The Long Arm of EU Sanctions? Latest EU Sanctions on Russia and Belarus Extend to Non-EU Subsidiaries and Introduce Mandatory Risk Assessment

July 3, 2024

Many multinational companies based in or operating in the European Union will need to restructure their sanctions compliance programs to avoid potential sanctions violations and enforcement risks going forward.

Amidst a plethora of new restrictions on specific goods, vessels and parties, the EU’s 14th package against Russia (June 24, 2024) and latest Belarus sanctions (June 29, 2024) include a few fundamental changes in the territorial reach and substantive design of EU sanctions bolstering the EU’s anti-circumvention toolbox. Many multinational companies based in or operating in the European Union will need to restructure their sanctions compliance programs to avoid potential sanctions violations and enforcement risks going forward.

1. New Provision Changes the Reach of Russia Sectoral Sanctions as regards Non-EU Subsidiaries of EU Entities

According to the new Article 8a of Regulation (EU) 833/2014 (“Reg 833/2014”), EU companies shall undertake their best efforts to ensure that any non-EU company they own or control (“Non-EU Subsidiary”) does not participate in activities that undermine EU sectoral sanctions against Russia under Reg 833/2014.

This provision changes the treatment of Non-EU Subsidiaries under EU sanctions. To date, companies have been relying on general jurisdictional provisions laid down in each EU sanctions regulation (such as Article 13 of Reg 833/2014), according to which non-EU companies shall comply with EU sanctions only “in respect of any business done in whole or in part within the EU.” If a non-EU company maintained no nexus to the EU territory in its operations, it would not be obliged to comply with EU sanctions, even if it was a subsidiary of an EU company. In turn, as per Consolidated FAQs of the European Commission, the EU parent company was bound only in respect of its own actions, for example if clearing/green-lighting decisions taken by the Non-EU Subsidiary. It was understood that the EU parent company would not incur any liability for an independent conduct of a Non-EU Subsidiary it did not have any impact on. A similar understanding of who can be liable for sanctions violations is in fact common to many Western sanctions jurisdictions.

The new provision of Article 8a of Reg 833/2014 changes these dynamics. Remarkably, the jurisdictional provisions of Article 13 remain intact despite the amendment, so that non-EU companies doing business entirely outside the EU continue to be not subject to EU jurisdiction – this allows the EU legislator to uphold its regular claim that EU sanctions are never extraterritorial. However, the new provision of Article 8a forces EU parent companies, in order to avoid direct liability risks for themselves, to ensure that their Non-EU Subsidiaries practically comply with EU sanctions.

The new provision already instilled a debate of its enforceability as the “best efforts” requirement is seen to be too vague. Criminal liability will ultimately be defined by the interplay of Member State criminal laws and EU sanctions regulations, and in this respect, Article 8a might open the door for criminal enforcement agencies to prosecute EU companies in connection with the conduct of Non-EU Subsidiaries. One liability option seems to be that sanctions-undermining activities of a Non-EU Subsidiary would be attributed to the EU parent company as its own sanctions violation, if such an attribution is possible under criminal or administrative laws of the respective Member State. Alternatively, the executives of the EU parent company could be exposed to the criminal liability “by omission,” as for example practiced in German or Dutch legal systems. The respective offense would be a sanctions violation by virtue of failure to undertake necessary measures within the meaning of Article 8a of Reg 833/2014. In this regard, the widespread understanding that EU companies and their executives are not obliged (in a sense of a “guarantor’s duty” or “duty to care”) to ensure EU sanctions compliance in Non-EU Subsidiaries can no longer be upheld, at least in the context of sectoral sanctions against Russia. Instead, diligent and robust policies, procedures and systems should be put in place to avoid to the extent possible conduct by the Non-EU-Subsidiary that could be considered “undermining” EU sanctions.

With regard to the application of the new provision, Recitals 27-30 to Amending Regulation (EU) 2024/1745 provide for helpful clarifications:

“Ownership” and “control” of a non-EU company are defined in the same way as they are for party-based restrictions under financial sanctions; i.e., 50% or more of the proprietary rights for “ownership” and certain rights to exercise decisive influence for “control.”
Activities that undermine EU sanctions under Reg 833/2014 are those resulting in an effect that those restrictive measures seek to prevent. The Recitals use the example that a recipient in Russia obtains goods, technology, financing, or services of a type that is subject to prohibitions under Reg 833/2014, indicating that the prevention of such an outcome is at the core of the new provision of Article 8a.
With regard to the term “best efforts,” the Recitals clarify that:
- “Best efforts” comprise all actions suitable and necessary to achieve the result of preventing the undermining of EU sanctions under Reg 833/2014.
- Those actions can include, for example, the implementation of appropriate policies, controls, and procedures to mitigate and manage risk effectively, considering factors such as the country of establishment, the business sector, and the type of activity of the non-EU company owned or controlled by the EU company.
- At the same time, best efforts should be understood as comprising only actions that are feasible for the EU company in view of its nature, its size, and the relevant factual circumstances, particularly the degree of effective control over the non-EU company. In this context, the situation where the EU company is not able to exercise control over a non-EU company due to the legislation of a third country should be taken into account.

The placement of these clarifications in the Recitals indicates the challenges to find unanimity in introducing unequivocal requirements into the binding provisions of Reg 833/2014, so that they rather provide interpretative aid.

Notably, the new provision was adopted only within sectoral (Reg 833/2014) but not within party-based financial sanctions against Russia (Regulation (EU) 269/2014). However, within the new package of sanctions against Belarus adopted a few days later, the new provision with the same wording was added to the Belarus Sanctions Regulation (new Article 8h of Regulation (EU) 765/2006), which covers both sectoral and party-based financial measures.

