Transposition of Directive 2024/1226 — 9 EU Countries That Implemented on Time

20 May 2025 was the deadline for transposing Directive (EU) 2024/1226 — the act that, for the first time, harmonises criminal penalties for sanctions violations across the entire European Union. By that date, 9 of 27 member states had fulfilled the obligation. Poland had not. On 24 July 2025, the European Commission launched infringement proceedings against 18 countries, including Poland.¹ For any company that sells abroad, has a branch in Stockholm, or works with a counterpart from Vilnius, this means one thing: the same sanctions violation is today punished differently in each EU country — and in 9 of them the penalty is already defined, severe, and in force.

TL;DR

• 9 countries transposed Directive 2024/1226 before or shortly after the deadline: Sweden, the Netherlands, Denmark, Estonia, Finland, Latvia, Lithuania, Slovakia, and Luxembourg.²
• Maximum prison sentence: 6 years (Sweden, Netherlands, Denmark, Finland, Lithuania) or 5 years (Estonia, Latvia, Slovakia).
• Maximum fine for a company with publicly stated ranges: 10 million SEK in Sweden (~€900,000) and €870,000 in the Netherlands.
• Only 2 countries met the exact EU deadline (20 May 2025): Estonia and Finland.
• Poland, Germany, France, Italy, Spain, the Czech Republic, and 12 other countries are subject to EC infringement proceedings.¹
• Practical implication: if you conduct sales or have a branch in any of these 9 countries, penalties apply today — not after Poland’s UC92 bill comes into force.

Why Only 9 of 27

The transposition deadline for Directive 2024/1226 — that is, incorporating it into national law — was set for 20 May 2025. The European Commission monitored notifications from member states and on 24 July 2025 announced the first batch of infringement proceedings, sending letters of formal notice to 18 of 27 member states.¹

The rest — Sweden, the Netherlands, Denmark, Estonia, Finland, Latvia, Lithuania, Slovakia, and Luxembourg — avoided proceedings. Each of these countries took a different path.

Two transposition models recur most frequently:

1. Amendment to the criminal code — six states modified existing economic offences provisions (Denmark, Estonia, Finland, Latvia, Lithuania, Slovakia).
2. New act or separate legislation — Sweden adopted a dedicated International Sanctions Act (SFS 2025:327).³

The Netherlands and Luxembourg took a third route — they concluded that existing provisions already met the Directive’s requirements and no new legislation was needed.⁴

This is not merely a comparative-law curiosity. For a Polish company with counterparts in any of these nine countries, it carries a very specific consequence. A transaction that in Poland is currently subject only to an administrative penalty under the Act of 13 April 2022 is, in Stockholm, subject to criminal liability with an upper limit of 6 years in prison for a managing director.

The Harshest Penalties — 6 Years’ Imprisonment and Financial Sanctions

Of the nine countries, five set the maximum prison sentence for natural persons at 6 years: Sweden, the Netherlands, Denmark, Finland, and Lithuania. The remaining three (Estonia, Latvia, Slovakia) stopped at 5 years. These are the upper limits for the most serious violations — intentional acts, carried out within an organised group, and significant in financial scale.

1. Netherlands — 6 years’ imprisonment, €870,000 for a company

The Netherlands today has the most precisely defined financial penalty ranges of all nine. No new legislation was needed — the Sanctiewet 1977 and the Wet op de economische delicten (Economic Offences Act) already satisfied the Directive’s requirements.⁴ Notification to the Commission was made on 15 April 2025, and the transposition table was published in Staatscourant 2025, no. 12900.⁴

Maximum penalties for natural persons: 6 years’ imprisonment for serious sanctions violations (as an economic offence) plus fines up to the fifth category — currently €87,000. For companies: fines up to €870,000 (sixth category for legal persons), supplemented by a ban on conducting business and publication of the judgment.⁴

Guidelines from the Public Prosecution Service issued in 2024 introduced voluntary self-reporting of violations as a mitigating circumstance — “Aanwijzing zelfmelden, medewerking en zelfonderzoek (2024A007)” has been in force since 1 January 2025.⁴ This means a company that proactively discloses its own breach may qualify for a reduction — provided it does so on its own initiative, not in a panic after a case has already been referred to the prosecutor.

