Policy Brief “Sanctions Licensing Mechanism in the EU, US and UK Sanctions Policy”

This policy brief summarises the findings of an analytical study of the authorisation mechanism (licensing mechanism) within the sanctions frameworks of the European Union, the United States and the United Kingdom, including its legal basis, institutional models and application procedures.

The study aims to examine how sanctions derogations make it possible to balance strong economic pressure on the aggressor state and those supporting it with the protection of fundamental human rights, the interests of European, American and British businesses, and humanitarian needs. The study forms part of the efforts of the Institute of Legislative Ideas analytical centre to develop a roadmap for improving Ukraine’s national sanctions framework in the context of the Russian Federation’s armed aggression, aligning it with EU law, and ensuring an effective response to schemes aimed at circumventing restrictive measures.

The brief examines the dichotomy between supranational decision-making at the level of the Council of the EU and decentralised implementation by national competent authorities (NCAs), as well as the legal basis for sanctions derogations in the United States and the United Kingdom. It also analyses the procedural aspects of submitting and reviewing applications, the legal consequences of refusals, and the mechanisms available for challenging such decisions.

Based on an analysis of leading international practices and taking into account Ukraine’s European integration trajectory, the study proposes draft wording for an article of the Law of Ukraine “On Sanctions” introducing a national sanctions authorisation mechanism. Such a mechanism is intended to make the application of sanctions more flexible, transparent and predictable, while also facilitating the implementation of Directive (EU) 2024/1226 and the harmonisation of Ukraine’s criminal legislation on combating sanctions circumvention.

Restrictive measures have evolved from targeted limitations into a comprehensive instrument of political and economic containment. This transformation reflects the fundamental geopolitical objectives of the EU, the United Kingdom and the United States: to weaken the economic base of the aggressor state, deprive it of unrestricted access to critical Western technologies, financial markets and services, and thereby significantly constrain its ability to finance and wage a war of aggression. These are unilateral measures adopted independently, without the consent of the other party and without legal authorisation from the UN Security Council. Their use is a direct response to the crisis of the international security architecture caused by the aggressor state itself repeatedly blocking relevant Security Council resolutions.

The scale of these restrictive measures is unprecedented. They extend far beyond the conventional freezing of assets and travel bans imposed on specific individuals. They include comprehensive embargoes on arms and dual-use goods, restrictions on the export of technologies, the immobilisation of the aggressor state’s central bank assets, financial restrictions, bans on the import of raw materials, restrictions on propaganda media, prohibitions on the provision of key services, and measures affecting the transport and logistics sectors. These measures encompass both vertical, or targeted, sanctions imposed on thousands of specific individuals and legal entities, including political figures, military leaders, oligarchs and companies, and horizontal, or sectoral, sanctions targeting particular sectors of the economy or types of economic activity irrespective of the specific actors involved.

Given their breadth, restrictive measures inevitably affect the legitimate rights and economic interests not only of designated persons but also of citizens and economic operators in the EU, the United States and the United Kingdom, as well as third parties. In jurisdictions founded on respect for human rights, the rule of law and the principle of proportionality, this has created a need to strike an appropriate balance, since foreign and security policy remains embedded within the broader legal order.

It is precisely to maintain this balance, minimise the adverse impact of sanctions on human rights and fundamental freedoms, protect critical economic interests, support global humanitarian objectives and prevent disproportionate collateral effects that sanctions law provides for an extensive system of derogations from sanctions prohibitions. On the basis of these legally established derogations, national competent authorities are empowered to issue authorisations or licences permitting actions that, in the absence of such an administrative decision, would constitute a breach of the applicable sanctions regime, including, in certain cases, a criminal offence. The authorisation mechanism therefore serves as a critical safeguard that preserves the legitimacy of sanctions and ensures their compatibility with the fundamental principles of a democratic legal order.

A comparative study of the experience of EU Member States in sanctions licensing is of strategic importance for Ukraine. The EU is a leading jurisdiction in the design and implementation of sanctions regimes and offers highly developed models of public administration in this field. Drawing on European practices through the analysis of both the applicable legal framework and enforcement practice is an essential prerequisite for developing an effective national sanctions policy in Ukraine. Ultimately, the introduction of an authorisation mechanism is also a necessary step in fulfilling Ukraine’s European integration commitments on its path towards full membership of the European Union.

