An Overview of Financial Sanctions in Europe and the Associated Risks – and its Implications for FATF Rec 8

The FATF Framework in the context of sanctions

 

As a refresher, FATF Recommendation 8 requires countries to identify the features and types of NPOs that are at risk of terrorist financing abuse, and to implement focused, proportionate, and risk-based measures to protect such organisations from being exploited by terrorists.  In November 2023, following its October 2023 Plenary, the FATF released significant amendments to R8 and its Interpretive Note. The amendments were designed to address a widespread pattern of misapplication and misinterpretation of R8, which had led states to impose disproportionate measures across the NPO sector as a whole, impeding organisations’ ability to operate, access banking services, and pursue their missions. The amendments reaffirm that measures directed at NPOs must be focused, proportionate, and risk-based, and that they must not ‘unduly disrupt or discourage legitimate NPO activities.’ The FATF simultaneously published updated Best Practices on Combating the Abuse of Non-Profit Organisations to guide states, the NPO sector, and financial institutions in applying the revised standard. [1] In July 2025, the FATF introduced a further new procedure to allow countries, the International Monetary Fund, and the World Bank to raise concerns about unintended consequences arising from a jurisdiction’s misapplication of the Standards in ways that disrupt legitimate NPO activity. [2]

Immediate Outcome 10 (IO10) sits within the FATF’s effectiveness framework and is directly engaged by R8. IO10 measures whether ‘terrorists, terrorist organisations and terrorist financiers are prevented from raising, moving and using funds, and from abusing the NPO sector.’ Unlike technical compliance with R8 — which asks whether the correct laws and systems exist — IO10 asks whether they actually work. A jurisdiction may be technically compliant with R8 but rated low on IO10 if its supervisory framework fails to produce tangible results.

The relationship between R8 and IO10 is significant in the context of financial sanctions: sanctions screening by charities and NPOs forms part of the practical architecture through which IO10 is achieved. An NPO that unknowingly transfers funds to a designated individual has failed in its obligations; a state that has not adequately guided or supervised the NPO sector may be found ineffective under IO10. Financial sanctions regimes therefore sit at the intersection of technical obligations (the legal prohibition on dealing with designated persons) and effectiveness outcomes (whether the NPO sector is genuinely protected from abuse). The FATF commenced its 5th round of mutual evaluations in 2024 under a revised 2022 Methodology, which places greater emphasis on real-world outcomes. [3] How jurisdictions are rated under IO10 in this round will depend, in part, on the quality of their engagement with — and supervision of — the NPO sector on sanctions compliance.

 

A comparative jurisdictional analysis

 

The United Kingdom

 

Following the United Kingdom’s withdrawal from the European Union, the primary legislative basis for financial sanctions in the UK is the Sanctions and Anti-Money Laundering Act 2018 (SAMLA 2018). SAMLA 2018 provides the framework enabling the UK to impose, implement, and enforce sanctions regimes by way of statutory instrument, and it grants HM Treasury and the Secretary of State powers to designate individuals and entities. The substantive prohibitions, including the prohibition on making funds or economic resources available, directly or indirectly, to or for the benefit of a designated person, are contained in the relevant regulations made under SAMLA 2018, of which there are many, covering Russia, Iran, North Korea, and a range of thematic regimes including the Global Human Rights and Global Anti-Corruption sanctions. Responsibility for administering and enforcing UK financial sanctions rests with the Office of Financial Sanctions Implementation (OFSI), established within HM Treasury in 2016.

SAMLA 2018 and the UK sanctions framework apply across England, Scotland, Wales, and Northern Ireland. The Charity Commission for England and Wales is the principal regulator for registered charities in England and Wales and has a role in supporting the sector’s understanding of financial sanctions obligations, operating alongside OFSI.

 

Risk and Enforcement

 

OFSI has published specific guidance for charities and NGOs, noting that the global nature of charitable operations frequently exposes the sector to transactions involving individuals or regions subject to financial sanctions. [4] It is a strict liability matter to make funds or economic resources available to a designated person without a licence: intent is not an element of the civil liability. Charities that wish to operate in sanctioned jurisdictions or to engage with counterparties proximate to designated persons must apply to OFSI for a licence — the humanitarian licence being the most commonly sought by the sector.

