Strict and Uniform: Improving EU Sanctions Enforcement

Please note that the online version of this DGAP Policy Brief below does not include footnotes. To see them, please read the PDF version here.

Sanctions against Russia have magnified the challenge

Sanctions – or “restrictive measures” as they are called under the Common Foreign and Security ­Policy (CFSP) – have been a key instrument of EU foreign policy since the early 1990s. Yet, only recently have the European Commission and member states publicly signaled an increased interest in improving their enforcement.

The usual focus has been on the design, objectives, and adoption of sanctions regimes, and a joint enforcement policy has seemingly been a matter of secondary importance for the EU. This is also reflected in the institutional set up: The adoption of sanctions is strongly centered on Ministries of Foreign Affairs and the EU’s Foreign Affairs Council (FAC). By contrast, the enforcement of sanctions is scattered across multiple actors in each member state. This web of enforcement actors risks undercutting the very legitimacy of the sanctions instrument in the longer term, thus undermining the EU’s foreign and security policy objectives.

The EU is waking up to this challenge. At the start of Russia’s war against Ukraine, huge political and media attention was still being devoted to the adoption of EU sanctions, whilst their application and effect did not receive quite the same level of public interest. This may be due to the fact that sanctions enforcement is technically complicated, economically costly, and politically complex. In the past months, however, the importance of sanctions enforcement has gained significant public attention and institutional traction: as the first Russia sanctions packages were being adopted – with much public fanfare – it became clear that the subsequent enforcement could be an Achilles Heel for their effectiveness.

This is the case not least because of the sheer scale of the EU’s recent Russia sanctions, which has confronted EU enforcement authorities with an unprecedented task. In response to Russia’s military invasion of Ukraine, the EU has with record speed built one of the most comprehensive and robust sanctions ­regimes ever seen (Box 1). The seven sanction ­packages in place at the time of writing include a wide range of measures that are designed to reduce the Kremlin’s ability to finance the war, impose clear economic and political costs on the ­Russian elites responsible for the invasion, and diminish ­Russia’s economic base with a view to ultimately changing its behavior.

Overview of the EU’s major Russia Sanctions

Individual restrictions

Travel bans and asset freezes (including the prohibition of making any funds or assets available for these targets): 1214 individuals and 108 entities

Export restrictions

 The list of sanctioned products includes among others:

• Cutting-edge technology (e.g. quantum computers and advanced semiconductors, high-end electronics and software)
• Certain types of machinery and ­transportation equipment
• Specific goods and technology needed for oil refining
• Energy industry equipment, technology, and services
• Aviation and space industry goods and ­technology (e.g. aircraft, spare parts or any kind of equipment for planes and helicopters, jet fuel)
• Maritime navigation goods, and radio ­communication technology
• Numerous dual-use goods (e.g. drones, drone software, encryption devices)
• Luxury goods (e.g. luxury cars, watches, jewelry)

Import Restrictions

The list of sanctioned products includes among others:

• Crude oil and refined petroleum products, with limited exceptions (with phase out of 6 to 8 months)
• Coal and other solid fossil fuels (as there was a wind-down period for existing contracts, this sanction applied from August 2022)
• Gold, including jewelry
• Steel and iron
• Wood, cement and certain fertilizers
• Seafood and liquor (e.g. caviar, vodka)

Other restrictions (with certain exceptions)

• Prohibition on trade in arms
• Restrictions on certain investments and trade assistance
• Prohibition of Russian (and Belarusian) road transport operators from entering the EU, including for transit of goods
• Restricted access to EU airports and airspace for Russian aviation carriers
• Closure of EU ports to Russia’s maritime merchant fleet
• Ban on certain Russian banks using the international payments system SWIFT
• Prohibition of transactions, as well as a range of other financial interactions, with the National Central Bank of Russia
• Suspension the broadcasting rights of five Russian state-owned media outlets
• Full exclusion of Russia from EU public contracts

Of course, the EU has prior experience of adopting far-reaching sectorial trade and investment sanctions. But the trade relations between the EU and previous sanctions targets such as Belarus, the Democratic People’s Republic of Korea (DPRK), Iran, Libya, and Syria have been comparatively minor in comparison to those with Russia, not to mention the associated media and political attention afforded them. For the first time, the EU has introduced substantial and extensive export controls and import bans against a relatively close trading partner, not least in the energy sector.

