This is particularly important for Latvian companies for several reasons. The EU has adopted Directive (EU) 2024/1226, which aims, among other things, to harmonise the approach to criminal offences involving breaches of sanctions and to penalties for such breaches. Directive (EU) 2024/1226 was to be transposed by 20 May 2025. In Latvia, the principal implementing amendments entered into force on 10 June 2025. The issue is therefore no longer a future convergence of legislation, but an operating model of administrative and criminal liability. Latvian regulation is already designed so that liability may arise at several levels at once: for the company itself, for responsible officers and, in certain cases, in criminal-law proceedings through the application of measures to a legal person.

Why sanctions risk can no longer be treated as an “external” problem

In many companies, sanctions are still perceived as a list-screening exercise before a payment or shipment. That approach is no longer sufficient. Latvia’s Law on International and National Sanctions expressly requires supervised entities to carry out and document a sanctions risk assessment and, on that basis, establish an internal control system, including policies, procedures, allocation of resources and staff training.

This is an important shift. The law is based not on the logic of a one-off check, but on systematic risk management. In other words, the regulator considers not only whether a particular prohibited payment or delivery took place, but also whether the company had an effective framework capable of preventing such breaches. Management risk therefore arises not only in the event of a direct breach of sanctions, but also where the company lacks an adequate model for control, escalation and decision-making.

Where management risk arises

For the supervisory board, management board and senior management, sanctions risk will usually materialise in one of five areas.

The first area is an incorrect assessment of a counterparty. Formally, a company may be dealing not with a person on a sanctions list, but with that person’s distributor, agent, logistics intermediary or an entity effectively controlled by a sanctioned person. If the company limits itself to a superficial name check and does not analyse ownership, control, the supply chain and the economic rationale of the transaction, this creates not only a risk of a breach but also questions about the quality of management oversight.

The second area is the circumvention of sanctions through intermediaries and third countries. The FIU and sanctions-indicator materials published in Latvia expressly point to the need to pay attention to circumvention schemes involving transit jurisdictions, unusual routes, changes in product descriptions, atypical payment terms and chains of companies with no clear economic function.

The third area is the gap between a formal policy and actual practice. Very often, a company has a policy on paper but lacks an effective procedure: who makes the stop/go decision, who reviews exceptions, who documents the reasoning, who liaises with the bank, and who notifies the FIU if suspicions arise. In such a situation, the issue quickly moves from an “operational error” to a “management-control failure”.

The fourth area is the failure to act on internal red flags. If employees have reported a questionable counterparty, an unusual transaction structure, a change of route or suspicious urgency, and management has not ensured a review and documented decision, this weakens the company’s position in any subsequent dispute or investigation. For the management board, the danger is that the risk begins to look not like an isolated error, but like deliberate inaction or inadequate oversight.

The fifth area is an incorrect response after a problem has been identified. Often, the key risk arises not at the moment of the initial error, but afterwards, when the company tries to “complete the paperwork”, finalise a shipment already underway, expedite a payment or internally agree not to raise the issue. This stage is particularly sensitive from the perspective of subsequent administrative and criminal assessment.

How liability is allocated in Latvia

From a Latvian perspective, it is important to distinguish at least three levels of consequences.

The first level is administrative or criminal liability for a breach of sanctions restrictions. For transport, transit and logistics companies, risk may arise, for example, from transporting or moving sanctioned goods, providing prohibited services, participating in a supply through intermediaries or facilitating sanctions circumvention. Depending on the nature of the breach, the value of the goods or services and other circumstances, the matter may be dealt with in administrative or criminal proceedings.

A separate regime applies to persons supervised by competent authorities, including, in particular, entities subject to AML regulatory requirements, as well as certain licensed and professional categories. For them, failure to comply with requirements relating to the internal control system and sanctions-risk management may result in a warning, a fine of up to EUR 1,000,000 and, where provided by law, restrictions on or termination of activities, or the suspension or revocation of a licence or registration.

The second level is administrative or criminal liability for the sanctions breach itself. Latvian law draws a distinction under which some breaches entail administrative liability, while more serious cases give rise to criminal liability. In particular, the law expressly links the criminal-law dimension to breaches that meet a higher threshold of public harm and value, while less serious cases are subject to administrative proceedings conducted by the State Revenue Service (VID).

The third level is the liability of a legal person in criminal proceedings. Under Latvian law, coercive measures may be applied to a legal person if a criminal offence was committed in its interests, for its benefit, or became possible as a result of inadequate supervision or control by a person acting on behalf of the company, making decisions or exercising control within it. Depending on the circumstances, the law provides for measures including liquidation, restriction of rights, confiscation of property and a monetary penalty.

This is where sanctions become a matter for the management board and supervisory board. The question is no longer only whether “the company breached a rule”, but also how the management control function was organised.

What reduces management risk in practice

For management, the strongest argument in a contentious situation is not a general statement that “we tried to comply with the law”, but evidence that the company has established an effective system.

Today, the minimum set of measures looks as follows:

1. The company has carried out and documented a sanctions risk assessment tailored to its business profile.
2. Specific responsible persons have been appointed and an escalation process has been defined.
3. Counterparty checks go beyond name screening and include an analysis of ownership, control, geography, goods, routing and payment flows.
4. Red flags are described in the procedures, and staff are trained to recognise them.
5. For disputed cases, a documented decision trail is retained: who reviewed the matter, what was identified and why the transaction was stopped, permitted or referred for further review.
6. The company understands when it is necessary to refrain from performing a transaction, freeze assets, seek clarification or provide information to a competent authority.

It should also be remembered that Latvian law protects good-faith conduct. It expressly provides that, under certain conditions, a person, its management and employees do not incur legal liability, including civil liability, for a good-faith report of information about possible breaches, a good-faith refusal to establish or continue a business relationship, non-performance of a transaction, or the freezing of funds and economic resources when applying a sanctions regime.

This is an important practical signal: the law not only penalises the ignoring of sanctions, but also protects a business that in good faith stops a risky operation.

What to do if a problem has already been identified

If a potential sanctions incident is identified within the company, management’s task is not first to assess the reputational discomfort, but to stabilise the legal position immediately.

A sensible sequence of actions will usually be to stop the disputed operation, preserve documents and correspondence, limit the internal circle of participants, conduct an urgent legal review, document the factual circumstances, determine whether a report or engagement with a competent authority is required, and only then make decisions on external communications. If the situation affects a group of companies, a supply chain or several jurisdictions, the investigation should be conducted in a coordinated manner. Otherwise, the company may quickly face inconsistent explanations and documents.

Practical conclusion

In 2026, sanctions risk can no longer be described as a specialist issue for a compliance officer or an external lawyer “just in case”. It is a matter of corporate governance, the personal responsibility of management and the resilience of the business model.

For the supervisory board and management board, the main question today is not: “Do we have a sanctions policy?” A more accurate question is: can we demonstrate that the company genuinely identifies, assesses and controls sanctions risk in real transactions?

If the answer is not clear, it is necessary to review not only the documents, but also the architecture of decision-making itself.

How NJORD can help

NJORD advises companies and their management on sanctions compliance, including sanctions risk assessments, reviews of counterparties and supply chains, and the development or review of internal policies and procedures. We also help to establish practical escalation and decision-documentation processes, conduct an internal review when a potential sanctions incident is identified, and organise engagement with banks and competent authorities.

For companies in the transit, logistics and trade sectors, NJORD can offer solutions tailored to the specific features of routes, goods, intermediaries, payment flows and cross-border supply chains.