The Legal Foundations of EU Sanctions — How the System Works and What It Means for Your Business

EU economic sanctions are not a single piece of legislation but an entire system built on several layers — from the EU Treaties through political Council decisions and directly applicable Regulations right through to the Polish Act of 13 April 2022.¹ If you do not know which layer applies to you or where your obligations actually come from, it is impossible to run meaningful sanction screening. This article explains the hierarchy of legislation step by step — without legal jargon, with concrete statutory references.

Legal status as of: 2026-05-20.

TL;DR — five key points

• Treaty basis — the EU imposes economic sanctions under Art. 29 of the Treaty on European Union (TEU) and Art. 215 of the Treaty on the Functioning of the European Union (TFEU). These Treaties are the constitution of the entire system.
• Council Decision (CFSP) — a political decision of the EU Council taken within the Common Foreign and Security Policy (CFSP); it sets the objective and scope of the sanctions but is not directly enforceable against businesses.
• Council Regulation — this is the act that creates real obligations: transaction prohibitions, asset freezes, lists of designated persons. An EU Regulation applies directly in all Member States — without any national implementing legislation. Key for Poland: Regulation (EU) No 269/2014² and Regulation (EU) No 833/2014.³
• Polish Act of 13.04.2022 — supplements the EU regime, establishes the Polish sanctions list maintained by the Ministry of Internal Affairs and Administration (MSWiA — Ministerstwo Spraw Wewnętrznych i Administracji) ⁴ and sets administrative fines of up to PLN 20 million (Art. 6(2)).⁵
• Directive 2024/1226 — introduces the criminalisation of EU sanctions violations, but requires transposition into national law; the Directive itself does not bind your company directly — only the Polish implementing legislation will do so.

Why a non-financial business needs to understand the legal foundations of sanctions

Most SME owners, when they hear about EU sanctions, assume these are a problem for banks and financial institutions. That is a mistake that can cost up to 20 million zloty. EU Council Regulations — the legislation that creates sanctions prohibitions — are addressed to “any natural or legal person, entity or body” conducting business in the EU.² There is no carve-out for travel agencies, estate agents, leasing companies or e-commerce businesses.

To know what applies to you and why, you need to understand the legal basis on which sanctions are created in the first place. Otherwise you are reliant on random media reports and cannot tell whether a given prohibition is already in force, whether it still requires a national act, or whether it applies to your sector at all. Below we explain the system from the ground up.

For a detailed overview of exactly who is subject to sanctions obligations, see the article Who is required to conduct sanction screening?

The EU Treaties — the foundation of the entire system (Art. 29 TEU and Art. 215 TFEU)

Every EU sanctions regulation has a Treaty basis. The Treaties — the Treaty on European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU) — are the Union’s constitution. They are where the EU’s competence to impose economic sanctions on third countries, natural persons and entities is enshrined.

Article 29 TEU gives the EU Council the power to adopt decisions within the Common Foreign and Security Policy (CFSP). In plain terms: Art. 29 TEU is the provision on the basis of which the Council can declare, as a political matter, that restrictive measures apply to a given country or group of entities. A decision under Art. 29 TEU does not, however, impose direct obligations on businesses — it is a political act of the Council, not a generally binding legal instrument.

Article 215 TFEU is the second step. It provides that where the Council has adopted a CFSP Decision (for example under Art. 29 TEU), it may then — acting by a qualified majority on a joint proposal from the High Representative and the Commission — adopt a Regulation imposing restrictive measures against third countries, natural persons or entities. It is precisely the Regulation adopted under Art. 215 TFEU that creates your obligations as a business. An EU Regulation is directly applicable in every Member State — without the need for any national legislation.

In practice, every “sanctions package” against Russia consists of a pair: a CFSP Decision (legal basis: Art. 29 TEU) and a Council Regulation (legal basis: Art. 215 TFEU). For example, Council Regulation (EU) No 833/2014³ is accompanied by Council Decision 2014/512/CFSP.⁶

Council Decisions and Council Regulations — how a sanctions package is adopted

When the EU wishes to impose new sanctions, the procedure is as follows. The European External Action Service (EEAS), together with the High Representative for Foreign Affairs, prepares a proposal. The text goes through COREPER — the Committee of Permanent Representatives of the Member States to the EU — where the substantive negotiations take place. The EU Council then adopts the package; a CFSP Decision requires unanimity, whereas a Regulation under Art. 215 TFEU requires a qualified majority. Once adopted, both acts are published in the Official Journal of the European Union and as a rule enter into force the following day.

