In addition to the financial penalty, for each offense the imposition of disqualifying sanctions is further provided; from two to six years where the offense is committed by top management, and from one to three years where it is committed by subordinate personnel.
3) Impacts on companies and takeaways
The expansion of entities’ liability risk for offenses introduced by the new Decree requires a comprehensive reassessment and strengthening of the internal control system, by integrating in a cohesive manner the “sanctions and export controls” area into the control framework and into the organization, management, and control model provided for under Decree 231 (“Model 231”). Particular attention should be paid by parent companies established in the European Union to their foreign branches or subsidiaries with respect to sanctions risk.
Under the exemption mechanism, based on an adequate and effective Model 231, the role of the Supervisory Body on training and monitoring remains unchanged. However, the bar of eligibility is significantly raised: the sanctioning perimeter extends along the export, finance, logistics, procurement, and professional services supply chains, with risk profiles that are also extraterritorial and potential hypotheses of complicity in the crime.
Overall, companies are thus exposed to a double risk front: criminal for individuals, and criminal liability for entities pursuant to Decree 231, with financial penalties anchored to turnover and serious disqualification measures.
3.1) The update of Model 231: operational priorities for risk mapping and management
Companies operating in sectors potentially at risk (such as, among others, finance and insurance, energy, international trade and manufacturing, transport, and logistics and shipping) should map the potential risk areas for committing these type of crimes as soon as possible, and consequently update their Model 231 to reflect these risks and formalize the control safeguards. In particular, companies should undertake the following:
- Specific risk assessment: carry out a specific assessment of the risk profile covering countries, product/service portfolios, sales channels, and counterparties, clearly distinguishing the different critical issues: Designated Subjects, high-risk countries and sectors, dual-use and military goods, financial and non-financial prohibitions, etc.
- Mapping and classification of products/services: establish customs and dual-use classification processes, determine the export control classification numbers/ items relevant to the EU lists and applicable regulations, and keep evidence of the technical-legal assessment carried out.
- Governance and accountability: define the roles of the corporate bodies and corporate business functions involved in the processes and controls with formalized escalation procedures for the management of critical issues and the involvement of the Supervisory Body.
- Licenses, waivers, and authorizations: develop structured procedures for the application, management, and monitoring of authorizations, including segregation of duties and the application of the four eyes principle in the process.
- Documentability, traceability, and adequate archiving: keep the documentation relating to screening, risk assessment, classifications, licenses, authorizations, decisions, and periodic audits in an orderly and complete manner.
- Sanctions screening/due diligence: carry out: (i) checks, during onboarding and contractual execution, on customers (including distributors and agents), suppliers, partners, and their respective beneficial owners, verifying their presence on the sanction list; (ii) screenings of individual operations and transactions to identify red flags (e.g., those related to the use of distributors or agents, nature of end customers, banking institutions involved, payment methods, possible circumvention through third countries or interposed parties); and (iii) define the cases that require Enhanced Due Diligence (such as opaque ownership structures or the inclusion of additional third parties in the operational chain).
- Beneficial ownership and avoidance: strengthen checks on beneficial ownership and de facto control of counterparties and assets, with policies that prohibit structures or schemes aimed at concealing the availability of funds or assets of Designated Subjects and ensure the traceability of decisions.
- Transaction monitoring and blocking of transactions: define thresholds, rules and alerts to block payments, shipments, and services in the presence of suspicious or prohibited transactions.
- Audit program: schedule periodic audits, with a frequency proportionate to the level of risk, on the sensitive processes and controls implemented.
- Management of third parties and contractual remedies: structure or strengthen the due diligence process on relevant third parties, as well as providing contractual clauses on “sanctions and export controls” with audit rights and termination rights to prevent the risk of secondary liability or concurrence.
- Information flows: provide ad hoc information flows on export control to the Supervisory Body.
- Targeted training: activate differentiated training programs for the most exposed functions (export, sales, compliance and legal, supply chain, and finance), with practical cases, continuous updating, and testing of learning.
- Whistleblowing provisions: make confidential internal channels available for reports relating to the violation of restrictive measures of the European Union and, consequently, update the relevant documentation (Model 231, whistleblowing policies, and corporate websites) to reflect this novelty.
3.2) Compliance in the context of groups and the obligation of best effort
In light of the new offenses introduced by the Decree and the related reflections on the provisions of quasi-criminal liability of entities pursuant to Decree 231, European Union companies with subsidiaries in third countries must implement ad hoc measures to prevent the risk of sanctions and the risk of “rising” liability for acts committed by their subsidiaries.
In this context, it should be noted that in the event that a European Union company is aware that the activity of a subsidiary in a third country affects the restrictive measures of the European Union, the European parent entity may be held liable for a violation of Article 8-bis of Regulation (EU) No. 833/2014 (the “best effort rule”), for not having taken all the necessary and possible actions in order to prevent the violation by the subsidiary.
At the same time, failure by the European operator to carry out all necessary and possible actions may also constitute a violation of Article 12 of the same Regulation. This is because the exemption from liability occurs only if the European operator was not aware, nor had any reasonable reason to suspect, that the actions of the subsidiary would have violated the restrictive measures set out in Regulation (EU) No. 833/2014.
Conclusion
In conclusion, the Decree transposing EU Directive 2024/1226 significantly raises the expected level of internal control of entities operating in Italy on sanctions, export controls, and restrictive measures. The sanctioning lever pursuant to Decree 231, anchored to global turnover and significant prohibitions, makes it essential to promptly and substantially update Model 231 and the control measures, requiring a truly integrated approach between the various corporate functions involved (including legal, compliance, risk management, finance, and procurement).
