EU Russia Sanctions: Compliance After the Latest Packages

Russia sanctions compliance in 2026: the short answer

EU Russia sanctions are no longer a list of prohibitions that companies can check transaction by transaction. Since the 12th and 14th packages, Council Regulation (EU) No 833/2014 requires EU exporters to build sanctions protection into their contracts, to assess and document the risk that sensitive goods reach Russia through third countries, and to use their best efforts to ensure that subsidiaries outside the EU do not undermine the measures. The 20th package of 23 April 2026 and the 21st package of 23 July 2026 extended listings, transaction bans and anti-circumvention tools further. In Germany, breaches are prosecuted as criminal offences under § 18 of the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG), and companies face fines of up to EUR 40 million.

This article summarises the obligations that matter most for German companies in late 2026: the recent packages, the no-Russia clause in Article 12g, the due diligence duties for common high priority items, the best-efforts obligation for subsidiaries and the enforcement framework in Germany. Because the Council continues to adopt new measures, every compliance assessment must be checked against the latest consolidated text of Regulation 833/2014 and Regulation 269/2014.

The latest Russia sanctions packages

The two packages adopted in 2026 for which the Commission and the European External Action Service have published summaries illustrate the direction of travel: more listings, more transaction bans against third-country actors and new tools against circumvention.

The 21st package also allows courts and authorities in Member States to refuse recognition and enforcement of Russian court rulings in cases involving EU restrictive measures. For German companies facing claims by Russian counterparties in Russian courts, this complements the rights under Articles 11a and 11b of Regulation 833/2014 to recover damages caused by such proceedings before EU courts.

The no-Russia clause under Article 12g

Article 12g of Regulation 833/2014, introduced by the 12th package (Regulation (EU) 2023/2878), requires exporters selling, supplying, transferring or exporting certain goods to third countries to prohibit contractually the re-export to Russia and re-export for use in Russia. Since 20 March 2024 the obligation applies to new contracts; legacy contracts benefited from a transition period that ended no later than 20 December 2024.

• Goods covered. Goods and technology in Annexes XI, XX and XXXV (aviation and space, jet fuel), common high priority items in Annex XL and firearms and ammunition under Regulation 258/2012.
• Countries excluded. Partner countries listed in Annex VIII, which apply equivalent export controls.
• Remedies. The contract must provide adequate remedies for breach, such as termination and contractual penalties (Article 12g(3)).
• Reporting. Exporters must inform the competent authority as soon as they become aware of a breach by the counterparty (Article 12g(4)). In Germany, that is the Federal Office for Economic Affairs and Export Control (BAFA).

Article 12ga extends the same logic to intellectual property. Since 26 December 2024, licences and transfers of IP rights or trade secrets relating to common high priority items must prohibit their use for goods destined for Russia.

Russia sanctions due diligence for high priority items

Article 12gb, inserted by the 14th package (Regulation (EU) 2024/1745), turned due diligence from good practice into law. Since 26 December 2024, companies that sell, supply, transfer or export common high priority items listed in Annex XL must:

1. take appropriate steps, proportionate to their nature and size, to identify and assess the risk of export to Russia or for use in Russia, and document and update those risk assessments; and
2. implement appropriate policies, controls and procedures to mitigate and manage those risks, whether identified at company, Member State or EU level.

The duty does not apply to companies that sell such items only within the EU or to partner countries. EU parent companies must also ensure that non-EU entities they own or control and that trade in high priority items implement the same measures (Article 12gb(3)), unless they cannot exercise control for reasons they did not cause themselves.

In practice, Russia sanctions due diligence means screening customers and ultimate owners against EU lists, checking red flags such as new customers in transit hubs, unusual payment routes, implausible end-uses and requests to change shipping documents, and following the Commission's guidance on high-risk items and the published lists of third-country entities.

Best efforts for subsidiaries outside the EU

Article 8a of Regulation 833/2014 requires natural and legal persons to "undertake their best efforts" to ensure that legal persons established outside the Union that they own or control do not participate in activities that undermine the restrictive measures. The provision does not extend EU prohibitions to non-EU subsidiaries as such, but it obliges the EU parent to take reasonable and proportionate steps within its control.

For German groups with subsidiaries in Türkiye, Central Asia, the Caucasus, the United Arab Emirates or China, best efforts typically include group-wide sanctions policies, screening tools, approval requirements for sales of sensitive goods, training, audit rights and escalation procedures. Board minutes and internal audit reports should show that the parent exercised these controls. A parent that tolerates obvious circumvention through its subsidiary risks not only a breach of Article 8a but also criminal investigations of its managers.

