RPT.1 EU Sanctions DD

EU Sanctions DD RPT.1: Mandatory Authority Reporting

This control is 1 of 25 in EU Sanctions DD. Get the full checklist as a free interactive assessment with a scored gap report.

Start my free EU Sanctions DD assessment Google sign-in · No credit card · About 2 minutes

What This Control Requires

If any sanctioned parties or frozen assets have been identified, has a report been filed with the national competent authority within the required timeframe?

In Plain Language

EU sanctions create active reporting duties - not just prohibitions. Under Article 8 of Regulation 269/2014, discovery of funds or economic resources belonging to a designated person must be reported to your national competent authority within two weeks. This is a legal obligation, not optional guidance.

Under Directive 2024/1226, member states must make failure to report a criminal offence. This means that not only is the underlying sanctions violation criminalised, but simply knowing about it and not reporting is independently criminalised.

The two-week clock starts when you acquire the notifiable information - when you discover or have reason to believe that you are holding, controlling, or have information about funds or economic resources of a designated person.

How to Implement

Under Article 8 of Regulation 269/2014, you must report to your national competent authority:

1. Any funds or economic resources that have been or should have been frozen 2. Any movement of such assets in the 2 weeks preceding the designation 3. Any cooperation with the authority to verify the information

The 2-week reporting deadline runs from when you acquire the notifiable information. This means when your screening returns a match, when you receive information suggesting a counterparty is designated, or when you identify assets that should be frozen.

Identify your national competent authority before you need it: - Germany: Deutsche Bundesbank - France: Direction Generale du Tresor - Netherlands: depends on your sector (De Nederlandsche Bank covers financial institutions) - Italy: UIF at the Bank of Italy and the Financial Security Committee - Each EU member state has a designated authority - check the European Commission's list

Under Directive 2024/1226 (member states were required to transpose it by May 2025; transposition status varies), failure to report carries criminal penalties including imprisonment and substantial fines. The Directive requires member states to impose maximum penalties of at least 5 years imprisonment for the most serious violations.

Document: what was discovered, when, how, what actions were taken (asset freeze, transaction block), and when and how the report was filed.

Evidence Your Auditor Will Request

Records of all reports filed with national competent authorities, including submission dates
Internal timeline documentation showing compliance with the 2-week reporting deadline
Identification of the applicable national competent authority for each jurisdiction of operation
Asset freeze records showing immediate action upon discovery of designated person assets
Internal policy documenting the reporting obligation and process

Common Mistakes

Not knowing which national competent authority to report to before a situation arises
Missing the 2-week reporting deadline because of slow internal escalation processes
Treating the reporting obligation as discretionary rather than mandatory
Filing reports to the wrong authority or in the wrong format
Not documenting the internal timeline of discovery and escalation for evidence purposes

Related Controls Across Frameworks

Framework	Control ID	Relationship
EU Sanctions DD	EU Sanctions DD RPT.2: Internal Escalation Process	Related
EU Sanctions DD	EU Sanctions DD WHO.1: Counterparty Screening Against EU Consolidated List	Related
EU Sanctions DD	EU Sanctions DD PROG.1: Designated Sanctions Compliance Officer	Related

Frequently Asked Questions

What exactly triggers the reporting obligation?

The obligation is triggered when you possess or control funds or economic resources belonging to, owned by, held by, or controlled by a designated person or entity. This includes: bank accounts, securities, real property, receivables, inventory, intellectual property, and any other economic resources. The obligation also covers information about such assets even if you do not directly control them. In practice, a sanctions screening match, a suspicious ownership discovery, or intelligence suggesting a counterparty is designated all trigger the clock.

What are the criminal penalties under Directive 2024/1226?

Directive 2024/1226 requires all EU member states to make violations of EU sanctions a criminal offence. For the most serious violations, maximum penalties must be at least 5 years imprisonment. For legal entities, member states must provide for maximum fines that can reach at least 5% of total worldwide turnover or EUR 40 million, depending on the national implementation. Failure to report is specifically covered - it is not just the underlying violation that is criminal, but the failure to report it to the competent authority.

Does the reporting obligation apply to suspected matches or only confirmed ones?

The obligation applies when you have 'information that assets should be frozen' - this covers reasonable suspicion, not just confirmed matches. If your screening returns a potential match and you cannot quickly resolve it as a false positive, you should report within the deadline rather than risk missing it while you investigate. You can always supplement the report with additional information later. Err on the side of reporting.

Track EU Sanctions DD compliance in one place

AuditFront helps you manage every EU Sanctions DD control, collect evidence, and stay audit-ready. The full EU Sanctions DD checklist is included on the Free plan.

Start Free Assessment

Free plan · No credit card required

Start my free EU Sanctions DD assessment