5. Legal impact of sanctions violations
5.1. Introduction to sanctions currently in force against Russia (and Belarus)
The legal bases for the EU, UK and US sanctions regimes currently in force against Russia were implemented in 2014 as a response to Russia's illegal annexation of the Ukrainian territory of Crimea. In addition to the sanctions regimes imposed by the EU, UK and US, several other European countries align their national legislation to conform to these regimes (most often adopting the EU's sanctions). This includes the candidate countries for the EU, North Macedonia, Montenegro, Albania, Ukraine and Bosnia and Herzegovina, and the EEA countries, Iceland, Liechtenstein and Norway as well as Switzerland. Other countries, including G7 members and other third countries such as New Zealand and Australia, have also implemented sanctions regimes against Russia.
While the UN General Assembly has condemned Russia's aggression, the UN has to date not implemented any sanctions against Russia in response to its illegal activities towards Ukraine, and it will likely not do so due to the veto power Russia holds as a permanent member of the UN Security Council. For instance, days after the full-scale invasion of Ukraine, Russia vetoed a UN Security Council resolution demanding that Russia stop its attack on Ukraine. Recently, Russia has also vetoed the imposition of UN sanctions against other third countries, which may result in a weakening of the UN as a sanctions authority going forward.
Following Russia's full-scale invasion of Ukraine on 24 February 2022, the sanctions against Russia have expanded rapidly and significantly. To date, the EU has implemented eleven packages of sanctions, reinforcing the measures targeted at Russia's industry, economy and resources. The main objective of the sanctions is to deprive Russia of its capability to continue its aggression against Ukraine. As such, one objective of the sanctions imposed against Russia is to end the aggression altogether, while also seeking to restore respect for human rights, humanitarian law and other core tenets of international law.
In addition to the rapidly evolving sanctions targeting Russia, similar restrictions have been (and are being) imposed on Belarus for its involvement in Russia's aggression. Following the collapse of the Soviet Union, Belarus maintained close ties with Russia. Belarus has a strategically important geographic location, bordering Ukraine in the south and Russia in the north-west. Notably, as the Belarusian borders are in closer proximity to Kyiv than Russia's own borders, Russia executed part of its invasion through Belarusian territory.
Sanctions against Belarus pre-date Russia's invasion of Ukraine in February 2022, having originally been imposed to end the authoritarian regime's rigging of elections, violence and repression against its own people. The measures have subsequently been extended due to the country's support for Russia's aggression. In its conclusions of 24 February 2022, the European Council, in addition to condemning Russia's military aggression against Ukraine, strongly condemned "the involvement of Belarus in this aggression against Ukraine" and called for "the urgent preparation and adoption of a further individual and economic sanctions package that will also cover Belarus".
The latest round of EU sanctions against Belarus, implemented on 3 August 2023, included, among other things, an export ban on firearms and ammunition and export restrictions on goods used by Russia in its aggression against Ukraine, resulting in a closer alignment of EU sanctions targeting Belarus and Russia. Similarly, other jurisdictions and sanctions regimes have implemented sanctions targeted at Belarus in light of its enabling of Russia's aggression against Ukraine.
The sanctions against both Russia and Belarus encompass a diverse range of measures, ranging from sector and trade (product) restrictions on one end to the targeting of specific individuals and entities claimed to be benefiting from or in some form contributing to the aggression against Ukraine on the other. The trade restrictions have the overarching objective of limiting trade in products and services that generate revenue for the Russian economy. Additionally, they seek to impede Russia's access to weapons and other goods, including technology, that are or may be used in warfare.
5.2. Export and import restrictions comprising both direct and indirect transactions
The sanctions do not only limit individuals and entities subject to relevant sanctions regimes from dealing directly with Russia with respect to restricted goods, individuals and entities. They also prohibit indirect dealings with such restricted goods, individuals, and entities. For instance, the prohibition in Article 2a of Regulation 833/2014 states that it is prohibited to "sell, supply, transfer or export, directly or indirectly, goods and technology which might contribute to Russia’s military and technological enhancement... to any natural or legal person, entity or body in Russia or for use in Russia."
The prohibition clearly captures the sale of restricted goods directly to a person or entity in Russia. Companies should bear in mind, however, that sales to a third party (e.g. a customer located in a third country) which subsequently sells the goods to a person in Russia, would be considered an indirect sale to a person in Russia, thereby also constituting a violation of the prohibition.
