From 24 January the violation of EU international sanctions has become a criminal violation, also triggering the criminal liability of corporations.
Through Legislative Decree No. 211 of 2025 (the decree) Italy implemented Directive (EU) 2024/1226 on the definition of criminal offences and penalties for violating union restrictive measures (the directive). The government published the decree in the Official Journal on 9 January, and it entered into force on 24 January.
Several months after the expiration of the directive’s transposition deadline, Italy has adopted a comprehensive framework on the criminalization of breaches of EU restrictive measures.
The decree:
- criminalizes conduct that was previously subject only to administrative sanctions, particularly under Legislative Decree No. 109/2007;
- strengthens and supersedes criminal penalties for individuals;
- introduces new criminal offences, adding a specific chapter on crimes affecting the EU’s foreign and common security policy to the criminal code;
- makes certain criminal violations predicate offences under Legislative Decree No. 231/2001 (the Decree 231), governing corporate criminal liability, significantly increasing monetary penalties (which can now be up to 5% of a company’s global turnover); and
- introduces amendments to the Code of Criminal Procedure, the whistleblowing legislation, and the legal framework on preventing and combating terrorism.
The new provisions may increase risks for companies, their employees, and their directors.
1. Towards More Consistent EU Sanction Enforcement Across Member States
The European Union has established more than 40 sanctions regimes targeting non-EU countries, entities, and natural and legal persons. These measures include, among others, arms embargoes, trade restrictions, financial and banking prohibitions, asset freezes, and travel bans.
While the adoption of sanctions is centralized at the EU level, their implementation and enforcement remain the responsibility of the Member States, which may result in divergences across national legal systems.
Prior to the directive, the absence of EU-wide harmonization led to differences in how governments classified and sanctioned violations of EU restrictive measures. In some Member States, breaches of EU sanctions always constituted criminal offences, while in others, they might give rise to either administrative or criminal liability, depending on intent, gross negligence, or the degree of harm. In a limited number of jurisdictions, governments punished violations exclusively by using administrative sanctions. Sanctioning regimes also varied in severity, with maximum prison sentences ranging from a few years to over a decade and monetary penalties differing substantially across Member States. Approaches to the liability of legal persons were equally fragmented, both in terms of criminal and administrative sanctions and in the level of maximum fines applicable to companies.
Enforcement structures have likewise been decentralized. Across the EU, more than 180 national authorities have involvement in implementing and enforcing sanctions, with some Member States designating numerous competent bodies and others relying on one or two. For several years, enforcement activity remained limited, which may reflect a relatively low prioritisation of sanctions violations. However, this trend has changed in recent years, particularly following the introduction of sanctions against Russia, which resulted in an increase in investigations, prosecutions, and penalties across the EU.
Against this backdrop, the directive may seek to strengthen and harmonise the enforcement of EU restrictive measures by establishing minimum rules on the definition of criminal offences and penalties for both violations and circumvention of sanctions. The directive aims to ensure a more consistent and effective enforcement framework across all member states, enhancing the deterrent effect of sanctions and reinforcing the credibility of the EU’s external action.
At the EU level, monitoring of implementation and enforcement is entrusted to the European Commission, in particular to the Financial Stability, Financial Services, and Capital Markets Union (DG FISMA). The directive promotes enhanced cooperation among member states and EU bodies, including Europol, Eurojust, and the European Public Prosecutor’s Office. It also allows for the creation of networks of experts and practitioners to facilitate the exchange of best practices and provide operational support to national authorities in the investigation and prosecution of sanctions-related offences.
2. Previous Italian Legal Framework and Aim of the Decree
Italian law penalized violations of EU restrictive measures, even before the decree entered into force. Italy’s sector-specific legislation provided for administrative – and in some cases criminal – consequences for non-compliance with EU sanctions:
- asset-freeze obligations – such as failing to freeze funds or failing to report assets belonging to designated persons – are primarily sanctioned through administrative fines under Legislative Decree No. 109/2007;
- other forms of misconduct may already constitute criminal offences, particularly where the violation involves the export, import, transit, or brokering of goods or services subject to EU restrictions (e.g., dual-use items, embargoed goods, or items covered by trade bans). These offences apply only to natural persons, not to legal entities, and are punishable by imprisonment and fines depending on the violation’s severity.
