What are the penalties for breaching sanctions?

Breaching EU sanctions against Russia or Belarus can result in imprisonment for a CEO and multimillion-euro fines for a company — and this does not apply only to banks. A travel agency, an estate agency, an insurance broker, or an e-commerce retailer are all subject to the same rules, yet they rarely know it. This article sets out precisely what your company and you personally are exposed to — for failing to maintain sanctions compliance.

If you are short on time — key facts

• Breaching EU sanctions triggers three types of liability simultaneously: criminal (imprisonment for individuals), administrative (fines for the company), and civil (void contracts, exclusion from public procurement).
• Directive (EU) 2024/1226 requires that the maximum custodial sentence be at least 5 years for serious violations (including making funds available, failure to freeze, and transactions of ≥€100,000), and at least 3 years for breach of a travel ban. ¹²
• For companies: a fine of at least 5% of total worldwide annual turnover or €40 million — whichever is higher — for primary offences. ³
• Your company may be inspected by MSWiA (the Ministry of the Interior and Administration), GIIF (the General Inspector of Financial Information), and KAS (the National Revenue Administration) — not only by KNF (the Polish Financial Supervision Authority). ⁴⁵
• “I did not know” does not automatically exclude liability — having no sanctions procedure at all is treated as an aggravating factor, not a mitigating one.
• The transposition deadline for the Directive passed on 20 May 2025. ⁶ Poland missed it, but domestic penalties under the Act of 13 April 2022 apply today. ⁷
• What to do now: check whether your company is under a legal obligation to conduct screening, and start documenting your counterparty verification.

Three types of liability for breaching sanctions

Sanctions law does not confine liability to a single regime. A company and its management can be held liable simultaneously on three levels — criminal, administrative, and civil. The distinction is of practical importance: criminal liability falls on individuals, administrative liability on the entity as a whole, and civil liability affects the validity of concluded contracts and the ability to participate in public tenders.

The substantive foundation is provided by Council Regulation (EU) No 269/2014 ⁸ and Council Regulation (EU) No 833/2014 ⁹, which apply directly in every EU Member State without requiring national implementation — supplemented in Poland by the Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security (hereinafter: the 2022 Act). ⁷

Criminal liability — imprisonment for individuals

Breaching sanctions is not merely a financial risk for the company. A CEO, board member, or authorised signatory — any natural person who directly brought about a prohibited transaction — may personally face criminal prosecution.

Article 15(1) of the Polish 2022 Act provides for a custodial sentence of no less than 3 years for violation of the prohibitions arising from EU Regulations. ¹⁰ The same penalty applies to participation in activities whose purpose or effect is to circumvent those prohibitions — which eliminates the argument “I acted through an intermediary”. ¹⁰

Directive (EU) 2024/1226, which harmonises criminal penalties across the EU, operates on a “minimum for the maximum” mechanism — it requires Member States to ensure that the maximum penalty provided for in national law is at least a specified threshold. ¹¹ For serious violations — covering making funds available to a sanctioned entity, failure to carry out a freeze, or violations under Article 3(1)(a), (b) and (h)(i)–(ii) — where the value of the transaction is at least €100,000, the maximum sentence must be at least 5 years’ imprisonment. ¹ For breach of a travel ban imposed on designated natural persons, the Directive requires a maximum sentence of at least 3 years. ² For violations relating to goods, services, or transactions under Article 3(1)(d)–(g) and (i) with a value of at least €100,000 — including military products on the EU Common Military List without a value threshold — the maximum sentence must also be at least 5 years. ¹²

Important: Directive 2024/1226 also criminalises incitement and aiding and abetting a sanctions violation — meaning your procurement team that “turned a blind eye” is also liable. ¹³

Administrative and financial liability — monetary fines for the company

Independently of the criminal liability of individuals, the company as an entity is financially liable. The 2022 Act provides two separate mechanisms here.

First, the Head of the National Revenue Administration (KAS — Krajowa Administracja Skarbowa) may impose a monetary fine of up to PLN 20,000,000 by way of a decision for failure to carry out the obligation to freeze funds or economic resources — under Article 6(2) of the 2022 Act. ¹⁴ Second, the President of the Public Procurement Office (Prezes UZP — Urząd Zamówień Publicznych) may impose a monetary fine of up to PLN 20,000,000 under Article 7(7) of the 2022 Act — where an entity bid for a public contract despite being statutorily excluded. ¹⁵ These are two separate provisions and two separate proceedings — a company could theoretically be exposed to both simultaneously.

