Sanctions compliance means establishing, before money moves or goods ship, that no counterparty, owner, vessel or end user is caught by a restrictive measure, and then freezing and reporting whatever the law says must be frozen and reported. For a business in the Netherlands the binding rules are the directly applicable EU sanctions regulations, enforced nationally through the Sanctiewet 1977; a breach is an economic offence under the Wet op de economische delicten (WED). The provision that catches most companies out is not the list itself but the ownership and control test: an unlisted company is treated as listed as soon as one or more listed parties hold 50 percent or more of it.
What sanctions compliance requires of a business in the Netherlands
Every undertaking established in the Netherlands is bound by EU sanctions, and so is every Dutch national and every business done in whole or in part within Dutch territory. That obligation reaches far beyond exporters and banks. It applies to the haulier who arranges a shipment, the software company that grants a licence, the accountant who issues an invoice, the landlord who lets warehouse space and the shareholder who receives a dividend. Restrictive measures bite on funds and economic resources, on goods and technology, and on an expanding list of services.
Reduced to its essentials, the duty consists of four recurring obligations. You must know who you are dealing with, including who ultimately owns and controls them. You must know what you are supplying and where it will actually end up. You must stop and freeze the moment a match appears, rather than after you have taken advice. And you must report, to the authority the regulation designates, within the period it sets. Every policy, screening tool and training session exists only to make those four things happen reliably and repeatably.
There is no de minimis threshold. A small payment to a listed party is a breach in exactly the same way as a large one, and the fact that a shipment was routine, unprofitable or a favour to a long-standing client changes nothing. Nor is a sanctions breach a matter of intent alone: the prohibitions are drafted objectively, and the absence of bad faith affects the sentence rather than the offence. Ignorance of a counterparty ownership structure is not a defence if a reasonable enquiry would have revealed it.
One point of vocabulary is worth settling at the outset, because it causes genuine confusion. The word sanction is used in two quite different senses in Dutch law. This article deals with restrictive measures imposed on states, entities and individuals as an instrument of foreign policy. For sanctions in the sense of punishments imposed in criminal and administrative proceedings, see our kompletan vodič za međunarodne i domaće kaznene mjere.
Where the rules come from: EU regulations, the Sanctiewet 1977 and the WED
EU sanctions take the form of Council regulations, which apply directly in the Netherlands without any act of implementation. They enter into force on publication in the Official Journal, in practice on the day they appear, which is why a counterparty that was acceptable on a Friday afternoon can be prohibited by Monday morning. The regulations that matter most in practice are the asset freeze regulation adopted in 2014 in response to the situation in Ukraine, the sectoral Russia regulation of the same year, the Iran regulation of 2012 and the dual-use regulation of 2021.
National law supplies the enforcement machinery. The Sanctiewet 1977 is a framework act: it empowers the responsible ministers to issue sanctieregelingen, arranges supervision, and creates the hook that turns a breach of an EU regulation into a punishable act in the Netherlands. For financial institutions the Sanctiewet 1977 designates De Nederlandsche Bank and the Autoriteit Financiele Markten as supervisors, and the Regeling toezicht Sanctiewet 1977 requires those institutions to maintain adequate administrative organisation and internal control and to report any match to their supervisor without delay. Companies outside the financial sector have no licence-based supervisor, which is often misread as an absence of obligation. It is not; it simply means enforcement arrives through Customs and the criminal law rather than through a supervisory dialogue.
That criminal law is the Wet op de economische delicten. A breach of the rules made under the Sanctiewet 1977 is an economic offence; committed deliberately it is a crime (misdrijf), otherwise a regulatory offence (overtreding). The WED allows imprisonment and fines, confiscation of the profit obtained, and additional measures such as placing the business under administration or ordering its closure. Investigations are conducted by the FIOD under the direction of the Functioneel Parket, the specialist branch of the public prosecution service that handles economic and financial crime.