In the EU, each sanctions regime is based on a corresponding Council Decision and Council Regulation. The former sets out the Union’s conceptual and political approach to a specific geographical or thematic issue and is binding on the Member States. It applies directly at the national level in matters such as arms embargoes or visa restrictions.

Where broad economic and financial restrictions are introduced, including asset freezes, export and import prohibitions, and restrictions on financial services, the EU’s economic competence is engaged. The Council then adopts regulations, which are directly applicable and binding in their entirety in all Member States without requiring national implementing legislation. They create direct legal obligations for all natural and legal persons subject to EU jurisdiction.

These regulations provide the legal basis for the activities of the national competent authorities of the Member States (hereinafter, NCAs), which are entrusted with discretionary powers to authorise derogations from sanctions restrictions within clearly defined limits. At the same time, the European Commission (hereinafter, the Commission) performs a supervisory and interpretative role, supporting the authorisation mechanism through soft-law instruments.

The Anglo-American model of sanctions regulation combines broad delegated powers of the executive branch with a high degree of procedural flexibility. In the United States and the United Kingdom, statutory legislation — the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) in the United States, and the Sanctions and Anti-Money Laundering Act 2018 (SAMLA) in the United Kingdom — establishes only the general framework of executive authority. More detailed rules are adopted through Presidential Executive Orders and provisions of the Code of Federal Regulations in the United States, or through government regulations in the United Kingdom.

Statutory exemptions and administrative derogations (authorisations)

In sanctions law, the scope of prohibitive rules is limited through two conceptually distinct mechanisms: statutory exemptions and administrative derogations or authorisations. Although these mechanisms are closely related, they must be distinguished from one another. Understanding this legal dichotomy is fundamental to the proper design and application of an authorisation mechanism.

An exemption means that a specifically defined activity, such as a humanitarian transaction, or a particular category of persons is automatically excluded from the scope of a general sanctions prohibition, without the need to apply for an authorisation. Council Regulations typically formulate exemptions as follows: “Article X shall not apply to …” or “Article X shall not apply in relation to …” Given that exemptions may create risks to the integrity of a sanctions regime, they are interpreted narrowly. For example, Council Regulation (EU) No 269/2014 contains only four such exemptions, the most significant of which concerns EU humanitarian partners that may carry out transactions for humanitarian purposes in Ukraine. By contrast, Council Regulation (EU) No 833/2014 contains a broader range of autonomous exemptions, including those relating to medical supplies, the prevention of environmental disasters, and the activities of diplomatic missions, among others.

Derogations, by contrast, are controlled relaxations of sanctions prohibitions that require completion of a mandatory authorisation procedure. An activity falling within the scope of a derogation remains prohibited until the relevant person applies to the NCA, demonstrates the existence of exceptional grounds, undergoes a comprehensive risk assessment and obtains a formal administrative act in the form of an authorisation or licence. Most provisions of EU sanctions regulations dealing with derogations set out in detail the grounds on which such authorisations may be granted. They are typically formulated along the following lines: “The competent authorities may authorise …, under such conditions as they deem appropriate, if …” Unlike the sanctions legislation of the United States and the United Kingdom, which uses the term license, EU sanctions regulations use the term authorisation to denote such derogations.

Objectives and types of derogations

The authorisation mechanism is an integral component of sanctions regimes, arising from the very nature and objectives of sanctions. Derogations pursue the following objectives:

• Humanitarian and medical objectives are aimed at preventing humanitarian crises and disproportionate harm to civilian populations. In particular, under the EU Guidelines, sanctions are targeted measures intended to affect the military and political elite while minimising consequences for those not responsible for the conduct concerned. Authorisations may be granted to ensure the supply of agricultural, medical and pharmaceutical products, as well as to meet the basic needs of designated individuals and their families, including food, rent, medical treatment and taxes.