Overall, the previous framework was fragmented and highly sectoral, and the nature of the sanction depended on the specific type of prohibition breached. This decree aims to replace the patchwork system by establishing a single, coherent set of criminal offences expressly dedicated to violations of EU restrictive measures, by envisaging a significant strengthening of the criminal sanctions already applicable to natural persons pursuant to Legislative Decree No. 221/2017 (whose provisions on penalties will be repealed by the same decree), and by introducing corporate liability for violating or circumventing restrictive measures.
3. Introduction of New Types of Offences and Jurisdiction
The decree introduces a new set of criminal offences into the Italian Criminal Code, gathered in a new Chapter I-bis (“Offences against the EU’s foreign policy and common security”), covering Articles 275-bis to 275-quinquies, together with provisions on aggravating and mitigating circumstances, mandatory confiscation, accessory penalties, and territorial jurisdiction.
In this regard:
- Article 275-bis punishes violations of EU restrictive measures, such as providing funds or economic resources to designated persons, failing to freeze sanctioned assets, engaging in prohibited economic or financial operations with third countries, trading in banned goods or services (including intangible transfers and technical assistance), or offering services in breach of restrictions with imprisonment from two to six years and with a fine between €25,000 and €250,000. The same penalties apply to anyone who circumvents EU measures using frozen assets or false or misleading documentation.
- Article 275-ter punishes designated persons — or the legal representative of a designated entity — who fail to report any funds or economic resources they own or control in Italy to the authorities, as well as professionals who, despite being under a legal obligation, omit to disclose relevant information with imprisonment from six months to two years and with a fine between €15,000 and €50,000.
With specific reference to this provision, Article 8 of the decree provides for a “legal privilege” for legal professionals (particularly those who are admitted to the Italian bar as lawyers) that exempts the reporting obligation when the information concerns a client and has been obtained while assessing the client’s legal position or in the course of providing a defence.
- Article 275-quater punishes anyone who carries out authorized activities in breach of the conditions set out in the relevant authorization with imprisonment from two to five years and with a fine between €25,000 and €150,000, according to a materiality threshold.
- Article 275-quinquies adds a negligent offence related to transfers of sensitive items (military goods or dual-use items), punishable by imprisonment from six months to three years and with a fine between €15,000 and €90,000.
The framework is complemented by a set of aggravating circumstances — including cases where the offence is committed in the context of professional, commercial, banking, or financial activities — and by special mitigating circumstances, such as effective cooperation with the authorities aimed at limiting the consequences of the offence and assisting investigations that may lead to a reduction of the penalty ranging from one-third to two-thirds.
The decree also provides for the mandatory confiscation of the items used — or intended to be used — to commit the crime and items that are the price, product, or profit thereof (either directly or through an equivalent value) as well as the publication of the sentence1 when the conviction includes a term of imprisonment of not less than three years.
Moreover, the new rules establish a coordination mechanism for criminal offences relating to breaches of EU restrictive measures: when the competent authorities responsible for enforcing EU sanctions become aware of such offences, they must promptly inform the National Anti-Mafia and Anti-Terrorism Prosecutor and share all relevant information. Outside of these cases, the new mechanism requires public prosecutors to notify the Anti-Mafia and Anti-Terrorism Prosecutor when they learn of such offences. Instead, administrative sanctions will fall under the responsibility of the Ministry of Economy and Finance (MEF) and the Unit for the Authorizations of Armament Materials.
The new offences are punishable under Italian law even when committed abroad by an Italian citizen,2 implementing an option set out by the directive that allowed Member States to choose between asserting jurisdiction over offences committed within their territory or over offences committed by their own nationals.
This choice is also consistent with the EU legislator’s objective of strengthening and streamlining enforcement by concentrating responsibility within the hands of a central authority in each Member State. In the Italian system, this centralization is articulated through a coordinated allocation of competencies between administrative enforcement and criminal prosecution.
Additionally, the decree amends Article 1 of Legislative Decree No. 24/2023 on whistleblowing to ensure that the safeguards granted to whistleblowers also apply to those reporting breaches of EU restrictive measures.
