Finland 2026, Criminal Liability for Sanctions Violations: What Companies, Boards and Executives Must Know

Last updated: 30 April 2026

Finland’s criminal liability framework for sanctions violations underwent its most significant overhaul in decades when legislative amendments implementing the EU Sanctions Criminalisation Directive entered into force on 20 May 2025. The reforms introduced dedicated sanctions-offence provisions into the Finnish Criminal Code, created a new tier of corporate fines reported to reach as high as EUR 40 million, and extended personal criminal exposure to directors and officers who fail to prevent breaches. Finnish Customs recorded 43 regulation offences related to sanctions in 2025, with 17 cases investigated as suspected aggravated offences, a pace of enforcement that shows no sign of easing into 2026.

This guide explains the new rules, maps criminal liability for sanctions violations in Finland in 2026 across companies, boards and executives, and provides the practical checklists, investigation protocols and compliance steps that decision-makers need right now.

Key Takeaways

• New dedicated sanctions offences. Since 20 May 2025, the Finnish Criminal Code contains specific criminal offence provisions for violating EU sanctions, replacing the previous general regulation-offence framework.
• Higher corporate fines. Corporate fines for sanctions violations could now amount to as much as EUR 40 million, according to practitioner commentary.
• Individual liability for directors and officers. Board members and senior executives face personal criminal prosecution where violations are linked to intentional conduct or a failure to supervise.
• Active enforcement. At least 26 formal investigations into breaches of trade sanctions were commenced in Finland in 2025, and Finnish Customs is dedicating additional resources to detection.
• Immediate board action required. Companies should audit sanctions compliance programmes, appoint responsible individuals, and ensure legal-privilege protocols are in place before, not after, an investigation begins.

Quick Summary for Boards and Executives

Immediate Checklist, If a Sanctions Investigation Starts

1. Engage specialist criminal defence counsel immediately. Do not rely on in-house legal teams alone; privilege and procedural rights must be protected from day one.
2. Preserve all records. Issue a litigation-hold notice covering emails, contracts, shipping documents, screening logs, communications with counterparties, and internal approvals.
3. Suspend suspect transactions. Halt any ongoing exports, payments or services that may involve sanctioned parties, goods or destinations.
4. Brief the full board. Hold a minuted board session to record the company’s awareness, initial response steps and delegation of authority.
5. Appoint an internal investigation lead. Ideally an external law firm to maximise privilege protection.
6. Activate your communications plan. Prepare holding statements for regulators, employees, counterparties and media; control information flows.
7. Notify insurers. Check D&O and professional-liability policies for notification deadlines and exclusion clauses.
8. Consider self-disclosure. Evaluate whether proactive engagement with the prosecutor or Finnish Customs may result in more favourable treatment.
9. Segregate implicated personnel. Where specific individuals are suspected, consider temporary reassignment to prevent evidence interference while respecting employment-law obligations.
10. Document every decision. Maintain a contemporaneous log of all governance steps and rationale, this record may later be decisive in demonstrating good faith.

If You Are a Director, Five-Point Priority List

• Seek independent legal advice on your personal exposure.
• Confirm whether you have a conflict of interest that requires recusal from the investigation process.
• Review your personal involvement in any relevant approvals, contracts or due-diligence decisions.
• Verify that D&O insurance covers sanctions-related criminal proceedings.
• Do not destroy, alter or remove any company records under any circumstances.

What Changed in 2025–2026: Statutory Timeline and Key Provisions

Understanding criminal liability for sanctions violations in Finland in 2026 requires a clear picture of the legislative sequence that created the current regime. The changes were driven by EU-level harmonisation and implemented through targeted amendments to the Finnish Criminal Code.