For your business, the key moment is publication in the Official Journal — from that date the Regulation applies directly. You do not wait for a Polish act. You do not wait for a circular from the Ministry of Finance. If a counterparty has been listed, the prohibition on dealings with them applies from the date of publication. This is why compliance-conscious companies monitor the Official Journal — or use systems that do it automatically.

A typical package is not a single act but a set of documents: a Council Regulation amending the base regulation (e.g. 269/2014 or 833/2014), a CFSP Decision, and sometimes a Commission Implementing Regulation updating the annexes containing the lists of names. For the 20 sanctions packages against Russia⁷ announced since February 2022, this structure is consistent. A full overview of all packages with dates and key changes can be found in the article How many EU sanctions packages against Russia are there, and what do they change for businesses?

Regulation versus Directive — the critical distinction

This distinction is the single most important thing to take away from this article.

An EU Regulation enters into force across the entire Union automatically, in identical form, in all 27 Member States, without any additional national legislation. The prohibition contained in Council Regulation (EU) No 269/2014² applies equally to a Polish construction company, a Slovenian travel agency and a Finnish steel importer — from the date of publication in the Official Journal of the EU. Poland cannot soften, modify or delay that prohibition through a national legal act.

An EU Directive works differently. It sets a result to be achieved by the Member States but leaves the method of implementation to the national legislator. A Directive does not in itself directly create obligations for businesses — only the national implementing legislation translates its content into law that binds you. The transposition deadline that a Directive sets for Member States is a deadline for the legislator — Poland is required to enact implementing legislation within that period, but until it does so, the Directive affects you only indirectly.

Why does this matter in practice? Because the EU sanctions system involves both types of act. Regulations 269/2014² and 833/2014³ bind your company right now, without any national legislation. Directive of the European Parliament and of the Council (EU) 2024/1226 of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures⁸ is a different type of act — it requires transposition.

In Poland, the draft legislation implementing Directive 2024/1226 is designated UC92 and, as of the date of publication of this article, its legislative status requires confirmation.

The national level — the Polish Act of 13 April 2022 and the MSWiA list

Alongside the EU regime, there operates in parallel the Polish Act of 13 April 2022 on special solutions in the scope of counteracting support for Russian aggression against Ukraine and serving the protection of national security (Journal of Laws 2022, item 835).¹ This national act does three things.

First, it creates the Polish sanctions list maintained by the minister responsible for internal affairs (MSWiA — Ministerstwo Spraw Wewnętrznych i Administracji, Ministry of Internal Affairs and Administration). Decisions on listing or delisting are issued by the minister ex officio or on a reasoned application from, amongst others, the Head of the Internal Security Agency (ABW), the Head of the Foreign Intelligence Agency (AW), the Head of the Central Anti-Corruption Bureau (CBA), the Chief of Police, the General Inspector of Financial Information (GIIF — Generalny Inspektor Informacji Finansowej) or the Polish Financial Supervision Authority (KNF — Komisja Nadzoru Finansowego).⁴ The list is publicly available on the gov.pl portal.⁹

Second, the Act sets administrative fines for breaches of sanctions obligations — both those arising from EU Regulations 269/2014 and 765/2006, and those under the Polish list. The Head of the National Revenue Administration (KAS — Krajowa Administracja Skarbowa) may impose a financial penalty of up to PLN 20,000,000 for breaching the obligation to freeze funds or the prohibition on making funds available (Art. 6(2) of the Act).⁵ The same maximum penalty is imposed by the Head of KAS for violating the prohibition on importing Russian or Belarusian coal (Art. 12(2) of the Act).¹⁰ The President of the Public Procurement Office (UZP — Urząd Zamówień Publicznych) may in turn impose a penalty of up to PLN 20,000,000 for allowing a listed person or entity to participate in a public procurement procedure (Art. 7(7) of the Act).¹¹

Third, the Act of 13.04.2022 introduces its own economic prohibitions — including a ban on importing coal from Russia and Belarus¹⁰ — as a supplement to the EU regime. The Belarusian regime is based on a separate Regulation 765/2006 — its scope is discussed in the article on EU sanctions against Belarus.

Important note: the Polish Act operates in parallel with the EU Regulations, not instead of them. Your company must comply with both regimes simultaneously. A prohibition contained in Regulation 269/2014 or 833/2014 applies to you regardless of whether the entity in question appears on the Polish MSWiA list. The Polish list and the EU list are two separate registers — each requires separate checking.

If you want to see exactly what penalties apply in Poland and what criminal liability looks like following Directive 2024/1226, see the article Penalties for violating EU sanctions in Poland.