Two developments are worth tracking. At EU level, Directive (EU) 2024/1226 of 24 April 2024 obliges member states to criminalise a defined catalogue of sanctions breaches, including circumvention, and to provide effective penalties for legal persons. At national level, a bill for a Wet internationale sanctiemaatregelen was submitted to the Tweede Kamer on 17 February 2026 and is still under consideration there. It would largely replace the Sanctiewet 1977, create a single Centraal Meldpunt Sancties for reporting, and add administrative enforcement alongside criminal prosecution. Until that bill is passed and brought into force by royal decree, the Sanctiewet 1977 continues to apply in full.
The substantive content of the Russia measures changes with every package, and reproducing it here would date within weeks. For the shape of the successive packages and what they cover, see our overview of the dodatne sankcije protiv Rusije, and for the practical realities of trade with the region our Odjel za Evroaziju i ZND.
Screening: which lists you check, and how often
Screening is the operational core of sanctions compliance, and it is checking against lists rather than against countries. The authoritative source for a business in the Netherlands is the EU consolidated list of persons, groups and entities subject to financial sanctions, maintained by the European Commission and reproduced in the EU Sanctions Map. United Nations designations reach you through that same EU list. Alongside it sit the national terrorism list maintained by the Dutch government and, for companies with exposure to the United States, the Specially Designated Nationals list of the Office of Foreign Assets Control.
The parties you screen are broader than the party you invoice. A defensible programme checks the customer, the customer parent and shareholders, the directors and ultimate beneficial owners, suppliers and subcontractors, agents and intermediaries, freight forwarders and carriers, the banks on both sides of the payment, insurers, and the end user named on the shipping documents. Where goods travel by sea or air, vessels and aircraft are designated in their own right and are identified by IMO number or registration mark rather than by name, because names change and IMO numbers do not.
Timing matters as much as coverage. Screening at onboarding alone is worthless, because designations are added continuously and take effect immediately. A workable rhythm is a check at onboarding, a check before each material transaction or shipment, and an automated rescreen of the entire counterparty file whenever the EU list is updated. Record the date, the list version and the result of every check. When enforcement authorities look at a file two years later, the question is not whether you were right but whether you can show what you knew and when.
Expect false positives and plan for them. Transliteration from Cyrillic and Farsi produces many spellings of the same name, common surnames generate noise, and a fuzzy-matching threshold set too tightly hides real hits while one set too loosely buries the compliance officer. The answer is a written hit-handling procedure: who reviews a potential match, what additional information is gathered, who may clear it, and who must be informed if it stands. Clearances are decisions and belong in the file with reasons.
Sanctions screening is often confused with customer due diligence under the Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft), and the two are genuinely different. Wwft due diligence applies only to designated institutions, is risk-based, and allows a proportionate approach. Sanctions rules apply to everyone and admit of no proportionality: a listed party is prohibited, full stop. The two regimes do reinforce each other in practice, and the same file usually serves both. For the client-identification side of that work, see our guide to KYC obligations, and for the wider financial-crime picture our Vodič za pranje novca u Holandiji. Note that money laundering itself is criminalised in articles 420bis to 420quater of the Wetboek van Strafrecht, not in the Wwft, which imposes preventive duties only.
The ownership and control test: why 50 percent decides
An entity that appears on no list at all is nevertheless treated as listed if it is owned or controlled by a listed party. This is the single most important rule in commercial sanctions practice, and the one most often missed, because a name check against the consolidated list returns nothing and the file is closed.
Ownership is a bright-line test. Where a listed person or entity holds 50 percent or more of the proprietary rights in another entity, that entity is caught, and its funds and economic resources must be frozen in the same way. The holding may be direct or indirect, and the holdings of several listed parties are added together. Two listed shareholders with 30 percent and 25 percent respectively therefore cross the threshold even though neither does so alone. Because the test aggregates, a chain of intermediate holding companies has to be traced through rather than stopped at the first unlisted layer.
Control is a separate test and carries no percentage at all. A listed party may control an entity through the right to appoint or remove a majority of the board, through a shareholders agreement that gives it a dominant influence, through control of day-to-day management, through guaranteeing the entity debts, or through any other arrangement that lets it direct the entity affairs. A minority stake combined with such rights is enough. This is why an ownership chart alone is insufficient and why the constitutional documents and any shareholders agreement need to be seen for higher-risk counterparties.