The prohibition against indirect dealings is closely linked to the prohibition against circumvention of sanctions, as further described in section 4.3 below. However, while circumvention is aimed at actions conducted "knowingly and intentionally" to circumvent the relevant provisions (e.g. a scheme to deliberately avoid the restrictions imposed by sanctions), the prohibition against indirect dealings with restricted goods and/or parties also targets negligent/inadvertent breaches. This places an additional obligation of due diligence on the relevant party to ensure that they do not inadvertently export goods to, or for use in, Russia, in breach of a relevant prohibition.
The degree of expected due diligence will differ on a case-by-case basis. A degree of caution is, however, generally required when dealing in areas known to be of high importance to Russia. For instance, compliance with the prohibitions against indirectly selling, supplying or exporting goods to Russia may require investigations into the ultimate beneficial ownership of counterparties, as well as their business operations, including typical customers and re-sale/export practices, to ensure that the transaction does not violate a prohibition against indirect sales to Russian individuals or entities.
Moreover, the prohibition on indirect dealings with restricted goods and/or parties imposes a responsibility upon all relevant actors, private or public, to ensure that the sanctions are implemented in accordance with their full potential.
5.3. Prohibitions on violations and circumvention of sanctions
It Is prohibited to "knowingly and intentionally" circumvent sanctions. Unlike direct and indirect sanctions violations, which in many jurisdictions can be punishable when committed negligently, the threshold for circumvention requires an intentional act. The Court of Justice of the European Union stated in the case C-72/11 (regarding sanctions on Iran) that the term "knowingly and intentionally" implies cumulative requirements of knowledge and intent. These requirements are met where the operator intentionally seeks to circumvent sanctions or is at least aware that its participation may have that object or that effect and accepts that possibility. The European Commission has, in FAQs of 30 June 2023, confirmed that this interpretation also applies in the case of EU sanctions against Russia.
While both indirect violations and circumvention of sanctions are prohibited, it is, as discussed in chapter 3 above, evident that Russia is still able to obtain restricted goods, thereby undermining the efficacy of the sanctions. In order for the sanctions to attain their full potential in the effort to stop Russia's aggression against Ukraine and restore respect for human rights and international law principles, the loopholes must be closed. A measure to achieve this is the implementation of similar sanctions across the majority of the Western world. With respect to the sanctions against Russia, the UK, EU and US have generally sought to align and coordinate the measures imposed, although often with differences in the formulation and adoption of the rules imposed as well as reach and timing of implementation.
Still, transit through third countries that are not subject to and have not aligned themselves with Western sanctions on restricted goods and technology, remains an issue and reduces the impact of the sanctions. In its eleventh package of sanctions imposed against Russia, which entered into force on 24 June 2023, the EU specifically targeted indirect violations of sanctions via third countries as well as circumvention, strengthening its legal framework in order to tackle these issues.
Among the new measures are additional designation criteria added to Regulation 269/2014, allowing the designation of natural or legal persons, entities or bodies facilitating infringements of the prohibition against circumvention. Furthermore, the eleventh package introduced legal tools to limit the sale of restricted goods and technology to third countries considered to constitute a high risk of being used to indirectly violate and/or circumvent sanctions. Notably, Article 12f of Regulation 833/2014 introduces a new prohibition on the sale, supply, transfer and export of specified goods and technology to individuals and companies located in specified third countries. Presently, the lists of restricted goods and technology and specified third countries remain empty. The Commission has confirmed that the lists will be populated only as a last resort, when communication and cooperation with the third countries concerned fail to yield a solution. It seems plausible, however, that countries that might in due course be added to the list could be those from which we have already seen entities and individuals be designated for aiding Russia's war effort, including Iran, Syria, the United Arab Emirates and Uzbekistan.
The European Commission also recently launched a guidance document intended to help EU operators conduct sufficient due diligence to prevent inadvertent violations or circumvention of sanctions against Russia. At the outset, the guidance document identifies examples of EU companies that might be at particular risk of indirectly violating or circumventing sanctions (and must therefore exercise particular vigilance), including but not limited to: (i) EU based manufacturers of goods that are in high demand in Russia (e.g. semiconductor devices), the export of which is prohibited to Russia from the EU, and where the volume of exports is increasing towards third countries with which trade was previously limited or non-existent; and (ii) EU based manufacturers of goods which may be easily miscategorized under an HS code not subject to sanctions.
