Newsletter February 2026

Corporate compliance and European Union restrictive measures

The new sanctions system
I.1. The extension of the scope of application of Decree 231 to violations of EU restrictive measures

On 9 January 2026, Decree-Law No. 211 of 30 December 2025 (hereafter the “Decree-Law No. 211/2025”) was published in the Official Gazette, implementing “Directive (EU) 2024/1226 of 24 April 2024 on the definition of criminal offences and sanctions for violations of Union restrictive measures, and amending Directive (EU) 2018/1673”(hereafter the “Directive”), which aims to ensure uniform national sanctions for violations and circumvention of restrictive measures adopted by the European Union. Decree-Law No. 211/2025 affects the criminal justice system by introducing new criminal offences and expanding the scope of corporate criminal liability under Decree-Law No. 231/2001 (hereafter the “Decree 231”) through a change in the penalty system.

The Directive establishes a regulatory framework designed to address the fragmentation of national regulations concerning violations of European Union restrictive measures. This framework achieves this by precisely identifying criminally relevant conduct and reinforcing the enforcement system by extending liability to legal entities.

In particular, Article 3 defines a number of acts committed in violation of prohibitions or obligations arising from EU restrictive measures as criminal offences when committed with intent, including:

  • the provision of funds or economic resources to designated people;
  • failure to freeze funds or economic resources;
  • facilitating the entry of designated individuals into the national territory;
  • carrying out prohibited commercial or financial transactions; and
  • conduct aimed at circumventing the measures themselves.

In addition to direct violations, the provision includes specific cases of circumventing restrictive measures aimed at neutralising their effectiveness through simulated transactions, subjective interpositions or untruthful documentation.

Article 4 extends criminal liability to incitement, aiding and abetting, complicity, and in certain cases, attempts to commit offences referred to Article 3. This significantly broadens the scope of punishable conduct.

Articles 6 and 7 of the Directive expressly address the liability of legal entities, requiring Member States to impose effective and deterrent penalties on legal entities responsible for offences under Articles 3 and 4.

Under Article 6, Member States must ensure that legal entities can be held liable for violations of EU restrictive measures if the offences have been committed through acts or omissions of supervision or control, in their interest or for their benefit, by individuals in leadership positions within the organization.

Therefore, the reference to Articles 3 and 4 plays a fundamental role, as it enables the liability of legal entities to be invoked for various conduct that may affect the effectiveness of EU restrictive measures, which has significant repercussions for the internal organisation of entities and their prevention systems.

Of the various amendments introduced by Decree-Law No. 211/2025, those concerning the Criminal Code are of central importance. New types of offences concerning the violation and circumvention of European Union restrictive measures have been introduced in a new chapter of Book II. These innovations are accompanied by an extension to the administrative liability of entities under Decree 231, through the inclusion of these new offences among the predicate offences. Decree-Law No. 211/2025 also amends Decree-Law No. 24 of 10 March 2023 (hereafter the “whistleblowing decree”), extending protections for whistleblowers to violations of European Union restrictive measures.

Decree-Law No. 211/2025 introduced new offenses into the Criminal Code related to violations of European Union sanctions system, with the aim of harmonizing the repressive response of Member States to such conduct. The Directive requires that the offenses provided for therein be punished with criminal sanctions that are consistent with each other, at least in terms of minimum limits, throughout the European Union.

The new criminal offenses are therefore intended to ensure the effectiveness of decisions taken by the European Union in the field of common foreign and security policy. In this context, there is also provision for a specific aggravated offense (Article 275 quinquies) for crimes committed with serious negligence and involving military or dual-use products, punishable by imprisonment and a significant fine, in line with the repressive standards required by the European Union.