Sanctions against Russia were designed to prevent the Kremlin from importing and procuring EU goods and services, including for potential use in hostilities with Ukraine. But they could risk damaging the economic performance of certain member states or specific economic operators within the EU. This raises the question of whether affected member states might be tempted to skimp on their obligation to ensure the full effect of EU law. Similarly, economic operators might try to circumvent or evade sanctions in pursuit of profit.

Discrepancies in member states’ enforcement efforts and actions could allow malign actors to profit from illegal conduct. If such instances do arise and become public, this will undermine the effectiveness of sanctions, and their public legitimacy. Previous EU sanctions regimes have demonstrated how national competent authorities already differ in their procedures, speed and diligence in translating legal acts imposing sanctions into action, despite their fundamental obligation to ensure the full effect of EU law when it enters into force (Case study 1).

Case Study 1

The difficulty of translating EU legal acts into sanctions enforcement

One clear example of the difficulty of enforcement is the case of a hostel operated from the premises of the diplomatic representation of the DPRK in Berlin. The hostel was used to raise money for the DPRK regime in violation of EU/UN sanctions, as well as the Vienna Convention on Diplomatic Relations. It remained open for more than two years before the lease was finally terminated and the hostel closed by German authorities. To date, nobody, including the external operator, has – to the authors’ knowledge – been criminally punished for their involvement in the lease, rental payment, booking fees, or indeed anything else in relation to this case, despite the fact that it generated an alleged EUR 38,000 a month for the DPRK regime.

A further example is the complaint to the European Commission from the European Centre for Constitutional and Human Rights and 14 other human rights organizations, alleging that a secret meeting took place in Italy in 2018 between senior Italian officials and a Syrian military adviser, who was the former intelligence chief to Bashar al-Assad and subject to EU sanctions, including a travel ban. To date, no action appears to have been taken.

Another example is the case of a Danish company that, through a Russian branch office, was involved in supplying jet-fuel to the Russian air force in Syria, allegedly transiting the goods through other EU member states. There had already been public warnings in the press that jet fuel was being smuggled through Greek and Cypriot ports by Russian-flagged vessels, and yet the relevant national competent authorities were criticized for failing to prevent future shipments. EU institutions were also unable to document any action taken in response to the warnings.Eventually, however, this case did end in convictions for the Danish company, its CEO, and a Greek captain by national courts.

The need to focus on the EU’s complicated political institutions

The EU’s focus has now turned to enforcement; to ensuring that no assets held within the EU by sanctioned Russian individuals or entities escape asset freezing. Besides creating a Freeze and Seize Task Force to enhance cross-EU information sharing on assets held by sanctioned individuals, EU and G7 members joined the newly established Russian Elites, Proxies, and Oligarchs (REPO) Task Force to share insights with other sanctioning actors. The REPO Task Force, which gathers representatives from ministries of justice, trade and economy, finance, and home affairs recently reported that its members have collectively blocked or frozen more than USD 30 million of assets in financial accounts and economic resources.

Innovative solutions, like the establishment of REPO, are a positive development. And yet, they barely scratch the surface of the real challenge: the sheer institutional complexity of sanctions coordination and enforcement within the EU. Different aspects of the “sanctions cycle,” from negotiations in Brussels to actual enforcement in member states, are spearheaded by a great variety of different actors. And the process of translating the legal acts imposing sanctions at the EU level into action at the member state level is an institutional tangle of its own.

As with other fields of CFSP, decision-making on sanctions is a prerogative of member states, which must unanimously agree on sanctions by adopting decisions in the Council, while other EU institutions have no say on the final decision. This is already a recipe for fragmentation, but matters become even more complicated when it comes to translating sanctions into tangible action. This task is delegated to individual member states – or, more precisely, to 27 different configurations of “national competent authorities,” and 27 national public prosecution services.