Enforcement of Russia sanctions in Germany

Germany prosecutes breaches of EU sanctions as criminal offences. Under § 18(1) AWG, intentional breaches of directly applicable EU sanctions prohibitions are punishable by imprisonment from three months to five years, with higher penalties for particularly serious cases, commercial or gang activity. Germany transposed the EU Directive on criminal offences for violations of restrictive measures (Directive (EU) 2024/1226) through an act adapting criminal offences and sanctions, which revised §§ 18 and 19 AWG. The consolidated text now includes:

• offences covering the provision of legal, accounting, tax, IT and other prohibited services and of crypto-wallets;
• reckless (leichtfertig) breaches involving listed dual-use goods (§ 18(8a) AWG);
• a maximum corporate fine of EUR 40 million for intentional offences under § 18(1) AWG and for related supervisory failures under § 130 OWiG (§ 19(7), (8) AWG).

BAFA is responsible for licences and reporting on goods, the Deutsche Bundesbank for financial sanctions (§ 13 AWG), and customs authorities and public prosecutors investigate breaches. The Sanctions Enforcement Act (Sanktionsdurchsetzungsgesetz, SanktDG) created a Central Office for Sanctions Enforcement with powers to trace and secure frozen assets and imposes reporting duties on listed persons.

Existing contracts, force majeure and claims

New packages regularly affect contracts that were lawful when signed. Where a prohibition applies, performance is legally impossible, and German contract law generally releases both parties from their primary obligations (§ 275 of the Civil Code). Many contracts also contain sanctions or force majeure clauses that define notice periods, suspension rights and termination. Before relying on them, companies should check whether the relevant package contains a wind-down period for pre-existing contracts and whether a licence for the execution of legacy contracts is available from BAFA or the Bundesbank.

Article 11 of Regulation 833/2014 bars claims by Russian persons and listed entities in connection with contracts affected by the sanctions, and Articles 11a and 11b give EU companies a right to recover damages caused by proceedings brought against them in third-country courts. These provisions are relevant when Russian counterparties sue in Russian courts, which have repeatedly asserted exclusive jurisdiction over sanctions-related disputes. Companies should document the sanctions basis for every suspension or termination to support later defences.

Payments and banks

Even where the goods are not restricted, payments can fail. Transaction bans against Russian and third-country banks and crypto service providers mean that payment routes must be screened as carefully as customers. Banks in Germany apply their own risk policies and may refuse transactions with links to high-risk jurisdictions, so payment terms and the identity of paying banks should be agreed in advance.

Building a Russia sanctions compliance programme

A defensible programme in 2026 typically covers the following elements:

• Classification. Classify products against Annex XL, the dual-use list and other annexes using customs tariff codes and technical data.
• Screening. Screen customers, beneficial owners, banks and logistics providers against EU lists, including third-country entities added in recent packages.
• Contracts. Implement Article 12g and 12ga clauses with remedies, audit rights and termination.
• Group governance. Extend policies to non-EU subsidiaries under Articles 8a and 12gb(3), with documented oversight.
• Change management. Monitor new packages, as the 21st package's crypto and bank measures show how quickly counterparties can become prohibited.
• Incident response. Define how to investigate suspected breaches, report to BAFA or the Bundesbank and assess voluntary disclosure.

Documentation is the thread that runs through all of these elements. Authorities and prosecutors assess whether a company acted with the care that could reasonably be expected, and that assessment relies on what the company can show: dated risk assessments, screening logs, signed clauses, training records and decisions on red flags. A programme that exists only as a policy document offers little protection when a shipment turns up in Russia.

Illustration: a hypothetical German machine-tool supplier sells CNC components listed in Annex XL to a distributor in Kazakhstan. It needs a signed no-Russia clause with remedies, a documented risk assessment, end-use checks on the distributor's customers and a procedure for reporting a breach. If its Turkish subsidiary sells the same items, the parent must ensure the subsidiary applies the same controls.

How TRW & Co helps with Russia sanctions

We advise German and international companies on Russia sanctions compliance across the supply chain. We classify goods and services, draft and negotiate Article 12g and 12ga clauses, design risk-based due diligence for high priority items and set up group policies for non-EU subsidiaries. When problems arise, we conduct internal investigations, advise on reports to BAFA and the Bundesbank and defend companies and individuals in proceedings under the AWG. Our work connects with our export control and sanctions and white-collar defence practices. Read more about sanctions enforcement in Germany and dual-use export controls. To review your sanctions set-up, contact us.