Chapter I bis, “Offenses against the foreign policy and common security of the European Union”, has been added to Book II, Title I:

The changes made

Art. 275 bis

“Violation of European Union restrictive measures”

 

Anyone who violates a prohibition, obligation or restriction imposed by a European Union restrictive measure or national legal provisions implementing such a measure:

(a) makes funds or economic resources available, directly or indirectly, to a designated person, entity, body or group, or allocates funds or economic resources for their benefit;

(b) fails to take measures to freeze funds or economic resources belonging to, or owned, held or controlled by, a designated person, entity, body or group;

(c) enters into any economic, commercial or financial transactions, including the award or continuation of public procurement or concession contracts, with a third country, its agencies, or entities or agencies directly owned or controlled by that third country or its agencies;

(d) imports, exports, trades, sells, purchases, transfers, transits or transports goods (including intangible goods) or provides intermediation, technical assistance or other services related to such goods; or

(e) provides services of any kind (including financial services) or carries out financial transactions.

The same penalty referred to in the first paragraph shall apply to anyone who evades the implementation of a restrictive measure of the European Union by:

(a) using, transferring to third parties, or otherwise disposing of, directly or indirectly, frozen funds or economic resources owned, held, or controlled by a designated person, entity, body, or group;

(b) presenting or using false statements or documents, or providing false information, for the purpose of hindering the identification of the beneficial owner or final beneficiary of funds or economic resources to be frozen.

In cases referred to in paragraphs 1 and 2 where the funds, economic resources, goods, services, transactions or activities have a value of less than €10,000 at the time of the offence, only an administrative fine ranging from €15,000 to €90,000 shall apply. This provision shall not apply to the case referred to in paragraph 1, letter d), if the offence relates to products included in the European Union’s common list of military equipment or dual-use products as defined in Annexes I and IV to Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021.

For the purposes of determining the value referred to in paragraph 3, transactions of lesser value shall be taken into account when they form part of the same economic plan.

The provisions referred to in the preceding paragraphs also apply to transactions carried out without the relevant authorisation or where authorisation was obtained by providing false statements or documentation.

Art. 275 ter

“Breach of information obligations imposed by a restrictive measure of the European Union”

 

Any designated person or legal representative of a designated entity or body who fails to report to the competent administrative authorities the funds or economic resources over which they exercise ownership or control, or which they possess or hold in the territory of the State, in violation of a specific obligation imposed by a European Union restrictive measure or by a provision of national law implementing a European Union restrictive measure.

The same penalty referred to in the first paragraph shall also apply to anyone who, in violation of an obligation imposed by a European Union restrictive measure or a provision of national law implementing such a measure, fails to provide the competent administrative authorities with information of which they are aware by reason of their office or profession concerning funds or economic resources present in the State’s territory that belong to designated people, entities, bodies or groups, or that are owned, held or controlled by them.

If the value of the funds or economic resources is less than €10,000 at the time of the offence, only an administrative fine ranging from €5,000 to €45,000 shall be imposed.

For the purposes of determining the value indicated in paragraph 3, transactions of lesser value shall be taken into account when they form part of the same economic plan.

Art. 275 quater

“Violation of the conditions of authorization to carry out activities”

 

Anyone who carries out transactions, provides services, or performs other activities in breach of the obligations set out in authorisation issued by the competent authority when such authorisation is required by a European Union restrictive measure shall be punished by imprisonment for a term of between two and five years and a fine of between €25,000 and €150,000. If the activities referred to in the first paragraph concern funds, goods or services with a value of less than €10,000 at the time of the offence, only an administrative fine ranging from €15,000 to €80,000 shall apply.

When determining the value referred to in the second paragraph, transactions of lesser value shall be taken into account if they form part of the same economic plan.

Art. 275 quinquies

“Negligent violation of European Union restrictive measures”

 

Where any of the acts referred to in the first paragraph of Article 275 bis, letter d), are committed through gross negligence and concern products included in the European Union’s common list of military equipment or dual-use products listed in Annexes I and IV to Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021, the penalty shall be imprisonment for a term of six months to three years and a fine of between €15,000 and €90,000.