Dealing with an entity that is 50 percent or more owned by a listed party is legally the same as dealing with the listed party itself. Not having examined the ownership structure is not a defence.
Do not confuse this threshold with the 25 percent figure familiar from the UBO register. Twenty-five percent is the Wwft threshold for identifying an ultimate beneficial owner; it tells you whom you must identify. Fifty percent or more is the sanctions threshold; it tells you whom you may not pay. Mixing the two produces the two classic errors: clearing a counterparty because no single listed shareholder reaches 25 percent, and freezing a relationship that in fact falls outside the ownership test.
Practically, this means asking every higher-risk counterparty for a current ownership chart down to natural persons, verifying it against company registers where they are reliable, recording the date of verification, and requiring the counterparty to notify you of any change. Ownership structures are also deliberately restructured to move below the threshold, so a chart obtained before a designation should be refreshed after one.
Freezing and reporting: what you must do, and whom you must tell
When a match is confirmed, the obligation is immediate and twofold: freeze, and report. Freezing means that nothing leaves your control. Payments are stopped, goods are not released, services are suspended, credit balances stay where they are and no economic resource of any kind is made available to the listed party, directly or indirectly. Making available is read broadly: paying a supplier who will pass the money on, releasing goods that can be sold, or providing a service that has economic value all fall within it. You may not set the frozen amount off against a debt, and you may not release goods against a bank guarantee.
Reporting in the Netherlands is currently fragmented, which is precisely the problem the pending Wet internationale sanctiemaatregelen is meant to solve with a single Centraal Meldpunt Sancties. Until then, the report goes to the ministry responsible for the type of asset concerned. Frozen financial assets are reported to the Ministry of Finance. Enterprises and shareholdings that are not themselves listed go to the Ministry of Economic Affairs. Immovable property is reported to the Ministry of the Interior and Kingdom Relations, vessels and aircraft to the Ministry of Infrastructure and Water Management, and cultural objects to the Ministry of Education, Culture and Science. The current reporting addresses are published on rijksoverheid.nl, and the Netherlands passes the information on to the European Commission.
Listed parties themselves carry a separate duty. A person or organisation designated under the Russia, Belarus, Haiti or Iran regimes must declare the assets they hold within the European Union within six weeks of being listed. Failing to declare is itself a violation, and it is one of the routes by which hidden holdings come to light.
Financial institutions supervised by De Nederlandsche Bank or the Autoriteit Financiele Markten report a match to their own supervisor without delay under the Regeling toezicht Sanctiewet 1977, in addition to any asset report to the ministry. For everyone else the practical rule is simple: if you are holding something that belongs to or benefits a listed party, someone in government needs to be told, and quickly.
Unfreezing is not a decision you can take yourself. Where a regulation allows a derogation, for basic needs, for professional fees, for pre-existing contracts or for humanitarian purposes, the competent ministry must grant it in advance, in writing, and on the conditions the regulation sets. Wind-down periods work the same way: they are fixed deadlines written into the regulation, not a negotiable grace period, and once they expire the performance becomes prohibited whatever the contract says.
Export controls, dual-use goods and the circumvention ban
Sanctions screening deals with who; export control deals with what. Dual-use items, meaning goods, software and technology that have both civil and military applications, require a licence for export from the European Union under the dual-use regulation. In the Netherlands licences are issued by the Centrale Dienst voor In- en Uitvoer, part of Customs, on the basis of policy set by the Ministry of Foreign Affairs. The control list is technical and covers far more than weapons: high-performance computing, certain sensors and lasers, machine tools, encryption software and semiconductor manufacturing equipment all appear on it.
