EU international sanctions are restrictive measures (asset freezes, trade embargoes, bans on dealing with listed parties) adopted to advance the Union’s foreign and security policy. The point this guide makes, and that most trade and compliance guides skip, is the criminal one: under Directive (EU) 2024/1226 of 24 April 2024 the violation of EU restrictive measures must be a criminal offence across the Union, and in Spain that risk runs through the corporate criminal liability of the company itself under article 31 bis of the Criminal Code, not only the liability of its directors. For a company that trades with third countries, that changes everything: a sanctions breach is no longer an administrative fine, it is a criminal file. This article is written from the defence side and anchored on the Spanish and EU framework, because that is where this firm defends.
What EU international sanctions are
EU sanctions, or restrictive measures, are instruments of the Common Foreign and Security Policy. They are designed to change the conduct of a State, an entity or a person without resorting to force. They are adopted by EU regulations that apply directly in Spain, so a company does not need any Spanish implementing act to be bound by them: the regulation is the law.
In practice they take three forms, and a single sanctions programme often combines them.
Types of EU sanctions
| Type of measure | What it involves |
|---|---|
| Trade embargo | Bans the export, import, sale or transfer of certain goods, including brokering and technical assistance |
| Asset freeze | Blocks the funds and economic resources of a listed party and prohibits making any asset available to it |
| Individual restrictions | Entry and transit bans, and a prohibition on dealing with the listed person or entity |
| Sectoral and financial restrictions | Limits on banking, finance, insurance and on whole sectors (energy, technology, transport) of a targeted country |
The last row matters because most enforcement risk for an ordinary company sits there: not in a headline embargo, but in a financial transfer or a technical service that quietly breaches a sectoral measure.
The consolidated list: who you cannot deal with
The European Commission maintains a consolidated list of the persons, groups and entities subject to EU financial sanctions, and the Spanish Treasury (Secretaría General del Tesoro) mirrors and links to it. Screening counterparties against that list before operating is the first line of defence, and it is a moving target: the list is updated frequently, so a counterparty that was clean last quarter may be listed today. Dealing with a listed party, even indirectly through an intermediary, exposes the company to direct criminal risk.
From administrative fine to criminal offence: Directive (EU) 2024/1226
For years a sanctions breach was treated, in most Member States, as an administrative infringement. Directive (EU) 2024/1226 changes the baseline: it requires every Member State to make the intentional violation of EU restrictive measures a criminal offence, with a common minimum catalogue of conducts and penalties. It entered into force on 19 May 2024 and Member States were required to transpose it by 20 May 2025. It also amends the EU anti-money-laundering Directive (EU) 2018/1673 to add the violation of restrictive measures to the list of predicate offences for money laundering, which is exactly the overlap this firm flags below.
What conduct is now a crime
Under article 3 of the Directive, the following are to be criminalised when intentional:
- Making funds or economic resources available, directly or indirectly, to a listed person or entity.
- Failing to freeze the funds or economic resources of a listed party.
- Enabling a listed natural person to enter or transit through a Member State (travel-ban breach).
- Entering into or continuing prohibited transactions with a third State, its bodies or entities it controls, including public and concession contracts.
- Trading, importing, exporting, selling, purchasing, transferring or transporting restricted goods, and providing related brokering or technical services.
- Providing financial or non-financial services where prohibited.
- Breaching the conditions of an authorisation granted by a competent authority.
- Circumvention.
Circumvention as a stand-alone offence
Circumvention is treated by the Directive (article 3(1)(h)) as its own offence, and it is where the real exposure lives. It covers using, transferring or disposing of frozen funds to conceal them; providing false or misleading information to hide the beneficial ownership of funds that should be frozen; failing to report frozen funds when you are the designated person or act for one; and failing to give competent authorities information on frozen funds. In practice this is the re-export through a third country, the nominee structure that hides who really owns the goods, the “the buyer is a Turkish company so it is fine” reasoning. Routing a restricted product through an intermediary in a non-sanctioned country to reach a sanctioned end-user is not a loophole: it is the textbook circumvention case.
