New criminal penalties related to EU sanctions violations will enter into force in Italy on 24 January 2026, following the implementation of EU Directive 2024/1226. Enrico Vergani, Marco Mastropasqua and Giulia Morelli explain the consequences of the new restrictive measures.  

On 9 January 2026 Legislative Decree No. 211 of 30 December 2025 (the “Decree”) was published in the Official Gazette, the journal of record of the Italian government. The Decree implements EU Directive 2024/1226 on the definition of criminal offences and penalties for the violation of Union restrictive measures and will enter into force on 24 January 2026.

Before the introduction of the Decree, sanctions-related offences were partly contained within the broader export-control framework (Legislative Decree 221/2017, as subsequently amended), including penalties linked to products listed as a result of EU restrictive measures.

Now, the Decree implements Directive (EU) 2024/1226 via a stand-alone criminal regime for EU restrictive measure and, amongst other things, introduces a new Chapter inside the Italian Criminal Code (“ICC”) on “Crimes against the foreign policy and common security of the European Union”.

New criminal offences

Breach of EU restrictive measures (Art 275-bis, ICC)

Anyone who violates the restrictive measures adopted by the European Union or established by national law in implementation of a European Union measure is punishable with imprisonment from two to six years and a fine between EUR 25,000 and EUR 250,000.

The provision expressly covers (among others) the following activities:

• making funds/resources available to designated persons/entities;
• failing to freeze;
• certain transactions with third states / state bodies where restricted;
• import/export/trade/transport/transfer of restricted goods and related services; and
• provision of services including financial services/activities.

The above provision also criminalises with the same penalties circumventing activities through the use, transfer, or disposal of frozen funds or resources, or through the submission or use of false statements or documents to impede the identification of the beneficial owner or the final beneficiary of the funds or resources to be frozen.

If the restricted transaction that is being carried out has a value below EUR 10,000, the penalty is only an administrative fine in the amount between EUR 15,000 and EUR 90,000.

Breach of sanctions-related reporting duties (Art 275-ter, ICC)

A designated person, or the legal representative of a designated entity, is punishable for violation of reporting obligations in the event of failure to report to the competent administrative authorities the funds or economic resources owned, held, or controlled in the territory of the State.

The same penalty applies to anyone who, for official or professional reasons, fails to provide the authorities with information relating to funds or economic resources belonging to or attributable to designated persons, entities, bodies, or groups.

The penalties for the above offences are between six months to two years’ imprisonment and a fine between EUR 15,000 and EUR 50.000.

When the value of the funds or economic resources is below EUR 10,000 the penalty is only an administrative fine in the amount between EUR 5,000 and EUR 45,000.

Breach of authorisation conditions (Art 275-quarter, ICC)

Anyone who carries out an activity in breach of the conditions of an authorisation issued by the competent authorities is punishable with between two to five years’ imprisonment and a fine between EUR 25,000 and EUR 150,000.

If the restricted transaction that is being carried out has a value below EUR 10,000, the penalty is only an administrative fine in the amount between EUR 15,000 and EUR 80,000.

Negligent breach of EU restrictive measures (Art 275-quinquies, ICC)

The above provision introduces a negligent offence applicable to cases of violation committed with gross negligence for the import/export/trade/transport/transfer (and ancillary services) of products included in the common list of military equipment of the European Union or dual-use products listed in Annexes I and IV of Regulation (EU) 2021/821. The law punishes such conduct with imprisonment from six months to three years and a fine between EUR 15,000 to EUR 90,000.

Aggravating circumstances

The Decree also sets out a list of aggravating circumstances that can significantly increase exposure for the new EU-sanctions offences discussed above.

In particular, the applicable penalties are increased by one third up to one half where the breach is committed:

• as part of a criminal association;
• through the use of false statements or forged documents;
• in the course of professional/commercial banking or financial activities;
• by abuse of public office;
• where it generates a significant profit/advantage;
• where the offender conceals/destroys evidence.

A further uplift may apply where the offender engages in obstruction / witness-tampering conduct to secure impunity.

Mitigating circumstances

The Decree also introduces some mitigating circumstances for the above offences.

Where the offender effectively cooperates—for example by preventing the unlawful activity from producing further consequences, helping secure evidence, identifying other responsible parties, or enabling the seizure of goods, funds or economic resources—the applicable penalty is reduced by between one third and two thirds.

Extension of corporate liability under Legislative Decree 231/2001

Article 6 of the Decree amends Legislative Decree 231/2001 (on administrative liabilities of companies) introducing, inter alia, the new article 25-octies.2 extending administrative liabilities of companies for violations of the new EU sanctions provisions of the Italian Criminal Code.

Financial penalties are calculated as a percentage of the entity’s total annual turnover, by reference to the financial year preceding the offence (or, if lower, the financial year in preceding the application of the financial penalties), specifically:

• Between 1% and 5 % for breaches of article 275-bis (violations of EU restrictive measures) and article 275-quter (Breach of authorisation conditions). If turnover cannot be determined the penalties for these breaches are set between EUR 3 million to EUR 40 million.
• Between 0.5% and 1% for breaches of article 275-ter (breach of sanctions-related reporting duties). If turnover cannot be determined, the penalties for these breaches are set between EUR 1 million and EUR 8 million.

Conclusions

The new Decree materially increases the compliance and enforcement risk for operators exposed to EU restrictive measures, including at corporate level. Businesses engaged in cross-border trade, shipping and complex payment chains should proactively stress-test their sanctions controls—screening, escalation, governance and record-keeping—against the new offences and penalty framework. CJC remains available to assist and support its clients with focused gap assessments, updates to policies and (where relevant) Organisation and Management Model 231, training, and transaction-specific advice.