical steps a practitioner takes, and the cross-regime comparisons that matter most to a board facing this situation.

Step one: confirming that a violation has occurred

The first task in any EU sanctions enforcement matter is establishing whether conduct actually constitutes a violation under the applicable Council Regulation. This sounds obvious, but it is the step most often compressed under time pressure – and the one that shapes every calculation that follows.

EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person. That formulation is broader than it appears. A payment routed through a chain of intermediaries can still constitute prohibited conduct if a listed person benefits at the end of it. The question is not whether the client intended to benefit a listed person; the question is whether, on the facts, a listed person did benefit.

In our cross-border practice, the most common point of genuine uncertainty at this stage is whether the counterparty was, at the time of the transaction, actually subject to an asset freeze. EU listings are reviewed periodically – commonly every six or twelve months depending on the programme – and a company's listing status can change. Transactions that were compliant at the point of execution may post-date a re-listing. Or a company may have been de-listed before the transaction, making conduct that looks problematic on a current-list search entirely lawful on the facts.

Practitioners also need to apply the EU control test at this stage. Where a counterparty is not itself listed, the question is whether a listed person holds ownership of more than fifty percent or exercises control over it. That threshold and control test determine whether the counterparty is itself caught. If the control test was not applied before the transaction, and the enforcement authority later concludes that it should have been, that gap in due diligence is itself relevant to the aggravating-factor analysis.

Document everything found at this stage. The quality of the contemporaneous record is one of the most powerful variables in the subsequent methodology. A well-documented, good-faith compliance review conducted at the time of the transaction is evidentially useful. A reconstruction built after the letter arrives is not.

Step two: identifying the governing authority and the applicable national regime

Unlike OFAC in the United States or OFSI in the United Kingdom, there is no single EU-level enforcement authority for sanctions violations. EU sanctions are imposed by Council Regulation – directly applicable across all member states – but enforcement is a matter of national law. Each member state designates its own competent authority, sets its own penalty scale, and applies its own procedural rules to investigations and penalty decisions.

This architecture matters for the calculation methodology because the penalty exposure for identical conduct can differ substantially depending on which member state's authority is conducting the inquiry. Some national regimes have civil-penalty frameworks with defined maxima. Others lead with criminal liability. The EU criminalisation directive, which required transposition by 20 May 2025, sets minimum standards – at least five years' maximum imprisonment for serious offences and corporate fines expressed as a percentage of worldwide turnover or a defined fixed maximum – but transposition was still ongoing through 2026, and the effective framework in each member state must be verified against the national implementing legislation.

For a business with operations in multiple member states, this creates an important threshold question: which authority will lead, and are there parallel risks in other jurisdictions? In our experience, multinationals sometimes assume that a single national inquiry closes off the risk elsewhere. It does not. Where the same transaction touches operations in two member states, both competent authorities can, in principle, investigate.

The cross-border dimension does not stop at EU borders. The same transaction may also engage OFAC jurisdiction if it involves a US person, a US financial institution in the payment chain, or US-dollar clearing. OFAC operates its own civil-penalty methodology entirely independently of the EU process. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both – and parallel processes mean parallel penalty exposures. This is the moment to instruct counsel with sight of both regimes.

Step three: mapping the aggravating and mitigating factors

Once the violation is confirmed and the governing authority identified, the substantive penalty calculation begins by mapping the full set of factors that will move the figure up or down. The EU regime – at both the directive level and through national implementing guidance – organises these factors into aggravating and mitigating categories.

Aggravating factors typically include the duration of the prohibited conduct, the value of the funds or economic resources involved, the degree of deliberateness or negligence, the seniority of personnel involved, and whether the entity derived a financial benefit from the violation. Prior violations, or a history of non-compliant conduct, will be weighed against the current matter. Where the conduct involved obscuring the nature of the transaction or making it harder for screening systems to detect the prohibited element, that is treated as a serious aggravating consideration.

