Bulgaria advances criminal and administrative enforcement of EU sanctions

Criminal Code bill clears first reading, with a companion law on international restrictive measures in the pipeline

On 24 September 2026, Bulgaria’s National Assembly approved at first reading a government bill that would add a dedicated chapter on EU restrictive measures to the Criminal Code. If enacted, it would expose individuals to imprisonment of up to ten years in aggravated cases and legal entities benefiting from qualifying offences to substantial court-imposed pecuniary sanctions. A separate draft Law on International Restrictive Measures would place the allocation of administrative responsibilities, derogation procedures and enforcement powers on a broader statutory footing. Both texts remain subject to change.

Executive summary

• What changes: A new Criminal Code chapter would criminalise the violation and circumvention of EU restrictive measures, transposing Directive (EU) 2024/1226. Bulgaria missed the May 2025 deadline and is already the subject of European Commission infringement proceedings for failing to notify transposition measures.
• Who is exposed: Individuals face up to ten years’ imprisonment in aggravated cases; companies face pecuniary sanctions of up to €40.5 million. Most offences apply only from €10,000 upwards, but dealings in military and dual-use items are criminal regardless of value, even when committed negligently.
• Administrative framework: A draft Law on International Restrictive Measures (the RMA) would make the State Agency for National Security (SANS) the competent authority for financial sanctions, create a formal derogation procedure and introduce administrative fines and licensing consequences.
• Timing: The criminal provisions would enter into force one month after publication and the government is pressing for swift adoption. The RMA has not yet reached Parliament and would largely apply six months after publication.
• Open issues: Several gaps remain to be addressed at second reading, including a missing “breach” element in the military and dual-use offence and a travel-ban penalty below the EU minimum.
• Action: Businesses should test their screening, freezing, reporting, export-classification and escalation processes against the new criminal standard now (see Section 5).

1. Why now?

Directive (EU) 2024/1226¹ sets EU-wide minimum rules on criminal offences and penalties for sanctions violations – including liability for legal persons – and had to be transposed by 20 May 2025. In July 2025, the Commission opened infringement proceedings against 18 Member States, including Bulgaria, for full or partial failure to communicate measures transposing Directive (EU) 2024/1226.² The next step would be referral to the Court of Justice, with a possible request for financial penalties under Article 260(3) TFEU. Separately, the explanatory memorandum to the RMA acknowledges that Bulgaria lacks national legislation governing the implementation of international restrictive measures, citing particular difficulties relating to financial sanctions, requests to unfreeze assets and the identification of the authority competent to grant certain derogations.³

2. The Criminal Code bill

The government bill (No. 52-602-01-43)⁴ was adopted at first reading on 24 September 2026. The deadline for proposals ahead of second reading is currently 1 October 2026 and the Legal Affairs Committee has decided to establish a working group comprising experts from the Ministry of Justice, the Supreme Court of Cassation and the Prosecutor’s Office to refine the text.⁵

2.1 What becomes a crime

A new Chapter Seven “a” – “Crimes against the restrictive measures of the European Union” (Articles 268a–268v) – would cover:

• making funds or economic resources, including crypto-assets, available to designated persons or failing to freeze them;
• entering into or continuing prohibited transactions with third states or entities that they own or control, including public contracts and concessions;
• prohibited trade in goods, related brokering, insurance or technical assistance and prohibited financial or other services, such as legal, accounting, audit, consulting or IT services;
• breaching the conditions of an authorisation or derogation, regardless of value;
• enabling a person subject to an EU travel ban to enter or transit through Bulgaria; and
• circumvention, including concealing assets that should be frozen, providing false or misleading information to conceal that a designated person is the beneficial owner or failing to comply with specified reporting obligations.

Articles 233 and 339b of the Criminal Code, which already penalise certain arms and dual-use dealings in breach of EU sanctions, would be confined to UN and OSCE measures. This may relevant in pending cases, as the law most favourable to the offender applies until a judgment becomes final.

2.2 Penalties at a glance

Courts could also impose disqualification for military and dual-use offences and in aggravated cases. Because most commercial breaches are profit-driven, the profit-motive aggravator could push many cases into the three-to-ten-year bracket. Conversely, full voluntary disclosure that facilitates detection and proof of an offence would mitigate the penalty.

Bulgaria does not recognise corporate criminal liability. Companies that benefited – or would have benefited – from an offence would face court-imposed pecuniary sanctions under Article 83a of the Administrative Violations and Sanctions Act of up to €40.5 million for principal offences or €8.5 million for reporting offences, in each case not less than the benefit obtained. The bill also extends whistleblower protection to sanctions breaches, permits the use of special intelligence means in the most serious cases and would enter into force one month after publication.

3. The draft Law on International Restrictive Measures

The Ministry of Foreign Affairs published the draft RMA for consultation from 11 August to 10 September 2026. It has yet to pass inter-ministerial coordination and be approved by the Council of Ministers. Covering EU, UN and other binding international measures, it would:

• designate 21 competent authorities, with the Chairperson of SANS responsible for financial sanctions and empowered to obtain information directly from businesses and issue binding written instructions;
• create an Interdepartmental Council, chaired by a Deputy Prime Minister, to coordinate implementation – including with law enforcement – and resolve disputes concerning scope and competence;
• introduce a derogation procedure, with decisions to be issued within one month of receipt of complete information under the Administrative Procedure Code and with the Council of Ministers deciding cases where several authorities are competent;
• override banking, commercial and professional secrecy for information requests while shielding compliant disclosures from liability under other laws or contracts;
• impose administrative fines. For companies, these would amount to €5,000–25,000 for breaches (€10,000–100,000 for repeat breaches) and up to €25,000 for failure to provide information (up to €100,000 for repeat failures). According to the Ministry of Justice, these penalties are intended to cover breaches below the €10,000 criminal threshold; and
• make sanctions breaches grounds for licensing and supervisory measures, including licence revocation, in banking, payments, investment services, insurance, crypto-assets, gambling and other regulated sectors.

