Sanctions bind everyone, not only obliged entities, and the obligation most often breached is not the duty to freeze — it is the duty to make nothing available, which fails as an ordinary payment run. Since May 2025 Member States have been required to make the conduct criminal, and from July 2027 a sanctions process outside the AML framework is a gap in the AML framework.
The duty does not come from the AML Law
Most businesses meet sanctions through their AML file, which is where the confusion starts. Anti-money-laundering obligations attach to obliged entities — a defined list of banks, payment firms, accountants, lawyers, estate agents and others. Sanctions attach to everyone.
Council Regulation (EU) No 269/2014 is directly applicable in every Member State, and it is written as a flat prohibition rather than as a supervisory requirement. Under Article 2, all funds and economic resources belonging to, owned, held or controlled by a listed person or entity shall be frozen; and no funds or economic resources shall be made available, directly or indirectly, to or for the benefit of a listed person or entity.
Nothing in that turns on your size, your sector or whether anyone supervises you. A manufacturer paying an invoice, a landlord releasing a deposit and a software company renewing a licence are all within it.
Two duties, and the second is the one that gets breached
Read Article 2 as two separate obligations, because they fail in different ways.
Freeze what you hold. Freezing is defined broadly — preventing any move, transfer, alteration, use of, access to or dealing with funds that would change their volume, location, ownership or destination — and so are funds: cash, balances, debts, securities, dividends, credit, rights of set-off, guarantees, letters of credit, bills of lading.
Make nothing available. This is the one ordinary businesses breach, and it rarely looks like a sanctions decision at the time. Paying a supplier, shipping goods, returning a deposit, crediting an account, settling a commission — the word in the Regulation is indirectly, so routing the benefit through an intermediary does not take it outside.
The counterparty does not have to be on the list
Article 2 catches funds and economic resources controlled by a listed person, not only those in their own name. A company that appears nowhere in the Annex can still be within the freeze because of who stands behind it.
The designations themselves sit in Annex I to the Regulation, and the Annex is amended by further regulations published in the Official Journal — which is why a screening done once at onboarding is not screening. The Annex carries the identifying data: names and aliases, date and place of birth, nationality, passport and identity-card numbers for individuals; name, place and date of registration and registration number for entities. Those are what a check should be run against, not a name string alone.
How far ownership and control reach in a given structure is a question of analysis, and the Council has published guidance on assessing it. A borderline case is not one to decide in the payment run.
Three provisions worth knowing before you need them
Reporting is immediate, and it is an obligation. Article 8 requires any person to supply immediately to the competent authority of the Member State where they are resident or located any information that would facilitate compliance — such as accounts and amounts frozen — and to cooperate in any verification of it. This is not a voluntary disclosure regime.
Circumvention is prohibited in its own right. Article 9 prohibits participating, knowingly and intentionally, in activities whose object or effect is to circumvent the measures. Restructuring a payment chain so a listed party is no longer the formal recipient is an activity with that effect.
Acting in good faith is protected — if you can show it. Article 10 is the provision that justifies the whole screening exercise. Freezing funds, or refusing to make them available, in good faith on the basis that the action is in accordance with the Regulation gives rise to no liability of any kind for the person doing it or for their directors and employees, unless it is proved that the funds were frozen or withheld as a result of negligence. And no liability arises where the person did not know, and had no reasonable cause to suspect, that their actions would infringe the measures.
Both limbs are evidential. “Good faith” and “no reasonable cause to suspect” are established by what you can produce afterwards: the check that was run, the list version it was run against, the date, and who decided what. A screening process with no record protects nobody.
From 2025 this is criminal law across the Union
Directive (EU) 2024/1226 requires every Member State to make violations of Union restrictive measures criminal offences. Its transposition deadline was 20 May 2025.
Article 3 sets out the conduct that must be criminal where it is intentional: making funds or economic resources available to or for the benefit of a designated person; failing to freeze them; prohibited transactions with a third State or its bodies; prohibited trade in goods and the related brokering, technical assistance or services; prohibited financial and other services; and circumvention — including providing false or misleading information to conceal that a designated person is the ultimate owner or beneficiary.
Member States may exclude conduct involving less than EUR 10,000 from the criminal offences. Above that, Article 5 sets the floor for maximum sentences: at least five years for making funds available, failing to freeze and concealment where the value is at least EUR 100,000, and at least one year for the reporting failures at that value.
The provision to read twice is Article 6. A legal person is liable not only for offences committed for its benefit by someone in a leading position, but also where a lack of supervision or control by such a person made the offence possible for someone under their authority. A company can be liable because nobody was checking. Article 7 then allows, alongside fines, exclusion from public funding and tenders, disqualification from business activities, withdrawal of permits, judicial winding-up and publication of the judgment.
What changes on 10 July 2027
Until now a business could treat sanctions and AML as separate files that happen to share a screening tool. Regulation (EU) 2024/1624 ends that for obliged entities, and it does so in three places.
Article 9(1)(b). Internal policies, procedures and controls must — in addition to the obligation to apply targeted financial sanctions — mitigate and manage the risks of their non-implementation and evasion.
Article 10(1). The business-wide risk assessment must identify and assess those same risks, alongside money laundering and terrorist financing.
Article 11(2). The compliance officer is responsible for the day-to-day operation of the AML/CFT requirements including in relation to the implementation of targeted financial sanctions.
So from that date a sanctions process that lives outside the AML control framework is a gap in the AML control framework, and it is assessed as one.
What a defensible process looks like
Screen at onboarding and before payment, not only at onboarding. The Annexes change by regulation, and a counterparty cleared in March can be listed in April.
Screen against identifiers, not names. Date of birth, registration number and document details are in the Annex because a name alone produces both false negatives and a great many false positives.
Look through the structure. “Controlled by” is in Article 2 for a reason; an unlisted counterparty with a listed controller is within the freeze.
Record the check. The list version, the date, the result and the decision. Article 10 protection is proved, not asserted.
Have an escalation route that ends somewhere. A hit stops the payment; it does not start a negotiation with the client. Freezing and the Article 8 report are the regulated path — and quietly declining instead leaves that obligation unmet while looking, internally, like a prudent decision.
One further point for Latvia: sanctions risk arises under a different statute from the AML Law, with its own assessment and its own control system, and an AML risk assessment however well built does not discharge it. Which national measures reach your sector, and where a report goes, is the part to settle locally — before a hit appears, not during one.