Russia sanctions: is the parent company answerable for its non-EU subsidiary?

This post is also available in:

EU sanctions apply within the Union and to EU nationals and companies. A subsidiary established in Dubai, Istanbul or Almaty is not, as such, bound by them. Since 2024, however, its EU parent company must do “its best” to ensure that it does not undermine the sanctions against Russia.

Where does the obligation come from?

The 14th sanctions package, adopted on 24 June 2024, inserted Article 8a into Regulation No 833/2014, which contains the economic and sectoral sanctions. The 16th package, adopted in February 2025, inserted an equivalent provision, Article 15a, into Regulation No 269/2014, which governs the asset freeze.

The text is short: EU persons and entities must undertake their best efforts to ensure that legal persons established outside the Union that they own or control do not participate in activities that undermine the restrictive measures.

Who is covered?

The obligation lies with the EU company, not with the foreign subsidiary. It applies to subsidiaries the company owns or controls, under the usual sanctions criteria: a holding of 50% or more, or effective control (see the 50% rule and the notion of control).

A minority stake without control is not covered. Nor is a sister company held by a non-EU holding.

What should be done in practice?

The Commission published FAQs on Article 8a on 22 November 2024. It describes an obligation tailored to the company’s size, resources, sector and degree of control over the subsidiary. Expected measures include:

• internal compliance policies and procedures applicable to the subsidiary;
• a risk assessment specific to its business and customers;
• vigilance on transactions and counterparties;
• informing the subsidiary about EU sanctions;
• where relevant, blocking the use of intellectual property or trade secrets that could be used to circumvent the sanctions.

An obligation of means

The parent company does not guarantee its subsidiary’s conduct. The obligation is not absolute. According to the Commission, its liability may be assessed differently if it lost control of the subsidiary for external reasons, such as restrictive local legislation, provided that loss of control was not due to its own negligence.

In practice, the question will always be the same: what did the parent company do, and when? A compliance programme that is actually applied, documented controls and traceable decisions are the best defence.

And banks?

A Belgian bank with a subsidiary or branch outside the Union is directly concerned. For a branch, the question arises differently: it is part of the bank, which is itself bound by the sanctions.

Banks are also concerned as lenders to, and partners of, companies with non-EU subsidiaries.

What penalties?

Penalties for breaching restrictive measures are set by each Member State. Belgium transposed Directive (EU) 2024/1226, which harmonises the criminal offences in this field, by a law of 15 July 2026, whose main provisions enter into force on 1 September 2026. On our reading, a failure to meet the best efforts obligation falls within the “other obligations imposed” by restrictive measures: it may give rise to an administrative fine of up to EUR 25 million for a legal person.

Situation at 5 August 2026. This article is for general information only and does not constitute legal advice.