Art. 275 sexies

“Aggravating circumstances”

 

The penalties established for the offences referred to in Articles 275 bis, 275 ter, 275 quater, 275 quinquies and Article 12, paragraph 1, aggravated pursuant to paragraph 1 bis of Decree-Law No. 286 of 25 July 1998, are increased by one third to one half.

a) if the offence is committed within the context of a criminal association as referred to in Article 416;

b) if the offence is committed through the use or presentation of false statements or documents certifying untrue facts;

c) if the offence is committed in the course of professional, commercial, banking or financial activities;

d) if the offence is committed through abuse of power or violation of duties inherent in a public function or public service;

e) if the offence results in a significant profit or advantage;

f) If the offender destroys, suppresses, conceals or damages, in whole or in part, a document or object that is to be used as evidence or that is otherwise useful for the discovery or investigation of the offence.

If, in order to obtain impunity for one of the offences referred to in paragraph 1, the offender commits any of the offences referred to in Articles 377 (third paragraph) and 377 bis, the penalties provided for therein shall be increased by one third to one half.

Art. 275 septies

“Mitigating circumstances”

 

For the crimes referred to in Articles 275 bis, 275 ter, 275 quater, 275 quinquies and Article 12(1) of Decree-Law No. 286 of 25 July 1998, as aggravated under paragraph 1(bis), the penalty is reduced by one-third to two-thirds for those who have effectively worked to prevent further consequences of the criminal activity, secure evidence of the crimes, identify other perpetrators or seize assets, funds or economic resources.

Art. 275 octies

“Mandatory confiscation”

 

In the event of a conviction or the application of a penalty at the request of the parties, pursuant to Article 444 of the Code of Criminal Procedure, for offences referred to in Articles 275 bis, 275 ter, 275 quater and 275 quinquies, and Article 12(1) of Decree Law No. 286 of 25 July 1998, as aggravated by paragraph 1-bis, the confiscation of items used or intended for use in committing the offence, and items that are the price, product or profit thereof, shall always be ordered unless they belong to someone not involved in the offence. If this is not possible, the confiscation of assets available to the offender, whether directly or indirectly, up to the value of the price, product or profit of the crime, shall be ordered.

Art. 275 novies

“Publication of the conviction”

 

A conviction for any of the offences referred to in Articles 275 bis, 275 ter, 275 quater, 275 quinquies and Article 12(1) of Decree-Law No. 286 of 25 July 1998, as aggravated under paragraph 1 bis, shall entail publication of the judgement if a prison sentence of at least three years is imposed.

The personal data of the convicted person shall only be reported if there are specific and exceptional reasons of public interest expressly indicated in the judgement.

Art. 275 decies

“Jurisdiction”

 

Offences referred to in Articles 275 bis, 275 ter, 275 quater and 275 quinquies of Decree-Law No. 286 of 25 July 1998, as well as Article 12, paragraph 1, aggravated pursuant to paragraph 1 bis, are punishable under Italian law even if they are committed by a citizen abroad.

Furthermore, pursuant to Article 8 Decree-Law No. 211/2025, professionals practising a legal profession are exempt from the obligation to provide information relating to their clients under Article 275 ter, paragraph 2, of the Italian Criminal Code. This exemption applies when the information was obtained while analysing the legal position, or during defence or representation activities, including those related to legal proceedings, such as assisted negotiation and advice on whether or not to take legal action.

The legislator then intervened by amending certain articles of the Code. Notably, the new offences referred to in Articles 275 bis, 275 ter, 275 quater and 275 quinquies of the Criminal Code, as well as the offence of aiding and abetting aggravated illegal immigration, were incorporated into the remit of the District Anti-Mafia Directorate. These offences have also been included among those for which Article 407 of the Code of Criminal Procedure provides for longer preliminary investigation periods due to their complexity, as set out in paragraph 2 of number 7 quater. In conclusion, the amendment of Article 371 bis of the Code of Criminal Procedure extends the system of investigative coordination between public prosecutors to these crimes, thereby facilitating the circulation of information.