• Human rights and institutional objectives reflect respect for international law and fundamental human rights. The fundamental right to an effective remedy requires designated persons to be able to obtain the release of frozen funds in order to pay reasonable professional fees for legal services and cover litigation expenses, which is essential for challenging the sanctions themselves. Authorisations also ensure the uninterrupted functioning of diplomatic missions and international organisations.

• Economic objectives, including the protection of the economy of the sanctioning state or jurisdiction, take into account the degree of integration between the European, British, American and Russian economies. To avoid energy disruption and other adverse economic consequences for the EU, the United States and the United Kingdom, derogations are provided for the import of critical raw materials, the maintenance of civilian nuclear energy activities, the termination of pre-existing contracts and the orderly withdrawal of capital from the Russian market.

• Security and environmental objectives allow otherwise prohibited activities to be authorised where strictly necessary to prevent environmental or technological emergencies, respond to natural disasters, or ensure the safety of maritime navigation and civil aviation.

Depending on their degree of specificity, derogations may be divided into universal derogations, which are potentially available to any person in any Member State, for example for humanitarian needs, and narrowly targeted derogations designed for a specific project, such as the maintenance of Budapest Metro rolling stock.

OFAC in the United States and OFSI in the United Kingdom widely distinguish between specific licences and general licences. A general licence allows an undefined group of persons meeting specified criteria to carry out standard types of transactions without applying to the regulator on each occasion.

In the EU legal system, however, the use of general authorisations has long been the subject of debate. Despite the reference to general authorisations in Article 2a(2) of Regulation (EU) No 269/2014 and the absence of an explicit prohibition on them in other provisions of EU sanctions regulations, the European Commission maintains that NCAs should assess applications “on a case-by-case basis” and issue individual authorisations. A general authorisation effectively amounts to automatic approval of a particular category of activity, which more closely resembles an exemption, the introduction of which falls within the exclusive competence of the Council of the EU. This position is supported by the judgment of the Court of Justice of the European Union in Europäisch-Iranische Handelsbank AG v Council (C-585/13 P).

In its guidance, the European Commission recommends that Member State NCAs avoid abstract general licences and instead use framework authorisations. At the applicant’s request, an NCA may grant a time-limited authorisation covering a series of identical recurring transactions. This significantly reduces the administrative burden because the applicant does not need to obtain a new authorisation for each individual transaction, while preserving individualised oversight, since the authorisation is granted to a specific person and is accompanied by an obligation to provide detailed subsequent reporting.

NCAs in EU Member States

Because the implementation of supranational EU regulations is entrusted to the Member States, whose legal systems retain significant differences, national authorisation mechanisms vary in their institutional design.

From an institutional perspective, the decentralised model predominates. Powers are distributed among specialised ministries, customs authorities and financial intelligence units, creating a need for robust mechanisms of inter-agency cooperation and coordination. This model is based on allocating powers among multiple authorities depending on the type of restrictive measure concerned. Its rationale is to make use of the specialised expertise of each authority in the areas to which a particular derogation may relate.

Germany provides a classic example of such differentiation. The Bundesbank is the NCA responsible for financial sanctions and considers applications for the release of frozen funds, while the Federal Office for Economic Affairs and Export Control (BAFA), operating within the remit of the Federal Ministry for Economic Affairs, is responsible for economic resources, trade restrictions and the provision of services.

In Croatia, Romania and Estonia, the number of responsible NCAs is considerably higher. In Romania, for example, more than 15 public institutions are involved in issuing different types of authorisations. Despite the clear advantages in terms of specialised expertise, this model also has shortcomings, including a high risk of legal uncertainty for applicants involved in complex transactions at the intersection of finance and trade, as well as the complexity of domestic coordination.

By contrast, the centralised model based on a one-stop-shop principle responds to excessive institutional fragmentation. Malta, for example, has established a unique collegial body, the Sanctions Monitoring Board (SMB), whose status is defined by specific legislation. It comprises 18 senior officials representing all key ministries and authorities.

Cyprus has established the National Sanctions Implementation Unit (NSIU) within the Ministry of Finance. In Latvia, the Financial Intelligence Unit (FIU) has become the principal decision-making centre. In the Czech Republic, the Financial Analytical Office (FAU) serves as the single coordinating authority responsible for considering the vast majority of applications, with the exception of military exports.

