Stricter penalties under new sanctions violation regulation – corporate fines of up to EUR 40 million

The new regulation is based on Directive (EU) 2024/1226 on sanctions violations, which aims to ensure that violating sanctions is criminalised in all Member States and that the related penalties meet a common minimum standard. Finland transposed the obligations under the Directive through amendments to the Criminal Code, resulting in a significant increase in the penalties that can be imposed for violating sanctions.

New offences: sanctions offence, aggravated sanctions offence, negligent sanctions offence and sanctions violation

Prior to the amendment, sanctions violations were punishable as regulation offences, but this is no longer the case.

The amendment added four new offences into chapter 46 of the Finnish Criminal Code: sanctions offence, aggravated sanctions offence, negligent sanctions offence and sanctions violation. 

• A sanctions offence is an act in violation of imposed sanctions. This includes, among other things, making funds or economic resources available for the benefit of a sanctioned person and violating import and export embargoes imposed under sanctions regimes.

• A sanctions offence is considered aggravated if, in the violation of sanctions, considerable economic benefit is sought, the offence concerns considerably valuable assets, military equipment or dual-use items, or the offence is committed in a particularly premeditated manner. The offence must also be assessed as aggravated when considered as a whole.

• A negligent sanctions offence is committed when the violation of sanctions is committed through gross negligence and concerns military equipment or dual-use items. This is a new provision that tightens the regulation – previously, criminal liability for sanctions violations required intent.

• A sanctions violation is a less severe form of a sanctions offence. It covers acts involving assets of minor value and acts that are otherwise of minor importance. 

The new offences also apply to the circumvention of sanctions. For example, delivering goods with the knowledge that the goods will eventually end up in a country subject to sanctions may become punishable under the new regulation on sanctions violations.

Increased penalties highlight the importance of complying with sanctions in business operations

As a result of the amendment, a company that breaches or circumvents sanctions may be issued a corporate fine with a maximum amount that derogates from a typical corporate fine: 5% of the company’s turnover. Regardless of the turnover, the maximum monetary amount of the corporate fine is no less than EUR 850,000 and no more than EUR 40 million. The minimum amount is EUR 850, which means that, depending on the size of the company’s turnover, the fine can range from EUR 850 to EUR 40 million.

Increasing the maximum amount of corporate fines for sanctions violations is a significant change from the previous provision, under which corporate fines ranged from EUR 850 to EUR 850,000. This stricter maximum amount emphasises the responsibility of companies for their actions and guides them towards preventive measures in complying with sanctions legislation. A challenge in its own right is the ambiguity of sanctions regulation, resulting in a heightened importance of risk assessments in business decisions.

For natural persons, the maximum penalty for violating sanctions can be imprisonment, which is why company management must oversee and monitor sanctions compliance with particular care.

The continuous expansion of sanctions regulation, the specification of the elements of a criminal offence and the new maximum corporate fine emphasise that compliance with sanctions is more than just an administrative obligation. Companies need to make sure that their internal processes, guidelines, screening mechanisms, and staff competence meet regulatory requirements proactively, comprehensively, and consistently.

Increased focus on up-to-date and comprehensive compliance and sanctions processes

It is more important than ever for companies to stay up to date on sanctions developments and ensure compliance with sanctions regulation, which is enforced by criminal investigation authorities – the police and Customs. Companies need to ensure that their compliance and sanctions processes and guidelines are up to date and comprehensive, and train their staff so that everyone has the sanctions knowledge required for their role. Sanctions processes are particularly important for companies engaged in international trade.

If a sanctions violation is taken to a criminal investigation, one of the aspects the authorities will assess is the effectiveness and adequacy of the company’s compliance processes. The currency and effectiveness of these processes have a significant impact on how the authorities assess the intentionality of a possible violation – inadequate processes may indicate negligence or even wilful misconduct.

Effective and adequate compliance processes also play a key role in assessing the criminal liability of a company and its management. Effective internal screening systems and a clear allocation of responsibilities can protect not only the company itself but also its management from personal liability, whereas missing or inadequate processes can lead to liability for management if sanctions are violated. This is why compliance processes must not only be sufficiently comprehensive, but companies must also follow them and update them regularly.

Reform of sanctions violation regulation emphasises risk identification

If there is a suspicion of a possible irregularity in the company’s internal guidelines or processes, or of a sanctions breach, the matter must be thoroughly investigated. Companies should have a low threshold for initiating internal investigations, as assessing the necessary actions in a consistent manner requires gathering sufficient information about the events.

Under certain conditions, a company may become liable also if its products end up in sanctioned countries through its customer or partner networks. This means that companies must seek to ensure, up to a certain point, that sanctions are complied with in their own supply chains and endeavour to ensure that they themselves do not become suspected of sanctions circumvention, for example, in matters involving their customer or partner networks.

As part of risk management, it is worth assessing whether an internal investigation should be entrusted to an external expert. It is important to document the internal investigation carefully so that the company can demonstrate that it has acted diligently.

The EU’s 19th sanctions package enters into force

In late October, the EU adopted the 19th package of sanctions against Russia, which entered into force on 24 October 2025. The new EU sanctions specifically target the energy sector, and its measures include the ban on imports of Russian liquefied natural gas (LNG) as of 1 January 2027 for long‑term contracts and 25 April 2026 for short-term contracts. The sanctions package also seeks to further restrict the operations of Russia’s shadow fleet. Litasco Middle East DMCC, a Russian oil operator, was added to the sanctions list, and transaction bans on Rosneft and Gazprom Neft were tightened.

The package also expanded the product coverage of goods subject to export bans. As regards export restrictions, it is worth noting that the export ban on Belarus was also extended.

The EU was not the only one to introduce new sanctions in October – the US and the UK also implemented additional measures. For example, both countries added the Russian oil companies Lukoil and Rosneft to their sanctions lists. These listings also impact companies directly or indirectly owned by Lukoil and Rosneft.