2. Sweden — 10 million SEK for a company

Sweden is the only country among the nine that chose to enact a new, dedicated statute: Lag (2025:327) om internationella sanktioner (International Sanctions Act), passed by the Riksdag on 7 May 2025 and in force from 10 June 2025.³

Penalties for natural persons:³

• basic violation: up to 3 years’ imprisonment (previously: 2),
• serious violation (grov sanktionsbrott): up to 6 years (previously: 4),
• repeated violation: 2–6 years.

Fines for natural persons were removed from the catalogue — imprisonment remains the sole penalty. For companies, företagsbot (a corporate monetary penalty) of up to 10 million SEK (~€900,000) was introduced.³

The Swedish model has one particularity worth noting. Under Swedish law, only a natural person can commit a criminal offence. The penalty imposed on a company is not formally a criminal sanction — it is a “special legal consequence of a criminal offence” committed by an individual in the course of the company’s activities.³ Does this comply with the Directive? The Commission has not yet spoken. Legal advisers (Vinge) have flagged concerns — because the Directive requires penalties for companies “for acts committed for their benefit,” whereas the Swedish provision narrows this to “in the conduct of business activities.”³

3. Lithuania — the strictest enforcement in the EU

Maximum penalty: 6 years for natural persons for serious sanctions violations. Transposition: amendment to the Lietuvos Respublikos baudžiamojo kodekso pakeitimo įstatymas (Act Amending the Criminal Code), adopted around 20 May 2025 and in force from late May.²

On paper, Lithuanian penalties do not stand out above those of the Netherlands or Sweden. However, Commission data for 2023–2025 shows that Lithuania has the highest rate of criminal proceedings actually initiated for sanctions violations in the entire EU.² The reason is geographical: the border with the Kaliningrad exclave and Belarus, transit of dual-use goods, and the unilateral ban on transit to Kaliningrad introduced in 2022.

In short: the rules are similar. Enforcement practice — considerably stricter.

9 Countries — Brief Profiles

Sweden

• Legal act: Lag (2025:327) om internationella sanktioner.³
• Entry into force: 10 June 2025 (20 days after the EU deadline).
• Max. penalty for an individual: 6 years’ imprisonment.
• Max. penalty for a company: 10 million SEK (~€900,000).
• Particularity: company penalty = “special legal consequence of a criminal offence,” not a criminal sanction in itself. Questions about compliance with the Directive.³
• Enforcement: historically weak — few criminal proceedings despite growing Swedish corporate exports to third countries. This may change from June 2025.

Netherlands

• Legal act: existing Sanctiewet 1977 + Wet op de economische delicten — no new legislation.⁴
• Notification: 15 April 2025.
• Max. penalty for an individual: 6 years’ imprisonment + fine up to €87,000.
• Max. penalty for a company: €870,000 + ban on business activities + publication of judgment.
• Particularity: dual enforcement track. Criminal — for serious violations. Administrative — for lesser ones, de minimis threshold of €10,000 (Dutch Sanctions Modernisation Bill, legislative process ongoing).⁴
• Self-reporting: 2024 guidelines may reduce penalties for companies that voluntarily disclose a violation.⁴
• New development: notaries, tax advisers, and accountants are for the first time directly responsible for sanctions screening.⁴

Denmark

• Legal act: Lov nr 634 af 18. juni 2025 — amendment to the Straffeloven (Criminal Code).²
• Entry into force: June 2025.
• Max. penalty for an individual: 6 years’ imprisonment.
• Particularity: Denmark has an opt-out from JHA policy (Protocol No. 22 to the EU Treaty). It was not required to transpose the Directive. It did so voluntarily — as a political signal regarding Russia.²
• Enforcement: proactive. Denmark is among the most active EU countries in enforcing sanctions against Russia in 2022–2025.

Estonia

• Legal act: Karistusseadustiku muutmise seadus — amendment to the Karistusseadustik (Criminal Code).²
• Entry into force: 20 May 2025 — exactly on the EU deadline.
• Max. penalty for an individual: 5 years’ imprisonment (more for dual-use technologies or weapons).
• Particularity: digitalisation of enforcement. Estonia integrates customs, banking, and company registry databases into a single cross-border transaction monitoring system.² The risk of automated detection of a violation is real, not theoretical.
• Enforcement: one of the highest rates of criminal proceedings in the Baltic region.

