Violations of European Union Restrictive Measures in the Italian Legal System: from Directive (EU) 2024/1226 to Legislative Decree No. 211/2025

a) Directive (EU) 2024/1226

Through Legislative Decree No. 211 of 30 December 2025, which entered into force on 24 January 2026, the Italian legal system transposed Directive (EU) 2024/1226. The Directive required member states to “establish minimum rules concerning the definition of criminal offences and penalties for the violation of Union restrictive measures” in order “to ensure the effective application of Union restrictive measures, the integrity of the internal market within the Union and a high level of security in the area of freedom, security and justice” (see the first recital of the Directive).

The stated objective of the Directive is to ensure uniform application and rigorous enforcement of restrictive measures adopted within the framework of the Common Foreign and Security Policy (CFSP), with a view to preserving the stability of the European Union, promoting respect for international law and strengthening the European Union’s ability to respond to threats and violations that may undermine international peace and security.

In particular, from a subjective standpoint, the Directive expressly provides that, in addition to natural persons, legal persons must also be capable of being held liable for offences “where such offences have been committed for their benefit by any person who has a leading position within the legal person concerned” (Article 6 of the Directive). It also provides for a set of significant sanctions, calibrated – as regards financial penalties – by reference to the total worldwide turnover of the legal person, in an amount of not less than 1% or 5%, depending on the seriousness of the offence (see Article 7 of the Directive).

The European legislature has therefore entrusted member states with a clear mandate: to sanction, in an effective and harmonised manner, all conducts amounting to a violation or circumvention of restrictive measures imposed by the European Union, while ensuring that the level of sanctions is sufficiently dissuasive, including for larger undertakings.

b) Transposition of the Directive in Italy

In Italy, the Directive was transposed by Legislative Decree No. 211 of 30 December 2025, which entered into force on 24 January 2026. That decree introduced a new Chapter I-bis into Book II, Title I, of the Italian Criminal Code, entitled “Offences against the foreign policy and common security of the European Union”, which includes:

• New criminal offences and administrative penalties protecting European Union restrictive measures, set out in Articles 275-bis to 275-decies.
• New predicate offences for the liability of legal persons under Legislative Decree No. 231/2001, introduced by Article 25-octies.2, entitled “Offences relating to the violation of European Union restrictive measures”. Their repression is governed by a new and particularly stringent criterion, which departs from the traditional quota-based system used to date and instead refers – where it can be determined – to percentages of the undertaking’s worldwide turnover.

Regarding the new criminal offences and administrative penalties, Article 275-bis of the Italian Criminal Code targets anyone who intentionally violates or circumvents European Union restrictive measures by engaging in one of the following forms of conduct:

• making funds or economic resources available to persons or entities included in sanctions lists, or otherwise providing funds or economic resources to listed persons;
• failing to freeze assets; and
• importing, exporting, selling, purchasing, transferring or transiting prohibited goods (including technological, military or dual-use goods) or prohibited services including services of any nature, financial services, or the execution of financial transactions.

The offence also covers circumvention, carried out through acts intended to evade sanctions by means of sham interpositions, false declarations or concealment of the beneficial owner.

Concerning sanctions, the legislator has provided for the coexistence of both criminal and administrative penalties.

Where the offence is committed, it is punishable by imprisonment from two to six years and a fine of between EUR25,000 to EUR250,000.

However, a criminal relevance threshold applies: if the overall value of the transaction is less than EUR10,000, only an administrative penalty applies (from EUR15,000 to EUR90,000), unless the transaction concerns military equipment or dual-use items, in which case the criminal response remains applicable regardless of the value of the transaction. For the purpose of calculating this threshold, transactions of lower value are also taken into account when they are executed as part of the same economic design.

Article 275-ter of the Italian Criminal Code punishes any person who intentionally breaches information obligations connected with European Union restrictive measures. The provision applies, firstly, to the sanctioned person or the legal representative of a sanctioned entity who fails to notify the competent authorities of funds or economic resources owned, held, controlled or possessed in Italy. The same liability also applies to anyone who, by reason of his or her office or profession, becomes aware of the existence of funds or economic resources attributable to sanctioned persons and fails to report them to the competent authority (for example, the Financial Security Committee).

The breach is punishable by imprisonment from six months to two years and a fine of EUR15,000 to EUR50,000. Here too, a criminal relevance threshold applies: if the funds or economic resources have a value of less than EUR10,000, only an administrative penalty of EUR5,000 to EUR45,000 applies. For the purposes of calculating that threshold, multiple low-value transactions are also considered cumulatively where they form part of the same economic design.

Article 275-quater of the Italian Criminal Code prohibits transactions, provisioning of services or the carrying out of activities in a manner that does not comply with an authorisation granted by the competent authority, where such authorisation is required by an EU restrictive measure.