Directive (EU) 2024/1226 requires EU Member States to ensure that fines for legal persons for serious violations amount to at least 5% of total worldwide annual turnover or €40,000,000 — whichever is higher. ³ For reporting violations, the minimum threshold is 1% of turnover or €8,000,000. ³ Once the Directive is transposed into Polish law (the UC92 bill), those bands should appear in domestic legislation.

For a small company: 5% of annual turnover on a PLN 10 million turnover amounts to PLN 500,000 — the fine is scaled to the size of the business, and is not purely a problem for large corporations.

Civil liability — void contracts and contractual consequences

The third layer of liability is less obvious, but can be equally painful. Contracts concluded with a sanctioned entity may be declared void — as a legal act contrary to the prohibitions in the EU Regulations, under Article 58(1) of the Polish Civil Code read together with Article 2 of Regulation 269/2014. ⁸

A company that has already carried out a transaction with a sanctioned entity may be required to return the funds received. This risk is particularly significant in long-term B2B contracts, where the counterparty was listed during the life of the agreement.

Exclusion from public tenders is a separate consequence, arising directly from Article 7(1) and (2) of the 2022 Act. ¹⁶ An entity placed on the sanctions list is excluded from proceedings conducted under the Public Procurement Law for the entire duration of the circumstances giving rise to the listing. If your company carries out contracts with the public sector, being listed means immediate removal from the market.

A sectoral regulator may also consider revoking a licence within the scope of its general supervisory powers if a sanctions violation is established in the course of proceedings.

Sanctions clauses in B2B contracts with foreign counterparties — particularly partners from the United States, the United Kingdom, or Germany — are becoming increasingly common. The absence of a declaration confirming no links to sanctioned entities may provide grounds for the other party to terminate the contract.

Who enforces — authorities empowered to enforce sanctions in Poland

Most business owners assume sanctions are a matter for KNF (the Polish Financial Supervision Authority) and banks. That is a mistake that can prove very costly. Non-financial sector companies are subject to at least three different authorities.

If you run an estate agency, a travel agency, or a leasing company — you are an obliged entity within the meaning of the Act of 1 March 2018 on countering money laundering and terrorist financing (hereinafter: the AML Act). ⁵ This means GIIF has the power to inspect you with regard to, among other things, the application of sanctions measures. KAS enters the picture when your company exports goods to Russia or has failed to carry out a freezing decision.

The Polish sanctions list maintained by MSWiA is a separate register from the EU sanctions lists — the exact listing procedure and the list of entities currently included can be checked at gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami. More on which lists apply to Polish companies is covered in the article EU sanctions packages against Russia — what your company needs to know.

A detailed guide to the Polish MSWiA sanctions list and EU lists explains how to read entries and how frequently the list is updated.

What Directive (EU) 2024/1226 and the UC92 bill change

Until 2024, penalties for breaching EU sanctions differed drastically between Member States. In one country a violation was an administrative offence; in another, a serious crime. Companies could attempt to “optimise” through jurisdictions with more lenient laws. Directive (EU) 2024/1226 of 24 April 2024 ¹¹ puts an end to this disparity.

It is the first EU legislative act harmonising minimum criminal penalties for sanctions violations across all 27 EU Member States. The Directive establishes a closed list of criminal offences in Article 3(1) ¹⁷ — covering both making funds available to a sanctioned entity and trading in prohibited goods, providing financial and non-financial services, and allowing a designated natural person to enter EU territory.

The deadline for transposing the Directive into the national law of all EU Member States was 20 May 2025. ⁶ Poland missed that deadline. The implementing bill — provisionally designated UC92 — was, as of 2026-05-18, still in the course of legislative proceedings; the current stage can be checked manually at legislacja.rcl.gov.pl (search for “UC92” or “dyrektywa 2024/1226 naruszenie środków ograniczających”).

The delay in transposition does not mean impunity. Council Regulations (EU) No 269/2014 and No 833/2014 apply directly — without any national implementation. ⁸⁹ The penalties under the 2022 Act — including the custodial sentence of at least 3 years under Article 15 — apply right now. ¹⁰ The Directive will merely raise the minimum threshold, and UC92 will introduce new offence definitions and extend the range of criminal conduct.