Enforcement data from OFSI’s most recent annual review illustrates the growing significance of the regime. According to OFSI’s Annual Review 2024-25, as of April 2025 OFSI had 240 active cases, with a growing proportion identified through non-self-reported sources: 151 cases in 2024-25 were identified through proactive intelligence-led means, up from 108 in the preceding period. In 2024-25, a total of 57 enforcement actions were taken, including monetary penalties, warning letters, disclosures, and referrals. Of particular note for the sector, disclosures were issued against three charities during the same period, reflecting that enforcement is no longer confined to financial institutions and professional services firms. In the counter-terrorism context specifically, 16 new breach cases under all Counter-Terrorism Regimes were actively pursued by law enforcement or HM Treasury in 2024-25. [5] In the 2023-24 review period, OFSI added 564 new designations and recorded 396 enforcement cases, a decline from 473 in 2022-23, with the majority of cases attributable to the financial services sector. [6]

The risk profile for charities is distinctively shaped by their operational context: many provide aid in areas affected by conflict or governed by states subject to comprehensive sanctions regimes, where the probability of inadvertent contact with designated persons or entities is structurally elevated. The ‘de-risking’ behaviour of banks — which increasingly decline to operate accounts for charities with high-risk operational profiles — compounds this challenge by limiting access to the formal financial system.

The UK Sanctions List replaced the OFSI Consolidated List as the sole source of current UK sanctions designations from 28 January 2026, and is publicly accessible at https://search-uk-sanctions-list.service.gov.uk/. [7]

 

France

 

As an EU Member State, France applies EU financial sanctions directly: EU sanctions regulations made under Article 215 of the Treaty on the Functioning of the European Union (TFEU) are binding and directly applicable in France without the need for national implementing legislation. The legal basis for the associated Council decisions is Article 29 of the Treaty on European Union (TEU) within the framework of the Common Foreign and Security Policy (CFSP). France’s national regime for asset freezes in the context of counter-terrorism is codified in the Code monétaire et financier (CMF), principally at Articles L. 562-1 et seq., which empower the Direction Générale du Trésor (DG Trésor) to order asset freezes in domestic counter-terrorism cases. The DG Trésor publishes and maintains a national register of all asset freeze measures (the registre national des mesures de gel des avoirs), accessible at https://gels-avoirs.dgtresor.gouv.fr/. [8] The Autorité de contrôle prudentiel et de résolution (ACPR), which supervises banks and insurers, and the financial intelligence unit TRACFIN together form the operational backbone of France’s AML/CFT and sanctions compliance architecture.

 

Risks and Regulatory Context

 

France was subject to a FATF mutual evaluation in May 2022 under the 4th round assessment methodology. The evaluation concluded that France was compliant with 9 of the 40 FATF Recommendations, largely compliant with 29, partially compliant with 10, and non-compliant with one. [9] The evaluation noted France’s strong overall AML/CFT framework, while identifying areas for improvement in supervision and the use of financial intelligence.

For associations (the predominant legal form for NPOs and charities in France, governed by the loi du 1er juillet 1901), the core obligation under EU sanctions regulations and the CMF is to screen their counterparties against the EU Consolidated List and the DG Trésor national register, and to report any matches to TRACFIN. The ACPR has published guidelines on the implementation of asset-freezing obligations by regulated entities, clarifying expectations around suspicious transaction reporting and the integration of sanctions checks into due diligence frameworks. [10] French associations engaging in international activity — particularly those providing aid in conflict zones — must navigate the same structural tensions between humanitarian operations and the prohibition on transacting with designated persons that their counterparts in other jurisdictions face.

TRACFIN’s published data provides a useful proxy for the intensity of AML/CFT activity in France. In 2023, reporting entities submitted a record 190,653 suspicious transaction declarations (déclarations de soupçon) to TRACFIN — an increase of 15% on 2022. TRACFIN exercised its right to oppose suspect financial transactions on 132 occasions in 2023, more than in the preceding six years combined, as part of a broader strategic shift towards proactive intervention in ephemeral companies used as vehicles for money laundering and fraud. [11] While these figures relate to AML/CFT activity broadly rather than NPOs specifically, they reflect the overall volume and intensity of the French suspicious activity reporting ecosystem within which charities and associations operate.

 

Germany

 

Germany, like France, applies EU financial sanctions directly through the binding force of EU regulations made under Article 215 TFEU. Germany does not unilaterally impose financial sanctions. The national legal authority for implementing and enforcing both EU financial sanctions and EU economic sanctions is the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG), supplemented by the Foreign Trade and Payments Ordinance (Außenwirtschaftsverordnung, AWV). In December 2022, Germany significantly strengthened its sanctions enforcement architecture through the Second German Sanctions Enforcement Act (Zweites Sanktionsdurchsetzungsgesetz, SDG II), which entered into force on 28 December 2022. The SDG II introduced a standalone Sanctions Enforcement Act (Sanktionsdurchsetzungsgesetz, SanktDG) and amended the AWG, the Anti-Money Laundering Act (Geldwäschegesetz, GwG), the Banking Act (Kreditwesengesetz, KWG), and the Securities Trading Act (Wertpapierhandelsgesetz, WpHG). [12]

