Sanctions bind everyone, not only obliged entities, and the obligation most often breached is not the duty to freeze — it is the duty to make nothing available, which fails as an ordinary payment run. Since May 2025 Member States have been required to make the conduct criminal, and from July 2027 a sanctions process outside the AML framework is a gap in the AML framework.
This duty does not come from the AML Law
Most businesses meet sanctions through their AML file, and that is where the confusion starts. Anti-money-laundering duties apply to a defined list of businesses — banks, payment firms, accountants, lawyers, estate agents and so on. Sanctions apply to everyone.
The EU sanctions regulation works directly in every member country, and it is written as a flat ban rather than as something a supervisor checks. All money and economic resources belonging to, owned, held or controlled by a listed person must be frozen. And nothing may be made available, directly or indirectly, to a listed person or for their benefit.
None of that depends on your size, your industry or whether anyone supervises you. A manufacturer paying an invoice, a landlord returning a deposit and a software company renewing a licence are all inside it.
Two duties, and it is the second one that gets broken
Read the rule as two separate obligations, because they go wrong in different ways.
Freeze what you hold. Freezing is defined widely: you may not move, transfer, change, use or deal with the money in any way that would change how much there is, where it is, who owns it or where it is going. “Funds” is just as wide — cash, account balances, debts, securities, dividends, credit, rights of set-off, guarantees, letters of credit, bills of lading.
Make nothing available. This is the one ordinary businesses break, and at the time it rarely looks like a sanctions decision at all. Paying a supplier, shipping goods, returning a deposit, crediting an account, paying a commission. The regulation says indirectly as well, so sending the benefit through someone else does not put you outside.
Your counterparty does not have to be on the list
The freeze catches money and resources controlled by a listed person, not only what is in their own name. A company that appears nowhere on any list can still be caught because of who stands behind it.
The names themselves are in an annex to the regulation, and that annex is changed by further regulations published in the Official Journal. This is why a check done once at onboarding is not really a check at all. The annex also carries the identifying details — names and aliases, date and place of birth, nationality, passport and ID numbers for people; name, place and date of registration and registration number for companies. Those are what you should be checking against, not a name on its own.
How far ownership and control reach through a particular structure takes analysis, and the Council has published guidance on working it out. A borderline case is not one to settle in the middle of a payment run.
Three rules worth knowing before you need them
Reporting is immediate, and it is not optional. Anyone who holds relevant information — for example accounts and amounts frozen — has to give it immediately to the competent authority of the country where they live or are located, and cooperate when it is checked. This is not a voluntary disclosure scheme.
Getting around the rules is itself banned. It is prohibited to take part, knowingly and deliberately, in anything whose purpose or effect is to get around the measures. Rearranging a payment chain so a listed party is no longer the formal recipient is exactly that.
Acting in good faith protects you — if you can show it. This is the rule that makes the whole screening exercise worth doing. If you freeze money, or refuse to hand it over, in good faith because you believe the regulation requires it, no liability of any kind falls on you, your directors or your staff — unless someone proves you did it through negligence. And there is no liability at all where you did not know, and had no reasonable cause to suspect, that what you were doing would breach the measures.
Both of those are about evidence. “Good faith” and “no reasonable cause to suspect” are shown by what you can produce afterwards: the check you ran, which version of the list you ran it against, the date, and who decided what. A screening process that leaves no record protects nobody.
Since 2025 this is criminal law across the EU
A 2024 EU directive requires every member country to make breaches of EU sanctions criminal offences. The deadline for putting it into national law was 20 May 2025.
The conduct that has to be criminal, where it is deliberate: making money or resources available to a listed person or for their benefit; failing to freeze them; banned transactions with a third country or its bodies; banned trade in goods and the brokering, technical help or services that go with it; banned financial and other services; and getting around the rules — including giving false or misleading information to hide that a listed person is the ultimate owner or beneficiary.
Countries may leave out conduct involving less than EUR 10,000. Above that, the directive sets minimum maximum sentences: at least five years for making funds available, failing to freeze and concealment where the value is EUR 100,000 or more, and at least one year for the reporting failures at that value.
The rule to read twice is the one on companies. A company is liable not only for offences committed for its benefit by someone senior, but also where a lack of supervision or control by that senior person made the offence possible for someone working under them. In other words, a company can be liable because nobody was checking. On top of fines, the penalties available include exclusion from public funding and tenders, a ban on carrying on business, withdrawal of permits, winding up by the court, and publication of the judgment.
What changes on 10 July 2027
Until now a business could keep sanctions and AML as two separate files that happen to share a screening tool. The new EU AML Regulation ends that for the businesses it covers, in three places.
Internal policies and controls have to — on top of actually applying sanctions — manage the risk that they are not implemented or are evaded.
The business-wide risk assessment has to cover those same risks, alongside money laundering and terrorist financing.
The compliance officer is responsible for the day-to-day running of the AML requirements including putting sanctions into practice.
So from that date, a sanctions process sitting outside your AML framework is a hole in your AML framework, and it gets assessed as one.
What a process that holds up looks like
Check at onboarding and again before you pay, not only at onboarding. The lists change by regulation, and a counterparty who was clear in March can be listed in April.
Check against identifiers, not names. Date of birth, registration number and document details are in the annex for a reason: a name on its own produces both misses and a great many false matches.
Look through the structure. “Controlled by” is in the regulation deliberately. An unlisted counterparty with a listed owner behind it is inside the freeze.
Write the check down. Which list version, what date, what result, who decided. The good-faith protection is something you prove, not something you assert.
Have an escalation route that actually ends somewhere. A hit stops the payment; it does not open a negotiation with the client. Freezing and reporting are the regulated path — and quietly declining instead leaves the reporting duty unmet while looking, internally, like a sensible decision.
One more point for Latvia. Sanctions risk comes under a different law from the AML Law, with its own assessment and its own control system, and an AML risk assessment, however good, does not cover it. Which national measures reach your sector, and where a report goes, is worth settling locally — before you get a hit, not during one.