Italy Introduces New Criminal Offenses and Corporate Liability for Breaches of EU Sanctions

Legislative Decree No. 211/2025 (the “Sanctions Decree”), effective as of January 24, implements EU Directive 2024/1226 (the “Directive”) on violations of EU restrictive measures (the “EU Sanctions”) and introduces new criminal offenses, thereby significantly reshaping the applicable sanctions framework.

Importantly, these offenses are now included among those triggering corporate liability under Legislative Decree No. 231/2001 (the “Decree 231”).

The main changes include:

• The introduction of new criminal offenses punishing violations of EU Sanctions. The most serious violations are punishable by imprisonment from 2 to 6 years and fines from € 25,000 to € 250,000;
• The extension of corporate liability under Decree 231 to these new offenses. Companies may face significant financial penalties calculated on the basis of a new criterion: instead of the traditional “quota system”, penalties are based on a percentage of the company’s global turnover (up to 5%) or, if turnover cannot be determined, on predetermined amounts (up to € 40 million);
• The introduction of strict reporting obligations for companies and professionals, with criminal penalties for failure to comply;
• The extension of the protections provided by Legislative Decree No. 24/2023 (the “Whistleblowing Decree”) to persons who report violations of EU Sanctions.

1. The New Criminal Offenses

The Sanctions Decree was adopted more than seven months after the deadline set by the Directive, which led the European Commission to open infringement proceedings against Italy.[1]

Before the Sanctions Decree, breaches of EU Sanctions were predominantly subject to administrative sanctions. Despite a recent reform aimed at extending the scope of criminally relevant conduct,[2] the enforcement framework remained fragmented and largely administrative in nature.

To fully implement the objectives of the Directive and avoid further regulatory fragmentation or overlap, the Sanctions Decree consolidates all new criminal offenses related to violations of EU Sanctions into the Italian Criminal Code (the “ICC”), introducing a new dedicated section entitled “Crimes Against the Foreign Policy and Common Security of the European Union” and repealing the corresponding criminal provisions previously set out in special legislation. Both the inclusion of these offenses in the ICC and their placement in a dedicated section underline the importance of these offenses under the new framework. At the same time, the Sanctions Decree preserves an administrative enforcement layer for less serious cases, by setting a threshold of € 10,000 for criminal liability (based on the value of the funds, economic resources, or activities involved in the unlawful conduct), below which the conduct is subject only to administrative penalties.

The newly introduced offenses include:

• “Violation of EU Sanctions” (new Article 275-bis of the ICC), which punishes by imprisonment from two to six years and a fine ranging from € 25,000 to € 250,000[3] whoever: (a) makes funds or economic resources available to designated persons, whether directly or indirectly; (b) fails to adopt measures to freeze funds or economic resources attributable to designated persons; (c) enters into economic, commercial, or financial transactions with sanctioned third countries, their agencies, or entities directly owned or controlled by them; (d) imports, exports, trades, transfers, transits, or transports goods subject to EU Sanctions, or provides related intermediary services, technical assistance, or other services; (e) provides services of any kind, including financial services, or performs financial transactions subject to EU Sanctions. Paragraph 2 of Article 275-bis extends these penalties to anyone who circumvents EU Sanctions, for example through complex corporate structures, intermediaries, or false or misleading documentation.[4] Finally, this criminal offense also applies to transactions carried out without the required authorization, or with authorization obtained through false statements or documentation;
• “Violation of reporting obligations” (new Article 275-ter of the ICC) which punishes by imprisonment from six months to two years and a fine between € 15,000 and € 50,000 (i) designated persons who fail to report to the competent authorities any funds or economic resources they own, control, possess, or hold within the territory of the State; and (ii) any person who, by reason of their office or profession, are aware of funds or resources belonging to designated persons in the territory of the State and fail to provide this information to competent authorities.[5] However, an exemption from reporting obligations is provided for legal professionals in respect of information obtained while providing legal advice to clients, representing them in judicial proceedings, or in related negotiations, including advice on whether to initiate or avoid such proceedings;
• “Violation of authorization conditions” (new Article 275-quater of the ICC), which punishes by imprisonment from two to five years and a fine from € 25,000 to € 150,000[6] whoever carries out transactions or provides services or otherwise conducts activities in breach of the obligations set by an authorization required under EU Sanctions (such as in the case of export licenses for dual-use products provided for by Regulation (EU) No. 2021/821);
• “Negligent Violation of EU Sanctions” (new Article 275-quinquies of the ICC). This provision extends criminal liability to grossly negligent conduct in import, export, trade, transit and transport operations, as well as in providing services, involving products included in the EU Common Military List or dual-use products. Such conduct is punishable by imprisonment from six months to three years, together with a fine from € 15,000 to € 90,000.