Two features regularly surprise businesses. The first is the catch-all: even an item that is not on the control list needs a licence if you have been informed by the authorities, or are otherwise aware, that it is or may be intended for a military end use or for a weapons of mass destruction programme. Awareness is judged on what a diligent exporter would have concluded from the circumstances. The second is that country-specific sanctions add their own export bans on top of the dual-use list, which is how ordinary industrial goods, vehicles, chemicals and luxury items came to be prohibited for Russia. For a defined group of sensitive items, EU rules also require exporters to include a contractual prohibition on re-export to Russia in their sales contracts, and to provide for a remedy if the buyer breaches it.
Alongside the prohibitions sits an anti-circumvention rule: it is forbidden to participate knowingly and intentionally in activities whose object or effect is to circumvent a restrictive measure. This is where most current enforcement activity is concentrated, and it is aimed at re-routing through third countries. The warning signs are consistent and worth training staff to recognise. A new intermediary appears in a market with no history of buying the product. The declared end user has a business that does not plausibly need the goods. Order volumes jump without explanation. Payment comes from a jurisdiction unconnected to the buyer. The customer declines to sign an end-user statement, refuses an on-site visit, or is unusually indifferent to price, specification or after-sales support.
Services have become a control area in their own right. EU measures prohibit supplying a range of services to entities established in Russia, among them accounting, auditing, business and management consulting, public relations, IT consultancy and certain legal advisory services, subject to defined exceptions. A Dutch consultancy or software supplier can therefore breach sanctions without ever shipping a physical item. Keep end-user statements, licences, transport documents and correspondence for the retention period that applies, and make sure the file explains not only what was decided but why.
Enforcement, penalties and personal liability
Enforcement in the Netherlands runs along several tracks at once. Customs checks consignments at the border and holds those that raise questions. The FIOD investigates suspected offences and works with the Functioneel Parket, which decides on prosecution. De Nederlandsche Bank and the Autoriteit Financiele Markten supervise financial institutions and can impose administrative measures on them. The Ministry of Foreign Affairs coordinates sanctions policy, while the ministries named above administer freezes and derogations in their own domains.
The consequences of a breach are not confined to a fine. Because sanctions offences fall under the WED, a deliberate breach is a crime, and the sentencing options include imprisonment, substantial fines set by penalty category, confiscation of the advantage obtained, and additional measures such as placing the undertaking under administration, ordering its total or partial closure, or depriving it of subsidies or entitlements. Convictions can be published. Because the amounts and categories are adjusted periodically, the reliable statement is not the figure but the exposure: sanctions breaches are prosecuted as serious economic crime, not as an administrative slip.
Individuals are exposed alongside the company. Under article 51 of the Wetboek van Strafrecht an offence committed by a legal person can also be charged against those who directed or knowingly permitted it. A director who overruled a compliance objection, a sales manager who accepted an implausible end-user statement, or a finance officer who processed a payment after a hit was flagged can all be prosecuted personally. Self-reporting matters here: voluntary disclosure, prompt remediation and cooperation are taken into account by the prosecution service, and a documented decision trail is what makes such a disclosure credible.
Commercial consequences often arrive faster than legal ones. Banks de-risk on the first sign of exposure, insurers withdraw cover, carriers refuse bookings and customers require sanctions warranties before they will contract. EU regulations also bar listed parties from bringing claims in connection with contracts affected by sanctions, so the counterparty cannot sue you for the performance you have lawfully withheld, but that protection depends on the withholding being lawful in the first place.
United States measures deserve a careful word, because the common advice to simply comply with the strictest rule is wrong as a matter of EU law. US primary sanctions bind you when a transaction touches US persons, US-origin goods or technology, or the US financial system, and clearing in dollars is enough to do that. US secondary sanctions can penalise a non-US company for conduct outside US jurisdiction. But for a defined set of US measures concerning Iran and Cuba, the EU Blocking Regulation prohibits EU operators from complying with them and from giving effect to foreign judgments based on them, unless the European Commission authorises compliance. A Dutch company faced with that conflict needs advice on both regimes together, not a blanket policy of following whichever rule is stricter.