The serious-negligence standard for dual-use and military goods
This is the part a defence lawyer cannot ignore. For most offences the Directive requires intent. But for trade in goods on the EU Common Military List or the dual-use items listed in Annexes I and IV to the Dual-Use Regulation (EU) 2021/821, article 3(3) requires Member States to criminalise the conduct committed at least with serious negligence. In plain terms: with military and dual-use goods, you do not need to have known the shipment was prohibited. Getting your classification or your end-user diligence seriously wrong can be enough. That is why dual-use exporters are the highest-risk population under this regime.
Inciting, aiding, abetting and attempt
Article 4 requires that inciting, aiding and abetting these offences be punishable, and that attempt be punishable for most of them. A deal that never closes, or facilitating someone else’s breach, can already be criminal. The criminal exposure does not start at the completed transaction.
Penalties: the real numbers
The figures below are the minimum maximums the Directive obliges Member States to provide. They are EU-level minimums; a national transposition can go further, but cannot go lower.
Fines for companies
| Offence | Minimum maximum fine for the legal person (Art. 7) |
|---|---|
| Most offences (asset-freeze breach, trade, financial services, concealment circumvention) | not less than 5% of total worldwide turnover, or EUR 40,000,000 |
| Failure-to-report circumvention (Art. 3(1)(h)(iii)-(iv)) | not less than 1% of total worldwide turnover, or EUR 8,000,000 |
Turnover-based fines are the headline, but article 7 also lets Member States add: exclusion from public funding, grants and tender procedures; disqualification from business activity; withdrawal of permits and authorisations; judicial supervision; and judicial winding-up. For an exporter, exclusion from public tenders can hurt more than the fine.
Imprisonment for individuals
For natural persons (directors, compliance officers, anyone in the chain), article 5 sets graduated minimum-maximum prison terms:
| Offence band | Minimum maximum imprisonment |
|---|---|
| Asset-freeze breach and concealment circumvention, where value ≥ EUR 100,000 | at least 5 years |
| Prohibited trade, financial/non-financial services, breach of authorisation, where value ≥ EUR 100,000 | at least 5 years |
| Trade in EU Common Military List or dual-use (Annex I and IV) goods | at least 5 years, irrespective of value |
| Travel-ban breach | at least 3 years |
| Failure to report frozen funds, where value ≥ EUR 100,000 | at least 1 year |
Member States may decide not to criminalise breaches involving less than EUR 10,000 (article 3(2)), but that floor does not apply to the military and dual-use goods, where value is irrelevant.
Confiscation and limitation period
The Directive also requires that the instrumentalities and proceeds of these offences can be frozen and confiscated, in line with the EU confiscation framework (Directive 2014/42/EU), and that frozen assets tied to a concealment offence can be confiscated (article 10). The limitation period for the more serious offences must be at least 5 years from commission (article 11). For a company, that means a transaction can be reopened years after it closed.
Corporate criminal liability: the angle that matters in Spain
Most trade guides stop at the company’s compliance obligations. The defence-relevant question is different: when, exactly, does the company itself become a criminal defendant?
Two routes to liability
Article 6 of the Directive sets out two routes, and Spanish law mirrors the logic. A company can be liable for an offence committed for its benefit by a person in a leading position (someone with power of representation, authority to take decisions, or control). And, crucially, it can be liable where a lack of supervision or control by such a person made it possible for a subordinate to commit the offence for the company’s benefit. You do not need a rogue director: a poorly supervised export desk is enough.
Spain: article 31 bis of the Criminal Code
In Spain this maps onto article 31 bis of the Criminal Code, which already establishes the criminal liability of legal persons. Two features make it the centre of the defence:
First, the dual basis of attribution. A company answers for offences committed in its name and for its direct or indirect benefit by its legal representatives and decision-makers, and for offences committed by subordinates because those in charge seriously breached their duties of supervision, oversight and control. This is the same two-route structure the Directive demands.
