EU Financial Sanctions: Compliance, Penalties, and Delisting

EU financial sanctions are legal restrictions that freeze the assets of listed people and entities and prohibit transactions with sanctioned countries or sectors. They bind anyone with a connection to the European Union, from companies incorporated in a member state to EU citizens living abroad, and since April 2024 a single directive requires every member state to punish breaches as criminal offences. The stakes for getting compliance wrong are now measured in years of imprisonment and percentages of worldwide turnover.

What the Sanctions Actually Do

EU restrictive measures come in two shapes. Targeted sanctions hit named individuals and organizations. Sectoral sanctions hit entire industries within a country.

Asset Freezes

The workhorse of the targeted regime is the asset freeze. Once a person or entity is added to the EU sanctions list, every financial asset and economic resource they own, hold, or control within EU jurisdiction becomes inaccessible. Council Regulation (EU) No 269/2014 defines “funds” broadly to include cash, deposits, securities, dividends, and credit instruments, while “economic resources” covers real estate, vehicles, and anything else that could be converted into funds or exchanged for services.¹²

The freeze is only half of it. EU law also prohibits anyone under EU jurisdiction from making funds or economic resources available to a designated person, directly or indirectly. You cannot pay them, lend to them, sell property to them, or route any financial benefit that ends up in their hands.

Sectoral Measures

Sectoral sanctions restrict whole industries rather than named parties. They typically block access to EU capital markets, ban insurance or brokering services connected to certain trades, and prohibit financial assistance tied to restricted goods. Dual-use items, meaning goods, software, and technology with both civilian and military applications, are a recurring focus.³ Under specific regimes, EU banks and insurers cannot process transactions involving energy equipment, military technology, or aviation parts destined for the targeted country.

Who Has to Comply

EU sanctions bind everyone within the “EU nexus.” That covers anyone physically present in a member state regardless of nationality, every EU citizen wherever they live or work, and every company incorporated under the law of a member state, including that company’s foreign branches.⁴ A French-incorporated company running a subsidiary in Dubai must make sure that subsidiary does not process transactions with sanctioned parties.

When anyone in scope identifies a customer or counterparty as a match to a sanctions list, they must freeze the relevant assets immediately and report the match to their national competent authority. Failing to freeze, or failing to report, is itself a criminal offence under the 2024 penalties directive.

The 50 Percent Ownership and Control Rule

A company does not have to be named on any list to be caught by an asset freeze. If a listed person or entity owns 50 percent or more of an unlisted company, that company is treated as if it were sanctioned itself.⁵ The EU also evaluates “control” separately using qualitative indicators, so a listed person can trigger an asset freeze over an entity they do not technically own a majority of.

The European Commission’s guidance lists indicators of control that compliance teams need to check:

The power to appoint or remove a majority of the entity’s management or supervisory board.
Control of a majority of shareholders’ voting rights through a shareholder agreement.
The power to direct the entity’s financial or operational decisions.
The right to use all or part of the entity’s assets.
Managing the entity on a unified basis and publishing consolidated financial statements.
Sharing or guaranteeing the entity’s financial liabilities.

The list is not exhaustive. The Commission tells organizations to consider any other mechanism through which a listed person might exercise influence.⁵ Checking a shareholder register and stopping there is not enough. Board composition, voting arrangements, financial dependencies, and broader commercial relationships all matter.

Screening and Due Diligence

Compliance starts with screening every customer, supplier, and counterparty against the EU Consolidated Financial Sanctions List, which the European Commission publishes in XML, CSV, and PDF formats.⁶ Screening is only the first step. The EU Sanctions Helpdesk describes a three-phase due diligence process: collect information about the transaction and identify red flags, verify that information through independent checks, and put direct questions to the counterparty when concerns remain unresolved.⁷

The level of diligence must be proportionate to the risk. A company exporting electronics to Central Asia faces very different exposure than a domestic retailer. The Helpdesk framework asks four questions of every transaction: who is the counterparty and are they connected to sanctioned persons; what goods or services are involved and are they restricted; where are the goods going and does the route raise circumvention concerns; and why does the end user need them.⁷

If the red flags cannot be resolved, the guidance is blunt: do not proceed until you obtain professional advice, or decline the transaction. The European Banking Authority issued binding guidelines effective December 2025 setting common regulatory expectations for financial institutions, payment service providers, and crypto-asset service providers on sanctions governance, internal controls, and screening protocols.⁸

Circumvention Rules

EU law prohibits knowingly and intentionally participating in any activity whose object or effect is to circumvent sanctions. That reaches well beyond direct dealings with a listed person. Routing goods through third countries, using shell companies to obscure beneficial ownership, and providing false documentation to conceal a sanctioned party’s involvement all count as circumvention.⁹

For certain sensitive goods, including aviation parts, jet fuel, firearms, and common high-priority items, EU exporters must insert a contractual “no re-export to Russia” clause when selling to operators in non-EU countries, excluding partner nations like the United States, Japan, the United Kingdom, and Switzerland. The contract must provide adequate remedies for breach, such as the right to stop deliveries, suspend or terminate the agreement, and impose financial penalties. An EU exporter that becomes aware of a breach must notify its national competent authority.¹⁰

Enforcement has accelerated since 2023. Recent European cases include multi-year prison sentences for arranging luxury vehicle exports to Russia through intermediary countries, convictions of freight companies for rerouting sanctioned goods through Central Asian states, and corporate fines where subsidiaries kept shipping restricted parts. Prosecutors have made the point that not knowing your own supply chain will not be treated as a defence.

