Criminal Defence for International Sanctions and Restrictive Measures

Regulatory Framework

The international sanctions regime has expanded unprecedentedly since 2022 with the successive EU packages against Russia and Belarus, restrictive measures against Iran and North Korea, and the tightening of OFAC secondary sanctions with extraterritorial effect. Every Spanish company operating with clients, suppliers or destinations in sanctioned jurisdictions must comply with the restrictive measures (financial sanctions apply immediately to any natural or legal person: Art. 42.1 of Law 10/2010), which in practice requires systematic screening against restrictive lists and ultimate beneficial owner (UBO) traceability.

At Alonso Sala we defend companies and executives investigated for alleged sanctions evasion, advise on the design of international compliance programs and appeal individual or corporate inclusions in SDN lists, the EU Consolidated List or Annex I.

Criminal Typologies

• Smuggling (Art. 2 LO 12/1995): Export without authorisation of dual-use goods, defence material or goods prohibited by an EU regulation, worth €50,000 or more. 3 to 5 years' imprisonment (upper half of the 1-to-5-year range, Art. 3.1).
• Money laundering (Art. 301 CP): Channelling or conversion of funds deriving from criminal activity (belonging to a listed party is not enough).
• Document forgery (Art. 392 CP): Alteration by private individuals of certificates of origin, bills of lading or customs documents to conceal real destination.
• Cooperation with criminal organisation (Art. 570 bis CP): When evasion is channeled through structured networks.
• Tax offence (Art. 305 CP): Where tax fraud is associated with the operation.

Preventive Compliance

Enhanced due diligence requires three pillars: real-time screening of counterparty, beneficial owner and intermediary bank against EU, OFAC, UN, HMT and OFSI lists; jurisdiction and sector analysis; documentary traceability. Without these pillars operational, the company cannot invoke due diligence in criminal proceedings.

Defence in Evasion Investigations

Defence is built on three axes: absence of intent — demonstrate reasonable screening mechanisms; invincible error — opacity of UBO in offshore jurisdictions may prevent knowledge of sanctioned nature; operative compliance program — invoke, for the legal person, the exemption of Art. 31 bis CP (there is no compliance-based mitigating factor for the individual, although their cooperation may mitigate the penalty under Art. 21 CP).

Appeals Against Listing

Inclusion on the EU Consolidated List can be appealed before the EU General Court (Luxembourg) within 2 months from OJEU publication. The most successful ground is insufficient evidence of the facts justifying inclusion.

An effective compliance model: the six requirements of Art. 31 bis 5 CP applied to EU sanctions

When managing the criminal risk arising from breaches of European Union restrictive measures, having a compliance manual on paper is not enough. Article 31 bis 5 of the Spanish Criminal Code requires the organisation and management model to meet six cumulative requirements before it can produce an exempting effect. First, identifying the activities in which the offence to be prevented may be committed: in sanctions, this means export operations, services to third countries, the supplier chain and payment flows. Second, establishing protocols that set out how the company forms its will, adopts decisions and executes them. The model's suitability is measured against the specific risk, not in the abstract.

The third requirement imposes adequate financial-resource management models to prevent the offence, which in sanctions matters translates into controls over payments, collections and fund routes that could benefit listed persons or entities. The fourth is the duty to report possible risks and breaches to the body charged with overseeing the model. The fifth, a disciplinary system that adequately sanctions non-compliance with the model's measures. The sixth, periodic verification of the model and its amendment when relevant infringements come to light or circumstances change, which is especially sensitive because sanctions regimes are updated frequently.

For these requirements to have an exempting effect, the model must have been adopted and effectively implemented before the offence was committed (Art. 31 bis 2 CP). A formally correct but unapplied programme does not protect the legal entity, and one introduced after the events can only mitigate the penalty if established before the trial (Art. 31 quater d CP). Screening against sanctions lists, the traceability of due diligence on clients and end destinations, and targeted training of exposed staff are elements the court will weigh in deciding whether the model was genuinely suitable and alive. Our work is to build and document that effectiveness so it can be proven before a court.

