Skip to content
AuditFront
RPT.1 EU Sanctions DD

EU Sanctions DD RPT.1: Mandatory Authority Reporting

What This Control Requires

If any sanctioned parties or frozen assets have been identified, has a report been filed with the national competent authority within the required timeframe?

In Plain Language

EU sanctions create active reporting duties - not just prohibitions. Under Article 8 of Regulation 269/2014, discovery of funds or economic resources belonging to a designated person must be reported to your national competent authority within two weeks. This is a legal obligation, not optional guidance.

Since Directive 2024/1226, failure to report is a criminal offence in all EU member states. This means that not only is the underlying sanctions violation criminal, but simply knowing about it and not reporting is independently criminal.

The two-week clock starts when you acquire the notifiable information - when you discover or have reason to believe that you are holding, controlling, or have information about funds or economic resources of a designated person.

How to Implement

Under Article 8 of Regulation 269/2014, you must report to your national competent authority:

1. Any funds or economic resources that have been or should have been frozen 2. Any movement of such assets in the 2 weeks preceding the designation 3. Any cooperation with the authority to verify the information

The 2-week reporting deadline runs from when you acquire the notifiable information. This means when your screening returns a match, when you receive information suggesting a counterparty is designated, or when you identify assets that should be frozen.

Identify your national competent authority before you need it: - Germany: Deutsche Bundesbank - France: Direction Generale du Tresor - Netherlands: De Nederlandsche Bank - Italy: UIF at the Bank of Italy and the Financial Security Committee - Each EU member state has a designated authority - check the European Commission's list

Under Directive 2024/1226 (effective in all member states since May 2025), failure to report carries criminal penalties including imprisonment and substantial fines. The Directive requires member states to impose maximum penalties of at least 5 years imprisonment for the most serious violations.

Document: what was discovered, when, how, what actions were taken (asset freeze, transaction block), and when and how the report was filed.

Evidence Your Auditor Will Request

  • Records of all reports filed with national competent authorities, including submission dates
  • Internal timeline documentation showing compliance with the 2-week reporting deadline
  • Identification of the applicable national competent authority for each jurisdiction of operation
  • Asset freeze records showing immediate action upon discovery of designated person assets
  • Internal policy documenting the reporting obligation and process

Common Mistakes

  • Not knowing which national competent authority to report to before a situation arises
  • Missing the 2-week reporting deadline because of slow internal escalation processes
  • Treating the reporting obligation as discretionary rather than mandatory
  • Filing reports to the wrong authority or in the wrong format
  • Not documenting the internal timeline of discovery and escalation for evidence purposes

Related Controls Across Frameworks

Framework Control ID Relationship
EU Sanctions DD EU Sanctions DD RPT.2 (related mapping) Related
EU Sanctions DD EU Sanctions DD WHO.1 (related mapping) Related
EU Sanctions DD EU Sanctions DD PROG.1 (related mapping) Related

Frequently Asked Questions

What exactly triggers the reporting obligation?
The obligation is triggered when you possess or control funds or economic resources belonging to, owned by, held by, or controlled by a designated person or entity. This includes: bank accounts, securities, real property, receivables, inventory, intellectual property, and any other economic resources. The obligation also covers information about such assets even if you do not directly control them. In practice, a sanctions screening match, a suspicious ownership discovery, or intelligence suggesting a counterparty is designated all trigger the clock.
What are the criminal penalties under Directive 2024/1226?
Directive 2024/1226 requires all EU member states to make violations of EU sanctions a criminal offence. For the most serious violations, maximum penalties must be at least 5 years imprisonment. For legal entities, fines must be at least 5% of total worldwide turnover or EUR 40 million, whichever is higher. Failure to report is specifically covered - it is not just the underlying violation that is criminal, but the failure to report it to the competent authority.
Does the reporting obligation apply to suspected matches or only confirmed ones?
The obligation applies when you have 'information that assets should be frozen' - this covers reasonable suspicion, not just confirmed matches. If your screening returns a potential match and you cannot quickly resolve it as a false positive, you should report within the deadline rather than risk missing it while you investigate. You can always supplement the report with additional information later. Err on the side of reporting.

Track EU Sanctions DD compliance in one place

AuditFront helps you manage every EU Sanctions DD control, collect evidence, and stay audit-ready.

Start Free Assessment