Legislative Timeline

What the New Criminal Code Provisions Cover

The Finnish Criminal Code now distinctly defines criminal offences specifically for violating EU sanctions. Before 20 May 2025, sanctions breaches were typically prosecuted under general regulation-offence provisions, a framework that carried lower penalties and was less clearly defined. The new provisions create a standalone offence category within the Criminal Code, covering acts such as making funds or economic resources available to sanctioned persons, providing prohibited services, and circumventing asset-freeze or trade-restriction measures.

The amendments distinguish between intentional offences and negligent conduct. An aggravated sanctions offence applies where the violation involves particularly large values, is committed as part of organised activity, or causes especially serious harm. The distinction between basic and aggravated forms directly determines the severity of penalties, as outlined in the section below.

Who Can Be Criminally Liable: Companies, Boards and Executives

A central question for decision-makers is whether corporate sanctions liability in Finland extends to the company itself, to individual directors and officers, or to both. The 2025 amendments expand exposure on both fronts.

Legal-Person Liability, Corporate Fines

Under the Finnish Criminal Code, corporations and other legal entities are not treated as direct perpetrators of crimes, only natural persons can commit offences. However, a company can be subject to a corporate fine (yhteisösakko) where the offence was committed in the course of the company’s operations and where a person in a management or decision-making position has been complicit in the offence or has allowed it to occur. The 2025 amendments substantially increased the maximum corporate fine for sanctions offences, with practitioner commentary reporting a ceiling as high as EUR 40 million.

Individual Liability, Directors and Officers

Board members, CEOs and other senior executives face personal criminal prosecution where a sanctions violation is connected to their intentional action or consent, or where they have negligently failed to supervise compliance. Board liability for sanctions is not theoretical: the new provisions are designed to reach individuals who approve, authorise or turn a blind eye to transactions that breach EU restrictive measures.

Liability Comparison Table

Penalties and Enforcement: Fines, Imprisonment and Corporate Measures

The penalties framework under the amended Finnish Criminal Code creates a graduated scale tied to the severity of the offence. Criminal sanctions for companies in Finland now carry materially higher financial consequences than under the previous regime, and individuals face meaningful custodial sentences.

Penalty Ranges

The EU Sanctions Criminalisation Directive set minimum harmonised thresholds across Member States: for individuals, a maximum penalty of at least five years’ imprisonment; for entities, fines of up to five per cent of total worldwide turnover or a fixed monetary amount. Finland’s implementation reflects these thresholds and, by enabling corporate fines reported at up to EUR 40 million, positions Finnish enforcement among the more robust in the EU.

In addition to fines and imprisonment, convicted individuals and entities may face forfeiture of the proceeds or instruments of the offence. Industry observers expect prosecutors to pursue forfeiture aggressively in high-value trade-sanctions cases, given the significant sums often involved in sanctioned commodity flows.

Enforcement Landscape and Recent Statistics (2024–2026)

Enforcement of sanctions offences in Finland in 2026 is no longer a theoretical risk. Multiple authorities are actively investigating potential violations, and the pace of cases has accelerated significantly since the 2025 amendments took effect.

Competent Authorities

• Finnish Customs (Tulli). The primary investigative body for sanctions-related regulation offences, including trade restrictions, export controls and prohibited imports. Customs conducts criminal investigations and refers cases to the prosecution service.
• National Prosecution Authority. Responsible for prosecuting sanctions offences before Finnish courts. The 2025 reforms give prosecutors clearer statutory tools to charge both individuals and pursue corporate fines.
• Ministry for Foreign Affairs (Ulkoministeriö). Oversees the implementation and policy framework for international sanctions in Finland, including guidance on EU restrictive measures.
• National Bureau of Investigation (KRP). May be involved in more complex or multi-jurisdictional investigations, particularly where organised sanctions-evasion networks are suspected.

Enforcement Statistics

According to data published by the Finnish Tax Administration’s grey-economy unit, Finnish Customs recorded 43 regulation offences related to sanctions breaches in 2025, of which 17 were investigated as suspected aggravated offences. Separately, reporting by Duane Morris noted that 26 formal investigations into breaches of trade sanctions were commenced during 2025. The likely practical effect of the new Criminal Code provisions will be to convert a greater proportion of these investigations into prosecutions with higher penalty exposure than was possible under the old regime.

