In an effort to further harmonise standards for punishing the violations of its sanctions and embargoes, the European Union has rolled out Directive (EU) 2024/1226 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673 (the “Directive”). The Directive was published in the Official Journal on 29 April 2024 and entered into force on 19 May 2024.
The Directive still needs to be transposed into the national legislation of the member states – which in Germany will mean that both natural persons and companies will face considerably stricter penalties, including significantly higher fines. As a last resort, businesses may even be wound up by court order.
I. Harmonising the definition of criminal offences for sanctions violations
The new Directive introduces EU-wide minimum standards for prosecuting violations of EU sanctions. Germany now has until 20 May 2025 to adapt national law to the stricter requirements.
1. Background
Responsibility for enforcing EU sanctions and punishing their violation in the EU primarily lies with the Member States. Because Member States are free to either penalise sanctions violations as criminal offences or treat them as (mere) regulatory offences, the individual enforcement regimes for sanctions violations vary widely across the EU.
Especially in light of Russia’s war of aggression against Ukraine and the significant expansion of EU sanctions against Russia that has followed, the EU has sought to harmonise enforcement of these sanctions across the Union. Under current law, the EU may only adopt minimum rules concerning the definition of criminal offences in the areas of particularly serious crime, such as corruption, money laundering and organised crime (cf. Article 83 TFEU) – a list that does not extend to violations of Union restrictive measures. However, the European Council is free to define additional areas of crime within the meaning of Article 83 TFEU if it identifies a corresponding cross-border dimension. It made use of this instrument in November 2022, thereby laying the foundation for the Directive.
2. What the Directive covers
The Directive identifies specific sanctions violations that Member States must categorise as criminal offences (cf. 2.1.) and defines minimum standards for the penalties and fines to be imposed in this regard (cf. 2.2.).
2.1 Criminal offences
Central to the Directive, Article 3 specifies which intentional violations Member States must define as criminal offences. These include:
- making funds or economic resources available to or failing to freeze funds or economic resources of a listed person subject to financial sanctions or enabling such a person to enter into the territory of a Member State (Article 3(1), letters (a) to (c));
- entering into or continuing prohibited transactions with a third State or a state-owned enterprise, including the award or continued execution of public or concession contracts (Article 3(1), letter (d));
- trading, importing, exporting, selling, purchasing, transferring, transiting or transporting sanctioned goods, as well as providing brokering services, technical assistance or other services relating to those goods (Article 3(1), letter (e));
- providing financial services or performing financial activities in violation of a prohibition (Article 3(1), letter (f));
- providing other prohibited services (Article 3(1), letter (g));
- circumventing sanctions in certain scenarios in connection with financial sanctions imposed on listed persons (Article 3(1), letter (h)) and
- breaching the conditions of authorisations granted by competent authorities (Article 3(1), letter (i)).
According to Article 3(2), Member States can stipulate that if the conduct involves funds or economic resources of less than EUR 10,000, such conduct does not constitute a criminal offence. Under Article 3(3), sanctions violations committed with serious negligence do however constitute criminal offences if the underlying transaction involves military or dual-use items. The German legislator will thus have to amend section 19 Foreign Trade and Payments Act (Außenwirtschaftsgesetz, “AWG”), which regulates regulatory offences that are subject to fine, to criminalise seriously negligent breaches of duty. Member States must also ensure by law that inciting and aiding and abetting the commission of – as well as the attempt to commit – the specified offences is punishable as a criminal offence.
2.2 Penalties and fines
Article 5 of the Directive contains the key provisions on penalties and fines for natural persons and Article 7 those applicable to companies:
Under Article 5(2), it must always be possible to punish persons involved in one of the aforementioned offences (cf. 2.1.) by imposing a term of imprisonment. The corresponding criminal provisions in section 18 AWG already stipulate imprisonment as the maximum penalty for any criminal act, meaning that no amendments are needed in Germany in respect of the penalty. The Directive imposes substantial maximum terms of imprisonment as minimum requirements for certain sanctions violations: Trading in sanctioned goods or violating transaction bans, for example, must be punishable by a maximum term of imprisonment of at least five years if the sanctions violation involves goods or transactions of a value of at least EUR 100,000. German law already provides for a corresponding punitive scope in section 18 AWG, at least for intentional sanctions violations. However, the German legislator will need to amend provisions regulating negligent sanctions violations currently classified as regulatory offences. Natural persons may also face the withdrawal of permits, disqualification from holding leading positions or bans on running for public office (Article 5(5) of the Directive).
Companies will be subject to heavier fines. For most of the sanctions violations covered by the Directive, Member States must set a maximum fine of at least EUR 40 million or 5% of the company’s total annual turnover (cf. Article 7(2), letter (b)). By comparison, the maximum fine that can currently be imposed under section 30(2), no. 1 Act on Regulatory Offences (Ordnungswidrigkeitengesetz, “OWiG”) is EUR 10 million. Article 7(1) enables Member States to introduce additional measures such as exclusion from public benefits and tender procedures, withdrawal of permits and authorisations and, as a last resort, the judicial wind-up of the company.
The Directive also sets out aggravating and mitigating circumstances that can be taken into account when determining penalties. Aggravating circumstances include committing the offence within the framework of a criminal organisation or when performing a public function, whereas helping the authorities with their investigation is regarded as a mitigating circumstance. The OWiG does not yet contain comparable provisions.
II. Outlook
Harmonised prosecution of sanctions violations across the EU means that individuals and businesses can expect a tightened, essentially uniform penalties regime in Member States.
Because Germany’s AWG already has stricter provisions on violations than other Member States (e.g. section 18), only part of the Directive needs to be implemented in Germany. This will nevertheless lead to considerable tightening of statutory provisions: Seriously negligent violations of the AWG – which were previously classified as (mere) regulatory offences under German law – must now in many cases be considered a criminal offence. Violations of transaction bans will likewise no longer be punishable as a regulatory offence, but instead as a criminal offence.
What will be especially interesting to businesses is how the German legislator will transpose the maximum fine level of not less than EUR 40 million or a specified percentage of the annual group turnover into national law. These two options could have very different outcomes depending on the size of the company concerned. Either way, companies will face much heavier penalties than they currently do in Germany, especially given that the Directive also allows for judicial winding-up.
Against this background, businesses can only (continue to) intensify their prevention efforts, take appropriate precautions to avoid sanctions violations and carefully scrutinise the effectiveness of the structures already in place. Risk-appropriate sanctions compliance can significantly reduce the risk of severe fines or other measures that could penalise the company.
Forward