The member states do have an institutional fig leaf to keep enforcement powers as well as to limit the oversight of their efforts with reference to the ­principle of “subsidiarity”; a principle, which ensures that the EU only acts in a given policy area if it cannot be more effectively handled at the national, regional or local level. However, the Commission holds the formal competency to oversee sanctions implementation as “guardian of the treaties”. Yet, unlike in most other EU areas, the Commission is not in the habit of using this power to launch infringement proceedings against member states. There have been no published cases of such proceedings in response to insufficient, inadequate, or incorrect sanctions enforcement. This reflects more than just timidity on the part of the Commission; it illustrates the asymmetric access to the information that would allow the Commission to fulfil its CFSP role, as set out in the EU treaties.

Recent intra-EU initiatives for improving oversight of executive enforcement actors

Member states largely control the flow of information to the Commission. They are, for instance, responsible for informing it about which national competent authorities they have officially designated for ensuring sanctions implementation at the national level. Not only does this power to nominate responsible authorities lead to a hugely complex and varied web of actors, it appears that member states have inconsistent setups that are difficult to explain merely in terms of their constitutional differences (Box 2).

The sheer Variety of National Executive Enforcement Actors

Member states are responsible for informing the Commission about which national competent authorities they have officially designated to ensure sanctions implementation at the national level. But the number and form of competent institutions listed by member states varies greatly.

Member states have, together, officially designated more than 160 national authorities involved in the enforcement of EU sanctions. These are all, in turn, subject to greatly varying mandates, and have very different human and technical resources, and methods. Indeed, so unclear is the logic behind the choice of actors formally reported to the EU that it must be assumed that a much higher number than the 160 listed national institutions are, in fact, involved.

There is no complete transparency for the public about all national authorities involved in sanctions implementation. Some member states (Denmark, Latvia, Lithuania, Romania, and Sweden) list ten or more authorities, while others, (Croatia, Cyprus, Finland, Germany, Greece, Italy, and Malta) list only one or two. The disparity both within and between the two groups is huge, and is difficult to explain only by constitutional differences.

In Germany, the national competent authorities are the Central Bank, and the Federal Office for Economic Affairs and Export Control, an agency under the Federal Ministry for Economic Affairs and Climate Action. In Greece, meanwhile, they are the Anti-Money Laundering Authority, and the Ministry of Development and Investments. In Finland and Malta, only the Ministry of ­Foreign Affairs is listed.

This provides for a scattered jungle of national authorities tasked with turning EU sanctions decisions into tangible action.

The Commission has recently launched various reform initiatives to improve its ability to oversee the sheer range of enforcement practices in member states. These initiatives are broadly constructive, but also notably respectful of member states, and the principle of subsidiarity, so as to preserve their national competence over the issue. Recent initiatives seem to focus primarily on ending the obscurity that shrouds enforcement, tackling the information challenge without directly addressing the underlying institutional complexities.

Softer tools are also being developed – and could prove highly effective. One such is the development of the Sanctions Information Exchange Repository, a database that will enable prompt reporting and exchange of information between member states and the Commission. In a similar vein, the Commission has also set up an expert group on sanctions to advise, inter alia, on enforcement. Experts are drawn from member states and the EEAS in the anticipation that these experts will provide means for the Commission to widen its picture of national enforcement. Another recent addition is the 2022 EU Sanctions Whistleblower Tool, which enables voluntary and anonymous information sharing with the ­Commission about potential EU sanctions violations. In addition, an updated and comprehensive list of relevant national competent authorities was published in May 2022, giving a better overview than previously, when authorities were listed separately on often hard-to-navigate government websites.

Such information tools and coordination forums may help the EU move towards more effective and consistent enforcement. However, while being new and innovative, these actions are a sign that any fundamental institutional reform or shift of competencies to the EU level is still most likely precluded.

This was also recently demonstrated when the EU Commissioner for Financial Services, Mairead McGuinness, tested the waters for providing the planned European Anti-Money Laundering Authority (AMLA) with similar competencies to the US’s federal sanctions enforcement body, the Office of Foreign Assets Control (OFAC), which would push a more consistent and centralized enforcement of penalties within the EU. Despite seemingly echoing an idea that had earlier emerged from a member state, it received no public political support from EU capitals.