A fuller analysis of the new legislation is available in the article Directive (EU) 2024/1226 — what changes for non-financial sector companies.

“But I did not know” — does ignorance exclude liability?

This is the most common argument. And the weakest.

EU Regulations have direct effect — they are binding on every business operating in the EU market without any need for publication in national law. ⁸⁹ You do not need to “be aware of the provision” — it is sufficient that a transaction with a sanctioned entity was completed.

Lack of knowledge that a counterparty was on a list may influence the level of any penalty — both upwards and downwards within the range. Directive 2024/1226 lists aggravating circumstances in Article 8 and mitigating circumstances in Article 9. ¹³ Mitigating circumstances include, among others, voluntarily reporting information to the authorities. Aggravating circumstances include acting within an organised structure, using false documents, or deriving large-scale benefit.

The key takeaway: the absence of any sanctions procedure is treated by authorities as evidence of gross negligence — not as a mitigating factor. A company that has not implemented screening, has not designated a responsible person, and keeps no verification register is in a significantly weaker position in any potential proceedings than a company with documented, if imperfect, procedures.

Frequently asked questions

Can a company be held liable for breaching sanctions if it did not know the counterparty was on the list? Yes. Lack of knowledge does not exclude liability — it may influence the level of the penalty, but it is not an automatic discharge. The obligation to exercise due diligence rests with the company.

Who bears liability — the company or the CEO? Both simultaneously. The company is liable administratively (fines) and civilly (void contracts). The CEO or other individual who brought about the violation is personally liable in criminal proceedings.

Does having a sanctions procedure mitigate the penalty? Yes. Documented screening and a written sanctions policy are arguments in favour of the company in proceedings. Authorities take into account whether the entity acted in good faith and whether it took reasonable steps to verify counterparties. ¹³

VAT penalties vs international sanctions — what is the difference?

The word “sanction” appears in Polish law in several entirely different contexts. Non-specialists — and, unfortunately, often the media — conflate tax penalties with international sanctions. These are two separate worlds.

If you have heard about “VAT penalties” — that is an entirely different legal regime. This article deals exclusively with international sanctions imposed by the EU and UN against individuals and entities linked to Russia, Belarus, Iran, Syria, and other regimes subject to restrictive measures. The consequences of breaching those sanctions are considerably more serious than a tax penalty.

A fuller comparison of both mechanisms is available in the article VAT penalties vs international sanctions — a comparison.

How to reduce the risk — what to do in practice

Sanctions compliance does not require an army of lawyers. It requires a process. Here are six steps you can implement regardless of the size of your company.

1. Check whether your company is under a legal obligation to conduct sanctions screening. Every company must comply with EU Regulations directly — without any exceptions. However, the scope of additional obligations (e.g. reporting to GIIF) depends on whether you are an obliged entity within the meaning of the AML Act. Check the details in the article Does my company have to conduct sanctions screening?.

2. Identify high-risk counterparties. Start with entities that have links to Russia, Belarus, Iran, Syria, and North Korea. Review active contracts and transaction history from the past two years. Existing contracts also require verification — a counterparty may be listed during the life of the agreement.

3. Screen against sanctions lists. Check the EU Consolidated Sanctions List (available at sanctionsmap.eu), the Polish MSWiA list, and, if you have counterparties from the US, the OFAC SDN list. A guide to sanctions lists and how to check them is available in the article Polish sanctions list and EU lists — how to check them.

   Practical advice on counterparty verification is covered in the article Counterparty verification for sanctions — step by step.

4. Implement a written procedure and designate a responsible person. A written sanctions policy, a procedural guide for employees who deal with counterparties, and a hit register are the minimum. Without documentation, screening does not exist in the eyes of a supervisory authority — a verbal procedure is not a procedure.

5. Document every verification and its outcome. Date of verification, list used, result (MATCH / POSSIBLE / CLEAR), who conducted the check — this information forms a defensive shield in any potential proceedings. A record of verification made before a transaction is evidence that due diligence was exercised.

6. Monitor changes to lists and legislation. New EU sanctions packages against Russia appear regularly — a significant number have been adopted to date. Subscribe to MSWiA and EUR-Lex alerts. Monitor progress of the UC92 bill at sejm.gov.pl — the entry into force of new provisions may require you to update your procedures.

