The issue of preventing circumvention of EU sanctions against Russia runs with increasing urgency through all EU sanctions packages and was therefore once again the subject of the 14th EU sanctions package, which came into force on 25 June 2024. For example, the 14th EU sanctions package contains some “clarifications” regarding the due diligence expected of EU economic operators by means of compliance measures.
In addition, the EU has adopted an EU directive that aims to harmonize criminal offences of sanction violations and their punishment among EU member states.
First, the main content of the 14th EU sanctions package in a shortened and simplified overview:
I. The 14th EU sanctions package
- Extension of personal restrictions (Annex I of Regulation 269/2014)
- Ban on reloading services for Russian LNG
- Prohibition of the use of the Russian payment system SPFS
- Sanctions against the Russian “shadow fleet”
- Extension of export bans, e.g. certain Chemicals, Excavation Machinery
- Extension of import bans, e.g. for Russian helium (Annex XXI)
- Iceland and Liechtenstein new partner countries (Annex VIII)
- Revision and extension of the “No Russia clause” to include know-how for Annex XL items
- Special Compliance Obligations for Annex XL items (new Article 12gb)
- Compliance obligation of the EU parent company for subsidiaries in a third country (new Art. 8a Reg. 833/2014)
II. Clarifications on the compliance requirements in the 14th EU sanctions package and current developments to prevent circumvention
A. Duty to undertake best efforts
What all sanctions packages have in common is the fight against circumventions that undermine the effect of EU sanctions against Russia. In order to prevent the circumvention of EU sanctions, the legislator wants to use the 14th EU sanctions package to clarify, among other things, that in the relationship between an EU parent company and a subsidiary owned or controlled by it in a third country, there is an obligation for the EU parent company to use its best efforts to influence its subsidiary to comply with the sanctions.
The scope of application of the sectoral EU sanctions under Regulation 833/2014 results primarily from Article 13 thereof and, for the personal EU sanctions under Regulation 269/2014, from Article 17 thereof. The factual alternatives to the scope of application of sanctions law mentioned therein can also cover situations that can already be described as extraterritorial. This is the case for example with transactions that are only “partially” operated within the EU or for which a decision/participation of the EU parent company is necessary, etc.
Irrespective of this per se already broad scope of application of Art. 13, the legislature of the 14th package of sanctions also sees the EU parent company as responsible for its subsidiary in the third country if the EU parent company, contrary to its duty of effort, fails to exert appropriate influence on the subsidiary to comply with the sectoral EU sanctions:
Recital No. 27 to amending Regulation 2024/1745 (emphasis added)
“Regulation (EU) No 833/2014 applies only within the jurisdictional limits defined in Article 13 thereof. At the same time, if Union operators are able to and effectively assert a decisive influence over the conduct of a legal person, entity or body established outside the Union, they may incur responsibility for actions of that legal person, entity or body that undermine the restrictive measures and should use their influence to prevent those actions from occurring.”
On the basis of these considerations, the legislature has inserted the new Article 8a into Regulation (EU) No 833/2014, which is addressed to both legal and natural persons, organizations and bodies:
Article 8a (emphasis added)
„Natural and legal persons, entities and bodies shall undertake their best efforts to ensure that any legal person, entity or body established outside the Union that they own or control does not participate in activities that undermine the restrictive measures provided for in this Regulation.”
Against this background, the legislator clarifies that with regard to compliance with the sectoral EU sanctions against Russia, a kind of “laissez-faire policy” or the deliberate isolation of EU-based companies from their subsidiaries in the third country is unacceptable and can be punished. However, the legislator cannot and does not want to demand the impossible from EU companies. It is therefore necessary to consider, inter alia, its size, nature and the factual circumstances on a case-by-case basis (e.g. the degree of effective control or the inability to exercise control, e.g. due to legislation of the third country).
B. Harmonization of the definitions of criminal offences for violations of EU sanctions and their punishment with penalties and fines, as well as the possibility of voluntary disclosure
With the same intention of better preventing the circumvention of EU sanctions (especially because of Russia) in the future, an EU directive was put into force on May 19, 2024, which must be transposed into national law by the EU member states by May 20, 2025 at the latest. With the help of this EU Directive, the penalties and fines for EU sanctions violations, which are currently still very divergent in some cases, are also to be harmonized to EU-wide minimums. It is at the discretion of the EU Member States to go beyond the minimum requirements of the Directive if necessary. At the same time, cooperation between all stakeholders in the EU on these issues is to be improved.