Finland

• Legal act: Laki rikoslain muuttamisesta — amendment to the Rikoslaki (Criminal Code).²
• Entry into force: 20 May 2025 — the second of two countries to meet the deadline exactly.
• Max. penalty for an individual: 6 years’ imprisonment.
• Particularity: the longest land border with Russia in the EU (1,340 km). Enforcement priority: dual-use goods and technology export control.²
• Enforcement: cooperation with Estonia and Latvia (Baltic Sea enforcement), intensified customs checks at the Finnish–Russian border.

Latvia

• Legal act: Grozījumi Krimināllikumā — amendment to the Krimināllikums (Criminal Code).²
• Entry into force: a few days after 20 May 2025.
• Max. penalty for an individual: 5 years’ imprisonment (more where an organised criminal group is involved).
• Particularity: border with Russia (276 km) and Belarus (161 km). Priority: control of re-exports to Russia via third countries.²
• Enforcement: high rate of criminal proceedings for sanctions violations in 2022–2025.

Lithuania

• Legal act: Lietuvos Respublikos baudžiamojo kodekso pakeitimo įstatymas — amendment to the Criminal Code.²
• Entry into force: a few days after 20 May 2025.
• Max. penalty for an individual: 6 years’ imprisonment.
• Particularity: the strictest enforcement in the EU (data 2023–2025).² Border with Kaliningrad and Belarus — high risk of transit checks.
• Practice: logistics and freight companies operating in Lithuania must have robust screening procedures, as standard customs checks routinely enquire about a counterpart’s sanctions procedures.

Slovakia

• Legal act: Zákon, ktorým sa mení a dopĺňa zákon o Trestnom zákone — amendment to the Trestný zákon (Criminal Code).²
• Entry into force: June 2025 (a few weeks after the EU deadline).
• Max. penalty for an individual: 5 years’ imprisonment (more under aggravating circumstances).
• Particularity: despite the delay, the Commission did not initiate infringement proceedings — the transposition was deemed sufficient.²
• Enforcement: border with Ukraine (97 km) — customs checks focused on transit of dual-use goods and humanitarian aid.

Luxembourg

• Legal act: no public details available. Probably an amendment to existing provisions (similar to the Netherlands).²
• Status: transposition considered sufficient by the Commission. No infringement proceedings.
• Max. penalties: no publicly stated ranges.
• Particularity: Luxembourg, as an EU financial centre, has enforced financial sanctions for decades. The banking sector has well-developed AML/CTF (anti-money laundering/counter-terrorist financing) procedures that are readily extensible to sanctions screening.² A small service business — not necessarily.

Comparison in One Table

Source: IZI Institute, Transposition of EU Directive 2024/1226 by EU Member States; reports by Vinge, Squire Patton Boggs, Paul Hastings; European Commission — July infringements package (24 July 2025).²⁴⁵³¹

What This Means for Companies Operating Abroad

If you conduct business exclusively in Poland, export nothing abroad, and have no EU branch — Directive 2024/1226 affects you indirectly (through Poland’s UC92 bill, once it comes into force). But companies in that situation are today a minority.

Most cross-border businesses fall into one of four scenarios:

1. Branch or subsidiary in one of the 9 countries

Your subsidiary in Stockholm is subject to Swedish law, not Polish law. A sanctions violation detected there triggers criminal proceedings under Lag (2025:327), with an upper limit of 6 years’ imprisonment for the manager and 10 million SEK for the company. The Polish parent finds out from the press and a belated call from a local lawyer.

Practical question: do your branches in the 9 countries have local sanctions procedures that comply with the law of the country concerned — in the Netherlands, that includes self-reporting and violation categorisation; in Sweden, specific documentation requirements? Does the same procedure cover both the subsidiary and the Polish head office? Rarely are both answers yes.

2. Cross-border e-commerce to these countries

An online shop based in Poland selling to the Netherlands, Germany, or Finland. From the perspective of the Dutch Public Prosecution Service, if you sell a product to a sanctioned person delivered to an Amsterdam address, you will have violated Dutch law. Dutch courts have jurisdiction because the effect occurred on Dutch territory.