How Sanqto can help

Implementing sanctions compliance does not have to begin with engaging external counsel. Sanqto offers sanctions screening software installed on the client’s own network — counterparty data never leaves your company’s infrastructure (on-premise model). The system returns a result in three states — MATCH, POSSIBLE, or CLEAR — and automatically logs every verification with the date, list used, and result. A sub-30ms response time allows screening to take place during the client onboarding process, without slowing down operations.

The implementation document pack includes a ready-made sanctions policy, a procedural guide for staff, and hit register templates — tailored to Polish and EU requirements, with no need to write them from scratch. The compliance officer training and certification programme gives the designated person the knowledge required to handle day-to-day cases and understand the applicable rules.

Industries for which we have prepared dedicated materials:

• Travel agencies and OTAs — sanctions screening in the tourism sector
• Estate agencies — sanctions obligations of an intermediary
• Insurance brokers and agents — sanctions screening

Legal basis

• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine — CELEX 32014R0269 — as amended
• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — CELEX 32014R0833 — as amended
• Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security — Dz.U. 2022 poz. 835 — ISAP / eli.gov.pl
• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and facilitating such violations — CELEX 32024L1226
• Act of 1 March 2018 on countering money laundering and terrorist financing — Dz.U. 2023 poz. 1124 (consolidated text) — eli.gov.pl — GIIF competences (Art. 12(1)) and list of obliged entities (Art. 2(1))
• Act of 11 March 2004 on the tax on goods and services — Dz.U. 2004 nr 54 poz. 535 as amended — ISAP — Art. 112b–112c (contextually: VAT penalties vs international sanctions section)
• UC92 bill — Polish implementing legislation for Directive (EU) 2024/1226 —

Frequently asked questions (FAQ)

What penalties are faced for breaching EU sanctions? A breach triggers three types of liability simultaneously. An individual (CEO, board member) risks a custodial sentence — at least 3 years under Article 15 of the 2022 Act, and after Directive 2024/1226 enters into force — at least 5 years for serious violations. The company as an entity may pay a monetary fine of up to PLN 20 million (Article 6(2) of the 2022 Act) or face fines provided for by the Directive (up to 5% of turnover or €40 million). Additionally, contracts may be void and the company may be excluded from public tenders.

Is breaching EU sanctions only a concern for large companies? No. EU Regulations are binding on every company operating in the EU — regardless of turnover, number of employees, or sector. The scale of the fine may be proportionate to turnover, but the compliance obligation is the same for all.

Who in Poland can inspect my company for sanctions compliance? It depends on the nature of the violation. MSWiA maintains the list and issues sanctions decisions. GIIF supervises obliged entities (estate agents, insurance intermediaries, accounting firms). KAS imposes fines for failure to implement a freeze and for trade embargo violations. The President of UZP acts when a listed company bids in a tender.

Has Poland already transposed Directive 2024/1226? As of 2026-05-18 — no. The transposition deadline passed on 20 May 2025. The UC92 bill is still in the course of legislative proceedings. However, the current domestic rules (the 2022 Act, Article 15) apply regardless of the status of the Directive’s transposition.

What should I do if I find that my counterparty is on the sanctions list? Immediately suspend all transactions with that entity. Consult a lawyer specialising in sanctions compliance. If you are an obliged entity within the meaning of the AML Act — you are under an obligation to report to GIIF. Document all steps taken following discovery — this is an important element of any defence in potential proceedings.

Is “I did not know the counterparty was on the list” a sufficient explanation? Not automatically. Lack of knowledge may influence the level of the penalty, but does not exclude liability. Directive 2024/1226 in Article 9 lists mitigating circumstances — among them voluntary disclosure to the authorities. The absence of a screening procedure is treated as gross negligence, not a mitigating factor.

Do I need to run screening for every transaction? The frequency depends on the risk profile and sectoral requirements. The minimum is verification when entering a new business relationship and following every update to the lists. For counterparties with elevated risk (links to sanctioned countries), regular periodic checks are recommended — because the sanctions list may change during the life of a contract.

Information, not legal advice. This article is for informational and educational purposes only. It does not constitute legal advice. Legal status as of: 2026-05-18. The specific obligations applicable to your company depend on the nature of your business and require individual assessment — if in doubt, consult a lawyer or compliance adviser.