Stricter requirements for compliance management systems in export control (ICP) following the implementation of Directive (EU) 2024/1226

I. Background

The Draft Law serves to implement the requirements of the Directive, whose deadline for adoption had already expired in May 2025. The European legislator aims to harmonize criminal sanction laws at the EU level in order to achieve efficient and uniform enforcement of sanctions. Legislative changes relevant for companies including criminal liability for reckless violations of economic sanctions measures involving the so-called Dual-Use-Goods, as well as penalties for failing to comply with reporting obligations. In addition, the Directive specifies increased penalties and fines. It is also important for companies to note that violations of new sanctions prohibitions or export control licensing requirements are no longer exempt from criminal punishment within two days after entering into force.

Below, we provide a brief overview of these significant changes and the resulting need for companies to act.

II. Details on the legal changes

• Tougher penalties for violations related to dual-use goods: A significant amendment to the law implementing the Directive relates to the newly inserted Section 18 (8a) AWG. Under these provisions, reckless violations in connection with European economic sanctions, relating to absolute export prohibitions as well as breaches of licensing requirements regarding the export of so called Dual Use-Goods are now punishable by imprisonment of up to three years or by a fine. No intent is required to commit such an offense. Instead, an elevated degree of negligence – the so called recklessness — is sufficient. Recklessness is deemed to exist if the violation results from particular carelessness. Usually, this therefore covers cases of non-compliance in which the occurrence of a violation was so obvious that it should have been recognized by those responsible within a company.
• Penalty for failure to comply with the “obligation of everyone”: The amendment to the law also introduces criminal liability for a violation of so called “everyones obligations” (Section 18 (5a) No. 2 AWG). This reporting obligation requries “everyone” to provide the competent authorities with information on the implementation of sanctions measures concerning frozen assets, if the information was obtained in the exercise of a professional duty. Anyone who fails to make the required report, or does so incorrectly or late, is punishable by imprisonment for up to one year or a fine. Professionals bound by confidentiality obligations, such as lawyers or tax advisors, are not affected by the amendment to the law (§ 18 (13) AWG new version). However, the provision does apply to all other consultants, such as management consultants or customs and foreign trade advisors.
• Significant increase of corporate fines: A significant amendment is the increase of fines imposed on legal entities and associations of persons in cases of intentional sanctions-related offenses committed by authorised representatives or senior management personnel. These have been raised from a previous maximum of 10 million to 40 million Euro, in accordance with the requirements of the Directive (Section 19 (7) AWG, new version). The same applies to the omission of a company owner to take supervisory measures regarding compliance with economic sanctions. This constitutes an administrative offense, which in the future may likewise result in a fine of up to 40 million Euros (Section 19 (8) AWG, new version).
• Abolition of the two-day grace period rule: Another crucial factor for companies is that exemption from punishment for violating sanctions obligations is no longer possible within the first two days after new sanctions or export control licensing requirements into force. Through this provision, the legislator had previously granted companies a certain time frame to implement the new obligations, for example to update their sanctions list screening software or to take goods related sales and delivery prohibitions into account in their internal complinace processes. This previous two-day grace period, previously regulated as a corresponding ground for exemption from punishment in Section 18 (11) AWG (old version), is abolished by the new regulation. Exemption from punishment will in the future only be possible in certain cases of humanitarian assistance (Section 18(11) AWG, new version).

III. Outlook and conclusion

The European legislator aims to achieve the effective enforcement of sanctions through the Directive and is, for this purpose, increasing the pressure on companies to comply with economic sanctions measures.The complexity of EU sanctions and their frequent and short-notice amendments have long made their implementation a challenge. Against this backdrop, companies should urgently review their compliance management system (ICP) to ensure that it can guarantee compliance with export control and sanctions requirements in order to avoid the now significantly increased personal and corporate liability risks. Regular audits of the compliance system were already recommended before the amendment and were required by the German Federal Office of Economics and Export Control (BAFA) as part of an effective and appropriate compliance system. Currently, ensuring the effectiveness of the compliance system is becoming even more important due to the tightening of the requirements under the Directive. In particular, due to the elimination of the two-day grace period, it is also important to ensure that new sanctions can be implemented on a daily basis.

Affected companies should take these changes as an opportunity to conduct, or have conducted, an internal or external review of their compliance management system (ICP). We would be pleased to support you with our leagal expertice in this matter at any time.