The de minimis threshold of €10,000 in the Netherlands does not protect you if the transaction value is higher — and in B2B that is standard.

3. Export, logistics, freight

Transit through Lithuania to Kaliningrad — a classic scenario. Lithuanian border authorities have the strictest enforcement practice in the EU. If your transport company carries dual-use goods through Lithuanian territory without screening the counterpart, the prosecution service in Vilnius may charge the driver and the Polish company — before a Lithuanian court.

The same applies to the Finnish–Russian border (1,340 km), the Latvian–Russian border (276 km), and the Slovak–Ukrainian border (97 km).

4. Professional services and intermediaries

This is the category that has most surprised the market. Since January 2025, the Netherlands has explicitly brought notaries, tax advisers, and accountants within the scope of mandatory sanctions screening.⁴ If you run an accounting firm serving Dutch companies, your Dutch clients are legally required to verify that their beneficial owner (UBO) is not sanctioned. Your role: supply them with documentation confirming that screening has been carried out.

If you run a real estate agency with a client portfolio in Luxembourg, a travel agency selling stays in the Baltic states, or insurance intermediation covering cross-border policies — the effect is the same. The local law of the country in which the service is provided takes precedence over Poland’s transposition gap.

Poland Without UC92 vs. These 9 Countries

The question clients ask me most often is: “since Poland hasn’t transposed the Directive, surely nothing can happen to me in Poland?” Short answer: incorrect. Long answer: below.

EU Regulations (269/2014, 833/2014, 765/2006) apply in Poland directly. Poland’s draft restrictive measures bill (UC96 / UD96) remains in the legislative process — we covered the details in the article “What are the penalties for violating sanctions?”. Until it comes into force, administrative penalties under the Act of 13 April 2022 apply — up to PLN 20 million per entity.⁶

Differences compared with the nine countries that have transposed the Directive:

Where Polish companies harbour a false sense of security, it is this: “an administrative fine of PLN 20 million — a lot, but one-off and no prison.” That is indeed true — in Poland. But if the same act affected a counterpart in the Netherlands, Sweden, or Lithuania, proceedings will take place there, not in Poland. And there the full Directive penalties already apply.

The second myth: “once Poland transposes UC92, the penalties will increase.” Yes. The UD96 draft provides for up to PLN 200 million or 5% of annual turnover for a collective entity — details in the article “EU Sanctions List in Numbers (2026)”. The question is not whether, but when.

The third aspect — often overlooked. This entire discussion assumes you know whom you are not permitted to serve. That requires systematic screening of clients — in practice, automated verification of every counterpart. No procedure = the risk is unmeasurable, and therefore unmanageable.

How Sanqto Can Help

If your company operates in Poland and has counterparts, branches, or customers in any of the nine countries described above, you need a unified screening procedure that meets the requirements of the most restrictive law in your counterpart portfolio. In practice: the Dutch or Lithuanian standard, not the Polish one.

Sanqto is a Polish product designed around exactly this logic. We install it within your infrastructure (on-premise) — client data never leaves your network, which resolves GDPR and third-country data transfer concerns. Response time below 30 ms, three-state decision model: MATCH (confirmed hit, transaction blocked), POSSIBLE (requires manual review by the compliance officer), CLEAR (green light). Lists updated continuously — EU FSF, OFAC SDN, UN, MSWiA (Poland’s Ministry of Interior and Administration), the consolidated list, and sectoral lists.

The package includes two elements beyond the software itself:

1. Implementation document kit — sanctions policy ready for board signature, a role-specific procedure for customer-facing staff, a hit register in audit-ready format, a risk assessment template, and model letters for KAS (National Revenue Administration) and the Ministry of Foreign Affairs. These are the documents you present to an inspector as evidence that you have met your duty of care.

2. Compliance officer training and certification — a knowledge base covering EU regulations, Polish law, Directive 2024/1226, and the specifics of the nine countries that have transposed it. Online exam, AML/sanctions certificate. A requirement increasingly demanded by foreign counterparts as a contractual precondition.

See the details at sanqto.com or arrange a call — we will show you a demo using your test data.