The advantages of the centralised model include greater consistency in enforcement practice, faster decision-making and greater convenience for applicants. Its principal disadvantage is the need for the staff of a single authority to possess multidisciplinary expertise across a wide range of sectors.

A common trend across the EU in recent years has been the growing role of financial intelligence units in issuing sanctions authorisations. Institutions originally established to combat money laundering have proved particularly well equipped, both methodologically and technically, to identify complex sanctions circumvention schemes and establish ultimate beneficial ownership.

All jurisdictions have introduced close coordination between different NCAs, between NCAs and other public authorities and institutions, and between NCAs of different Member States and the Commission. Some jurisdictions have established mandatory inter-agency approval procedures in which the Ministry of Foreign Affairs often plays a central role, helping ensure that authorisations granted are consistent with the objectives of the EU’s Common Foreign and Security Policy.

For the authorisation mechanism to be triggered, both a formal and a procedural element must be present. The formal prerequisite for initiating individual licensing is the existence of a relevant clause directly in the text of an EU Regulation, the US Code of Federal Regulations or a UK government regulation, since NCAs do not have “law-making discretion” to expand the available grounds. A derogation may be granted only where this is expressly provided for by the applicable sanctions legislation.

The procedural element is the application or request submitted to the NCA. The legal framework governs who may submit an application, the requirements concerning its form and content, and the method of submission.

The legal regulation of the authorisation mechanism in EU Member States is based on a mixed regulatory framework combining specific sanctions law with general administrative law. The prevailing practice is to adopt a dedicated framework law on sanctions or the implementation of international sanctions, which generally relies on procedural provisions of national administrative law. Specific sanctions legislation usually contains one or two provisions directly governing the granting of authorisations as lex specialis, while other procedural aspects are governed by general administrative legislation as lex generalis.

Since such laws usually contain only one or two provisions concerning the implementation of derogations, some states, particularly post-socialist countries, provide more detailed regulation at the level of secondary legislation. Latvia, Lithuania, Romania and Estonia have particularly detailed subordinate regulatory frameworks.

Some NCAs in EU Member States prepare and regularly update frequently asked questions and publish national guidance, guidelines and recommendations on the implementation of derogations, developing similar instruments issued by the Commission. The official webpages of the UK’s OFSI provide a notable example of such explanatory guidance.

Applicants and requirements for applications (requests)

A distinctive feature of the authorisation mechanism is that the legal interest in obtaining permission to release frozen assets or carry out a transaction is not limited to designated persons. A significant proportion of applications are submitted by so-called “interested third parties”. These include, in particular, exporting companies, creditors of designated persons, business counterparties and humanitarian organisations. Since access to legal assistance is a fundamental right, all jurisdictions permit applicants to be represented in authorisation procedures.

In certain jurisdictions, sanctions legislation expressly provides for an authorisation to be granted under a derogation on the NCA’s own initiative. At first sight, granting an authorisation without a specific request from an interested party may appear unusual. However, this is readily explained in the context of general licences, where an NCA acts proactively in anticipation of a large number of applications.

Each application must contain, at a minimum:

• accurate identification and contact details of the applicant, including their legal status

• comprehensive information on the other parties to the transaction, including the debtor, creditor, ultimate beneficial owner and banking institutions that will process the financial transactions

• the legal basis for the derogation, including a precise reference to the relevant legal act or regulation and the specific article, paragraph or subparagraph providing for the possibility of a derogation

• details of the transaction or activity, including the amount of funds in the relevant currency or a specification of the goods, with mandatory customs codes and technical descriptions, as well as a description of the proposed activity

• justification that the conditions for the derogation are satisfied, including a reasoned demonstration that the proposed derogation is consistent with the purpose of the sanctions regime, is strictly necessary to achieve the objectives set out in the regulation, and complies with any other conditions contained in the relevant derogation provision

• any other information that may be required to decide whether an authorisation should be granted

If only an application or request is submitted without supporting documentation, it may be left without consideration or returned to the applicant. NCAs require applicants to prepare a comprehensive evidentiary package, which increases the prospects of a favourable decision. They may request additional information or documents from the applicant or any other person where necessary to assess whether an authorisation may be granted and may establish specific requirements that such documents must satisfy. These broad powers of NCAs correspond to the applicant’s obligation to make sufficient efforts to satisfy the authority that the relevant conditions are met.