The criminal penalty is imprisonment from two to five years and a fine of EUR25,000 to EUR150,000. If the activities concern funds, goods or services with a value of less than EUR10,000, only an administrative monetary penalty of EUR15,000 to EUR80,000 applies; for the purposes of the threshold, lower-value transactions are also taken into account where they form part of the same economic design.

Article 275-quinquies of the Italian Criminal Code punishes the grossly negligent violation of European Union restrictive measures where it concerns specific activities involving sensitive goods (the provision applies to the conduct referred to in Article 275-bis, paragraph 1, letter d), namely import, export, trade, sale, purchase, transfer and similar activities).

The criminal penalty is imprisonment from six months to three years and a fine of EUR15,000 to EUR90,000.

Article 275-sexies of the Italian Criminal Code, with specific reference to the offences described above, provides for certain aggravating circumstances, increasing the penalty by one third to one half where the same conduct is committed:

• in the exercise of a professional, banking or financial activity;
• through the involvement of criminal associations (Article 416 of the Italian Criminal Code) or the use of falsified documentation;
• through abuse of powers or breach of duties relating to a public office or public service;
• where the offence generates a profit of significant value; and
• where the conduct is aimed at concealing, destroying or eliminating documentation or evidence relating to the facts covered by the preceding articles.

Article 275-septies of the Italian Criminal Code introduces a mitigating circumstance designed to reward cooperation by the offender, with a reduction of the penalty from one third to two thirds.

Articles 275-octies to 275-decies of the Italian Criminal Code provide, in summary, for mandatory confiscation, publication of the judgment and the circumstances in which Italian jurisdiction applies.

As regards to the liability of legal persons, Article 25-octies.2 of Legislative Decree No. 231/2001 introduces corporate liability for offences relating to the violation of European Union restrictive measures, with financial penalties which – unlike those applicable to other predicate offences, traditionally based on the quota system – are instead calculated by reference to global turnover, together with enhanced disqualification sanctions.

This clearly reflects the intention to achieve the dissuasive purpose underpinning the European Directive, considering that the quota-based criterion for calculating sanctions arising from liability under Legislative Decree No. 231/2001 could sometimes lack deterrent effect, particularly for large organisations. In this respect, the percentage ranging from 1% to 5% of global turnover is especially significant for large corporations, such as banks, financial institutions, asset management companies and, more generally, large multinational groups.

Specifically, confirming the above, for the offences referred to in Articles 275-bis, paragraphs 1, 2 and 5, and 275-quater, paragraph 1, of the Italian Criminal Code, as well as Article 12, paragraph 1-bis, of Legislative Decree No. 286/1998, the entity is subject to a financial penalty ranging from 1% to 5% of global turnover in the financial year preceding the offence or, if lower, in the financial year preceding the application of the sanction. For the offences referred to in Article 275-ter, paragraphs 1 and 2, of the Italian Criminal Code, the financial penalty ranges from 0.5% to 1% of global turnover. If global turnover cannot be determined, the sanction is fixed in absolute terms: from EUR3,000,000 to EUR40,000,000 for the more serious offences referred to in letter a), and from EUR1,000,000 to EUR8,000,000 for the offences under Article 275-ter of the Italian Criminal Code. In the event of conviction, the disqualification sanctions under Article 9, paragraph 2, of Legislative Decree No. 231/2001 also apply: from two to six years where the offence is committed by a senior manager, and from one to three years where it is committed by a person subject to the direction or supervision of others. In the event of repeated conduct, the financial penalties are increased by one third.

c) Sectors potentially most exposed to risk: selected examples

The regulatory framework outlined above, as recently amended, is particularly relevant to the following sectors and areas of activity:

• customs (import/export);
• financial services (payments);
• defence and dual-use goods;
• energy and commodities;
• logistics and transport;
• technology;
• consultancy and corporate services;
• luxury goods and patrimonial assets; and
• international activities (NGOs, humanitarian organisations, international cooperation) in sanctioned areas.

In any event, it should be noted that greater exposure to risk does not necessarily depend on the sector of activity in the abstract, but is linked to a series of concrete factors, such as destination countries, the nature of foreign counterparties, the structure of beneficial ownership, possible commercial triangulations, the international payment channels used, and the involvement of intermediaries in carrying out transactions.

The nature and type of risks connected with the newly introduced offences are a coherent expression of the intention of both the European and national legislators to make economic operators increasingly aware of, and responsible for, the characteristics and operating methods of their counterparties, whether customers, suppliers or other service providers.

As it occurs in other areas of the legal system, such as recent Italian investigations concerning tax offences arising from inadequate management of supplier relationships, particularly in the logistics, fashion and large-scale retail sectors, which led to a significant and widespread reassessment of corporate compliance concerning supplier qualification throughout the supply chain, the commission of the offences under discussion may also be prevented through the adoption of organisational safeguards capable of ensuring the proper and effective identification of commercial counterparties and/or customers.