For the German legislator, the EU directive means homework to be done. Therefore, the prompt review and necessary adaptation of the German criminal and administrative provisions for the definition and punishment of EU sanctions violations (in particular §§ 17, 18, 19 AWG and § 82 AWV). As a result, certain grossly negligent acts, for example, will be punishable in the future. In terms of punishment/fines, Germany is already largely within the target of the minimum requirements of the EU Directive, but there will probably still be tightening in certain places. For example, the “criminal liability” required by the EU Directive in the form of a possible sanctioning of companies in certain cases is quite comparable to § 30 German OWiG. However, the EU directive calls for a stricter sanction (possible maximum fine of at least 5% of worldwide turnover or minimum 40 MEUR).
Among other things, the EU Directive recognizes mitigating circumstances in the event of sanctions violations but defines them so narrowly that only leniency-like information transfers can fall under it. With the 14th EU sanctions package, however, the legislature clarifies that a voluntary disclosure of violations of EU sanctions can also be a mitigating circumstance (recital no. 26). Accordingly, Art. 8 (1) of Regulation (EC) No 833/2014 and Article 15 (1) of Regulation (EC) No 269/2014 have been amended by a half-sentence:
Art. 8 (1) Reg. 833/2014 (emphasis added):
“Member States shall lay down the rules on penalties, including as appropriate criminal penalties, applicable to infringements of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive, and may take the voluntary self-disclosure of infringements of the provisions of this Regulation into account as a mitigating factor, in accordance with the respective national law. Member States shall also provide for appropriate measures of confiscation of the proceeds of such infringements.”
According to the above-mentioned recitals, a possible self-disclosure must be voluntary, complete and timely in order to be successful.
C. No exclusion of liability for ignorance of sanctions violations due to lack of diligence
Art. 10 of Regulation 833/2014 and Art. 10 (2) of Regulation 269/2014 regulate the exclusion of liability for sanctions violations if economic operators did not know or had no reasonable suspicion that they would violate EU sanctions with their actions – were virtually completely unaware, e.g. with regard to a prohibited onward delivery of goods to Russia. The legislator of the 14th package of sanctions clarifies in recital 36 of Regulation 833/2014 (emphasis mine):
„Decision (CFSP) 2024/1744 clarifies that the protection against liability that is granted to Union operators if they did not know, and had no reasonable cause to suspect, that their actions would infringe Union restrictive measures cannot be invoked where Union operators have failed to carry out appropriate due diligence. Publicly or readily available information should be duly taken into account when carrying out such due diligence. Therefore, for example, a Union operator should not be able to successfully invoke such protection when it is accused of breaching the relevant restrictive measures because it has failed to carry out simple checks or inspections.“
D. Prohibited circumvention of EU sanctions not only in the case of deliberate acts
Here, too, the legislature is seeking clarification on the definition of circumvention under sanctions law in Art. 12 of Regulation 833/2014 and Art. 9 (1) of Regulation 269/2014 against the background of the case law of the ECJ:
Recital (37) to Reg. 833/2014 (emphasis added)
“In order to ensure alignment with the interpretation of the Court of Justice of the European Union in Case C-72/11, Decision (CFSP) 2024/1744 amends the provision prohibiting circumvention to clarify that the requirements of knowledge and intent are met not only where a person deliberately seeks the object or effect of circumventing restrictive measures but also where a person participating in an activity having the object or effect of circumventing restrictive measures is aware that such participation may have that object or that effect, and accepts that possibility.”
Accordingly, the aforementioned provisions of the Sanctions Regulations have been amended for clarification.
V. Resumee
It is clear from the above that this further increases the pressure on the provision and maintenance of an Internal Compliance Programme (ICP) in accordance with the individual risks of EU economic operators. The enforcement of EU sanctions in general, and against Russia in particular, requires the appropriate attention and support of all EU economic operators concerned.
In order for an ICP to actually and legally develop its intended protective effect, it requires appropriate maintenance and this almost permanently, as the sanction rules, transactions, processes, etc. can change at any time and thus require adjustments.
Appropriate ICP maintenance includes the (un)regular review of the organization of export controls and compliance with sanctions/embargoes – e.g. by means of checklists/interviews, etc. – ideally by external experts.
An ICP not only helps to prevent sanctions violations and export control violations, it also helps to uncover a violation that has already occurred as quickly as possible, to close organizational gaps and, if necessary, to prepare a corresponding self- disclosure correctly (voluntarily, on time and in full). Even in uncertain times like these, business can be done safely and sustainably. Sometimes companies shy away from the compliance effort due to the associated costs. However, in cases of sanctions violations, these costs are regularly outweighed by the associated costs, so that compliance represents real added value for companies even from a purely economic point of view. Even the initiation of criminal investigation proceedings against persons of an EU company and the carrying out of investigations (e.g. searches, interrogations) can already cause economic damage that is blatantly disproportionate to the effort of a risk-appropriate ICP.