11 Marzo 2026
Directive (EU) 2024/1226 requires Member States to introduce in their legal systems criminal offences for violations of EU restrictive measures and to ensure effective, proportionate, and dissuasive penalties. Although the deadline was 20 May 2025, many countries initially failed to notify the Commission of fully implemented national measures. Consequently, on 24 July 2025, the European Commission initiated infringement proceedings towards 18 Member States, including Italy, France, Germany, Spain, and Austria, for delayed or incomplete transposition.
Status of EU Member States’ Transposition of Directive (EU) 2024/1226
Building on this EU-wide context, the following section provides an overview of the current transposition status in selected Member States.
Italy
Italy has fully transposed the Directive with Legislative Decree No. 211 of 30 December 2025, in force since 24 January 2026. The decree establishes new criminal offences for breaches of EU restrictive measures introducing new sections of the penal code (art. 275 bis to art.275 quater, under the heading “Crimes against UE foreign policy and common security”). Moreover, corporate administrative liability is extended under Legislative Decree 231/2001 at section 25 octies.2, ensuring that companies can be held accountable where violations are committed in their interest or to their benefit, providing for sanctions based on global turnover.
Germany
Germany initially missed the May 2025 deadline due to parliamentary elections. On 15 January 2026, the Bundestag adopted an Implementing Act, which entered into force on 6 February 2026. This Act reinforces the existing Foreign Trade and Payments Act (AWG) by criminalising intentional sanctions violations, introducing imprisonment for individuals in some cases and expanding corporate liability. (Ordnungswidrigkeitenrecht, in particular § 30 of the Administrative Offences Act – OWiG). Germany opted for high fixed monetary ceilings for corporate fines alongside turnover-based calculations to comply with Directive 2024/1226 requirements.
France (as of early 2026)
France has not yet completed full transposition of Directive 2024/1226. While a decree in 2025 designated the competent authorities for enforcement and coordination pursuant to Article 15 of Directive (EU) 2024/1226, the criminalisation of sanctions violations and the relevant corporate liability required by the Directive 2024/1226 still remain under development. However, France already maintains a robust criminal framework since Customs Code (Article 459) punishes contraventions to laws and regulations governing financial relations with foreign countries in case of failing to observe the prescribed procedures or formalities required or by failing to obtain the required authorisations.
Spain (as of early 2026)
Spain has prepared a draft approved in March 2025, but the law implementing Directive 2024/1226 has not yet been formally enacted as of early 2026. Currently, violations of EU sanctions are addressed through generic offences under existing legislation (e.g., customs violations, anti-money laundering provisions).
Austria (as of early 2026)
Austria applies EU sanctions primarily through the Sanctions Act (Sanktionsgesetz) and the Foreign Trade and Payments Act (Außenwirtschaftsgesetz – AWG), alongside corporate liability under the Corporate Liability Act (VbVG) providing imprisonment for individuals, while companies can be held liable where offences are committed in their interest or to their benefit. Administrative fines can reach several million euros for breaches of reporting obligations or asset-freezing duties. Austria has not yet completed full transposition of Directive (EU) 2024/1226, though enforcement mechanisms are operational.
The above examples show the differing pace of implementation across the EU, with some jurisdictions having fully integrated the Directive into their domestic systems and others still adapting their legislative frameworks. The European Commission continues to monitor progress and may initiate further enforcement action where implementation gaps remain.
Against this comparative background, it is appropriate to examine more closely the Italian implementation and its operational consequences for companies.
Italian Framework
As of 24 January 2026, all entities engaged in international trade that adopted an Organisational Model pursuant to Legislative Decree 231/2001, must update it to prevent risks arising from violations of European Union economic sanctions and export control rules.
Italy implemented Directive 2024/1226 with Legislative Decree No. 211 of 30 December 2025, introducing a comprehensive framework governing criminal offences connected to violations of EU restrictive measures and expanding the scope of corporate administrative liability under Legislative Decree 231/2001. This reform has direct implications for Organisational Models and corporate compliance systems.
Introduction of new crimes
The Decree inserts into the Italian Criminal Code four new types of crime relating to EU foreign and security policy:
– Violations of restrictive measures (art. 275 bis c.p.)
– Violations of information obligations imposed by UE restrictive measures (art. 275 ter c.p.)
– Non-compliance with authorisation and reporting obligations provided under EU regulations (art. 275 quater c.p.).
– Culpable violation of UE restrictive measures (art. 275 quinquies c.p.)
Penalties include imprisonment from two to six years and fines ranging from €25,000 to €250,000.
Article 25-octies.2 of Legislative Decree 231/2001 extends the above violations to criminal corporate liability where the conduct is carried out — including abroad — in the interest or to the benefit of the company.
Revision of Risk Mapping
The first measure to be adopted is a revision of the risk-mapping process under D.lgs. 231/2001 framework. Sensitive activities should therefore include:
– Financial transactions.
– Relationships with intermediaries.
– Supply chain management.
– Cross-border payments.
– Granting of licences and authorisations.
– Reporting obligations toward competent authorities.
Restrictive measures apply to third countries currently subject to EU sanctions regimes (e.g., Russia, Belarus, Iran, Syria, North Korea), as well as other States, entities or individuals designated under EU Regulations and Council Decisions. The scope is dynamic and linked to developments in the EU’s Common Foreign and Security Policy.
Turnover-Based Sanctioning System
The new sanctioning system departs from the traditional quota-based mechanism foreseen by D.lgs. 231/01 and introduces administrative fines calculated as a percentage of global annual turnover: (from 1% to 5%). This approach reflects the Directive’s requirement that penalties for legal persons be effective, proportionate and dissuasive, taking into account the economic capacity of the Company.
Operational Guidance for Companies, Supervisory Bodies and Compliance Functions
Companies, particularly those operating in international trade, export control, finance, and global supply chains, must:
– Integrate their risk analysis including transactions involving sanctioned countries.
– Strengthen counterparty controls.
– Formalise authorisation and reporting procedures.
– Ensure adequate involvement of the Supervisory Body (Organismo di Vigilanza) with structured, periodic information flows.
Targeted and differentiated training is essential for both top management and operational functions. Knowledge of EU sanctions and related prohibitions is crucial for the effectiveness of the Organisational Model pursuant D.lgs. 231/01.
The reform marks a significant shift: compliance with EU sanctions now fully enters the criminal framework of corporate liability, requiring companies to adopt a preventive, structured, and constantly updated approach.
Seguici su LinkedIn