EU overhauls and strengthens enforcement of EU sanctions

As we previously reported (see here), the past year has been marked by an increased focus on enforcement of EU sanctions. 

With enhanced cooperation at an EU level and fines possibly going beyond 5% of a company’s global turnover, the EU now seems to be showing its teeth by adopting Directive (EU) 2024/1226 (the “Directive”; see here) and companies may feel the bite.

From national enforcement of EU sanctions…

At present, enforcement of breaches of EU sanctions is primarily left to national competent authorities and appropriate penalties must be implemented on a national level. However, this has led to disparities in the level and types of penalties (e.g. administrative and/or criminal liability, penalties, liability of legal persons, etc.) and resulted in inconsistent enforcement throughout the EU.

In light thereof, the European Parliament and the Council adopted the Directive on 24 April 2024. The Directive sets out the minimum rules which will need be transposed into national law, noting that the Member States may go further in their enforcement against breaches of EU sanctions. 

… to enforcement at the EU level

The Directive requires Member States to ensure that a broad range of intentional breaches of EU sanctions constitute a criminal offence under their national laws, including breaches relating to (i) freezing funds and economic resources, (ii) making funds and economic resources available, (iii) the entry into, or transit through, the territory of a Member State, (iv) sectoral economic and financial measures (including financial and technical assistance), and (v) arms embargoes.

In addition, the Directive requires Member States to adopt a range of ancillary rules to ensure a level playing field throughout the EU:

• the maximum penalties for natural persons must include at least five years’ imprisonment, with the maximum penalty for e.g. breaches of an asset freeze in respect of funds exceeding EUR 100,000 (on the date when the offence was committed). Additional penalties may also apply, such as the withdrawal of permits and authorisations;

• penalties must be imposed on legal entities when (i) persons having a leading position within that legal entity have committed a breach of EU sanctions for the benefit of the legal entity, where or (ii) there is a lack of supervision or control which has made such breaches possible, with penalties which include high criminal or non-criminal fines that should either be not less than 5 percent of the total worldwide turnover or, alternatively, not less than EUR 40 million. In both cases, Member States are granted some limited leeway on how to calculate the absolute amounts or the turnover (either based on the business year preceding the one in which the offence was committed, or preceding the fining decision);

• whistleblowing measures must be put in place, allowing courts to take into account as a mitigating circumstance that an offender provided the authority with information they would otherwise not have been able to obtain and which helps identify or bring to justice other offenders or find evidence, and granting protection to whistle-blowers under the Whistle-blower Directive (EU) 2019/1937;

• inciting, aiding and abetting, as well as attempting breaches of EU sanctions must also be punishable as a criminal offence (although there are exceptions for attempted breaches of the prohibition on circumvention);

The Directive also provides for minimum harmonisation of rules on aggravating circumstances (such as organised crimes, offences involving false or forged documents, offences committed by public officials, etc.), mitigating circumstances (in case of useful cooperation with the sanctioning authorities), confiscation of the proceeds of the breach, and rules on jurisdiction and limitation periods.

Member States may decide not to criminalise violations involving funds, economic resources, goods, services, transactions or activities of a value of less than EUR 10,000. However, this does not affect any obligations set out in Union restrictive measures.

The Directive also strengthens collaboration on a European level, in particular with Eurojust, Europol and the EPPO, which may lead to more enhanced enforcement. 

Of special note is that the Directive requires legal professionals to report violations of EU sanctions when providing legal, financial and trade services, though professional secrecy / privilege is preserved with regard to information obtained in the course of ascertaining a client’s legal position and in the course of representing clients before courts, administrations and arbitral proceedings. Exceptions apply, however, when the legal professional takes part in the violation of EU sanctions or knows that the client is seeking legal advice for the purposes of violating EU sanctions.

Nothing in the Directive should be understood as imposing any obligations on individuals that would prejudice their rights not to incriminate themselves and to remain silent.

What now?

The Directive will enter into force on 19 May 2024. However, this is only the first step: EU Member States still need to transpose it into their national laws by 20 May 2025.

The Commission has stressed that the harmonisation of enforcement of EU sanctions enforcement is urgent, given the unprecedented scope of the sanctions regime against Russia and Belarus. 

If you would like to discuss any aspect of the new regime, please reach out to the contacts on this post, or to your usual Linklaters contact(s).