How to read a sanctions act on EUR-Lex — a practical mini-guide

EUR-Lex (eur-lex.europa.eu) is the official database of European Union legislation. Each act has a CELEX number that uniquely identifies it. The CELEX number format is: 3 (denoting secondary EU acts) + year + letter (type of act) + number. Examples:

• 32014R0269 — Regulation (R) of 2014, No 269
• 32014R0833 — Regulation (R) of 2014, No 833
• 32024L1226 — Directive (L) of 2024, No 1226

To find the consolidated version of Regulation 269/2014 with all amendments incorporated from successive packages, go to EUR-Lex, enter 32014R0269 in the search box and select the “Consolidated text” tab. This is the version that incorporates all amendments — far easier to read than tracking each amending regulation separately.

In the structure of a sanctions regulation you will find several key elements. The Preamble (recitals) explains the political context and purpose of the sanctions — you read it to understand the legislator’s intent. The Articles contain the actual prohibitions and obligations — these are the provisions that bind you. The Annexes are the lists: of persons and entities (in 269/2014) or goods with CN codes (in 833/2014). The goods-related prohibitions in 833/2014 are spread across a number of annexes linked to specific articles (Art. 3, 3a, 3i, 3k and subsequent) — to check whether your goods are subject to a prohibition, you need to know which annex applies to your CN code and the direction of trade (import vs export).

Alternatively — instead of EUR-Lex you can use the DG FISMA (Directorate-General for Financial Stability, Financial Services and Capital Markets Union of the European Commission)¹² website at finance.ec.europa.eu. There you will find a chronology of all packages with direct links to the Official Journal of the EU.⁷ This is a good starting point when you want to check what a specific new package changes before diving into the full text of the regulation.

What to do in practice — a step-by-step checklist for your business

Understanding the hierarchy of legislation is not an academic exercise — it translates into concrete compliance actions in your business. Here is what you should do.

1. Identify which Regulations apply to your activities. If you have counterparties from Russia or Belarus, or if you trade in goods covered by CN lists: check Regulation 269/2014² (list of persons and entities), Regulation 833/2014³ (sector and goods prohibitions relating to Russia) and Regulation 765/2006¹³ (Belarus). These are the three core acts for a Polish business.
2. Download the consolidated texts from EUR-Lex. Use the CELEX numbers: 32014R0269, 32014R0833, 32006R0765. Always select the consolidated version — it incorporates all changes from successive packages.
3. Check the Polish MSWiA list. The list is available at gov.pl/web/mswia⁹ — this is a separate register, independent of the EU list. You check both in parallel.
4. Implement a sanction screening procedure. Every new counterparty and every new order requires checking against current lists. Not once — regularly, because lists can be updated several times a week.
5. Check whether Art. 5n or Art. 12g of Regulation 833/2014 applies to you. Art. 5n regulates the prohibition on providing certain services (including advisory, legal, IT and accounting services) to the Russian Government and entities established in Russia.¹⁴ Art. 12g introduces a contractual obligation to prohibit re-export — if you export goods from the CHP list to third countries, your contract must contain a “No re-export to Russia” clause.¹⁵ How this mechanism works and how to identify the risk is described in the article on circumvention of sanctions through third countries.
6. Document your process. When the Head of KAS or MSWiA carries out an inspection, you must be able to demonstrate that you are systematically checking counterparties. Maintain a register of hits with dates, package numbers and outcomes (CLEAR / POSSIBLE / MATCH).
7. Track new packages. The EU has already adopted 20 sanctions packages against Russia⁷ — the most recent in April 2026.¹⁶ New packages may add your sector or your CN codes. Set up an alert on the DG FISMA website or use a tool that monitors changes automatically.

How Sanqto can help

Tracking changes to Regulations 269/2014 and 833/2014, verifying counterparties against multiple lists simultaneously and documenting the entire process — this is work that most SMEs carry out manually, irregularly and without evidence ready for an inspection. Sanqto is sanction screening software installed on-premise — within your company’s own network, so counterparty data never leaves your infrastructure. The system works on a three-state model — MATCH / POSSIBLE / CLEAR — giving the compliance officer decision-making space for ambiguous hits. We automatically fetch current lists from DG FISMA, the Polish MSWiA list and other registers — you do not need to monitor the Official Journal of the EU after every new package. The software comes with an implementation document pack ready for a KAS or MSWiA inspection. For more on how screening works in practice for different sectors: sanction screening in the insurance sector, and an overview of all 20 sanctions packages in the article How many EU sanctions packages against Russia are there?

