Criminal Liability for Breaching EU Sanctions in France (2026): What Companies and Directors Must Do Now

The question of EU sanctions France liability has moved from a background compliance concern to an urgent boardroom priority. On 3 March 2026, the French government introduced a bill to transpose and strengthen the EU Sanctions Enforcement Directive, signalling expanded criminal penalties for companies and individuals who breach EU restrictive measures on French soil or through French nationals abroad. Coupled with the March 2026 National Anti-Corruption Plan, which explicitly links sanctions enforcement to broader financial-crime strategy, the legislative push creates immediate exposure for general counsel, compliance officers and directors overseeing international operations. This article provides the France-specific legal analysis, penalty framework and operational playbook that compliance teams need right now.

Executive Summary: Five Urgent Actions for 2026

France already criminalises violations of EU sanctions under Article 459 §1bis of the Code des douanes. The proposed 2026 bill, however, would raise maximum penalties, introduce turnover-based corporate fines aligned with the EU Directive and expand the scope of prosecutable conduct to include negligent circumvention. At the same time, the Parquet National Financier (PNF) has signalled a more assertive posture on sanctions investigations, and TRACFIN, France’s financial intelligence unit, has increased its reporting expectations for entities handling sanctions-sensitive flows.

Industry observers expect French authorities to ramp up enforcement actions through 2026 and 2027 as the transposition deadline approaches. Early indications suggest that directors of French companies, and French nationals serving on boards of non-EU subsidiaries, face a heightened personal risk profile that did not exist even two years ago.

Companies operating in or through France should take five immediate steps:

• Audit sanctions screening. Verify that all customer, supplier and counterparty screening covers current EU consolidated lists and is updated within 24 hours of list amendments.
• Review licence status. Confirm whether any ongoing transactions require a DG Trésor licence and whether existing authorisations remain valid.
• Establish escalation protocols. Ensure that any potential match or red flag is escalated to legal counsel within a defined timeframe, not buried in operations.
• Conduct an internal review. Map all sanctions-sensitive flows (trade, finance, technology transfers) and assess exposure under both current and proposed French law.
• Engage specialist counsel. The interaction between French sanctions law, EU Regulations and sector-specific rules demands expert guidance tailored to the company’s risk profile.

EU Sanctions France Liability: The Legal Framework

Understanding the legal hierarchy is essential for any corporate sanctions compliance programme operating in or touching France. Three layers of law interact: EU Regulations that are directly applicable across all Member States, the EU Sanctions Enforcement Directive that harmonises criminal offences and penalties, and French domestic law that implements and supplements both.

EU Directive Requirements

The EU Sanctions Enforcement Directive requires all Member States to ensure that violations of EU restrictive measures constitute criminal offences punishable by effective, proportionate and dissuasive penalties. According to the EUR-Lex summary of the Directive, an intentional violation of sanctions must give rise to imprisonment as the maximum penalty, with a minimum of five years’ imprisonment for certain offences. Companies or other legal bodies can be held criminally or non-criminally liable, with maximum fines of at least 5% of worldwide turnover or €40 million. The Directive also mandates that Member States define aggravating and mitigating factors, and it requires that both natural and legal persons can be held accountable for aiding, abetting or attempting sanctions breaches.

Crucially, the Directive does not introduce a blanket strict liability standard. In certain instances, particularly concerning procedural and administrative mandates, the EU’s sanctions regime may reflect a strict liability approach. However, the criminal offences under the Directive generally require intentional conduct, although Member States retain discretion to criminalise negligent or reckless behaviour in transposition.

French Implementing Law: Current Rules and the 2026 Bill

French sanctions law already contains comprehensive criminal offences. Article 459 §1bis of the Code des douanes criminalises violations of EU restrictive measures, including asset freezes, trade embargoes, and prohibitions on making funds or economic resources available to designated persons. Current penalties include up to five years’ imprisonment and confiscation of the goods or funds involved. Under Article 121-2 of the French Criminal Code, all legal persons (excluding the State itself) may be held criminally liable for offences committed on their behalf by their organs or representatives.

The bill introduced on 3 March 2026 proposes several significant changes. The likely practical effect will be to align French penalties with the EU Directive’s minimum thresholds, introduce turnover-based fines for corporate offenders, and broaden the definition of punishable conduct to cover certain negligent failures to implement effective sanctions controls.

Who Enforces EU Sanctions in France and How Investigations Start

Multiple French authorities share responsibility for sanctions enforcement. Understanding which body does what, and how sanctions investigations are typically triggered, is critical for companies managing compliance risk or responding to a suspected breach.

The Enforcement Map

The Direction générale du Trésor (DG Trésor) is the primary administrative authority responsible for implementing EU and UN sanctions in France. It manages the national asset-freeze list, processes licence applications and coordinates with the European Commission. The Direction générale des douanes et droits indirects (DGDDI), French customs, enforces trade-related sanctions, conducts border inspections and can initiate seizure proceedings. TRACFIN, the French financial intelligence unit housed within the Ministry of Economy, receives and analyses suspicious transaction reports (STRs) from obliged entities, including those related to sanctions circumvention. When financial markets or regulated institutions are involved, the Autorité des marchés financiers (AMF) and Autorité de contrôle prudentiel et de résolution (ACPR) may also intervene.