The guidance document goes on to state that companies should assess the nature of the risks to which their sector, products and economic activities are exposed, and take steps to prevent these risks to ensure that their goods are not diverted to Russia. Such steps include becoming familiar with counterparties, implementing contractual clauses with third country business partners prohibiting further re-exports of items to Russia and Belarus and enhanced evaluation of risk by trained staff.
By publishing this guidance, the EU is also establishing a benchmark for future enforcement action. It seems likely that companies that inadvertently export restricted products to Russia via a third country, and which also fail to take the steps outlined in the document, would be at greater risk of being found to have negligently violated sanctions.
5.4. Consequences of violating sanctions
5.4.1. Criminal and administrative liability for sanctions violations
Criminal law in the EU has traditionally been a competence (power) exclusively pertaining to the EU's member states. This may change in the future, however, following a proposal from the European Commission in May 2022 to add violations of EU sanctions to the list of EU crimes, which in turn led to the decision of the European Council late last year (and a subsequent draft proposal for a directive from the European Commission) to establish minimum rules concerning the definition of and penalties for violations of EU sanctions. In parallel, through an amendment to Regulation 833/2014 of 3 June 2022, Article 8 of the Regulation was updated to expressly encourage EU member states to implement "as appropriate criminal penalties" in response to sanctions violations. Pending legislative enactment of the Council's proposal for mandatory minimum penalties, however, it remains the case that there is no harmonized approach to enforcement across the member states (as discussed further below).
Across the member states of the EU, as well as Norway, the UK and US, there are significant differences in the type and severity of penalties that can be imposed for different sanctions violations, as well as the extent to which individuals and corporations can be held criminally or administratively liable for such violations. In 12 EU member states, as well as Norway and Switzerland, violation of sanctions is solely a criminal offense, while in 13 member states, as well as in the UK and US, violations can amount to either an administrative or a criminal offense. Only two EU member states, Spain and Slovakia, have not made violation of sanctions an express criminal offense.
| Penalties for sanctions violations in EU member states, Norway, Switzerland, UK and US | ||||
|---|---|---|---|---|
| Criminal offense only | Administrative or criminal offense | Administrative offense only | ||
| Croatia | Luxembourg | Austria | Italy | Spain |
| Cyprus | Malta | Belgium | Lithuania | Slovakia |
| Denmark | Netherlands | Bulgaria | Poland | |
| Finland | Norway | Czechia | Romania | |
| France | Portugal | Estonia | Slovenia | |
| Hungary | Sweden | Germany | UK | |
| Latvia | Switzerland | Greece | US | |
| Ireland | ||||
As noted, the UK is an example of the dual approach – where violations can amount to either an administrative or criminal offense. For the former, the UK's sanctions regulator (OFSI) has the power to impose a monetary penalty (up to a maximum of GBP 1 million or 50% of the estimated value of the funds or resources involved, whichever is greater) based solely on a factual violation of the UK sanctions regime, without also needing to prove any kind of fault (e.g. knowledge, recklessness, negligence). OFSI is still required to prove that there was an actual violation of a sanctions prohibition, but only that this occurred "on a balance of probabilities" (i.e. that there was a greater than 50% chance), and without needing to show that the person that committed the breach knew or should have known that, or was negligent as to whether, their behavior would result in a sanctions violation. For criminal penalties, however, where the maximum penalty is seven years' imprisonment, the requirement is still that the person committing the offense must have known or had a reasonable suspicion that the behavior could result in a sanctions violation, and this must be proven "beyond reasonable doubt".
On the other hand, Norway is an example of a country where sanctions violation is solely a criminal offense. This, in turn, means that prosecuting authorities must demonstrate beyond reasonable doubt both that a given act constitutes a violation of the Sanctions Act and that the person committing the offense acted with the requisite subjective fault. The subjective fault (guilt) must generally cover the entire objective content (i.e. all elements) of the relevant criminal provision.
Both negligent and intentional violations are caught, with the former carrying a maximum sentence of up to six months' imprisonment and the latter up to three years (both may also lead to fines of an unspecified (and unlimited) amount, to be determined according to the severity of the offense). In addition, there could be confiscation of proceeds from a criminal offense.