Most of the RMA would take effect six months after publication.

4. Open issues ahead of second reading

• Missing “breach” element. The military and dual-use offence does not require a breach of an EU restrictive measure and, read literally, would capture lawful, licensed trade. The element was included in the consultation draft of 26 June 2026⁶ and the Ministry of Justice acknowledged the omission before the Legal Affairs Committee.
• Travel-ban penalty. The two-year maximum falls short of the three-year minimum required by Article 5(3)(c) of the Directive. The Ministry has acknowledged that one penalty falls below the Directive’s minimum and this appears to be the relevant provision.
• Linked transactions. The Directive requires that the €10,000 threshold can be met through a series of linked acts by the same offender (Article 3(2)). The bill contains no such rule and, under the Bulgarian rules on continued offences, each act must itself satisfy the elements of the offence, leaving room for structuring.
• Professional secrecy. The RMA would override professional secrecy for information requests, whereas the Criminal Code bill protects lawyers’ and in-house counsel’s client information in line with Article 3(4) of the Directive. The boundary between the two regimes should be clarified.
• Timing and completeness. The criminal rules could apply months before the RMA identifies the competent authorities to which reports must be made. The RMA’s Interdepartmental Council also appears intended to satisfy the coordination requirement in Article 15 of the Directive. Full transposition and closure of the infringement case may depend on both texts.
• Next wave. Directive (EU) 2024/1260 on asset recovery and confiscation,⁷ due to be transposed by 23 November 2026, requires asset recovery offices to be able to trace and identify property belonging to persons and entities subject to EU restrictive measures, upon request by national competent authorities where necessary to detect sanctions offences.

5. What businesses should do now

EU sanctions already apply directly. The bill raises the stakes by attaching personal criminal liability to the individuals involved and substantial sanctions to their companies. Businesses active in or through Bulgaria should:

• Put sanctions on the board agenda. Confirm who is accountable, brief management on personal exposure (including the profit-motive aggravator) and review D&O cover for criminal proceedings.
• Screen beyond the list. Screen counterparties, beneficial owners and payment chains against the EU consolidated list, apply the EU ownership-and-control tests rather than relying solely on direct listings only and re-screen whenever the lists change.
• Write down freeze-and-report procedures. Define who freezes assets, who reports, to which authority reports must be made and within what timeframe. Above €10,000, failing to report frozen assets or relevant information obtained in the course of professional duties would itself constitute a criminal offence.
• Classify before you ship. Check goods, software and technology against the EU Common Military List and Annexes I and IV to Regulation (EU) 2021/821. There is no value threshold and serious negligence is enough.
• Harden contracts and supply chains. Use sanctions representations, suspension rights and termination rights and, where required, the “no re-export to Russia” clause under Article 12g of Regulation (EU) No 833/2014. Monitor for potential diversion through third countries.
• Track licences and derogations. Maintain a register of authorisations and their conditions. Breaching a condition would itself constitute an offence.
• Prepare for the incident, not just the audit. Extend whistleblowing channels to sanctions breaches, establish an internal investigation and evidence preservation protocol and agree in advance how decisions regarding voluntary disclosure will be taken.

***

This client alert provides general, high-level guidance and does not constitute legal advice. It reflects the Criminal Code bill as adopted at first reading on 24 September 2026 and the draft Law on International Restrictive Measures as published for consultation on 11 August 2026. Both may change before adoption. Clients should seek tailored legal advice before acting on the matters discussed.

1. Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673, OJ L, 2024/1226, 29.4.2024: https://eur-lex.europa.eu/eli/dir/2024/1226/oj/eng. ↩︎
2. European Commission, infringement decisions of 24 July 2026 : Commission takes action to ensure complete and timely transposition of EU directives ↩︎
3. Draft Law on International Restrictive Measures, explanatory memorandum and consultation documents, Public Consultation Portal, consultation No. 12600: https://www.strategy.bg/bg/public-consultations/12600. ↩︎
4. Bill amending and supplementing the Criminal Code, No. 52-602-01-43, submitted by the Council of Ministers on 11 September 2026: https://www.parliament.bg/bg/bills/ID/167546. ↩︎
5. Legal Affairs Committee of the National Assembly, transcript of the meeting of 16 September 2026: https://www.parliament.bg/bg/parliamentarycommittees/3816/steno/9876. ↩︎
6. Consultation draft of the Criminal Code bill (version 1.0 of 26 June 2026), Public Consultation Portal, consultation No. 12479: https://www.strategy.bg/bg/public-consultations/12479. ↩︎
7. Directive (EU) 2024/1260 of the European Parliament and of the Council of 24 April 2024 on asset recovery and confiscation, OJ L, 2024/1260, 2.5.2024: https://eur-lex.europa.eu/eli/dir/2024/1260/oj/eng. ↩︎