The authorisation procedure is characterised by an asymmetric allocation of responsibility for establishing the relevant facts: the entire “burden of proof” rests with the applicant. In practice, NCAs do not conduct investigations to identify grounds in favour of an applicant and are not required to act as advisers or fill evidentiary gaps. Instead, applicants are expected to demonstrate unequivocally that they are entitled to the derogation sought.

Because the application process may be difficult for applicants to navigate, NCAs generally publish accessible instructions, recommendations and guidance on their websites.

Form and method of submitting an application (request)

EU Member States can be divided into two groups depending on whether standardised application forms for authorisations have been developed and published:

• states with approved mandatory or recommended templates, such as Cyprus, Malta, the Czech Republic and Ireland. A form may be mandatory, but more commonly it is recommended, with the substance of the request and the persuasiveness of the applicant’s case taking precedence over formal presentation

• states whose NCAs have not adopted specific forms, meaning that applications for authorisations may be submitted in a relatively flexible format, such as Slovenia and Lithuania

Most NCAs require documents to be submitted in the official language of the state. Documents in a foreign language are accepted where accompanied by a translation into the official language in accordance with the procedure prescribed by law. In some states, applications may also be submitted in English.

Most Member States consider applications for sanctions derogations free of charge. In some jurisdictions, however, where the application concerns derogations from sectoral economic sanctions rather than basic-needs derogations and requires extensive expert review, an administrative fee may be charged.

Applications must be submitted in written or electronic form, while the available methods range from traditional paper submissions to modern digital platforms. In the financial sector, applications concerning the release of frozen funds are most commonly submitted as PDF documents by email to the NCA. Applications may also be submitted in paper form to the NCA’s postal address or electronically to its designated email address. Applications for export or import licences are generally submitted through dedicated online portals.

In the United States and the United Kingdom, electronic submission through specialised government web portals is the principal method of applying. This standardises data entry and accelerates processing. In the United States, applications are submitted through the OFAC Licensing Portal, while submission by ordinary mail is exceptional. In the United Kingdom, applications are submitted through an online form on the government portal.

Time limits for consideration

The legislation of EU Member States is not fully harmonised with regard to time limits for considering applications for authorisations. A general processing period is usually established for ordinary cases, although this period may be shortened in urgent cases or extended where additional circumstances must be clarified or the case is particularly complex.

The standard processing period is generally around 30 days, with the possibility of expedited consideration of humanitarian requests. These periods begin to run only once a complete set of documents has been submitted. If the applicant amends the application, for example by adding a new document or changing the legal argument, the time limit starts again.

In some jurisdictions, no statutory processing period is established. NCAs explain this on the basis that processing time depends on the complexity of the request and the circumstances of each individual case.

A special rule is expressly provided for in Article 2a(3) of Council Regulation (EU) No 269/2014. In relation to humanitarian derogations, a mandatory “tacit approval” rule applies: if the national authority neither adopts a decision refusing the application nor requests additional information within five working days of receiving it, the authorisation is legally deemed to have been granted.

In matters not regulated by EU Regulations, national law applies. In some countries, however, the opposite rule applies to all other cases, except those governed by Article 2a(3) of Regulation (EU) No 269/2014: a presumption of refusal. Where the NCA does not provide a formal response within the prescribed period, this is treated as a formal decision refusing the authorisation. This mechanism protects applicants from prolonged legal uncertainty by enabling them to seek judicial review.

In the United States and the United Kingdom, processing times are not subject to statutory limits and depend on the complexity of the case, with consideration generally taking several months. The United Kingdom has introduced a system for prioritising applications based on seven criteria, including the nature of the purpose pursued, the impact on the economy and reputational risks.

Assessment of the application

Obtaining a licence or authorisation is treated not as an individual entitlement but as an exceptional administrative privilege subject to the doctrine of “residual discretion”. This allows the authority to refuse an application even where all formal criteria are satisfied if the proposed transaction conflicts with the broader geopolitical objectives of the sanctions regime or with national interests.