Although the threshold for both civil and criminal liability will vary between countries, most authorities would treat an intentional violation of sanctions as a more serious offence than an inadvertent or negligent breach. In countries where a sanctions violation can be both an administrative and a criminal offense, intentional violation would most likely result in criminal charges (which, as described above, is the case in the UK).
Penalty systems also differ. In 15 member states, as well as in Norway and Switzerland, the maximum length of imprisonment for individuals found guilty of sanctions violations is between two and six years. In eight member states, as well as in the UK, the maximum sentence imposed is between eight and 12 years. Of the countries that have in place a criminal regime for sanctions violations, only Greece and Romania have prison sentences below two years: in Greece, the maximum sentence is six months; whereas in Romania only criminal fines may be imposed, but no imprisonment. In the US, prison sentences may be imposed for up to 20 years (for each violation). The maximum fine that can be imposed on individuals, either as a criminal or administrative penalty, also varies greatly, ranging from the equivalent of EUR 1,200 to several million (in the US, criminal penalties for individuals may be up to USD one million per violation).
14 member states, as well as the UK and US, also provide for corporate criminal liability for sanctions violations, while 12 member states provide for the imposition of administrative (but not criminal) penalties against corporations for sanctions violations. Maximum fines for corporations have historically ranged from the equivalent of EUR 133,000 to EUR 37.5 million. In the US, fines of several billion US dollars have been levied against companies.
Where a company engages in intentional violations of sanctions, for instance by knowingly purchasing sanctioned Russian-origin products from a third country, this would be more likely to result in a higher monetary penalty than an inadvertent violation of the same nature. Other aspects that might serve to increase the severity of a penalty in a given case includes especially egregious and/or repeated violations, as well as not having in place (adequate) preventive systems or procedures.
The dearth of enforcement practises (as described in section 4.5 below) means there is limited basis for an assessment of which legal framework (if any) is the most effective in deterring sanctions violations. Typically, however, the general preventive effect depends on both the severity of punishment (e.g. length of prison sentences and size of fines) and the detection risk as well as enforcement / conviction risk. The form of guilt (guilt criterion) required for criminal liability can also have an impact in this regard. Where liability can be imposed for negligent acts, (as opposed to intentional acts), the perpetrator is for example likely to take this into account in assessing enforcement / conviction risk. Similarly, for corporate liability, the deterrent is likely stronger where companies can be held strictly liable, including for anonymous or cumulative errors, than where liability can only be imposed where guilt can be attributed to one or more specific individuals acting on behalf of the company.
The US exemplifies this in practise: US authorities typically have a range of tools available to take enforcement action against companies (including an expansive jurisdictional reach); in turn, the risk of violating US sanctions is considered especially high (although it should be noted that the US also has higher prison sentences and fines than most other countries (as noted above), which ultimately makes it difficult to assess which is most decisive). The UK's Economic Crime and Corporate Transparency Bill, which is expected to be passed by the end of this year, is an example of prosecutors, at least, considering that a lower accountability (guilt) threshold is decisive in the ability to hold companies accountable for criminal acts.
On top of monetary penalties, some sanctions authorities – most notably in the US – may impose certain administrative requirements on companies, for instance requiring companies to submit to an independent audit, implement specific improvements to their compliance program or impose periodic reporting requirements.
The Commission’s proposal for a directive on harmonization of criminal offenses and penalties includes common minimum standards for penalties: depending on the offense, individuals could be liable to a maximum penalty of at least five years in prison and companies could be liable to penalties of no less than 5% of the total worldwide turnover of the company, where the sanctions violation has been committed for the company's benefit (including in circumstances where a lack of supervision and control has made possible the commission of an offense). In a recently adopted draft negotiating mandate, Members of the European Parliament's Civil Liberties Committee proposed that the maximum fine that may be levied on companies should be increased to 15% of overall annual turnover.
