Key Takeaways
- On July 24, 2025, the European Commission opened infringement procedures against 18 Member States for failing to fully transpose Directive (EU) 2024/1226 by the May 20, 2025 deadline.
- The Directive harmonizes criminal offences and penalties for violations of EU sanctions, including asset freeze breaches, arms embargo violations, and circumvention schemes.
- Penalties include prison sentences of up to 5 years for individuals and fines up to 5% of worldwide turnover or EUR 40 million for companies, plus additional restraining measures.
- Serious negligence involving military or dual-use goods can also trigger criminal liability.
- Companies face increased enforcement risk across all EU jurisdictions and should ensure tailored compliance programs are in place.
- Despite harmonization efforts, national enforcement practices will still vary, making jurisdiction-specific compliance strategies essential.
Background
On July 24, 2025, the European Commission initiated infringement procedures against 18 Member States for failing to fully transpose Directive (EU) 2024/1226 into their national legal orders. The Directive, which had a deadline for transposition of May 20, 2025, establishes a landmark framework for harmonizing the definition and enforcement of criminal offences and penalties related to violations and circumventions of EU sanctions and restrictive measures.
The EU currently maintains close to 50 sanctions regimes, addressing situations from regional conflicts to international threats in over 40 countries. In response to Russia’s 2022 invasion of Ukraine, this framework has been significantly expanded, with the EU now implementing its 18th package of sanctions targeting Russia and Belarus as of July 2025. Despite these unified measures at the EU level, enforcement has historically varied between Member States, resulting in significant differences in the consequences for violations among the countries. The harmonization of national laws through the Directive aims to facilitate more effective investigation and prosecution of sanctions violations throughout the EU.
Key Provisions of Directive (EU) 2024/1226
Adopted in April 2024, the Directive seeks to address disparities in enforcement by providing a common framework for defining what qualifies as a criminal offence under EU restrictive measures. These offences include:
- Failing to freeze assets;
- Breaching travel bans or arms embargoes;
- Providing prohibited financial or economic services:
- Transferring funds to third parties in violation of sanctions; and
- Supplying false or misleading information to conceal assets.
The Directive requires Member States to:
- Criminalize intentional violations of EU restrictive measures, including attempts, aiding and abetting.
- Extend criminal liability to serious negligence in relation to military or dual-use goods.
- Establish criminal liability for legal persons (companies), with penalties including pecuniary fines where the maximum level is not less than5% of total worldwide turnover or EUR 40 million, and possible restraining measures such as exclusion from public funding, tender procedures, grants, and concessions, withdrawal of permits and authorizations, and judicial winding-up.
- Consider aggravating factors such as involvement of organized crime or repeat offences when setting penalties.
- Set minimum limitation periods (generally at least five years) to ensure sufficient time for investigation, prosecution, and adjudication.
- Define jurisdictional rules and strengthen cross-border cooperation with the European Commission, Eurojust, and Europol.
Next Steps in the Enforcement Process
The Commission’s recent action specifically targets Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, France, Germany, Greece, Hungary, Ireland, Italy, Malta, Poland, Portugal, Romania, Slovenia, and Spain—Member States that have not yet fully transposed the Directive.
These countries now face two months to respond, finalize the transposition, and inform the Commission of their measures. If they do not comply or their response is deemed insufficient, the Commission may proceed to issue a formal reasoned opinion as the next step. Continued non-compliance may ultimately result in the case being brought before the Court of Justice of the European Union.
Practical Implications
For companies operating in the EU, these changes mean greater legal clarity but also increased risk of criminal exposure for sanctions breaches, even if committed through serious negligence in certain cases. Businesses should reassess their compliance programs and internal controls to ensure readiness for both administrative scrutiny and potential criminal enforcement across all EU jurisdictions. Notably, the Directive does not establish a centralized EU enforcement authority; responsibility for investigating and prosecuting violations remains with national authorities. As a result, despite the drive towards harmonization, enforcement practices can still vary from one Member State to another, underscoring the importance of tailored compliance in each jurisdiction.