Reference may be made, for example, to specific rules, procedures and protocols – provided for by the organisational model or, more generally, by corporate compliance – concerning:

• Procedures for the proper identification of customers (KYC) as a safeguard against the risk of money laundering and terrorist financing offences, where applicable in accordance with sector-specific regulations (for example, Legislative Decree No. 231/2007 for financial intermediaries).
• Procedures for selecting and qualifying suppliers in the context of proper supply-chain management, requiring the adoption and implementation of rigorous procedures for both supplier qualification and supplier selection, as well as corresponding contractual clauses allowing termination of the contract if the counterparty is included on a sanctions list.

In other words, more structured companies with an effective culture of compliance may already have internal rules which, if properly implemented and applied to the offences introduced by Legislative Decree No. 211/2025, could provide a defence against the risk of violating sanctions measures.

d) Focus: the relevance of the issue for the financial sector and the UIF communication of May 2026

Confirmation of the above can be found in the recent communication addressed by the UIF (the Financial Intelligence Unit for Italy, an autonomous and independent authority established within the Bank of Italy and tasked with receiving and analysing a financial information concerning possible cases of money laundering and terrorist financing submitted by obliged entities) to financial intermediaries on 7 May 2026, concerning the “prevention of unlawful activities connected with the violation of European Union restrictive measures”.

In that communication, the UIF expressly states that the new offences introduced by Legislative Decree No. 211/2025 constitute criminal activity giving rise to the obligation to file suspicious transaction reports (STRs) for money laundering purposes under Article 35 of Legislative Decree No. 231/2007. Therefore, the authority that is the natural recipient of anti-money laundering reports considered it necessary to draw the attention of financial operators to a point that is as simple as it is important: violations of European sanctions constitute criminal offences and may therefore be the predicate for money laundering activity which, pursuant to Legislative Decree No. 231/2007 and, in particular, Article 35 thereof, must be reported as a suspicious transaction.

Indeed, while noting that the reporting obligation is separate and autonomous from the communication duties concerning restrictive measures and always requires an appropriately assessed suspicion, the UIF nevertheless confirms the close link between anti-money laundering rules and the identification of potential violations of European Union sanctions measures. It also provides examples of indicators and characteristics that should be considered suspicious of money laundering resulting from a violation of EU sanctions – in other words, money laundering based on a violation of the regime introduced by Legislative Decree No. 211/2025.

In its communication of 7 May 2026, the UIF reminded economic operators that the recently introduced offences under Articles 275-bis to 275-decies of the Italian Criminal Code may constitute predicate offences for the offence of money laundering.

In this regard, the UIF further notes that, when assessing suspicion, the following circumstances are relevant: matches against names on public lists, the involvement of connected persons and the objective features of the activity identified.

A mere coincidence of names is not sufficient if the recipient can rule out, with reasonable certainty, that the person concerned is the same as the person indicated on the lists.

By way of example, the UIF then identifies several risk scenarios:

• Opaque transnational corporate chains that obscure the ownership of assets attributable to sanctioned persons, especially in the real estate sector.
• Involvement of professionals facilitating circumvention of the relevant offences.
• Triangulation of funds through payment service providers in countries that do not apply similar sanctions regimes.
• Triangulation of crypto-assets and payment flows through correspondent accounts and virtual IBANs (vIBANs).
• Use of VPNs to conceal the location of the persons involved.
• Fundraising by non-profit organisations or digital platforms intended for conflict areas, where it entails violations of restrictive measures.
• Import/export of luxury goods, petroleum products, steel products, high-technology machinery or dual-use goods, often through recurring facilitators.

Finally, the UIF invites recipients to carry out a concrete and comprehensive analysis of the activity, ensuring full sharing of information among obliged entities (Article 39 of Legislative Decree No. 231/2007). On an experimental basis, a new code called “VO1–activity connected with the violation of Union restrictive measures” has also been made available for classifying STRs connected with violations of EU restrictive measures.

The content of the UIF communication is therefore a significant confirmation that, for financial intermediaries, the anti-money laundering safeguards that characterise the activities of entities subject to the sector-specific rules may, if properly adapted, constitute a first and important defence against the risk of committing the offences referred to in Articles 275-bis to 275-decies of the Italian Criminal Code.

In conclusion, the introduction of offences relating to the violation of European Union restrictive measures, including within the scope of Legislative Decree No. 231/2001, requires entities to carry out a concrete and substantive reassessment of their organisational safeguards, especially in processes involving relationships with foreign counterparties, suppliers, intermediaries, customers, subcontractors or persons operating in high-risk countries.