The autonomous oversight body and the compliance officer

Article 31 bis 2.2 CP conditions the exemption on the supervision of the model's operation and observance having been entrusted to a body with autonomous powers of initiative and control. This autonomy is the core of the system: the compliance officer or the committee assuming the function must be able to access information, gather documentation and raise alerts without depending on those who carry out the high-risk operations. In sanctions matters, that body oversees list screening, the updating of applicable regimes and the response to matches or red flags in foreign-trade operations.

Autonomy requires resources, direct access to the management body and a position that avoids conflicts of interest. An oversight body that lacks resources, does not receive relevant information or is subordinate to the business areas will struggle to convince a court that the model was effectively implemented. The function may be internalised or, in small legal entities, assumed by the management body itself as Article 31 bis 3 CP permits, but the feature of autonomy must be preserved in every case.

The scope of the compliance officer's duties and their relationship with the directors should be defined precisely, because the preventive effectiveness and the legal position of each participant in any investigation depend on that allocation. We advise on the design of the body's charter, its reporting protocols, its functional independence and the documentation of its oversight activity, which is the evidence that supervision was not merely nominal.

The company under investigation: its own procedural status, the burden of proving the exemption and conformidad

When proceedings are directed against the legal entity, it acquires its own procedural status as an investigated party, distinct from that of natural persons. It has the right to an autonomous defence, to appoint a representative in the proceedings and to exercise all the guarantees of a party facing an accusation, including the right not to incriminate itself. The liability of the legal entity is autonomous from that of the natural person: under Article 31 ter CP, the company may be held liable even where the specific natural person who carried out the act cannot be identified or proceeded against.

A decisive technical point is who must prove the suitability and effectiveness of the compliance model. The company's defence is built by showing that the model existed, was adequate to the risk and was genuinely implemented before the offence, which requires gathering and organising documentary evidence: minutes of the oversight body, training records, list-screening results, audits and periodic reviews. Preparing that evidentiary file in advance is what turns a paper model into a solid defence.

The legal entity may also consider its own conformidad, independent from that of the accused natural persons and with its own representative. Choosing between asserting the compliance-based exemption, arguing for the Article 31 bis mitigation or exploring a conformidad requires a case-by-case analysis of the evidence, of exposure to the penalties of Article 33.7 and of the reputational and business-continuity consequences. We accompany the company in that strategy from the first moment of the investigation.

Penalties under Art. 33.7, succession under Art. 130.2 and M&A operations

The penalties applicable to a legal entity are those of Article 33.7 CP and do not follow the scheme used for natural persons. They include a fine by daily quotas or proportional fine, dissolution of the legal entity, suspension of activities, closure of premises and establishments, a prohibition on carrying out in the future the activities in whose exercise the offence was committed, disqualification from obtaining subsidies and public aid, from contracting or from enjoying tax or social-security benefits and incentives, and judicial intervention. This is why risk analysis in sanctions matters is not measured in years of imprisonment, but by the impact of these consequences on the company's continuity and operations.

Article 130.2 CP provides that the criminal liability of a legal entity is not extinguished by its transformation, merger, absorption or division: liability transfers to the resulting or absorbing entity or entities. Nor is it extinguished by a covert or merely apparent dissolution, which is found when the economic activity continues and the substantial identity of clients, suppliers and employees is maintained. This means a corporate restructuring does not erase a latent criminal exposure.

The practical consequence is of the first order in M&A operations. Criminal due diligence prior to an acquisition or merger must detect contingencies arising from possible breaches of sanctions regimes and from smuggling offences, because they can travel with the operation to the resulting entity. We advise on identifying these contingencies, on contractual safeguards and on integrating the compliance models of the entities involved so that succession does not transfer an unmanaged risk.