Criminal Liability for Sanctions Violations Finland 2026: Board and Executive Immediate Steps If an Investigation Starts

When Finnish Customs or the prosecution service initiates a formal investigation into a suspected sanctions offence, the first hours and days are critical. Missteps during this period, particularly around evidence, communications and governance, can materially worsen both corporate and individual criminal exposure.

Recommended Action Plan by Timeframe

First 24 hours:

1. Engage external criminal defence counsel with sanctions expertise. Confirm the scope of the investigation if disclosed by authorities.
2. Issue a company-wide litigation-hold notice: all relevant documents, emails, electronic records, shipping logs, screening outputs and internal communications must be preserved.
3. Suspend any ongoing transactions that may involve the suspected conduct.
4. Brief the board chair and CEO. If any board member is personally implicated, ensure they recuse themselves from directing the response.

First week:

1. Appoint an internal investigation team, ideally led by external counsel, to maximise privilege protection.
2. Activate the company’s crisis communications plan. Prepare holding statements for regulators, employees, key customers and media.
3. Notify D&O and professional-liability insurers. Check notification deadlines and confirm coverage for sanctions-related proceedings.
4. Map the regulatory landscape: determine whether parallel investigations may be underway in other EU jurisdictions or by OFAC.

Within 30 days:

1. Complete a preliminary fact-finding assessment under privilege. Identify the nature and scope of any violation, the persons involved, and the approximate value at issue.
2. Evaluate whether voluntary self-disclosure to the prosecution service or Finnish Customs is strategically advisable. Early cooperation can influence enforcement outcomes and sentencing.
3. Begin remediation: close any compliance gaps identified, update screening procedures, and retrain relevant staff.

How to Run Internal Investigations and Preserve Privilege in Finland

A well-structured internal investigation for sanctions in Finland serves two purposes: it establishes the facts the company needs for decision-making, and it creates a defensible record that can support cooperation with authorities or be deployed in litigation. Getting the structure wrong, however, can destroy privilege, create additional liability, or undermine employee rights.

Scope and Plan

Before any interviews are conducted or documents reviewed, define the investigation scope in writing. The scope memorandum, prepared by external counsel, should identify the suspected conduct, the relevant time period, the individuals and business units in focus, and the key documents or data sources. The investigation plan should also address jurisdictional considerations: if the company operates across multiple EU states, determine which legal privilege rules apply to each data source and interview.

Use of External Counsel

Finnish law does not recognise attorney–client privilege in the same way as common-law jurisdictions. Privilege attaches to communications between a client and an external lawyer (an asianajaja, a member of the Finnish Bar Association) in the context of legal advice or litigation, but it does not extend to in-house counsel in the same manner. This distinction is critical. To maximise protection, companies should ensure the internal investigation is directed by, and reported through, external counsel from the outset.

Forensic Data Preservation

Digital evidence, email servers, enterprise resource planning systems, trade-compliance screening platforms and personal devices, must be preserved forensically. Engage a forensic IT provider to create verified copies before any review. Document the chain of custody meticulously. Any alteration or deletion of data after a company becomes aware of an investigation can constitute a separate offence and significantly worsen enforcement outcomes.

Evidence Preservation and Privilege Risk

Cross-Border Data and Third-Party Counsel

Where investigations span multiple jurisdictions, as many sanctions cases do, companies must coordinate privilege protocols across legal systems. Information shared with counsel in one jurisdiction may not be protected in another. A cross-border privilege matrix, prepared at the outset by lead counsel, prevents costly mistakes. Data-transfer requirements under the GDPR add a further compliance layer when moving employee data or communications across borders for review.

