Sanctions compliance: What obligations apply to my company?

The sanctions imposed by the EU include the freezing of assets of listed persons, bans on the provision of goods, travel restrictions, restrictions on economic cooperation as well as import and export restrictions. The EU's sanctions against Russia were recently tightened further with the 13th sanctions package. The EU's list of sanctions relating to individuals and organizations was expanded to an unprecedented extent with this sanctions package – by a total of 194 entries. The list contains more than 2000 entries. In parallel to the constantly expanding sanctions, both the EU and the German government in the form of the Federal Ministry for Economic Affairs and Climate Protection ("BMWK") are working to make the enforcement of EU sanctions even more effective. The measures proposed by the European Commission include the harmonization of criminal sanctions law.

The same minimum standards for the definition, scope of penalties and prosecution of violations of EU sanctions should apply in all member states as soon as possible. Germany already took a step towards even more efficient sanctions enforcement in May 2022 with the "First Act for more effective sanctions enforcement" ("Sanctions Enforcement Act I"), including the mandatory reporting of sanctioned assets (real estate, company shareholdings, etc.). The "Second Act for more effective sanctions enforcement" ("Sanctions Enforcement Act II") of December 2022 includes a structural reform of the enforcement of individual financial sanctions (blacklisting) as well as measures to prevent money laundering.  

The provision of compliance measures under foreign trade law, ideally in the form of an internal compliance program ("ICP"), has always been of crucial importance in order to minimize the risk of sanction violations and to enable exculpation in the event of a violation. The stricter penalties and enforcement of sanctions for companies in Germany and the EU now make a functioning ICP even more important. 

1. No "hard" requirement for a foreign trade ICP in the company 

In principle, there is no "hard" requirement to take compliance measures under foreign trade law such as an ICP. Legal obligations for such compliance measures mainly apply to companies that export listed goods (see Section 8 (2) of the German Foreign Trade and Payments Act ("AWG")). This compliance obligation is recognized by the company management through the appointment of a Chief Export Control Officer ("CECO") vis-à-vis the Federal Office of Economics and Export Control ("BAFA"). In this respect, the need for an ICP or other precautions in the company with regard to EU sanctions is also derived from Section 130 of the German Administrative Offenses Act ("OWiG") and the general duty of care of company management (see Section 93 AktG, Section 43 GmbHG). In the event of violations, an ICP can have the effect of reducing sanctions and fines. Ideally, an ICP even leads to complete exculpation of the company management in the event of breaches of sanction law.

2. Risk indicators in the company 

Compliance with sanctions-related due diligence obligations requires a company-specific and case-by-case identification and analysis of the existing risk parameters. In the context of sanctions compliance, there is no "one-size-fits-all" approach. With regard to sanctions, there is a comprehensive obligation to check for possible listing (sanctions list screening) when carrying out relevant transactions. However, this requirement is also primarily aimed at exporting companies. According to the European Commission's guidance, all European exporters are to check their contractual partners and the final destination of the goods with due diligence with regard to the export of (listed) goods. The liability framework applicable to the respective EU sanctions regime in the individual case assessment is set out in the directly binding EU sanctions regulations. For example, Art. 10 of Regulation (EU) No. 833/2014 states: "Natural or legal persons, entities or bodies shall not be held liable for their actions if they did not know, and had no reasonable grounds to suspect, that their actions would infringe the measures provided for in this Regulation". 

The exporter must use the information available to him about the actual use of the goods by the customer to check internally for a possible critical intention. A deliberate concealment of circumstances that impose themselves on the person concerned can be equated with knowledge. For certain, particularly critical groups of goods, specific regulatory requirements reflect the existing due diligence obligations: For dual-use goods and technologies (so-called dual-use goods), end-use declarations are mandatory; for certain goods that are particularly relevant to circumvention, the provision introduced with the 12th sanctions package in Art. 12g of Regulation (EU) No. 833/2014 provides for mandatory so-called "no-Russia clauses". It is important to note that these measures alone are not sufficient, but must be part of a comprehensive compliance organization.

The formulation of risk-based compliance measures tailored to the respective company with regard to sanctions is of crucial importance in order to minimize the risk of sanctions violations. The following are examples of some customer-, goods- and transaction-related risk indicators that should trigger further investigations or external advice for export transactions. Independent action or legal advice is particularly advisable if several of the following indicators are present cumulatively:

Goods-related risk indicators

• Business concerns dual-use goods;
• customer is directly or indirectly involved in the supply or purchase of sanctioned goods, in particular those named by the European Commission in the "List of Common High Priority Items" in Annex XL of Regulation (EU) No. 833/2014 or "List of Economically Critical Goods"; 
• customer requests a shipping method that is unusual for the goods ordered;
• goods and / or their quantity are not plausible for the stated or otherwise known use; 
• detour of the goods to third countries that are not the registered office of the specified or otherwise known end user.