For criminal prosecution, the Parquet National Financier (PNF) has jurisdiction over complex financial crime, including sanctions investigations involving French nationals or companies. As the European Commission has noted, Member States are responsible for identifying breaches and imposing penalties, while the Commission monitors uniform implementation.

How Investigations Typically Start

Sanctions investigations in France usually begin through one of four channels: a TRACFIN alert triggered by a suspicious transaction report from a bank or financial institution; a customs seizure or inspection revealing prohibited goods flows; a whistleblower report or media investigation; or cross-border cooperation with other EU authorities, OLAF, Eurojust or the European Public Prosecutor’s Office (EPPO). Once a criminal referral reaches the PNF, it can open a preliminary enquiry (enquête préliminaire) or request a judicial investigation (information judiciaire), deploying full investigative powers including dawn raids, document seizures and witness interviews.

Liability for Sanctions Breaches in France: Companies vs Directors

A central question for compliance officers concerns who is liable when EU sanctions are breached. French law imposes criminal liability on both legal persons and natural persons, and the two tracks operate in parallel, meaning a company and its directors can be prosecuted simultaneously for the same underlying conduct.

Corporate Criminal Liability

Under Article 121-2 of the French Criminal Code, legal persons are criminally liable for offences committed on their behalf by their organs or representatives. This means that if a sanctions breach is attributable to an act or omission of a company’s board, management committee, or any person exercising delegated authority, the company itself can face prosecution. The corporate sanctions compliance programme is not a statutory defence in the strict sense, but French courts and prosecutors increasingly consider the existence, or absence, of an effective compliance programme as a factor in determining culpability and sentencing.

Industry observers note that the EU Directive emphasises that Member States must ensure legal persons can be held liable for sanctions violations, reinforcing the trend toward robust corporate accountability. While the Directive does not mandate general corporate criminal liability (respecting Member States where such a concept does not exist), France has recognised corporate criminal liability since 1994 and applies it broadly.

Personal Liability for Directors and Officers

French nationals who serve as directors of non-EU subsidiaries face a heightened risk of personal liability for breaches of EU sanctions. Under French law, natural persons can be prosecuted for directly committing, ordering or knowingly facilitating a sanctions breach. Common scenarios that trigger personal exposure include authorising a prohibited shipment to a designated entity, knowingly circumventing an asset freeze by restructuring ownership, or failing to implement sanctions controls despite clear board-level awareness of the risk.

Establishing mens rea remains a critical element. Prosecutors must typically demonstrate that the director acted intentionally or, under the proposed 2026 bill, with gross negligence. Evidence of board minutes discussing sanctions risk, compliance reports flagged but not actioned, and email communications authorising transactions with sanctioned counterparties have all featured in recent enforcement matters across the EU.

Potential Defences

Directors may point to several mitigating factors: the existence and effective operation of a sanctions compliance programme; reliance on a valid DG Trésor licence; documented due diligence on counterparties; and prompt self-reporting upon discovery of a potential breach. None of these constitutes an absolute defence, but each can materially influence the prosecutorial and sentencing outcome.

Penalties for Sanctions Violations in France: Criminal Sanctions for EU Restrictive Measures

The penalties for sanctions violations in France are substantial and set to increase under the proposed 2026 legislation. Understanding the full range of consequences, criminal, financial and reputational, is essential for risk assessment.

The EU Directive specifies that penalties must include minimums for maximum terms of imprisonment for natural persons and that fines may be issued in addition to any sentence of imprisonment. Aggravating factors defined by the Directive include the involvement of a public official, the use of forged documents, and actions that generate substantial financial benefit for the offender. Mitigating factors include prompt cooperation with authorities and effective remediation.

France’s convention judiciaire d’intérêt public (CJIP), a deferred prosecution agreement mechanism, may also apply to certain sanctions cases, offering companies the possibility of resolving criminal liability through a negotiated settlement that includes a public interest fine, compliance undertakings and monitoring. The likely practical effect of the 2026 reforms will be to make CJIPs more common in sanctions cases, mirroring their growing use in anti-corruption matters.

Corporate Sanctions Compliance Playbook: Preventing Breaches

French authorities increasingly expect companies to maintain a robust, documented corporate sanctions compliance programme. The absence of effective controls not only increases the risk of a breach but also reduces the company’s ability to invoke mitigating circumstances if enforcement action follows.

Sanctions Screening and Reporting

Every company with exposure to EU restrictive measures must implement real-time sanctions screening and reporting across all counterparties, customers, suppliers, intermediaries and beneficial owners. Screening tools should be calibrated against the EU consolidated sanctions list, UN sanctions lists, and any sector-specific French restrictions. False positives should be resolved through a documented escalation process, not simply cleared by operational staff. TRACFIN reporting obligations apply to obliged entities (financial institutions, certain professions) that detect suspicious transactions potentially linked to sanctions circumvention.