Documenting Decisions

Every material decision during an internal investigation, from the choice of scope to cooperation strategy, should be recorded contemporaneously under privilege. If the company later chooses to self-report or to present its cooperation to a court, this record demonstrates good faith and responsible governance. Failure to document creates a vacuum that prosecutors may fill unfavourably.

Mitigation, Compliance Programmes and Remediation That Reduce Criminal Exposure

Companies that can demonstrate a genuine, functioning sanctions compliance programme may see materially different enforcement outcomes, both in terms of whether proceedings are initiated and in the severity of any penalties. Sanctions compliance reduces criminal risk in a direct and measurable way.

A credible programme should include, at minimum:

• Risk assessment. Identify sectors, geographies, counterparties and product categories that carry elevated sanctions risk.
• Sanctions screening. Implement automated screening of all counterparties, beneficial owners and transactions against EU consolidated lists and, where relevant, OFAC lists.
• Due diligence on third parties. Conduct enhanced due diligence on agents, distributors and intermediaries, especially those in high-risk jurisdictions.
• Escalation procedures. Define clear escalation paths from operational staff to compliance, legal, the board and external counsel.
• Training. Deliver regular, role-specific training to all personnel with exposure to sanctions-relevant activities.
• Audit and testing. Conduct periodic internal audits of compliance controls; engage external reviewers where appropriate.
• Reporting and record-keeping. Maintain detailed records of all screening results, escalation decisions and remedial actions.
• Remediation and cooperation. When a breach is identified, remediate promptly, close the gap, discipline responsible parties if appropriate, and cooperate with authorities. Early cooperation and self-disclosure are widely understood to influence enforcement outcomes favourably.

Practical Scenarios: How Sanctions Criminal Liability Applies in Practice

• Inadvertent export. A Finnish manufacturer ships dual-use components to a third country, unaware the end-user is a sanctioned entity. Industry observers expect that a functioning screening programme and prompt self-reporting would significantly reduce the company’s criminal exposure, while the absence of any screening could support an aggravated-offence charge.
• Third-party intermediary evasion. A trading company’s foreign agent routes sanctioned goods through a non-sanctioned intermediary. If the company’s due diligence was inadequate and red flags were ignored, both the company and the responsible director face prosecution for facilitation.
• Director oversight failure. A board receives a compliance report identifying screening gaps but takes no action. The likely practical effect of the 2025 amendments is that each director who received the report and failed to act could face individual criminal liability for negligent breach.

Conclusion and Recommended Next Steps

Criminal liability for sanctions violations in Finland in 2026 is broader, harsher and more actively enforced than at any previous point. The 2025 amendments to the Finnish Criminal Code, implementing the EU Sanctions Criminalisation Directive, have created dedicated offence categories, dramatically increased corporate fines and extended personal exposure to directors and officers who fail to act. With 43 regulation offences recorded by Finnish Customs and at least 26 formal investigations commenced in 2025 alone, the enforcement pipeline is growing. Boards, general counsel and compliance officers should treat sanctions compliance as an immediate governance priority: audit existing programmes, ensure screening and due-diligence protocols meet the new standard, establish privileged investigation protocols and document every oversight decision.

Companies and executives facing an investigation, or seeking to prevent one, should engage specialist criminal defence counsel without delay.

Sources

1. Valtioneuvosto, Maximum amount of corporate fine to rise due to national implementation of sanctions criminalisation offences directive
2. Ulkoministeriö / Ministry for Foreign Affairs, International sanctions
3. Vero.fi, Grey economy & economic crime prevention: current issues
4. Castrén & Snellman, Stricter penalties under new sanctions violation regulation
5. Dittmar & Indrenius, Liability for sanctions violations is increasing in Finland
6. Roschier, New and stricter sanctions enforcement laws on the horizon
7. Duane Morris Blog, Finland: 26 investigations into breaches of trade sanctions started in 2025
8. Global Investigations Review, Finland: corporate liability under scrutiny amid environmental and sanctions investigations