The legislator has expanded the list of predicate offences in Decree 231 through the introduction of Article 25octies.2, which is expressly dedicated to violations of restrictive measures adopted by the European Union. For the purposes of corporate liability, this provision includes the new intentional criminal offences introduced into the Criminal Code by the transposition decree. These offences cover not only conduct involving the violation and circumvention of restrictive measures, but also non-compliance with the reporting obligations provided for by the European Union’s sanctioning regimes. They also cover the violation of the conditions set out in authorisation measures, and the facilitation of the entry into the State’s territory of natural people designated in violation of those measures.

Moreover, as an exception to the ordinary quota-based system, the legislator uses the entity’s global annual turnover as the reference parameter. For violations of EU restrictive measures, non-compliance with the conditions attached to administrative authorisations and facilitating entry into the national territory in violation of sanctions regimes, a financial penalty between 1% and 5% of the entity’s global turnover in the financial year preceding that in which the offence was committed, or if lower, in the financial year preceding the application of the financial penalty, is imposed. For breaches of reporting obligations, this percentage is reduced to between 0.5% and 1%. Where it is not possible to determine the entity’s total annual turnover, an alternative system based on fixed amounts has been introduced, providing for fines of between €3 million and €40 million for the most serious cases, and between €1 million and €8 million for breaches of disclosure obligations.

The rules on disqualification penalties are also important: a penalty of between two and six years applies if the offence is committed by person in senior positions and a penalty of between one and three years applies if the offence is attributable to person under their management or supervision. This provision constitutes a special rule and confirms the legislator’s intention to attribute particular systemic importance to such cases, given the impact that the violation of restrictive measures can have on the fundamental interests protected by the European Union and is an exception to the ordinary two-year limit established by Decree 231.

The main amendments to Decree 231 are as follows:

 

The changes made

Art. 10

“Financial penalty”

 

1. For administrative offenses resulting from crimes, a fine is always imposed.

2. The fine is imposed in increments of no less than one hundred and no more than one thousand.

3. The amount  Except as provided for in paragraph 3 bis, the amount of a share ranges from a minimum of €258 (five hundred thousand lire) to a maximum of €1,549 (three million lire).

3 bis. In the cases provided for by law, the financial penalty is determined in relation to the specific percentage, indicated for each offense, of the total global turnover of the entity relating to the financial year preceding that in which the offense was committed or, if lower, to the financial year preceding the application of the financial penalty. When it is not possible to ascertain the entity’s total turnover, the financial penalty shall be applied in the amount determined in relation to each offense.

Art. 13

“Disqualification sanctions”

 

1. Disqualification sanctions shall apply in relation to offenses for which they are expressly provided, when at least one of the following conditions is met:

a) the entity has derived significant profit from the offense and the offense was committed by person in senior positions or by person subject to the direction of others when, in this case, the commission of the offense was determined or facilitated by serious organizational deficiencies;

b) in the event of repeated offenses.

2. Without prejudice to the provisions of from Article 25, paragraph 5 Articles 25, paragraph 5, and 25octies.2, paragraph 3, disqualification sanctions shall have a duration of not less than three months and not more than two years.

3. Disqualification sanctions shall not apply in the cases provided for in Article 12, paragraph 1.

Art. 25octies.2

 “Offenses relating to the violation of European Union restrictive measures”

 

1. With regard to the commission of crimes under the Criminal Code relating to the foreign policy and common security of the European Union, the following shall apply:

a) For violations of Articles 275 bis (first, second and fifth paragraphs), 275 quater (first paragraph) of the Criminal Code, and Article 12 (paragraph 1 bis) of Decree-Law No. 286 of 25 July 1998, a fine of between 1% and 5% of the entity’s total turnover in the financial year preceding that in which the offence was committed, or if lower, in the financial year preceding the application of the fine.

b) For violations of Article 275 ter, paragraphs 1 and 2 of the Criminal Code, a fine between 0.5% and 1% of the entity’s total turnover in the financial year preceding that in which the offence was committed, or if lower, in the financial year preceding the application of the fine.