Second, and this is the defence lawyer’s best tool, article 31 bis provides that the company is exempt from liability where, before the offence, its management body had adopted and effectively implemented an organisation and management model (a compliance programme) with surveillance and control measures suited to preventing offences of that nature or significantly reducing the risk of their commission. A real, operative sanctions-compliance programme is therefore not just risk mitigation: it is a statutory defence. A programme that exists only on paper is not.
The penalties a Spanish court can impose on a convicted legal person are listed in article 33.7 of the Criminal Code, and they are severe: fine (by quotas or proportional), dissolution of the company, suspension of activities, closure of premises, a ban on the activities through which the offence was committed, disqualification from public subsidies, aid and contracting with the public sector, and judicial intervention.
A second Spanish criminal title: smuggling (contrabando)
Here is a point that pan-European trade guides miss because it is specifically Spanish. Exporting defence material or dual-use goods without the required authorisation, or with a false or incomplete declaration about their nature or final destination, is also the criminal offence of smuggling under Organic Law 12/1995 on the Suppression of Smuggling, punishable with imprisonment of one to five years and a proportional fine, with its own corporate-liability regime. So in Spain a single shipment can engage both the new sanctions offence and the smuggling offence. For the defence, that means the framing of the conduct (which title, whether they overlap, how the penalties interact) is itself a battleground.
Overlap with money laundering
The sanctions risk does not sit in isolation. Moving, converting or concealing funds of sanctioned origin can also be the money laundering offence in Spain, and the Directive expressly added the violation of restrictive measures to the predicate offences for money laundering by amending Directive (EU) 2018/1673. In Spanish practice that means the same facts can be charged as both, which raises the stakes and the complexity of the defence. Treating a sanctions problem and a money-laundering problem as one file from day one is, in our experience, the right instinct.
Aggravating and mitigating factors, and self-disclosure
For a guide written from the defence side, this is the most useful section.
The Directive (article 8) lists aggravating factors Member States must be able to apply, including commission within a criminal organisation, abuse of a professional position, the conduct of a public official, and (a point worth underlining) the destruction of evidence or intimidation of witnesses. The instinct to clean up a problem internally before lawyers are involved is exactly the instinct that converts a defensible case into an aggravated one.
On the other side, article 9 lets Member States treat as mitigating that the offender provides the competent authorities with information they would not otherwise have obtained, helping to identify or bring to justice other offenders, or to find evidence. In other words, cooperation and well-handled self-disclosure can pull a penalty down. The decision whether, when and how to self-report is delicate and should never be taken without counsel, but it is a real lever, and it should be on the table early.
Higher-risk sectors and operations
Risk concentrates in: the import and export of dual-use goods, technology, energy and commodities; financial, insurance and transport services; and any operation with counterparties linked to sanctioned countries. The single most dangerous pattern is the indirect deal: sales routed through a third country, intermediaries with opaque ownership, or end-users whose real identity has not been pinned down. As shown above, that is precisely the circumvention conduct the Directive targets, and with dual-use goods it can bite even without intent.
Company obligations under sanctions
A company does not only have to refrain from dealing with listed parties; it has active duties. It must freeze, without delay, the funds and economic resources of a listed party that are under its control; it must not make any asset available to such a party; and it must report relevant transactions and freezes to the competent authorities. Failing to report, in the cases the Directive defines, is itself a criminal offence. Passivity is not a safe harbour.
A compliance programme as defence
The best defence is documented prevention, and Spanish law rewards it directly. A sanctions-specific compliance programme should include: due diligence on clients, suppliers and beneficial owners; systematic screening against the EU consolidated list; clear classification of dual-use and military goods; controls on indirect sales and third-country routing; an escalation and reporting procedure; and a traceable record of the decisions taken. Done properly, this is the article 31 bis organisation-and-management model that can exempt the company, and the evidence that, even if something went wrong, the company exercised the supervision and control the law requires.