Criminal Penalties Under Directive 2024/1226

Penalties for sanctions breaches used to vary widely across member states, from criminal offences to light administrative fines. Directive (EU) 2024/1226, adopted in April 2024, changed that. Every member state must now criminalize sanctions violations and impose penalties that meet common minimum floors. The transposition deadline was 20 May 2025, though implementation is uneven.

Conduct That Is Now a Criminal Offence

The directive requires member states to criminalize a full list of intentional conduct: making funds available to a designated person, failing to freeze assets that should be frozen, conducting prohibited transactions with sanctioned third-country entities, trading in restricted goods, providing banned financial or other services, and circumventing sanctions through concealment or false information. Failing to comply with reporting obligations is also a criminal offence.⁹

Prison Sentences for Individuals

The directive sets minimum maximum sentences. Member states can punish more harshly, but not more leniently, than these floors:

At least one year of imprisonment for reporting failures where the funds or resources involved are worth €100,000 or more.
At least three years of imprisonment for allowing a designated person to enter or transit through a member state’s territory.
At least five years of imprisonment for asset freeze violations and fund provisions where the amount involved is €100,000 or more.
At least five years of imprisonment for trading in restricted goods, services, or transactions worth €100,000 or more.
At least five years of imprisonment for offences involving military or dual-use items, regardless of value.

The €100,000 threshold can be met by aggregating linked offences of the same kind committed by the same person. Structuring transactions below that amount offers no protection.⁹

Fines for Companies

Legal persons face fines calibrated to the seriousness of the offence:

For reporting failures, at least 1% of total worldwide annual turnover, or €8 million, at the member state’s option.
For all other offences, including making funds available, failing to freeze, trading restricted goods, providing prohibited services, and circumvention, at least 5% of total worldwide annual turnover, or €40 million.

Member states choose whether to apply the turnover percentage or the fixed euro amount when they write the directive into national law.⁹ For a multinational with significant revenue, the turnover calculation will almost always produce the larger figure. National law may add exclusion from public procurement, revocation of permits, or judicial winding-up on top.

Aggravating Circumstances

The directive lists seven circumstances that member states must be able to treat as aggravating:

The offence was committed within a criminal organization.
The offender used false or forged documents.
A professional service provider committed the offence in breach of their professional obligations.
A public official committed the offence while performing official duties.
The offence generated or was expected to generate substantial financial benefit, or helped the offender avoid substantial expenses.
The offender destroyed evidence or intimidated witnesses.
The offender had a prior conviction for sanctions violations.

The combination of high baseline penalties and these aggravators means lawyers structuring transactions, bankers processing payments, and logistics providers arranging shipments face especially severe exposure when they facilitate evasion.⁹

Getting Frozen Funds Released

An asset freeze does not necessarily cut off every euro. EU sanctions regulations include specific exceptions, called derogations, that let frozen funds be released for defined purposes. The most common cover basic living expenses like food, rent, mortgage payments, and medical care. Others cover reasonable legal fees or routine charges for maintaining frozen accounts.¹¹ Humanitarian operators have separate carve-outs, and the Council has introduced broader humanitarian exceptions aligned with UN Security Council Resolution 2664.

Accessing frozen funds means applying to the national competent authority in the member state where the assets are held. Each member state designates its own agency, usually inside the Ministry of Finance or a specialized sanctions bureau.¹¹ The applicant identifies which derogation applies and produces documentation showing why the release is necessary, typically bank account details, invoices or lease agreements, medical bills, and evidence of the designated person’s current listing status. Review takes weeks to months. If approved, the authority issues a formal authorization that permits the financial institution to process the specific transaction while keeping the rest of the funds frozen.

Challenging a Listing

Designated persons and entities can challenge a listing before the General Court of the European Union through an action for annulment. The Council must provide a statement of reasons for each listing, and the designated party can argue that the evidence is insufficient, the criteria were misapplied, or fundamental rights were violated. Judicial review is the effective route; administrative delisting requests to the Council often go unanswered.

The limits of judicial review are real. Cases move slowly, and a successful challenge does not always produce a lasting result: the Council has re-listed individuals shortly after a court ordered their removal, sometimes on updated reasoning. Even so, the case law from the General Court has forced the Council to improve the quality of its evidence over time, and court proceedings remain the primary way to contest a designation.

1
EUR-Lex. Council Regulation (EU) No 269/2014
2
legislation.gov.uk. Council Regulation (EU) No 269/2014 – Restrictive Measures in Respect of Actions Undermining or Threatening the Territorial Integrity, Sovereignty and Independence of Ukraine
3
European Commission. Exporting Dual-Use Items
4
European Commission. Overview of Sanctions and Related Resources
5
EU Sanctions Helpdesk. Why Is Ownership and Control Important?
6
European Data Portal. Consolidated List of Persons, Groups and Entities Subject to EU Financial Sanctions
7
EU Sanctions Helpdesk. Sanctions Due Diligence: Where to Begin
8
European Banking Authority. Guidelines on Internal Policies, Procedures and Controls to Ensure the Implementation of Union and National Restrictive Measures
9
EUR-Lex. Directive (EU) 2024/1226 – Definition of Criminal Offences and Penalties for the Violation of Union Restrictive Measures
10
European Commission. FAQs: Implementation of Council Regulation (EU) No 833/2014
11
European Civil Protection and Humanitarian Aid Operations. Humanitarian Exceptions