Mitigating factors pull in the other direction. Voluntary self-disclosure to the competent authority is a recognised mitigating factor in most national frameworks, and the EU criminalisation directive affirms that cooperation with the investigation is relevant to the severity of the sanction. The quality and maturity of the compliance programme at the time of the violation also matters: a programme that was genuinely well-designed and properly resourced, but that the violation slipped past, is treated differently from a programme that existed only on paper. Prompt remediation – freezing the relevant accounts, correcting the record, implementing controls to prevent recurrence – demonstrates good faith and is routinely raised in mitigation.

The myth that staying silent is safer than self-disclosing is one of the most persistent and damaging misunderstandings we address. Silence does not preserve options. It removes them. An authority that discovers a violation through its own inquiry, without prior disclosure, will treat the absence of voluntary disclosure as an aggravating factor – or, in some national frameworks, as evidence of deliberate concealment. The practical effect is a materially higher penalty and a harder path to any settlement. Early legal advice is essential precisely because the decision on disclosure must be made before the authority's position hardens.

How does EU penalty methodology differ from OFAC and OFSI?

The EU methodology shares the broad structure of a sanctions-penalty analysis with the US and UK regimes, but the differences in design are significant and have practical consequences for a business facing cross-border exposure.

OFAC operates a centralised federal authority with published Enforcement Guidelines that set out an explicit framework for egregious and non-egregious violations, and for the role of voluntary self-disclosure in reducing the base penalty. OFAC's civil-penalty liability is strict: knowledge or intent are not required for the violation itself. Blocked-property and rejected-transaction reports must be filed within ten business days, and records must be kept for five years. These are fixed, published requirements that apply uniformly across all OFAC-administered programmes. The statute of limitations for civil and criminal violations was extended to ten years in 2024.

OFSI in the United Kingdom operates a strict-liability civil-penalty regime under SAMLA. The maximum penalty is the greater of £1,000,000 or 50 percent of the value of the breach. OFSI's enforcement and monetary penalty guidance, revised in early 2026, introduced an early account scheme, a settlement scheme with a defined discount, and fixed penalties for specified procedural breaches – creating a more granular penalty ladder than was previously in place. A reporting obligation also applies: relevant firms must report knowledge or suspicion of designated persons to OFSI.

The EU approach is distinctive in three ways. First, enforcement is decentralised: each member state's competent authority applies national penalty rules within the floor set by the directive. Second, the EU framework sits alongside criminal liability in a way that the civil-penalty frameworks of OFAC and OFSI do not by default: the criminalisation directive makes imprisonment of at least five years the expected maximum for serious offences, and member states may go further. Third, the EU Blocking Regulation can prohibit EU operators from complying with specified third-country measures – creating a structural tension for businesses subject to both US and EU jurisdiction that has no direct equivalent in the other regimes.

For compliance counsel advising a business with exposure across all three regimes, the practical implication is that a single remediation plan will not serve all three authorities equally. The OFAC voluntary self-disclosure process, the OFSI early account and settlement mechanisms, and the national-authority processes across EU member states each have their own procedural requirements and their own timelines. Coordination is essential, and it must begin early.

Step four: applying the calculation and preparing the penalty model

With the violation confirmed, the authority identified, and the aggravating and mitigating factors mapped, the practitioner can build a penalty model. This is not a simple arithmetic exercise. It is an analytical product that serves two purposes simultaneously: it informs the client's own risk assessment, and it forms the foundation for any representations made to the authority during the inquiry or any settlement negotiation.

The penalty model for an EU matter typically works through the following sequence. Start with the maximum penalty under the applicable national framework – expressed either as a fixed monetary cap, a percentage of worldwide turnover, or both. Apply the value of the transaction or funds involved, since that figure anchors any proportionality analysis. Then work through the aggravating factors systematically, identifying which apply on the facts and – where the national framework permits – what weight each is likely to carry.

The mitigating factors are then set against the aggravating ones. This is not a netting exercise in the mathematical sense: it is a structured presentation of the balance. Where voluntary self-disclosure has been made, or where the compliance programme was materially well-designed at the relevant time, those points are made explicitly and with supporting evidence. A compliance programme assessment – either one that existed before the inquiry, or one commissioned promptly after the violation was discovered – is the most useful document at this stage.

