Complying with international sanctions: new regulatory measures proposed at the EU level. Do companies know their risks and how to mitigate them?

Obligations to comply with international sanctions fall not only on the competent national authorities or on special categories of entities, but also on “any Romanian natural or legal person or located on the territory of Romania which must ensure compliance with the application of international sanctions, based on the normative acts that establish them”, according to the provisions of the Governmental Emergency Ordinance no. 202/2008 on the implementation of international sanctions, with subsequent amendments and additions. Among areas with relevant incidence in the application of international sanctions, the legislation mentions lending and financial activities, as well as other activities to which Law no. 129/2019 for prevention and combating of money laundering and terrorism financing, as well as for the modification and completion of some normative acts, with subsequent changes and additions, applies, import-export activities, the production of materials and goods subject to international sanctions regime, transport, customs clearance etc. In all these areas of activity, preventive measures are required, such as obtaining export licenses, compliance with commercial restrictions and embargoes, compliance with the provisions regarding trade within the European Union etc. Thus, in order to comply with the regulations issued at a national and European level, companies must implement an internal compliance program, consisting of implementing procedures aligned with legal provisions and internal processes and controls, on one hand, and, on the other hand, assigning responsibilities to specially designated professionals.

In practice, deficiencies frequently encountered in the application of international sanctions and, implicitly, of the compliance program are caused by insufficient knowledge or misinterpretation of the regulatory framework. Among these, the most common situations are those in which:

1. it is considered that the applicable legal provisions are only those adopted at the national level, and in this case, there where the provisions are not explicit, they are ignored. In this regard, EU decisions and regulations, as well as guidelines issued by the European Commission or the EU Council provide details on the obligations of individuals and entities in Romania and include clear rules of interpretation;

2. the internal compliance program is only partially implemented, for example, companies do not assign specific tasks to a person or a group of persons in the field of applying international sanctions, they do not formally adopt procedures in this field etc.;

3. the entities consider that their obligations are limited to only consulting the sanctions lists (name screening) and they do not proceed to the verification of the other parties within the end-to-end process, such as the authorizing officer, the intermediaries (banks, insurers, carriers, brokers, other front-companies etc.) or the final beneficiary of the transaction;

4. the screening of persons and entities is carried out at large time intervals from the date of the first check. The principle of applying the legislation is precisely that of immediately identifying the designated persons/entities, of those under their control or associated with them from among clients or business partners, to freeze their funds and economic resources and not to make them available directly or indirectly; notifying or, as the case may be, reporting these persons or entities to the authorities shall also be done as soon as possible from the date of official listing and identification;

5. the list of documents provided to justify the legality of a transaction is limited and does not include elements related to the verification of complying with the restrictions imposed by international sanctions – for example, the export license, the customs declarations etc.

Moreover, in addition to these deficiencies in the application of international sanctions regime, there are also entities that are not aware of the fact that they have obligations in this area. In response to this, the European Commission has initiated the adoption of a proposal for a directive to criminalise the breaching of EU sanctions as serious criminal offence.

Given that in recent years the restrictive measures enforced by the EU have been applied differently by member states, creating legislative loopholes that have allowed the avoidance of liability for certain entities and impediments in the application of the sanctioning regime, especially in the situations of groups of companies operating on the territory of several states, in December 2023, the European Parliament and the EU Council reached a provisional political agreement on the harmonization and consolidation at a community level of offenses and punishments for breaching sanctions.

Establishing a common legal framework for criminalizing the violation of EU restrictive measures, as well as standardizing cross-border criminal investigations and prosecutions will this way provide common grounds for the states to build their own legal framework. In this regard, the afore-mentioned agreement provides that the member states must criminalise a series of acts that result in the violation of sanctions, including the sale of goods subject to sanctions, carrying out transactions with states or entities included on the sanctions list, performing restricted or prohibited financial services, concealing assets owned by persons or entities subject to sanctions etc.

In order to ensure effective, proportionate and dissuasive sanctions, the agreement provides minimum limits of penalties margins, established according to the gravity of the crime, as follows: for natural persons, an imprisonment penalty of at least one or five years, by case, and for legal entities, monetary sanctions of at least 1% of the global turnover achieved in the previous financial year, with a maximum threshold starting at 5%. Moreover, in the case of legal entities, complementary sanctions are also provided, such as exclusion from access to public funding, including public procurement procedures, grants and concessions, lifting the right to conduct commercial activities, withdrawal of permits and authorizations for running activities that led to committing the offence, judicial control, the judicial liquidation and the closure of the units that served to commit the offence, as well as the confiscation of any income obtained as a result of breaching sanctions. At the same time, the agreement stipulates that the liability of legal entities does not exclude the possibility of criminal prosecution of natural persons involved in the violation of the restrictive measures’ regime.

Another important provision of the agreement refers to the establishment of a centralized EU database listing persons and entities subject to restrictive measures, a step that would facilitate their monitoring and identification, and would make bypassing restrictions difficult.

The establishment of a consolidated legislative framework at the EU level denotes the community commitment to strengthening the sanctions regime and comes as a response to emerging challenges in the field, as well as to the difficulties encountered in practice in creating an effective compliance framework. On the other hand, given the option of the EU legislators to shape this proposal in a directive-type legislative act, the transposition of this text into the national legislation of the member states will require careful coordination to ensure a balance between normative harmonization and national realities.