Customer-related risk indicators

• Customer is affiliated with persons or companies related to the Russian defense sector (see Annex IV of Regulation (EU) No 833/2014);
• customer is associated with companies that, according to publicly available sources, are suspected or known to sell sanctioned goods and technologies to Russia;
• customer maintains relationships with persons or companies that are subject to sanctions (for Russia, see the list in Annex I of Regulation (EU) No. 269/2014 and for all EU sanctions regimes, for example, the search masks at https://www.sanctionsmap.eu/ or https://www.finanz-sanktionsliste.de/fisalis/); 
• establishment of a new company after the start of the Russian war of aggression, especially if its main activity is trading in sanctioned goods. 

Transaction-related risk indicators

• Customer requires unusual labeling, marking or lettering of the goods; 
• customer splits a contract for a related order into several individual contracts for no apparent reason; 
• payment is made from a sanctioned country or with the involvement of banks in a sanctioned country;
• complicated structures that may indicate concealment, e.g. use of previously unknown corporate vehicles (e.g. legal entities such as letterbox companies, newly established companies or companies that do not engage in any significant independent economic activity) to conceal the ownership structure, the source of funds or the sanctioned countries involved; 
• use of financial institutions of jurisdictions other than the country in which the company itself is present, without any recognizable and objectively comprehensible reason.

3. Detection of breaches of EU sanctions law 

The detection of violations of EU sanctions law in companies has become more likely in recent times, as foreign trade audits have increased significantly since the Russia sanctions. The density of controls in foreign trade law in Germany is therefore extremely high, especially for companies that engage in foreign trade, as they are constantly in the focus of the customs authorities.

In the 11th EU sanctions package, Articel 6b of Regulation (EU) No. 833/2014 also establishes a general obligation to provide information directed at everyone (so-called "Obligation for everyone"). This obligation is already included in other EU sanctions regulations, but was previously missing from the export bans of the EU-Russia sanctions. In accordance with the obligation to report, anyone who has information about possible sanctions violations and information relevant to sanctions is obliged to report these to the competent authorities. Failure to report can be punished with an administrative offense. According to the wording, Article 6b of Regulation (EU) No 833/2014 covers all natural and legal persons, entities and bodies. The obligation does not distinguish between information obtained privately or professionally. The confidential communications between lawyers and their clients, protected by Article 7 of the EU Charter of Fundamental Rights, is excepted from this obligation.

4. Preventive measures - ICP  

Preventive measures in the form of a customized ICP should be taken to ensure that the company's own legal violations do not stand a chance. As part of foreign trade audits by customers, the correct processing of exports and export declarations, compliance with embargoes and sanctions, compliance with export controls, sanctions list checks or the submission of AWV declarations for incoming or outgoing international payments are checked, among other things. Another aspect that is frequently checked during foreign trade audits is software solutions for export controls, such as the correct use of software for sanctions list checks. If a company should nevertheless negligently violate EU sanctions, a proper ICP regularly opens up the possibility of exculpation or reduction of fines and penalties. 

5. Self-disclosure for violations of foreign trade law 

For minor administrative offenses pursuant to Section 19 (2) to (5) OWiG, which can be punished with fines of up to EUR 30,000, there is the option of self-disclosure with exemption from punishment pursuant to Section 22 (4) AWG. In the case of intentional violations of the EU Dual-Use Regulation or embargo regulations by company management, there is no provision for self-disclosure under foreign trade law. The options available to your company in the event of a breach of EU sanctions law should be reviewed in detail. In doing so, particular attention must be paid to the self-disclosure procedure; above all, the self-disclosure must be voluntary and complete. Otherwise, there is no entitlement to immunity from prosecution.

6. Conclusion

If your company has a risk propensity based on the risk indicators for export transactions, you should act and draw up an ICP as a preventive measure. We are also happy to advise you with the help of our "Sanctions Audit". We will support you in implementing a tailor-made compliance program in your company and will also review an export transaction for you in individual cases. If a breach of sanctions law is discovered, we will help you to examine the right steps and measures and support you in official proceedings.