Cyprus’s New Sanctions Law: Criminal Penalties for Aiding Sanctioned Entities

On July 25, 2025, the Parliament of the Republic of Cyprus adopted Law No. 149(I)/2025 “On the Criminalization of Violations of the Union’s Restrictive Measures”, which strengthens the mechanisms of criminal liability for non-compliance with sanctions imposed by the European Union.

The essence of this law is not only to establish responsibility for the direct support of individuals and entities included in the EU sanctions lists, but also to criminalize any indirect forms of assistance, circumvention, or consolidation of financial, advisory, technical, or other resources for sanctioned persons.

The law also applies extraterritorially, covering Cypriot citizens and residents, as well as persons whose actions are linked to Cypriot structures, even if such actions are carried out outside the country.

Thus, Cyprus is implementing EU Directive 2024/1226 not merely formally but in a highly substantive manner, effectively changing the rules of the game for international businesses and private individuals operating through Cypriot structures and maintaining relations with Russian sanctioned companies and individuals.

The adoption of the Law was directly related to the implementation of EU Directive 2024/1226, which requires EU Member States to ensure genuine criminal liability for the circumvention of sanctions, primarily those imposed against Russia.

The definition of “assets” subject to restrictive measures under the Law encompasses all forms of financial assets and economic benefits, including cash, receivables and obligations, any securities, investment instruments, derivatives, investment and capital gains, documents evidencing participation rights in capital or financial resources, set-off and claim rights, crypto-assets, and other types of property. Assets are subject to freezing and confiscation, even when they are not the direct result or instrument of a criminal offense.

The key elements of the offenses giving rise to criminal liability are outlined in Article 5 of the Law. These include not only the direct financing or provision of assets to EU-sanctioned persons or entities but also any form of assistance: banking operations, brokerage, consulting, technical or legal services, execution of contracts, work with dual-use goods, and any other schemes of circumvention. The Law emphasizes that even an attempt or organization of a circumvention scheme, concealment of the ultimate beneficiary, or masking of transactions through third parties or legal entities falls under the prohibition.

Importantly, in a number of cases, criminal liability arises not only for intent but also for gross negligence, for example, when dealing with military products or dual-use equipment. Consequently, the Law imposes a due diligence obligation on parties engaged in business activities.

The Law defines types of accomplices and criminalizes incomplete offenses (Article 6). It also lists aggravating circumstances (e.g., use of forged documents, selfish motives, commission of the crime by a public official in the performance of duties) and mitigating circumstances (e.g., cooperation with the investigation).

Severe penalties are established for natural persons convicted of such crimes: fines of up to €100,000 and imprisonment for up to five years. The court may also impose additional sanctions such as license revocation, prohibition from holding managerial or public office, and restrictions on access to certain professions.

Legal entities found guilty face fines ranging from 1% to 5% of their total annual turnover, or up to €40 million if the turnover cannot be determined (Article 8). Other sanctions may include revocation of licenses, temporary or permanent bans on activity, prohibition from conducting business, exclusion from public procurement and state funding, and even liquidation. Notably, if the violation results from a lack of proper control by management, both the company and its officers are held liable (Article 9).

The investigation, enforcement, and monitoring system is highly structured: under Article 13, the special EMEK Unit (National Sanctions Enforcement Unit) and the police are granted extensive powers to coordinate detection of violations and exchange information domestically and with European bodies (Europol, Eurojust). All data on investigations and penalties are collected, transmitted to the European Commission, and periodically published (Article 14), increasing compliance awareness among at-risk persons and companies.

The Law is particularly significant for Russian citizens and businesses holding Cypriot passports, residence permits, or corporate ties. Even maintaining an account in a Russian sanctioned bank or providing intermediary or advisory services to sanctioned persons (legal or natural) may expose individuals to criminal liability under the Law. Unsurprisingly, this has led to heightened scrutiny from banks, financial service providers, and legal advisors, many of whom have already ceased servicing Russian clients, including those formally under Cypriot jurisdiction.

As a result, Cypriot citizens and residents, company owners, and anyone providing services or engaging in activities in the interests of Russian entities or banks will now be required to regularly screen all beneficiaries, clients, and counterparties against EU sanctions lists, terminate suspicious operations, reorganize business structures when even a potential risk is identified, and document these compliance measures. Companies must maintain special registries of relationships and transactions and, when necessary, obtain prior legal opinions confirming the permissibility of operations under current law.

The adoption of the Law marks a shift toward comprehensive and strict prosecution of any facilitation of sanctioned activities, the establishment of elements of extraterritorial liability, and the adoption of preventive measures in international financial and corporate compliance. Under the new conditions, any support, even indirect, of sanctioned persons or entities may lead to criminal prosecution, heavy fines, and even loss of business.