After publishing a draft implementing decree (Atto del Governo n. 317) (see our previous blog post here), Italy has now approved final legislation (Legislative Decree No. 211 of 30 December 2025) implementing Directive (EU) 2024/1226 which enter into force on 24 January 2026, significantly changing the criminal enforcement landscape in relation to EU sanctions violations.
Legislative Decree No. 211/2025 increases criminal liability risks, particularly in respect of EU sanctions compliance, for companies (under Legislative Decree 231/2001) operating in Italy, as well as natural persons only, and should cause companies to reassess internal controls and escalation processes related to EU sanctions compliance.
Underlying compliance obligations do not materially differ from Directive (EU) 2024/1226 in that Legislative Decree No. 211/2025:
- criminalises intentional violations of EU restrictive measures;
- criminalises negligent violations in specific circumstances; and
- does not introduce additional substantive sanctions prohibitions in addition to those under the EU sanctions framework.
However, as anticipated during the legislative process, the most substantial change concerns the structure and proportionality of penalties for violations, together with the fact that companies are now subject to corporate criminal liability for EU sanctions violations (if committed in their benefit by individuals on behalf of the company). For the most serious violations, companies may now be subject to:
- criminal monetary fines ranging from 1% to 5% of their total global turnover, calculated based on the financial year preceding the offence; or
- criminal monetary fines of up to EUR 40 million where turnover cannot be determined.
These thresholds far exceed the previous maximum under Legislative Decree 231/2001 (EUR 1,549,000) and introduce a level of exposure similar to other EU regulatory regimes. Fines may also be increased by one‑third in the event of repeated violations.
In addition to criminal monetary fines, the following collateral penalties may be imposed on companies for up to six years (where offences are committed by individuals in leading positions), including:
- suspension or withdrawal of licenses or authorisations;
- exclusion from public funding, tender procedures, grants and concessions;
- prohibition from advertising goods or services; and/or
- judicial winding‑up.
Obviously, such collateral penalties materially affect business continuity and operational planning.
Legislative Decree No. 211/2025 also expands the scope of the whistleblower protection framework. Such whistleblower protections now expressly apply to individuals reporting:
- violations of EU sanctions introduced in the new Chapter I‑bis of the Criminal Code; and
- violations referred to in Article 12(1‑bis) of Legislative Decree No. 286/1998 (violations of a prohibition, obligation, or restriction imposed by an EU restrictive measure, or by national laws implementing an EU restrictive measure, whereby the entry into the territory of the State of designated individuals is permitted or otherwise facilitated).
This extension further enhances internal reporting obligations and signals heightened enforcement attention.
Given the significant increase in potential exposure under both EU sanctions and Legislative Decree 231/2001, companies should consider the following immediate actions.
- reviewing sanctions compliance frameworks;
- updating/adopting the 231 Model (Modello Organizzativo 231) and the underlying risk assessment; and
- assessing the impact of the new penalty regime on corporate governance and compliance functions.
We would be pleased to assist you in implementing such actions and we will continue to monitor further implementing guidance and enforcement developments.
Please do not hesitate to reach out to the authors of this post should you have any questions or require assistance.
The authors acknowledge the assistance of Federica Fischetti.