Article 3 of the proposed directive sets out a list of offenses that, as a minimum, shall be regarded as violations of EU sanctions and thus subject to criminal penalties (note that member states remain free to adopt more stringent rules, including a more expansive list of criminal offenses). In summary, the relevant offenses are (a) making funds or economic resources available to or for the benefit of sanctioned persons; (b) failing to freeze funds belonging to sanctioned persons; (c) enabling the entry of designated persons into the EU; (d) entering into restricted transactions; € trading in restricted goods or services; (f) providing restricted financial services; (g) providing other services that are prohibited under EU sanctions laws; (h) circumventing such measures (defined in the draft directive as (roughly) the concealing of funds or information to the benefit of designated persons and/or failing to cooperate with competent sanctions authorities); and (i) breaching conditions of a sanctions license or authorization granted by a competent sanctions authority.
Notably, the proposal distinguishes between the offenses in (a)-(g) above, and the circumvention and license breach offenses in (h) and (i). All nine offenses shall be subject to criminal penalties when committed intentionally. However, the offenses in (a)-(g) may also be committed with serious negligence (a lower threshold for criminal accountability). Article 4 of the proposed directive stipulates that inciting, aiding and abetting any of the offenses in Article 3 (a)-(i) shall also be punishable as a criminal offense.
In practice, and of most relevance to the matters discussed in this report, companies that sell restricted products to a Russian person or entity in violation of EU export restrictions, would be committing an offense under Article 3(e) of the proposed directive, even if the sale was via a person or entity in a third country. As outlined above, such acts would, if the proposal becomes law, be subject to the lower threshold of serious negligence (or, if the European Parliament's proposed amendments are adopted, just negligence) (as opposed to intent), and could also be committed by aiding and abetting a primary offender, both of which seem likely to increase the risk that companies (and individuals) could face criminal penalties for indirect sanctions violations.
Even before the new EU-wide harmonization proposal becomes law, however, it is clear that companies that intentionally or negligently violate sanctions are exposed to a significant legal risk, although the practical enforcement risk may vary to a great extent (this is discussed in more detail below). The risk is, naturally, greater in the case of persistent, significant and/or deliberate violations – as opposed to one-off, minor or negligent infractions – although the lack of enforcement precedent to date (as discussed below) means the question of which violations might lead to more stringent penalties is not always clear.
In addition to the legal consequences, and as discussed in more detail in chapter 5 below, sanctions violations also entail significant practical risks for those involved. For companies, such risks include reputational damage, withdrawal of banking facilities or insurance, procurement bans, as well as potential liability for damages for breach of relevant contractual provisions. These risks may also extend – to varying degrees – to the perpetrator company's board members and senior management, as well as owners and investors.
5.4.2. Aiding and abetting international crimes
The term 'international crime' is a collective term for certain especially egregious violations of international law, encompassing the four crimes specified in Article 5 of the Rome Statute of the International Criminal Court (the "Rome Statute"): the crime of genocide, crimes against humanity, war crimes and the crime of aggression.
The term 'genocide' is defined in Article 6 of the Rome Statute as certain acts "committed with intent to destroy, in whole or in part, a national, ethnical, racial or religious group". The specified acts include killing or causing serious bodily or mental harm to members of the group, as well as the forcible transfer of children of the group to another group.
The concept of 'crimes against humanity' is defined in Article 7 of the Rome Statute as an exhaustive set of acts committed "as part of a widespread or systematic attack directed against any civilian population, with knowledge of the attack". The specified acts include murder, forcible transfer of population, torture and "other inhumane acts of a similar character intentionally causing great suffering, or serious injury to body or to mental or physical health".
The UN has clarified that crimes against humanity involve either large-scale violence in relation to the number of victims or its extension over a broad geographic area (widespread), or a methodical type of violence (systematic). This excludes random, accidental or isolated acts of violence. In addition, Article 7(2)(a) of the Rome Statute determines that crimes against humanity must be committed in furtherance of a State or organizational policy to commit an attack, although this can be inferred from the totality of the circumstances and need not be explicitly stipulated or formally adopted.
The concept of 'war crimes', as defined in Article 8 of the Rome Statute, includes willful killing, extensive destruction and appropriation of property, willfully depriving a prisoner of war or other protected person of the rights of fair and regular trial and intentionally directing attacks against the civilian population or against civilian objects.
Finally, the crime of aggression is defined in Article 8 bis of the Rome Statute as the planning, preparation, initiation or execution by a head of state (or someone in a similar position) of armed force against the sovereignty, territorial integrity or political independence of another state.