4. Impact on Corporate Liability under Decree 231: New Offences and Sanctions
Equally important is the potential impact on corporate liability, as the decree introduces amendments to Decree 231, adding most of the new offences set out in Articles 275-bis, 275-ter and 275-quater — with the exclusion of Article 275-quinquies — of the Italian Criminal Code to the list of crimes that give rise to the criminal liability of entities. Companies may therefore be held liable — and subject to monetary fines and disqualification sanctions — for violating EU restrictive measures provided in the aforementioned articles, if committed by directors, managers, or employees in their interest or to their advantage.
Beyond inserting these new predicate offences under the newly introduced Article 25-octies.2 of Decree 231, the most significant innovation of the decree concerns the method of calculating monetary sanctions. Unlike the traditional “quota” system (with each quota valued between €258 and €1,549), fines for these offences will instead be calculated as a percentage of the company’s total turnover for the financial year preceding the offence or, if lower, for the year preceding the imposition of the sanction. If the government cannot determine the global turnover of the company, the decree provides for fixed monetary ranges applicable to each offence, alongside the existing disqualification measures. In particular:
- For offences under Articles 275-bis and 275-quater, entities may face a fine ranging from 1% to 5% of their global turnover for the relevant financial year. If global turnover cannot be determined, the applicable fine will range from €3 million to €40 million.
- For offences under Article 275-ter, sanctions are lower: the monetary fine ranges from 0.5% to 1% of global turnover. If turnover cannot be established, the fine will be between €1 million and €8 million.
In the event of repeated offenses, the above financial penalties shall be increased by one-third.
This approach represents a systemic innovation within the entire sanctioning system of Decree 231, consistent with the trends of the European legislator. The strategy intends to make sanctions genuinely dissuasive, even for large, multinational corporations, for which traditional sanctions under Decree 231 might otherwise prove negligible. However, the decree does not provide guidance on the criteria for calculating global turnover in multinational groups. Indeed, the reference to global turnover may be interpreted, by analogy with EU competition law, as encompassing the turnover of the entire corporate group rather than that of the individual entity alone. Moreover, the involvement of the MEF in the application of these sanctions may increase the risk of more extensive financial exposure, as administrative authorities are not subject to the same constraints that typically apply to criminal courts when determining penalties.
Finally, the decree does not introduce new disqualification sanctions, nor does it amend those already provided under Decree 231. According to the decree, disqualification sanctions – such as suspension or revocation of authorizations, licenses, or concessions as well as exclusion from public benefits, loans, contributions, or subsidies, and possible revocation of those already granted — may be applied for a term of two-to-six years where senior management is implicated, and for one-to-three years in cases involving employees.
5. Takeaways
The transposition of the directive into Italian law marks the Member State’s alignment with the European shift towards more effective enforcement against violations of restrictive measures, in light of the current geopolitical context. This means that for businesses, especially those active in sectors exposed to sanctions (i.e. exports, logistics, finance, technology, and dual-use goods and services) may wish to prepare for a strengthened enforcement environment, while also considering the extension of Italian jurisdiction for conducts committed abroad by Italian citizens.
In terms of prevention, companies should consider reviewing their existing policies and procedures in an effort to prevent and detect potential breaches. Priority actions may include updating sanctions-screening systems, reinforcing due diligence on customers and business partners, reviewing supply-chain controls, strengthening internal reporting mechanisms, and revising and updating their organizational models according to Decree 231 to incorporate the new predicate offences. Companies may also wish to include the adaptation of risk assessments and related control protocols and a careful evaluation of whether to amend the composition of the supervisory body to enhance the presence of expertise in the areas covered by the decree, and to update the code of ethics by introducing specific principles of conduct relating to EU sanctions. Failure to introduce appropriate internal controls measures may be regarded as a violation of directors’ duties, thus potentially exposing them to personal liability in the event of negative consequences for the company.
Companies may also wish to promptly investigate any potential violation of EU sanctions and introduce remedial actions as timely actions and effective cooperation with the authorities in cases of commission of the crimes are expressly incentivized by the legislator through significant reductions in penalties.
1 Pursuant to Article 36 of the Italian Criminal Code, the sentence is published by posting it in the municipality where it was issued, in the municipality where the offence was committed, and in the municipality where the convicted person last resided. It is also published on the website of the Ministry of Justice.
2 The principle of territoriality remains unchanged, pursuant to Article 3 of the Italian Criminal Code. Therefore, the new rules will apply to all those, whether Italian or foreign citizens, commit the aforementioned crimes within the territory of the Italian state.