Fortunately, EU Member States are already focusing on improving oversight in related fields. This is the case, for example, in Germany, where the government recently announced the creation of a new federal financial crime agency. This agency is likely to be granted the operative responsibilities for enforcing anti-money laundering regulations as well as (EU) financial sanctions. Such enhancements might inspire other Member States to follow suit, not least because of the need to further improve cooperation between Financial Intelligence Units (FIUs) across the EU.

Addressing uneven judicial punishment across the EU

With the EU’s sanctions credibility at stake, strict and uniform enforcement is paramount. But even under current political conditions, where European solidarity is high and the EU’s response to the Russian military aggression hinges largely on the effectiveness of its sanctions regime, it is apparently proving difficult to find sufficiently convincing arguments to support a harmonization of the executive enforcement powers of member states. Happily, this is not the only avenue available for tackling the challenge of member states’ disparate enforcement practices – other options exist that do not even involve a potential transfer of executive powers.

One long-standing blind spot lies in the judicial field. National courts are empowered to apply and inter­pret the common secondary legal acts that EU sanctions generally rest upon. Today, however, judicial handling of sanctions violations seems every bit as uneven as that of the executive, despite the cross-border nature of violations. And while the EU has focused on beefing up executive actors at home with new information sharing mechanisms, and across borders through initiatives like the REPO, it has not yet equipped the judiciary with new tools in the same constructive manner.

One major field of judicial enforcement relates to the punishment of misconduct, and of those evading or circumventing sanctions, or aiding others to do so. The EU’s 27 separate judicial systems each apply individual definitions and approaches, in particular when it comes to the question of whether a sanctions violation can be considered as a criminal and/or administrative offence (Box 3). The sheer variety of approaches is highly problematic because it opens up scope for sophisticated malign actors to seek out the weakest link(s), so-called “forum-shopping” between member states for the lowest risk.

Varying approaches to sanctions violations among member states

Type of offence (criminal and/or administrative)

In 12 member states, the violation of sanctions is solely a criminal offence. Some of these member states have in place only broad definitions of the offence such as a “breach of UN and EU sanctions” or “breach of EU regulations,” whereas others have more detailed provisions such as a list of prohibited conduct. The criteria for conduct to fall within the scope of criminal law vary among member states, but they are usually related to their gravity (serious nature), determined in either qualitative (intent, serious negligence) or quantitative (damage) terms.

For 13 member states, the violation of sanctions can be considered either an administrative or criminal offence. In these member states, the criteria according to which the conduct falls within one or the other ­category are usually related to its gravity, determined in either qualitative (intent, serious negligence) or quantitative (damage) terms. The exact criteria, however, differ between member states.

In the remaining two member states, the violation of sanctions is currently enforced exclusively by means of administrative penalties.

Penalties

The potential maximum fine for a sanctions ­violation by a legal person varies from EUR 133,000 in Croatia to EUR 37.5m in Latvia. In some member states, however, potential fines are not fixed, and vary according to the benefit or product obtained through the criminal offence.

Maximum prison sentences for individuals vary from 6 months in Greece to 12 years in Italy and Malta.

The maximum fine that can be imposed on individuals as either a criminal or administrative offence ranges from a fixed sum of EUR 1,200 in Estonia to EUR 5,000,000 in Malta.

Image

Still more problematic is the fact that variety also hinders judicial cooperation between law enforcement agencies across the whole of the EU. In a large integrated market like that of the EU, enforcement will naturally often have a cross-border element. Yet, the EU’s existing mutual recognition and enforcement support mechanisms tend to focus on criminal law, with EU agencies like EUROPOL and EUROJUST assisting with coordination and general support of cross-border investigations, including information exchange and the implementation of joint actions. This kind of cooperation is not possible if misconduct is treated as solely an administrative offence.