Building a sanctions compliance programme that holds up
Enforcement authorities do not expect a Dutch SME to run a bank-grade compliance function. They do expect a programme proportionate to the risk the business actually carries, and they expect it to be documented. The starting point is therefore a written risk assessment that maps the exposure honestly: which countries the goods and money touch, which product categories could be dual-use, which counterparties sit behind opaque structures, which currencies and correspondent banks are used, and which transport routes pass through jurisdictions known for re-export.
From that assessment flow the controls. Screening must cover the parties identified in the risk assessment and run on the rhythm set out above, with a documented hit procedure and a named person, at board level, who owns the decision. Contracts need sanctions clauses that do real work: a warranty that neither the counterparty nor its owners are listed, a continuing obligation to disclose changes in ownership and control, an end-use and re-export undertaking, an audit and information right, and a right to suspend and terminate immediately without liability if a designation occurs. A clause that merely says the parties will comply with applicable law achieves nothing.
Training belongs with the people who see the red flags first, which means sales, logistics, procurement and finance rather than the legal department alone. The training should be concrete: what an implausible end user looks like, why a change of delivery address matters, what to do with a payment instruction from an unexpected country, and whom to call. Add an internal escalation route that does not run through the person whose deal is at stake, and a record of who was trained and when.
Finally, keep the evidence. A compliance programme is judged after the fact, on the file. Screening logs, cleared hits with reasons, ownership charts with verification dates, licences, end-user statements and board minutes recording the decisions taken are what turn a good-faith mistake into a defensible one. Test the system periodically with a small internal audit or a sample of transactions traced end to end, and record what you found and what you changed.
Common sanctions compliance questions
What happens if a business partner is listed after we have signed the contract?
You must stop all prohibited performance immediately, on the day of publication, and freeze any funds or economic resources of that partner that you hold. Payments, deliveries and services cease; the contract does not override the regulation. Check the regulation for a wind-down derogation, which sometimes allows a limited period to terminate cleanly, and note that any such period is a hard deadline and may require a prior licence from the competent ministry. Report the frozen assets to the responsible ministry, take advice on the termination route in your contract, and document each step. Trying to restructure around the designation is itself a circumvention offence.
Can we deal with a company that is not listed but is owned by a listed party?
No, if the ownership or control test is met. An entity is treated as listed where listed parties hold 50 percent or more of it, directly or indirectly, counting their holdings together, or where a listed party controls it through board appointment rights, a shareholders agreement, dominant influence or comparable arrangements. In that case the entity funds and economic resources are frozen and you may not make anything available to it. A name check that comes back clean is therefore only the first step; the ownership chart is the decisive document.
Are humanitarian goods such as food and medicine exempt?
Not automatically. Sanctions regimes contain humanitarian carve-outs, but they are narrow and conditional rather than a general exemption. The goods may be permissible while the transaction as a whole is not, because a designated bank handles the payment, a designated carrier moves the cargo, or the consignee is owned by a listed party. Several regimes require a prior licence from the competent authority for humanitarian supplies, and the licence conditions bind you. Every link in the chain, from the bank and insurer to the shipping line and the final recipient, has to be screened.
Do we follow EU sanctions or US sanctions?
EU and Dutch sanctions are legally binding on you and are not optional. US sanctions are not Dutch law, but they create real exposure whenever a transaction involves US dollars, US banks as intermediaries, US persons, or goods and technology of US origin, and US secondary sanctions can reach conduct with no US nexus at all. The pragmatic answer is to map both regimes and manage the commercial risk deliberately. The important qualification is the EU Blocking Regulation, which for certain US measures relating to Iran and Cuba prohibits EU operators from complying without authorisation from the European Commission. Where the two regimes genuinely conflict, that conflict has to be resolved with advice rather than by defaulting to the stricter rule.
Law and More advises companies in the Netherlands on sanctions screening, ownership and control analysis, export licensing, freezing and reporting obligations, contract clauses and internal investigations, and represents them in dealings with Customs, the FIOD and the supervisory authorities. If you have a counterparty you are unsure about, a shipment that has been held, or a compliance programme that has never been tested, our compliance lawyers are available to review it with you.