2. Where it is not possible to establish the entity’s total annual turnover, the entity shall be subject to a fine ranging from €3 million to €40 million for offences under Articles 275 bis (first, second and fifth paragraphs), 275 quater (first paragraph) of the Criminal Code and Article 12 (paragraph 1), aggravated under paragraph 1 bis of Decree Law No. 286 of 25 July 1998. A fine ranging from €1 million to €8 million shall be imposed for offences under Article 275 ter (paragraphs 1 and 2) of the Criminal Code.

3. In cases of conviction for one of the offences referred to in paragraph 1, letters a) and b), the disqualification penalties provided for in Article 9, paragraph 2, shall apply to the entity for a period of not less than two years and not more than six years if the offence was committed by one of the individuals referred to in Article 5, paragraph 1, letter a); and for a period of not less than one year and not more than three years if the offence was committed by one of the individuals referred to in Article 5, paragraph 1, letter b).

4. In the event of a repeat offence under paragraph 1, letters a) and b), the financial penalties provided for shall be increased by one third.

 

At last, Article 7 of Decree-Law 211/2025 extends the scope of the Whistleblowing Decree to cover reports of breaches of restrictive measures imposed by the European Union.

The changes made

Art. 1

“Objective Area of Application”

 

1. This decree regulates the protection of individuals who report violations of national or European Union regulations that harm the public interest or the integrity of public or private entities, of which they have become aware in a professional context.

This decree also regulates the protection of people who report violations of the restrictive measures of the European Union referred to in Chapter I bis, Title I, Book II of the Criminal Code, as well as Article 12, paragraph 1 bis, of Decree-Law No. 286 of July 25, 1998.

2. The provisions of this decree shall not apply to:

a) to disputes, claims or requests relating exclusively to the personal interests of the reporting person or the person who has filed a complaint with a judicial or accounting authority, relating to their individual employment or public service relationships or their relationships with their hierarchical superiors;

b) to reports of violations that are already covered by European Union or national legislation listed in Part II of the Annex to this Decree, or by national legislation implementing European Union legislation listed in Part II of the Annex to Directive (EU) 2019/1937, even if they are not listed in Part II of the Annex to this Decree;

c) Reports relating to breaches of national security, as well as defence or national security contracts, unless such aspects fall within the scope of the relevant European Union secondary legislation.

3. The application of national or European Union provisions relating to the following shall remain unaffected:

a) classified information;

b) legal and medical professional secrecy;

c) the secrecy of the deliberations of judicial bodies.

4. The application of provisions relating to criminal procedure and the autonomy and independence of the judiciary, including the functions and powers of the Superior Council of the Judiciary and related procedures, shall also remain unaffected in all matters relating to the legal position of members of the judiciary, as well as matters of national defence, public order and security as referred in Decree No. 773 of 18 June 1931, containing the consolidated text of laws on public security. The provisions concerning the right of workers to consult their representatives or trade unions, protection against unlawful conduct or acts resulting from such consultations, the autonomy of social partners and their right to enter into collective agreements, and the repression of anti-union conduct, as set out in Article 28 of Law No. 300 of 20 May 1970, shall also remain in force. No. 300.

Implementing the Directive has had a significant impact on the national sanctions system relating to restrictive measures. It has remedied the fragmentation of previous regulations and strengthened the protection of interests relating to the common foreign and security policy. Decree-Law 211/2025 broadens the scope of criminal liability and tightens sanctions, particularly with regard to the liability of entities. Consequently, companies must give priority risk assessment and adapt organisational models to incorporate new risk profiles. They must also adjust company procedures relating to cross-border transactions, financial flows and “know your client” activities. In this context, the complexity of the regulations requires training initiatives to be reinforced to prevent the risk of sanctions.

Download the newsletter

Related Posts