Information sharing and transparency are also an issue in the judicial sphere. Only a limited number of published cases exist, making it difficult for regulators, academics, economic actors and their advisors, and, ultimately, courts to assess the consequences of non-compliance. Due to the lack of published data and known cases, it is difficult for the parties involved, including enforcement authorities and courts, to assess what constitutes an “effective, proportionate and dissuasive” penalty, as required under the common provision in the EU’s legal acts. This can be a rule-of-law problem as it may not provide sufficient legal certainty for the actors involved in sanctions violation cases.

Case Study 2

Sophisticated actors will always seek out the weak spots in enforcement structures

In 2019, complaints were brought against three EU-registered companies in Germany and Belgium, which were alleged to have been involved in shipping isopropanol and diethylamine, two chemicals that can be used in the production of chemical weapons, to Syria. At the time of the shipment, both products were on the list of restricted dual-use substances under the EU’s sanctions regime against Syria, and prior approval from national export control authorities was required for their export. The Syrian company that purchased the materials allegedly even had known ties with the regime in Damascus, and could only partially account for its demand for the products. The companies transferred the shipments through subsidiaries in Switzerland, where no such restrictions were in place, although EU legislation also prohibits indirect sales from the EU through third countries.

In a similar case, also from Belgium, three EU businesses and their owners were found guilty of shipping 168 tons of the same chemicals to Syria between 2014 and 2016 without submitting the appropriate export licenses. The EU does not appear to have closed these loopholes, leaving it instead to member states to interpret EU legal acts. Other cases relating to the chemical trade to and from Syria prove the point that sophisticated malign actors will always seek out the weak spots
in enforcement structures.

Seeking legal inspiration from other policy fields

The Commission has now also spotted the potential for greater judicial harmonization and cooperation by putting in place an additional legal basis for qualifying sanctions violations as a criminal act throughout the EU. Pursuantly, in May 2022, the Commission announced a proposal to include violation of EU restrictive measures in the EU’s list of crimes to be adopted by a Council decision. In a separate communication, the Commission set out the main contents of a potential future directive on the issue (as well as the Council decision necessary to adopt the directive). If adopted, this decision could open the way for common penalties, including turnover based fines, as opposed to the current system of individually fixed fines that vary significantly between member states. However, further steps are necessary not only to ensure the efficiency of the enforcement authorities involved, but also to deter and dissuade malign behavior from businesses such as banks and shipping companies, as well as other economic operators within the EU’s jurisdiction.

Here, inspiration can be drawn from successful enforcement and coordination approaches in ground-breaking EU policy areas such as data protection, competition law, and recent proposals for a common digital single market. The potential benefits of looking to these fields for inspiration are considerable, as each have faced similar challenges to CFSP in putting in place measures and restrictions that must be applied evenly throughout the EU, but remain the province of national enforcement authorities. The EU does not have to reinvent the wheel; it can copy those elements and/or best practices that are transferable to the field of sanctions.

Of course, these policy fields are not governed by the same procedures as the CFSP. But while CFSP differs from other policy fields in terms of decision-making, sanctions more often than not have much the same effect on the internal market as these other policy areas. They do, after all, have a cross-cutting and mainstreaming character, meaning they have a role to play in setting common standards, industry norms, and best practices. If the measures of the common foreign and security policy are actually commonly applied, this will decrease the risk of forum shopping by offenders, and will act as a safeguard to the level playing field of the EU’s internal market.

Recommendations

Introducing Innovations into CFSP

Narrowly tweaking member states’ information flows alone will not suffice to properly address the issue of implementation and enforcement of common rules on sanctions violations within the EU. What is required is a broad campaign to raise awareness, and an effort to turn the public enforcement of sanctions into a matter of prestige and common cause for both responsible actors and authorities. In this respect, it is helpful that responsible European commercial enterprises have a strong interest in effective sanctions enforcement as a way of seeing off undue competition, as well as preventing sanctions evasion by customers and partners.

The EU and member states could therefore usefully:

• Increase general awareness of and attention afforded to management, stakeholders and business owners in relation to compliance with EU sanctions for enforcement bodies, business entities, and the public;
• Stimulate self-reporting, for example in relation to mergers and acquisitions, financing, and insurance due diligence procedures, e.g. by adopting a leniency scheme for self-reporting;
• Support the rule-of-law, and in particular legal certainty with regard to non-compliance for all parties involved;
• Support information sharing, mutual assistance, and cooperation among competent authorities within and between member states, rather than simply between member states and the EU.