For the aforementioned offenses, the Sanctions Decree also provides for an increase in penalties from one-third to one-half under specific circumstances, including committing the offense in the exercise of a professional, commercial, banking, or financial activity or through the use or submission of false or misleading statements or documents (new Article 275-sexies of the ICC).[7] A specific aggravating circumstance has been introduced in Article 12 of Legislative Decree No. 286 of 1998 (the “Immigration Act”) for acts of facilitating immigration committed in violation of EU Sanctions, such as allowing or assisting designated individuals to enter Italy (new Article 12, paragraph 1-bis of the Immigration Act).

Finally, penalties are reduced from one-third to two-thirds for those who actively cooperate with authorities to prevent the criminal activity from being carried to further consequences, to secure evidence and to identify other offenders, or to allow seizure of goods, funds, or economic resources (new Article 275-septies of the ICC).

For all the aforementioned offenses, the Sanctions Decree also provides for:

• Mandatory confiscation,upon conviction or plea bargain, of assets that were used or intended to commit the offense, as well as of the price or the proceeds thereof (new Article 275-octies of the ICC);
• Publication of the judgment, when a sentence of not less than three years’ imprisonment has been imposed. The judgment may be published without personal data relating to the convicted person unless disclosure is required in the public interest (new Article 275-novies of the ICC);
• The application of the Italian jurisdiction when the offense is committed abroad by an Italian citizen (new Article275-decies of the ICC).

2. The impact on corporate liability under Decree 231

The Sanctions Decree also amends Decree 231, expanding the list of predicate offenses to include the new offenses of “Violation of EU Sanctions”, “Violation of reporting obligations”, “Violation of authorization conditions”, and the new aggravated offense of facilitating immigration committed in violation of EU Sanctions, thereby providing for the liability of entities in connection with such conduct.

In line with the Directive, the Sanctions Decree establishes a new mechanism for calculating fines for such offenses, departing from the traditional “quota” system. Under this new mechanism, fines are calculated as a percentage of the entity’s total global turnover for the financial year preceding the one in which the offense was committed or, if lower, the financial year preceding the imposition of the fine. Where the entity’s global turnover cannot be determined, the fine is imposed on the basis of predetermined amounts specified for each offense.

Based on this new mechanism, new Article 25-octies.2 of Decree 231 specifically provides:

• For violations of Articles 275-bis and 275-quater of the ICC, as well as Article 12, paragraph 1-bis, of the Immigration Act, a fine ranging from 1% to 5% of the entity’s global turnover or, when it is not possible to establish the annual global turnover, from € 3 million to € 40 million;
• For violations of Article 275-ter of the ICC, a fine ranging from 0.5% to 1% of the entity’s global turnover or, when it is not possible to determine the annual global turnover, from € 1 million to € 8 million.

The same fines are increased by one-third in case of repeated offenses.

The new turnover-based penalty system (currently applicable only to violations of EU Sanctions but potentially extendable to other offenses) may expose companies to significantly higher fines than those provided under the traditional mechanism, which sets a maximum amount of approximately € 1.5 million, excluding any aggravating circumstances.

In addition to monetary penalties, Article 25-octies.2 also provides for the application of the disqualification measures set out in Article 9, paragraph 2, of Decree 231 (including prohibition from conducting business; suspension or revocation of licenses, authorizations, or concessions functional to the offense; prohibition on contracting with the Public Administration; exclusion from benefits, funding, contributions, or subsidies, with possible revocation of those already granted; prohibition on advertising goods and services) for a period of not less than two years and not more than six years, if the offense was committed by a senior manager or executive, and for a period of not less than one year and not more than three years if the offense was committed by an employee.