Legal Basis

EU Directive

• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures — full text: https://eur-lex.europa.eu/eli/dir/2024/1226/oj/eng

National Acts (9 Countries)

• Sweden: Lag (2025:327) om internationella sanktioner — https://www.riksdagen.se/en/news/articles/2025/may/7/stricter-rules-on-international-sanctions
• Netherlands: Sanctiewet 1977 + Wet op de economische delicten (transposition table: Staatscourant 2025, no. 12900, 28 April 2025).
• Denmark: Lov nr 634 af 18. juni 2025 — amendment to the Straffeloven.
• Estonia: Karistusseadustiku muutmise seadus — amendment to the Karistusseadustik.
• Finland: Laki rikoslain muuttamisesta — amendment to the Rikoslaki.
• Latvia: Grozījumi Krimināllikumā — amendment to the Krimināllikums.
• Lithuania: Lietuvos Respublikos baudžiamojo kodekso pakeitimo įstatymas — amendment to the Baudžiamasis kodeksas.
• Slovakia: Zákon, ktorým sa mení a dopĺňa zákon o Trestnom zákone — amendment to the Trestný zákon.
• Luxembourg: no public details; probably an amendment to existing provisions.

Polish Context

• Act of 13 April 2022 on special solutions for counteracting support for aggression against Ukraine — https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20220000835
• Draft bill UC96 / UD96 on restrictive measures (Ministry of Foreign Affairs, March 2025 — legislative process ongoing).

FAQ

1. Do these 9 countries mean the remaining 18 have no sanctions penalties at all?

No. All 27 EU member states have their own criminal or administrative provisions on sanctions — often predating the Directive. The Directive itself requires harmonisation of minimum standards (penalty levels, offence definitions, corporate liability). The 18 countries have older provisions that may be less stringent or incomplete relative to the Directive. The European Commission initiated infringement proceedings against them on 24 July 2025.¹

2. Does the EC infringement proceeding mean a penalty for Poland?

Not directly. Infringement proceedings have three stages: a formal letter of notice, a reasoned opinion, and referral to the Court of Justice of the EU. Only the CJEU can impose a financial penalty on a member state. The process typically takes 2–4 years. Poland is currently at the first stage.

3. If a Polish company sells goods to a sanctioned person in the Netherlands, where will proceedings take place?

Most commonly where the effect of the transaction occurred — i.e., in the Netherlands. The Dutch Public Prosecution Service has jurisdiction if the delivery arrived at a Dutch address or the counterpart is located in the Netherlands. A Polish company may be prosecuted both before a Dutch court and a Polish court (the ne bis in idem principle excludes double punishment for the same act, but does not exclude dual jurisdiction).

4. Are small companies below the de minimis threshold?

The €10,000 de minimis threshold in Dutch law refers to the transaction value, not the size of the company. A single B2B sale, a year’s property lease, a business insurance policy — all typically exceed that threshold. Company size is irrelevant. A small firm with a single €15,000 transaction carries the same screening obligation as a large corporation.

5. What should a Polish company operating in the 9 countries do right now?

Three steps, in this order: (1) map which of the nine countries you have branches, counterparts, or regular sales in; (2) check whether the local subsidiary (if any) has a sanctions procedure that complies with the law of that country — in the Netherlands this includes self-reporting and violation categorisation; (3) implement uniform screening across the entire corporate group that meets the requirements of the most stringent applicable law. In practice — the Dutch standard.

6. How often are sanctions lists updated?

The EU FSF (Financial Sanctions Files) is updated dozens of times a year — on average several times a month. Each new sanctions package against Russia adds 50–200 new entries; individuals from cyber, human rights, and terrorism regimes are also added on an ad-hoc basis. A client who was “clear” in February may be on the list by May. Re-screening an existing client base is an obligation, not an option — although it is rarely stated explicitly in legislation.

Information, not legal advice. This article is for informational and educational purposes only. It does not constitute legal advice.

Legal status as of: 19 May 2026.

The specific obligations of your company depend on the jurisdiction, business profile, and corporate group structure. If in doubt, consult a local lawyer or compliance adviser — particularly in countries where criminal liability extends to gross negligence (Netherlands, Sweden, the Baltic states).