It remains to be seen whether the new provision becomes a standard for EU sanctions in general. However, at least with respect the EU’s sectoral sanctions on Russia and for the EU’s Belarus sanctions, companies need to act now to extend their EU sanctions compliance programs to cover Non-EU Subsidiaries of EU parent companies.

2. Mandatory Sanctions Risk Assessment for Companies Trading with Common High Priority Items

Starting from the 12th sanctions package against Russia, the EU has begun to introduce novel obligations for companies trading with so called “common high priority items” (“CHPI”), i.e. items used in Russian military systems found on the battlefield in Ukraine or critical to the development, production or use of Russian military systems. In particular, the so called “No Russia Clause” of Article 12g of Reg 833/2014 obliged EU companies trading with CHPI in third countries (except a few partner countries) to contractually prohibit re-exportation to Russia or for use in Russia, and to provide for adequate remedies in the event of a breach of this contractual obligation.

The 14th sanctions package establishes further obligations for such companies. In particular, the new Article 12ga of Reg 833/2014 introduces a so called “No Russia IP Clause” obliging companies to contractually prohibit their third-country counterparts to use or sublicense IP rights and trade secrets in connection with CHPI being delivered to Russia or for use in Russia, and to provide for adequate remedies in the event of a breach of this contractual obligation.

Furthermore, the new Article 12gb of Reg 833/2014 obliges companies in CHPI industries, as of December 26, 2024, to conduct risk assessments as regards exportation to/for use in Russia, to ensure that those risk assessments are documented and kept up-to-date, and to implement appropriate policies, controls and procedures to mitigate and effectively manage such risks. EU persons must further ensure that non-EU companies owned or controlled by them are equally implementing these requirements. The same obligations apply within the framework of EU sanctions against Belarus by virtue of new Article 8ga of Regulation (EU) 765/2006.

This is not the first call for companies to implement such enhanced due diligence procedures at the EU level. On September 7, 2023, the European Commission provided its Guidance on Enhanced Due Diligence to shield against Russia sanctions circumvention, whereas the less detailed Notice 2022/C 145 I/01 called for due diligence measures as early as on April 1, 2022. Article 12gb of Reg 833/2014 is the first provision which transposes these calls into a binding obligation, albeit only for CHPI industries and in respect of CHPI items.

At the same time, Recital 36 to Amending Regulation (EU) 2024/1745 makes it clear that, if an EU operator in any industry failed to carry out appropriate due diligence, in particular on the basis of publicly or readily available information, it may not invoke the protection against liability granted under EU sanctions regulations to those who did not know, and had no reasonable cause to suspect, that their actions would infringe EU sanctions. Therefore, while companies in CHPI industries have no choice but to implement required due diligence mechanisms due to the new provision, companies in other industries can likewise be advised to do so in order to shield against substantial liability risks.

The following Gibson Dunn lawyers prepared this update: Nikita Malevanny, Benno Schwarz, Christopher Timura, Melina Kronester, Vanessa Ludwig, Irene Polieri, and Adam Smith.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. For additional information about how we may assist you, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or the following leaders and members of the firm’s International Trade practice group:

Europe:
Attila Borsos – Brussels (+32 2 554 72 10, [email protected])
Patrick Doris – London (+44 207 071 4276, [email protected])
Michelle M. Kirschner – London (+44 20 7071 4212, [email protected])
Penny Madden KC – London (+44 20 7071 4226, [email protected])
Irene Polieri – London (+44 20 7071 4199, [email protected])
Benno Schwarz – Munich (+49 89 189 33 110, [email protected])
Nikita Malevanny – Munich (+49 89 189 33 224, [email protected])
Melina Kronester – Munich (+49 89 189 33 225, [email protected])
Vanessa Ludwig – Frankfurt (+49 69 247 411 531, [email protected])

United States:
Ronald Kirk – Co-Chair, Dallas (+1 214.698.3295, [email protected])
Adam M. Smith – Co-Chair, Washington, D.C. (+1 202.887.3547, [email protected])
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, [email protected])
Christopher T. Timura – Washington, D.C. (+1 202.887.3690, [email protected])
David P. Burns – Washington, D.C. (+1 202.887.3786, [email protected])
Nicola T. Hanna – Los Angeles (+1 213.229.7269, [email protected])
Courtney M. Brown – Washington, D.C. (+1 202.955.8685, [email protected])
Amanda H. Neely – Washington, D.C. (+1 202.777.9566, [email protected])
Samantha Sewall – Washington, D.C. (+1 202.887.3509, [email protected])
Michelle A. Weinbaum – Washington, D.C. (+1 202.955.8274, [email protected])
Chris R. Mullen – Washington, D.C. (+1 202.955.8250, [email protected])
Sarah L. Pongrace – New York (+1 212.351.3972, [email protected])
Anna Searcey – Washington, D.C. (+1 202.887.3655, [email protected])
Audi K. Syarief – Washington, D.C. (+1 202.955.8266, [email protected])
Scott R. Toussaint – Washington, D.C. (+1 202.887.3588, [email protected])
Claire Yi – New York (+1 212.351.2603, [email protected])
Shuo (Josh) Zhang – Washington, D.C. (+1 202.955.8270, [email protected])

Asia:
Kelly Austin – Hong Kong/Denver (+1 303.298.5980, [email protected])
David A. Wolber – Hong Kong (+852 2214 3764, [email protected])
Fang Xue – Beijing (+86 10 6502 8687, [email protected])
Qi Yue – Beijing (+86 10 6502 8534, [email protected])
Dharak Bhavsar – Hong Kong (+852 2214 3755, [email protected])
Felicia Chen – Hong Kong (+852 2214 3728, [email protected])
Arnold Pun – Hong Kong (+852 2214 3838, [email protected])

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.