Responsibility for administering and enforcing financial sanctions is divided between several federal authorities. The Deutsche Bundesbank is the competent authority for financial sanctions, processing notifications from banks and insurers on the implementation of asset freezes and handling licence applications. The Federal Office for Economic Affairs and Export Controls (Bundesamt für Wirtschaft und Ausfuhrkontrolle, BAFA) administers economic sanctions and export control licences. The Central Department for Sanctions Enforcement (Zentralstelle für Sanktionsdurchsetzung, ZfS), created by the SDG II, is responsible for enforcing the asset freeze and making-available prohibitions through investigations into sanctioned assets. The German Customs Administration (Zoll) enforces trade-related prohibitions, and criminal prosecution of sanctions violations rests with federal and state Public Prosecutors’ Offices (Staatsanwaltschaften). Germany does not maintain a national sanctions designations list; it applies the EU Consolidated List, accessible through the EU Sanctions Map at https://www.sanctionsmap.eu. [13]

 

Risks and Regulatory Context

 

Germany’s FATF mutual evaluation, conducted in August 2022, concluded that Germany had implemented significant reforms in the five years preceding the evaluation to strengthen its AML/CFT system. The 2022 Mutual Evaluation Report notably assessed Germany’s oversight of the NPO sector as strong and proportionate. [14] Germany has extremely large and diverse financial and designated non-financial business and professional (DNFBP) sectors, and the evaluation identified challenges in coordinating the large number of supervisory bodies and ensuring consistent risk-based approaches. For NPOs and charities, the relevant supervisory risk picture is shaped by the scale and international reach of the German charitable sector, which — as in England and France — includes organisations operating in conflict-affected regions where the risk of inadvertent engagement with designated persons is heightened.

Germany’s enforcement landscape has become increasingly active. In April 2025, the German Economic Ministry (Bundesministerium für Wirtschaft und Energie, BMWE) published an official digest of criminal enforcement cases related to Russia sanctions, including cases in which courts ordered the confiscation of assets ranging between EUR 880,000 and EUR 30 million. [15] Criminal enforcement of sanctions is carried out through the AWG, with intentional violations constituting criminal offences. Germany has not yet transposed EU Directive 2024/1226 on minimum standards for the definition of criminal offences and penalties for violations of EU sanctions (which EU Member States were required to implement by 20 May 2025), and the European Commission has opened infringement proceedings against Germany and 17 further Member States for this failure. [16] The new Merz administration, which took office in May 2025, is expected to present an implementation bill in due course.

Sanctions: Landscape and Trends

 

Across England, France, and Germany, three structural themes recur in the application of financial sanctions to the charity and NPO sector.

1. First, strict liability. In each jurisdiction, the prohibition on dealing with designated persons operates without a requirement to establish intent. A charity that inadvertently channels funds through a designated intermediary is in breach regardless of its knowledge or good faith. This imposes a higher compliance burden on the sector than would a fault-based regime, and is especially demanding for smaller organisations with limited compliance resources.
2. Second, de-risking. Financial institutions across all three jurisdictions have adopted risk-averse approaches that result in the withdrawal of banking services from charities operating in high-risk jurisdictions or with connections to regions subject to comprehensive sanctions regimes. This ‘de-risking’ phenomenon — identified by the FATF as an unintended consequence of disproportionate sanctions implementation — is itself a driver of the 2023 revisions to R8, which emphasise that measures should not unduly disrupt legitimate NPO activity. [17] The tension between a bank’s legitimate desire to manage its own sanctions exposure and an NPO’s need for reliable financial access remains unresolved in all three jurisdictions.
3. Third, licensing and carve-outs. Each jurisdiction provides mechanisms — whether through OFSI licences in England and Wales, DG Trésor authorisations in France, or Deutsche Bundesbank and BAFA licence applications in Germany — by which charities can seek permission to engage in activity that would otherwise be prohibited. The availability and accessibility of these mechanisms is central to whether R8 is being applied proportionately. A regime with robust prohibitions but no meaningful licensing pathway for genuine humanitarian actors will struggle to achieve positive IO10 outcomes, since it will push NPO activity outside formal channels rather than managing the risk within them.

 

Implications for R8 compliance and IO10 outcomes

 

The revised R8, read alongside the updated FATF Best Practices and the new unintended consequences procedure of July 2025, signals a clear direction of travel: jurisdictions that treat the entire NPO sector as a category of risk — rather than applying focused, risk-proportionate measures calibrated to the actual profile of at-risk organisations — will find it increasingly difficult to score well in 5th round mutual evaluations.