3. Other Relevant Provisions

The Sanctions Decree also introduces the following additional provisions:

• Amendments to the Italian Code of Criminal Procedure, which, with respect to the newly introduced criminal offenses (i) assign jurisdiction for criminal investigations to the district prosecutor’s office; (ii) set a maximum duration of preliminary investigations of two years; and (iii) provide for supervisory and coordination powers to be exercised by the national anti-mafia and anti-terrorism prosecutor over the district prosecutors;
• The explicit inclusion of persons who report violations of EU Sanctions among the subjects protected under the Whistleblowing Decree.

4. Main Consequences for Entities: New Compliance Obligations

For the first time, the Sanctions Decree brings violations of EU Sanctions within the scope of Decree 231, recognizing such conduct as criminally relevant also for the purposes of corporate liability.

As already noted, the new penalty framework provides for particularly high fines, significantly higher than those applicable under the traditional quota system.

In light of these changes, companies should consider revising and updating their 231 Models, policies, and procedures to cover the new predicate offenses, including in particular: (i) a mapping of the specific risks related to potential violations of EU Sanctions; (ii) dedicated information flows to the Supervisory Body (Organismo di Vigilanza); and (iii) targeted prevention protocols and control measures to mitigate the risk of new offenses. Such measures may include, for example:

• Strengthening customers and third parties screening systems, as well as enhanced due diligence for complex, unusual transactions and those involving high-risk countries, aimed at intercepting potential attempts to circumvent EU Sanctions;
• Clear procedures for identifying funds and economic resources subject to freezing;
• The adoption of specific contractual clauses to ensure compliance with EU Sanctions;
• Detailed rules for managing any authorizations to operate in derogation from EU Sanctions;
• Measures designed to ensure compliance with reporting obligations;
• Tailored training for personnel, particularly those working in commercial and sales areas, compliance and legal, finance and treasury, as well as logistics and supply chain.

 

Read the full alert memorandum in Italian.

---

[1] By the implementation deadline (May 20, 2025), fewer than half of EU Member States had implemented the Directive. In July 2025, the European Commission launched infringement proceedings against eighteen Member States, including Italy, France, and Germany, for failing to adopt or notify the required national measures.

[2] Decree-Law 69/2023 recently amended Article 20 of Legislative Decree No. 221/2017 by both increasing the penalties for conduct already classified as criminal offenses and extending criminal liability to conduct previously subject only to administrative sanctions, including all import and export operations involving listed products and the provision of services subject to EU Sanctions.

[3] Below the € 10,000 threshold, an administrative fine ranging from € 15,000 to € 90,000 applies. Different supervisory and enforcement authorities are responsible for identifying and reporting violations within their areas of competence, while the Ministry of Economy and Finance generally imposes the fines, except in cases under letter (d) of the article in question, for which the fine is imposed by the Unit for Authorization of Armaments (UAMA).

An exception applies to cases under letter (d) involving military or dual-use goods, where criminal penalties always apply irrespective of the value of the goods concerned.

[4] Specifically, this include: (i) using, transferring, or otherwise dealing with frozen funds or assets owned or controlled (directly or indirectly) by a designated person or entity; and (ii) using false or misleading documents to hide the true owner or beneficiary of assets that should be frozen.

[5] An administrative fine ranging from € 5,000 to € 45,000 applies when the value of the funds or economic resources is below € 10,000. Violations are identified and reported by the competent supervisory and enforcement authorities, while the Ministry of Economy and Finance is responsible for imposing the fine.

[6] An administrative fine ranging from € 15,000 to € 80,000 applies when the value of the funds, goods, or services involved is below € 10,000. The penalty is imposed by the Ministry of Economy and Finance for violations relating to authorizations concerning financial transactions, or by the UAMA for breaches of authorizations issued by such Unit. In all other cases, the authority that granted the authorization is also responsible for imposing the fine.

[7] Article 275-sexies of the ICC provides for increased penalties also in the following cases: (i) the offense is committed as part of a criminal association; (ii) the offender abuses public powers or breaches duties linked to a public office or public service; (iii) the offense results in a substantial economic benefit or other significant advantage; (iv) the offender destroys, hides, alters, or damages documents or objects that could be used as evidence or are relevant to investigating or proving the offense. The same increase in penalty also applies when, in order to avoid punishment for one of the newly introduced offenses, the offender commits any of the offenses under Article 377, third paragraph (obstruction of justice committed with the use of violence or threat) and Article 377-bis of the ICC (inducement not to make statements or to make false statements to the judicial authority).