All four crimes require a mental element of willfulness, intent or knowledge. It follows that mere negligence would not suffice, although willful blindness/recklessness – meaning a conscious decision to disregard a substantial risk that the relevant offense could be committed – could, depending on the circumstances, the nature of the offense and the relevant jurisdiction, be sufficient.
Notably, these crimes are subject to universal jurisdiction, which means they are considered so heinous that they may be prosecuted by any state, regardless of where the crime was committed and irrespective of the nationality of the perpetrator or victim.
In March 2023, the UN Independent International Commission of Inquiry on Ukraine (the "UN Commission") (which was established on 4 March 2022) issued a report with findings that Russian authorities have committed war crimes in Ukraine, including attacks on civilians and energy-related infrastructure, willful killings, unlawful confinement, torture, rape and other sexual violence, as well as unlawful transfers and deportations of children. The UN Commission further noted that some of these acts may also amount to crimes against humanity.
Also in March 2023, the ICC issued arrest warrants against Vladimir Putin and Russia's Commissioner for Children's Rights, Maria Alekseyevna Lvova-Belova for their alleged responsibility for the war crime of unlawful deportation and transfer of children to Russia from occupied areas of Ukraine (pursuant to articles 8(2)(a)(vii) and 8(2)(b)(viii) of the Rome Statute).
Since March 2022, the ICC has also been investigating more generally the extent to which potential war crimes, crimes against humanity and/or genocide may have been committed in the context of the situation in Ukraine. The crime of aggression is missing from this list because the ICC presently cannot prosecute Russia for the crime of aggression, since Russia is not a state party to the ICC. This has led to the recently opened (as of 3 July 2023) International Centre for the Prosecution of the Crime of Aggression against Ukraine (ICPA), hosted by the European Union Agency for Criminal Justice Cooperation (Eurojust). ICPA's stated purpose is to collect evidence to "investigate Russia's crime of aggression against Ukraine and facilitate case building for future trials", both before national and international courts.
The above-mentioned findings, arrest warrants and investigations are of relevance to companies which could become complicit in Russia's criminal acts if they are considered to have actively aided and abetted in a material way the commission of such crimes.
Under customary international law, the offense of aiding and abetting international crimes includes three elements: (1) an international crime (as defined in article 5 of the Rome Statute) has been committed by a principal offender (in this case, Russia); (2) another actor (e.g. a private company) committed an act (e.g. a violation of sanctions) of “practical assistance, encouragement, or moral support which had a substantial effect" on the commission of the underlying offense (in this case, Russia's ability to commit the international crime); and (3) the other actor (e.g. the company) knew that their act would assist or had the substantial likelihood of assisting the commission of the underlying offense.
Following the UN Commission's findings that Russia has committed war crimes (and potentially also crimes against humanity) in Ukraine, and in light of the other ongoing efforts to hold Russia accountable for various international crimes, it is not unthinkable that persons engaged in (direct or indirect) violations of sanctions against Russia could be considered to aid and abet Russia's war efforts, and thus also its war crimes (and possibly other international crimes). That being said, the threshold for considering that a company's act of violating sanctions has aided and abetted Russia's war crimes would likely be high (and even higher for crimes against humanity and genocide, which would additionally require sustained or systematic violations or circumvention, although see the case of French company Lafarge below). There is ongoing debate in academic international law circles around whether, in addition to the knowledge requirement, there is also a requirement that the aider and abettor had a purpose or intention to facilitate the underlying crime. If so, this would clearly serve to heighten the threshold for liability, as it would in most circumstances likely be difficult to demonstrate that a company that seeks to profit from sanctions violations has also had an intention to facilitate war crimes or other international crimes.
Of more immediate relevance to companies, however, will be the liability threshold for aiding and abetting under the national laws of countries where they operate. A number of European civil law countries, for instance, do not require more than deemed knowledge (e.g. willful blindness / recklessness) to impose criminal liability for complicity / aiding and abetting an offense.
An illustrative example is the case against the French company Lafarge, which continued its operations in regions invaded by ISIS following the terrorist organization's rise in 2013/14. In 2016, the company was accused of financing terrorism and of complicity in (aiding and abetting) crimes against humanity. Under French law, aiding and abetting only requires knowledge, not intent/purpose. In a preliminary procedural ruling, the French Supreme Court (Cour de Cassation) considered whether the threshold should be different in the context of crimes against humanity, but rejected this contention, finding that it was sufficient that the aider and abettor (in this case Lafarge) was aware that the main perpetrators (here, ISIS) were committing or would commit crimes against humanity, and that the company (Lafarge) through its actions, was facilitating the preparation or execution of such crimes.