In practical terms, this means that states should ensure their financial sanctions regimes for NPOs reflect the following principles derived from R8: (i) that supervision of NPOs for sanctions compliance is targeted at those within the FATF’s definition, rather than applied wholesale to the sector;

(ii) that guidance to the NPO sector is specific, accessible, and proportionate to organisational capacity;

(iii) that licensing mechanisms for humanitarian operations are efficient, predictable, and accessible;

(iv) that inter-agency coordination — between the sanctions enforcement body, the charity regulator, and the FIU — is effective; and

(v) that enforcement action against NPOs is accompanied by public reporting that enables the sector to learn from outcomes, as OFSI’s practice of public disclosure demonstrates.

The enforcement data from England and the operational statistics from France’s TRACFIN illustrate that scrutiny of the NPO sector within these regimes is real and growing. Germany’s strengthened enforcement architecture, introduced through the SDG II, similarly signals increasing operational capacity. Active due diligence, periodic screening of counterparties against relevant sanctions lists, and the maintenance of documented compliance procedures are not merely best practice; they are the operational standard against which exposure will be assessed.

 

Future Direction

 

The financial sanctions regimes in England, France, and Germany each reflect a shared set of underlying international obligations. drawn from the UN Security Council framework and, for France and Germany, from EU common foreign and security policy, while exhibiting important structural differences in their enforcement architecture, licensing mechanisms, and the administrative bodies responsible for the sector. The interaction of these regimes with charities and NPOs presents both a compliance risk for individual organisations and a systemic challenge for states seeking to achieve positive IO10 outcomes under FATF’s framework. Ultimately, NPOs and corresponding governments alike will need to balance the integrity of the financial systems in place against abuse by terrorist actors. At the same time, against this backdrop, governments need to address some of the  damage caused by a decade of areas of disproportionate FATF standards implementation. The practical implication is that the regulatory environment is simultaneously becoming more demanding in its enforcement expectations and more nuanced in its risk-differentiated approach. Both dimensions require active, informed engagement, and require a regular understanding of the changing regulatory and risk environment in order to stay relevant and credible.

Notes

[1] FATF, ‘Protecting non-profits from abuse for terrorist financing through the risk-based implementation of revised FATF Recommendation 8’, 16 November 2023, available here; FATF, ‘Best Practices on Combating the Abuse of Non-Profit Organisations’, November 2023, available here

[2] FATF, ‘FATF Launches New Procedure to Address Unintended Consequences Affecting Non-Profit Organisations’, 10 July 2025, available here

[3] FATF, ‘2022 Procedures for the FATF AML/CFT/CPF Mutual Evaluations, Follow-Up and ICRG’, available here

[4] OFSI, ‘Financial sanctions guidance for charities and non-governmental organisations (NGOs)’, available here

[5] OFSI, ‘Annual Review 2024-25: Effective Sanctions’, October 2025, available here

[6] White & Case LLP, ‘UK Sanctions Update: Key takeaways from the OFSI Annual Review’, available here

[7] FCDO, ‘UK Sanctions List Search’, available here

[8] Direction Générale du Trésor, ‘Gel des avoirs — registre national’, available here

[9] FATF, ‘Mutual Evaluation of France’, May 2022, available here

[10] ACPR, ‘Lignes directrices gel des avoirs’, 16 June 2021, available here

[11] Actu-Juridique, ‘L’activité de Tracfin s’intensifie’, available here (summarising TRACFIN’s 2023 annual activity report)

[12] Noerr, ‘Update: Second German Sanctions Enforcement Act enters into force’, available here

[13] AlixPartners/ICLG, ‘Germany — Sanctions 2026’, available here (last updated 2 October 2025)

[14] FATF, ‘Anti-money laundering and counter-terrorist financing measures — Germany, Mutual Evaluation Report’, August 2022, available here

[15] ICLG, ‘Germany — Sanctions 2026’, op. cit., para. 1.3 (citing BMWE criminal enforcement digest, April 2025).

[16] Ibid. (citing European Commission infringement proceedings for failure to implement Directive 2024/1226 by 20 May 2025).

[17] FATF, ‘FATF Launches New Procedure to Address Unintended Consequences Affecting Non-Profit Organisations’, op. cit.; FATF, ‘Best Practices on Combating the Abuse of Non-Profit Organisations’, op. cit.

[18] Aarti Thakor is a leading English charity barrister in Mishcon de Reya and served as the English and Welsh Charity Regulator’s chief legal and accountancy director until 2024. She currently specialises in international charity regulation, governance and philanthropy.