FAQ

What is Art. 29 TEU and what does it have to do with sanctions?

Article 29 of the Treaty on European Union (TEU) gives the EU Council the power to adopt decisions within the Common Foreign and Security Policy (CFSP). It is on this basis that the Council adopts the political decision to impose sanctions on a given country or entities. A CFSP Decision does not in itself create direct obligations for businesses — it is only the accompanying Regulation under Art. 215 TFEU, directly applicable in all EU Member States, that imposes concrete prohibitions.

Why does an EU Regulation bind my business without a Polish act?

An EU Regulation has direct legal effect — this follows from Art. 288 TFEU, which provides that a regulation “shall have general application” and “shall be binding in its entirety and directly applicable in all Member States”. Poland does not need to enact implementing legislation for a sanctions regulation to bind your business. The prohibition contained in Council Regulation (EU) No 269/2014² becomes binding law for every entity in Poland from the date of its publication in the Official Journal of the EU.

What is the difference between Regulation 269/2014 and Regulation 833/2014?

Council Regulation (EU) No 269/2014² governs the freezing of assets of specific natural persons and entities — it is a list of named individuals and companies with whom you may not carry out transactions. Council Regulation (EU) No 833/2014³ governs sector and goods prohibitions: energy, finance, transport, dual-use goods, services. It is this second act that sets out, amongst other things, the prohibition on providing certain services (Art. 5n), the oil price cap mechanism (Art. 3n)¹⁷ and the obligation to include a “No re-export to Russia” clause (Art. 12g).¹⁵ In practice you check both simultaneously.

Why does Directive 2024/1226 not apply to me directly?

A Directive, unlike a Regulation, does not bind businesses directly — it obliges Member States to transpose its content into national law. Directive of the European Parliament and of the Council (EU) 2024/1226 on the definition of criminal offences and penalties for the violation of Union restrictive measures must be transposed by each EU Member State into its own criminal code or a separate act. When Poland enacts implementing legislation (draft UC92), criminal penalties for sanctions violations will flow from that act — not directly from the Directive.

What is the Polish MSWiA list and how does it relate to the EU list?

The Polish sanctions list maintained by the minister responsible for internal affairs (MSWiA — Ministerstwo Spraw Wewnętrznych i Administracji) is a separate register that supplements the EU list.⁴ Entries on the Polish list may concern persons and entities that do not appear on EU lists, and vice versa. In practice you must check both lists independently — penalties for breaching the Polish list are imposed by the Head of KAS or the President of UZP under the Act of 13.04.2022.⁵ The Polish list is publicly available at gov.pl/web/mswia.⁹

What are implementing regulations and how often do they update the lists?

The base regulation (e.g. 269/2014) defines the rules — who can be listed and for what reason. Specific names and entities are added by Council Implementing Regulations, which are formally amendments to the annexes of the base regulation. These updates may appear every few days or every few weeks — independently of the “packages” announced in the media. The total number of individual listings (persons and entities) on EU lists against Russia after the 18th package (July 2025) exceeded 2,500.¹⁸ This means the list is very long and dynamic — manually tracking changes without a system is realistically impossible for most SMEs.

Legal basis

All legal facts in this article are based solely on verified sources. Below is a complete list of the legislative acts referenced.

Core EU acts (sanctions against Russia):

• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine — CELEX 32014R0269²
• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — CELEX 32014R0833³
• Council Decision 2014/512/CFSP — the act accompanying Regulation 833/2014⁶

Core EU act (Belarus):

• Council Regulation (EC) No 765/2006 of 18 May 2006 concerning restrictive measures in respect of President Lukashenko and certain officials of Belarus — CELEX 32006R0765¹³

EU Directives:

• Directive of the European Parliament and of the Council (EU) 2024/1226 of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures — CELEX 32024L1226

Polish legislation:

• Act of 13 April 2022 on special solutions in the scope of counteracting support for Russian aggression against Ukraine and serving the protection of national security (Journal of Laws 2022, item 835; consolidated text: Journal of Laws 2025, item 514) — ISAP¹
• Act of 1 March 2018 on counteracting money laundering and terrorist financing — for context¹⁹

Institutions and reference materials:

• DG FISMA — sanctions against Russia — chronology of all packages⁷¹²
• Polish MSWiA sanctions list⁹

Footnotes

Information, not legal advice. This article is informational and educational in nature. It does not constitute legal advice. Legal status as of: 20 May 2026. Your company’s specific obligations depend on your business profile and require individual assessment — if in doubt, consult a lawyer or compliance adviser.