When to File for an EU Licence vs Refuse

Not every transaction involving a sanctioned jurisdiction or designated person is prohibited. EU Regulations and French implementing measures provide for licences and authorisations that permit certain activities, for example, basic humanitarian payments, legal fees, or pre-existing contractual obligations. The decision tree is straightforward: if a transaction involves a designated person, a sanctioned sector, or a restricted jurisdiction, the compliance team must determine whether an applicable exemption or licence exists, apply to DG Trésor if required, and refuse the transaction if no authorisation can be obtained. Documentation of this analysis is essential.

Additional controls that French authorities expect include: sanctions clauses in commercial contracts (representations, warranties and termination rights); export control liaison with customs for dual-use and military goods; funds-flow monitoring to detect pass-through payments to restricted destinations; and defined escalation thresholds that require sign-off by senior management or the board for transactions exceeding specified risk levels.

Response Playbook: What to Do if You Discover a Sanctions Breach

Discovering a potential breach of EU sanctions triggers a chain of urgent decisions. Acting quickly and correctly in the first 48 hours can make the difference between a manageable compliance incident and a criminal prosecution. This response playbook outlines the critical steps.

Internal Investigation Checklist

The first priority is containment: halt the transaction or activity in question and preserve all relevant evidence, including emails, transaction records, screening logs and board minutes. Engage external legal counsel immediately, internal investigations must be conducted under legal professional privilege to protect the company’s position. The investigation should identify the scope of the breach (single transaction or systemic failure), the individuals involved, the monetary value, and whether designated persons or entities received funds or economic resources.

• Step 1: Freeze the activity; do not complete or reverse the transaction without legal advice.
• Step 2: Preserve documents and electronic data; issue a litigation hold.
• Step 3: Notify the board or audit committee; ensure legal privilege covers the notification.
• Step 4: Engage external counsel with French sanctions expertise.
• Step 5: Conduct a scoping review to assess the nature, duration and value of the breach.

TRACFIN vs Self-Reporting vs Remedial-Only: Decision Framework

If the company is an obliged entity under French anti-money laundering regulations, a suspicious transaction report to TRACFIN may be legally required. Beyond mandatory reporting, companies may consider voluntary self-disclosure to DG Trésor or the PNF. Self-reporting does not guarantee immunity, but it is recognised as a significant mitigating factor in French enforcement practice and is a prerequisite for accessing the CJIP settlement pathway in many cases. A remedial-only approach, fixing the problem without reporting, carries the risk that the breach will be discovered independently, at which point the failure to self-report becomes an aggravating factor.

Managing Communications and Board Reporting

Directors should be briefed through privileged channels. Board communications should document the discovery, the immediate containment actions, the investigation plan and the timeline for resolution. A template board memo should include: the date of discovery, the nature of the suspected breach, the steps taken to contain it, the status of the internal investigation, whether external reporting is required or recommended, and the remediation plan.

Practical Checklists and Templates

Board Escalation Checklist (5 items):

• Has the suspected breach been contained and the transaction halted?
• Has external counsel been engaged under legal privilege?
• Has the audit committee or board been notified through privileged channels?
• Has a scoping assessment been initiated to determine the value and scope of the breach?
• Has a preliminary decision been made on TRACFIN reporting or voluntary self-disclosure?

Internal Investigation Quick Checklist (10 steps):

1. Issue a litigation hold on all relevant documents and data.
2. Identify the transactions and counterparties involved.
3. Determine whether designated persons or entities received funds or resources.
4. Review screening logs and compliance records for the relevant period.
5. Interview key personnel (under privilege) to establish the facts.
6. Assess whether the breach was intentional, negligent, or systemic.
7. Calculate the monetary value and duration of the breach.
8. Evaluate mandatory reporting obligations (TRACFIN, DG Trésor).
9. Prepare a preliminary findings memo for the board.
10. Develop a remediation plan and enhanced controls.

Sanctions Screening SOP: Define screening triggers (onboarding, transaction, list update); assign ownership (compliance officer); set resolution timeframes for matches and escalation thresholds; document all outcomes in an auditable log. Downloadable templates, including a board escalation memo and an internal investigation rubric, will be published as companion resources.

Sources

1. EUR-Lex, Criminal offences and penalties for the violation of EU restrictive measures
2. Légifrance, Code des douanes, Article 459
3. European Commission, Overview of sanctions and related resources
4. Baker McKenzie, France advances first steps to transpose the EU Sanctions Enforcement Directive
5. White & Case, Practical and legal implications in France
6. Global Investigations Review, A closer look at sanctions in France
7. TRACFIN, French financial intelligence unit
8. Freshfields, The EU moves to harmonise criminal liability for sanctions breaches