Where transposition stands
A note of caution on timing, kept to what can be confirmed. The Directive’s transposition deadline was 20 May 2025. Not every Member State met it: the European Commission opened infringement proceedings in July 2025 against Member States that had not notified complete transposition. In Spain, the transposing law is still going through Parliament. The Council of Ministers approved the draft Organic Law in second reading on 21 October 2025 and sent it to the Congreso; it creates a new Title in the Criminal Code on offences against the EU’s area of freedom, security and justice. As things stand, that Spanish transposing law is not yet in force. We have deliberately not stated final Spanish penalty figures, because they belong to a text that is not yet law; the figures above are the Directive’s EU-level minimums. What is already firm is the framework: article 31 bis liability, the compliance-programme defence, and the overlap with smuggling and money laundering all apply today.
Frequently asked questions
Is breaching an EU sanction a crime?
Under Directive (EU) 2024/1226 the intentional violation of EU restrictive measures must be a criminal offence across the Union. In Spain the offence is being introduced by a transposing Organic Law that is currently before Parliament; the corporate-liability framework of article 31 bis of the Criminal Code, and the smuggling offence for defence and dual-use goods, already apply.
Can my company itself be prosecuted, not just its directors?
Yes. Under article 31 bis of the Spanish Criminal Code a legal person can be criminally liable, both for offences by its decision-makers and for offences made possible by a serious failure of supervision over subordinates. The Directive (article 6) requires the same two routes EU-wide.
Is serious negligence enough, or do I need intent?
For most offences the Directive requires intent. But for trade in EU Common Military List or dual-use goods (Dual-Use Regulation (EU) 2021/821, Annexes I and IV), article 3(3) requires criminalisation at least for serious negligence. With those goods, a serious diligence or classification failure can be enough.
What fine can my company face?
The Directive sets minimum maximum fines for legal persons of not less than 5% of total worldwide turnover or EUR 40,000,000 for most offences, and not less than 1% or EUR 8,000,000 for failure-to-report circumvention (article 7), plus measures such as exclusion from public tenders and withdrawal of authorisations. National law transposing the Directive may set its own figures.
Does a compliance programme actually protect the company?
It can be decisive. Article 31 bis of the Spanish Criminal Code allows a company to be exempt from liability where it had adopted and effectively implemented, before the offence, a suitable organisation and management model. A real, operative sanctions-compliance programme is a statutory defence; a paper one is not.
Can self-reporting reduce the penalty?
The Directive (article 9) lets Member States treat cooperation as mitigating where the offender gives authorities information they could not otherwise have obtained. Conversely, destroying evidence is an aggravating factor (article 8). The decision to self-report is delicate and should be taken with counsel, but it is a genuine lever and should be considered early.
What is “circumvention” and why is it so risky?
Circumvention (article 3(1)(h)) covers concealing or transferring frozen funds, giving false information about beneficial ownership, and failing to report frozen funds. In practice it is the re-export through a third country or the nominee structure that hides the real end-user. It is treated as a stand-alone offence, so an indirect deal designed to “get around” a sanction is squarely in scope.
Could the same facts also be money laundering?
Yes. The Directive added the violation of restrictive measures to the predicate offences for money laundering (amending Directive (EU) 2018/1673). Moving funds of sanctioned origin can be charged as both, so a sanctions matter and a money-laundering matter should be handled as one defence from the start.
If your company trades with third countries or handles dual-use goods, do not wait for an investigation to test your exposure. Talk to a criminal defence lawyer in Spain who works on EU sanctions and corporate criminal liability, and have your compliance programme reviewed as the defence asset it is.
Official sources: Directive (EU) 2024/1226 (EUR-Lex) · EU consolidated list of financial sanctions, via the Spanish Treasury (tesoro.es).