Once this overall approach has been put in place, the aim should be to further empower national competent authorities to work on their own initiative. ­Upcoming EU legal acts – such as the aforementioned proposal for a directive from the Commission – should provide authorities with meaningful powers to act on their own initiative in relation to:

• Instigating investigations of potential sanctions violations,
• Requiring the submission of information by ­business entities and external parties,
• Requiring an immediate end to potential violations,
• Ordering other interim measures, and/or
• Imposing fines and periodic penalty payments.

Only as a third step would it be wise to focus on improving cooperation as well as mutual assistance between the Commission and national competent authorities. This should include the possibility for said authorities to launch initiatives such as joint investigations and joint enforcement measures with their EU counterparts to tackle cross-border violations. Such powers should preferably be coupled with a legal obligation for the member states to ensure that they provide national competent authorities with adequate resources.

Furthermore, an explicit obligation should be introduced for national competent authorities and national courts to ensure uniform application of EU sanctions, as well as the obligation to publish all enforcement actions, preferably in a common EU registry.

Cross-pollination of ideas from outside CFSP

As for the injection of innovative measures drawn from further areas of EU law into CFSP, we recommend first and foremost adopting joint, turnover-based and substantial fines for violations of EU sanctions by economic entities. The maximum penalties for violations within three major legal framework of the EU – the General Data Protection Regulation (GDPR), the recently-proposed version of the Digital Services Act, and EU competition law – are as high as 4%, 6% and 10%, respectively. The fine for sanctions violations could well be fixed in the same range of up to 10% of the annual turnover of the violating economic actor. The Council decision that would be needed to advance this improvement is expected to be formally adopted in October 2022 at the earliest. Thereafter, the Commission will be able to put forward a proposal for a directive on the basis of the decision. However, the current draft proposal will need to be significantly amended in ­order to, inter alia, incorporate a joint, turnover-based and substantial fine.

The adoption of GDPR in 2016 is an example of how fines that are substantial and common to all EU member states can lead to widespread awareness, high-level attention, and significantly upscaled efforts by private as well as public actors both within and outside the EU. Besides ensuring more uniform enforcement and stricter punishment of EU sanctions violations, improvements in line with the recommendations set out above could also have wider regulatory effects beyond EU´s borders in terms of policy development, value chains, and market structures. Only by demonstrating its readiness to counter any and all efforts to undermine its sanctions policies in a coherent, efficient and forceful manner can the EU ensure that it remains respected by its own citizens, and at the same time increase its credibility as a significant foreign policy actor beyond its borders.

This would bring the EU closer to the enforcement credibility of other major sanctions practitioners, such as the US and the UK. In both cases, enforcement is a matter of prestige, and both US and UK authorities have recently taken steps to further boost their focus and enforcement measures against sanctions violators. US sanctions are widely enforced by the relevant federal authorities (OFAC, the Department of Justice, and various State Prosecutors), entail substantial fines, and attract significant political attention and oversight, as well as broad media exposure. This is the main reason for the high degree of awareness among businesses and local authorities that they need to comply with US sanctions, particularly among companies engaged in financial or logistics services. This, in turn, leads to a more level playing field across the US.

Conclusion

In its current form, differing national enforcement of sanctions among member states may be an ­Achilles Heel of the EU’s sanctions instrument. It risks affecting not only the long-term legitimacy of sanctions as a foreign policy tool, but also, inadvertently, the EU’s current response to the Russia military aggression towards Ukraine.

Nonetheless, enforcement by member states has the potential to be a huge asset for the EU if the right adjustments are made to ensure a stricter and more uniform approach to sanctions violations throughout the EU.

The answer, we believe, lies less in scrutinizing fundamental EU principles like subsidiarity, but rather in taking concrete steps to expand and enhance the prestige, power, and posture of the EU so as to ensure tough enforcement in response to any and all sanctions violations. Such improvements should be incorporated into the potential new sanctions-related legal acts that are currently under preparation in Brussels.