What does a completed model look like? In our experience, it identifies a range rather than a single figure, with a base case, a stressed case reflecting the authority's likely opening position, and a mitigated case reflecting the best achievable outcome on the facts. Presenting the full range to the board, rather than only the base case, is essential: boards that see only the base case are routinely surprised when an authority's opening position is materially higher.

One practical point on the compliance programme itself: the EU sanctions regime, like OFAC and OFSI, treats a programme that was genuine and well-resourced differently from one that existed on paper. Screening that relies on a name match without ownership and control analysis is not a complete control. The EU control test – the more than fifty percent ownership threshold and the broader control analysis – must be embedded in the screening logic, not treated as a manual check reserved for difficult cases.

Step five: presenting the case and engaging with the authority

The final phase of the engagement is the presentation of the client's position to the competent authority. This phase determines whether the penalty model's mitigated case is achievable in practice.

Most national authorities in the EU allow the subject of an inquiry to make representations before a final penalty decision is issued. The timing and format of those representations vary by jurisdiction, but the opportunity is almost always available and almost always material to the outcome. Missing the representations window – or submitting representations that are not precisely calibrated to the authority's framework – is one of the most avoidable ways to leave mitigation on the table.

The representations should address, directly and in order, each of the aggravating factors the authority is likely to weigh, and each of the mitigating factors the client can demonstrate. They should be supported by documentary evidence: the compliance programme materials as they existed at the time of the violation, the screening records, the due diligence conducted on the counterparty, the remediation steps taken since the violation was identified, and any voluntary disclosure made. Where the client operates in multiple member states, the representations should also address what the client has done to ensure that the risk does not recur elsewhere in the group.

Settlement is available in many national frameworks, and where the authority's framework includes a defined discount – as OFSI's revised guidance does in the UK – that discount is a material consideration. Engaging with the settlement process early, before the authority's position has hardened, produces better outcomes than entering it late under pressure. This is true in the EU context as it is in the UK and US contexts.

A word on the criminal dimension. Where the matter is referred to a criminal prosecutor – either because of the gravity of the conduct or because the national framework routes certain violations automatically to criminal proceedings – the position changes materially. Criminal exposure means different procedural rights, different evidentiary standards, and different counsel. The enforcement analysis must be reframed accordingly, and the board must understand that the civil and criminal tracks can run in parallel.

Risk flags: when to involve counsel immediately

Not every compliance query requires immediate external counsel. But certain facts change the risk profile sharply, and those are the moments when internal escalation to the board and engagement of external sanctions counsel should happen without delay.

The first flag is a formal inquiry letter or dawn raid. Once the authority has opened a formal inquiry, the client's options narrow and the clock starts running on response deadlines. Representations made without legal advice at this stage can foreclose arguments that would otherwise have been available.

The second flag is cross-jurisdictional exposure. Where the same facts engage OFAC, OFSI, and one or more EU national authorities simultaneously, the representations strategy must be coordinated. Inconsistencies between what is said to one authority and what is said to another are a serious aggravating risk.

The third flag is personal liability for directors or compliance officers. The EU criminalisation directive's minimum standards for individual criminal liability mean that in the most serious cases, personal exposure for senior individuals is a real possibility, not a theoretical one. Individuals in that position need separate legal advice from the advice given to the company.

The fourth flag is a large transaction value. Where the value of the funds or economic resources involved is significant – whether measured against the applicable national penalty cap or against turnover – the financial exposure is material enough to justify early investment in specialist advice. A well-prepared penalty model and a properly sequenced disclosure strategy can reduce the final figure substantially compared with an uncoordinated response.

Have you conducted a full mapping of which national authorities could be engaged by the facts at hand? In our experience, that mapping is incomplete in the majority of first instructions we receive on multi-jurisdictional matters.

Related practices

• Corporate liability and attribution under OFSI – assessing how enforcement liability is attributed to corporate groups under UK sanctions
• EU penalty calculation: advanced issues – deeper analysis of turnover-based fines and cross-border coordination

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.