In May 2022, the Court upheld the charges against Lafarge for complicity in crimes against humanity committed by ISIS.
Also of interest are a number of investigations into the French bank, BNP Paribas, by French prosecutors. The first, opened in 2017, examined allegations of complicity in genocide against Tutsis in Rwanda, specifically that USD 1.3 million had been transferred by BNP Paribas to a South African arms dealer to finance the purchase of weapons for genocide perpetrators, in violation of a UN arms embargo. BNP Paribas is alleged to have authorized the funds transfer to the Hutu regime in June 1994. The matter is still ongoing.
The second investigation, opened in August 2020, looks at allegations that BNP Paribas was complicit in the Sudanese government's torture, genocide and crimes against humanity in the period from 2002 to 2008. These allegations are based on a settlement from 2014, whereby the bank pleaded guilty to evading US trade embargoes on Sudan by acting as Sudan's "de facto central bank" and processing billions of dollars' worth of transactions on behalf of sanctioned Sudanese entities. This matter too, remains ongoing.
The cases illustrate the gravity of the risks companies could face when they violate sanctions. Although a single act of inadvertent violation of sanctions would be unlikely to result in a charge of complicity in war crimes or crimes against humanity, the Lafarge and BNP Paribas cases show the very real possibility that a company engaged in persistent, systematic and/or large-scale violation (or circumvention) of sanctions against Russia could be, depending on the context and nature of the sanctions being violated, found liable for aiding and abetting Russia's criminal acts. A conviction of (or settlement by) a company for violating EU sanctions on exports to Russia, for instance by exporting dual-use products or technology to third countries, might thus serve to underpin a criminal indictment for complicity in war crimes.
There are also examples of individuals that have been found guilty of serious human rights violations as a result of sanctions violations. Frequently, these individuals are owners, chief executive officers or board members of companies involved in such violations.
One example is the prosecution in the Netherlands of a Dutch national for complicity in war crimes through the sale of arms to Liberia in the period 1999-2003, in violation of UN and EU sanctions. At the time, the individual was the owner and president of two logging companies in Liberia. The prosecution claimed that by facilitating the import of arms into Liberia, the relevant individual – through his companies – violated the arms embargo and thus became an accomplice in war crimes committed with those weapons. After several rounds of appeals culminating in a case before the Supreme Court of the Netherlands, the individual was finally convicted in December 2018 (albeit in absentia, having fled to South Africa) and sentenced to 19 years' imprisonment for illegal weapons trafficking and complicity in war crimes through his "active and conscious contribution to the war operations".
A second example, once again from France, is the indictment in June 2021 of four executives of French surveillance companies Amesys and Nexa Technologies, for alleged complicity in, respectively, torture in Libya and enforced disappearance in Egypt. The two companies allegedly supplied surveillance technology to the authoritarian regimes of Muammar Gaddafi in Libya (in 2007) and Abdel Fattah al-Sisi in Egypt (in 2014), which in turn was used by both regimes to target, arrest and suppress opponents.
Although exports of the relevant technology to Libya and Syria, respectively, was not at the time restricted by EU sanctions or export control regulations, the indictment suggests that the barrier to prosecuting companies and/or their executives for war crimes (and quite possibly other international crimes) is lower than it once was.
Another illustrative case is the trial that recently kicked off in Sweden against former executives of a Swedish oil company, for alleged complicity in war crimes in Sudan between 1999 and 2003. The former CEO and Chairman of the Board are both accused of asking Sudan’s government to provide security at the site of one of the company's exploration fields, which – the prosecution claims – later led to aerial bombings, killing of civilians and burning of entire villages. Again, although the case did not involve a violation of sanctions, it is indicative of the increasingly heightened risk facing companies that are seen to assist, support or collaborate with regimes or non-state actors that have been deemed guilty of one or more international crimes.
5.5. Enforcement practises
According to the Genocide Network, very few individuals or corporations responsible for sanctions violations in the EU are effectively held accountable, although in a number of member states, a rising trend is increasingly being observed regarding both the number of enforcement actions launched and the rise in penalties imposed. A similar pattern (from a similar starting position) can be seen in the UK and Norway. It should be noted, however, that a full comparison is difficult, since many sanctions authorities do not publish details of their enforcement actions.
In the UK, as one of the more transparent jurisdictions, enforcement actions taken by OFSI are published on the UK government's website. To date, OFSI has taken action against a total of only nine companies since its establishment in 2016. Two of these relate to violations of the UK's sanctions against Russia. Nonetheless, based on statements and commentary, including pronouncements from OFSI itself and the relatively recent introduction of strict liability enforcement powers (as described in section 4.4 above), we may see a more aggressive approach to enforcement from OFSI going forward. In its Annual Review covering the period April 2021 to August 2022, OFSI noted that it had received 236 breach reports in the first six months of Russia's invasion of Ukraine, and also that it considers itself to be a "world leader in responding to breaches of financial sanctions".
Although the most high-profile enforcement cases, like the ones outlined in section 4.4.2 above, tend to involve companies and individuals that have engaged in direct and egregious violations of sanctions, sanctions authorities are increasingly also looking to target indirect violations, as also noted above. One example of this is OFSI's enforcement action against Tracero Limited in May 2022. The company received a monetary penalty for having violated UK sanctions against Syria by making an indirect payment – through a travel agent based in the United Arab Emirates – to a designated Syrian airline. In its enforcement notice, OFSI stated that it "is not sufficient for any company to rely on a third party to undertake financial sanctions checks on their behalf, and the company committing the breach will be liable for any breach that occurs".
By the same logic, an EU company selling restricted goods to a non-EU company that is not itself subject to EU or other similar sanctions against Russia, could be found liable for an indirect violation of sanctions if the non-EU company subsequently sells the goods to a Russian end customer, even if such a sale was lawful for the non-EU company. As is apparent based on a review of relevant case law, once a sanctions violation has been established, there is a risk that it could be used as a springboard to further indictments (e.g. complicity in war crimes). There is no reason why this would not also hold true for persistent or egregious acts of indirect sanctions violations.
In a number of EU member states, it seems to be customs authorities that are the most active in cracking down on (potential) sanctions violations. In Belgium, as of March this year, 19 reports relating to import and export offenses had been transmitted to the public prosecutor’s office and 15 others were being prepared. Similarly, Spanish and Dutch customs authorities are increasingly scrutinizing shipments in an effort to crack down on sanctions violations, while Swiss prosecutors (also as of March this year) had opened 21 criminal proceedings for sanctions violations, most of which related to sanctioned goods. Polish and German sanctions authorities seem to have been particularly active, with the latter recently announcing an increase in investigations into sanctions evasion practices, actioned through a number of unannounced raids on companies.
In contrast with Europe, with its budding (albeit increasing) sanctions enforcement practice, the concept and practice of sanctions enforcement is far more mature in the US, which has seen multiple high-profile enforcement actions and settlements linked to sanctions violations. The US sanctions authorities are also more active in their pursuit of non-US companies, asserting US jurisdiction based on a wide range of factors, including but not limited to the use of US currency and technology, physical presence in the US and involvement of US nationals (wherever located).
The US Department of Justice (DOJ) has also made clear its intention to ensure active enforcement of US sanctions on Russia, with US Deputy Attorney General Lisa Monaco last year stating that the DOJ recognizes "the critical need to enforce these sanctions with unprecedented intensity". She added that the DOJ is "pouring resources into sanctions enforcement" and that the world would continue to see results.
The differing practices of sanctions authorities and, in many countries the lack of past enforcement cases (and/or enforcement data), belie the clear trend towards increasing enforcement action for sanctions violations. The trend is evident from the bullish statements made by authorities, as well as the number of pipeline cases currently stated to be under investigation. When this trend is viewed in conjunction with the UN Commission's finding that Russia has committed war crimes in Ukraine (as well as the ICC arrest warrants and the various ongoing investigations), the extent of violations suggested by, among other things, toll and customs data (as outlined in chapter 3) and countries' increasing willingness to hold companies accountable for serious international crimes (as discussed in this chapter), it is clear that companies involved in persistent and/or deliberate acts of direct and indirect sanctions violations could be exposed to a genuine risk of action being taken against them for complicity in Russia's war crimes.