Although an NCA may not refuse an authorisation arbitrarily, the reasoning provided in a refusal may nevertheless be limited to general considerations concerning the risk of sanctions circumvention, inconsistency with national interests or incompatibility with the objectives of the sanctions regime.

NCAs first assess whether an application complies with procedural formalities. Where these requirements are not met, they may decide not to consider the application and/or return it to the applicant. Administrative procedures may also provide for the application to be forwarded to another competent NCA where the applicant has incorrectly identified the responsible authority.

The NCA is not limited to the documents submitted by the applicant. It may actively analyse other information already available to it, consult public registers, other NCAs under a decentralised model, other public authorities and even third parties, including legal entities and individuals, where they are required to cooperate with the NCA on matters falling within its competence. The NCA may also request additional justification or documents from the applicant and consult NCAs in other states.

When deciding whether to grant an authorisation, the NCA performs a key gatekeeping function in preventing sanctions circumvention. It may refuse an authorisation where it has credible grounds, derived from confidential or publicly available sources, to suspect that the transaction may be used to circumvent sanctions.

Within the EU, NCAs enjoy broad administrative discretion, but that discretion is not arbitrary. It is constrained by the requirements of the Charter of Fundamental Rights of the European Union. The Court of Justice of the European Union has developed case law defining the limits of NCA powers when considering applications: discretion is constrained by the need to strike a fair balance between the effectiveness of restrictive measures and the protection of fundamental rights. A refusal to grant an authorisation may not be based on considerations falling outside the criteria established by the relevant regulation or on grounds that would render the authorisation mechanism practically ineffective.

NCA decisions

Following consideration of an application for an authorisation under a derogation, the NCA adopts an administrative act, the nature of which depends on the completeness of the information provided and the substantive justification for the request.

A favourable decision takes the form of an individual authorisation or licence. This is an individual administrative act permitting a specific natural or legal person to carry out a clearly defined one-off or continuing transaction, specifying the exact amounts, counterparties, banking institutions and other relevant details.

General licences are less a response to an individual applicant than a regulatory response by the NCA to an existing or anticipated large volume of requests relating to the same type of derogation, provided that issuing such a licence does not undermine the effectiveness of the restrictive measure.

A positive decision to grant an authorisation requires strict and unequivocal demonstration that the purpose of the planned transaction or other activity falls within one of the derogations expressly and exhaustively provided for in the applicable sanctions regulations, that there is no risk of sanctions circumvention or that such risk is acceptably low, and that the proposed activity is not contrary to the national interests of the Member State.

An authorisation is also strictly personal in nature. It may not be transferred or assigned to another person for use by that person.

The NCA adopts a negative decision where it concludes that there are no substantive legal grounds for applying the derogation, where mandatory approval from another authority has not been obtained, where it identifies risks of sanctions circumvention, or where it considers the derogation inappropriate in light of national interests. A refusal must be reasoned, although the level of detail in the reasoning may vary.

The NCA notifies the applicant of its decision in writing or electronically. Following a refusal, the applicant has limited opportunities to submit the same request again. Since an NCA decision constitutes an administrative act, the principle of legal validity applies, preventing repeated consideration of identical applications.

Given the risks of sanctions circumvention, granting an authorisation does not mean that the authorised activity is left without oversight. NCAs actively exercise their discretion to impose additional conditions concerning the manner, timing and other aspects of the authorised activity.

Both legislation and the conditions of the authorisation itself may require the holder of an individual authorisation, or a person relying on a published general licence, to comply with ex post reporting obligations. Reporting requirements are generally specified directly in the authorisation.

An authorisation granted under a derogation does not confer an irrevocable acquired right on the applicant to carry out the authorised activities. NCAs may revoke, annul or amend an authorisation.

The most obvious ground for revocation is a breach of the conditions imposed by the authorisation itself, which may also give rise to liability for violating the terms of the authorisation. An authorisation may be annulled where it is subsequently established that it was granted on the basis of incomplete or falsified information. It may also be amended either by the NCA itself, for example following a partial change to the sanctions regime, or upon a reasoned request from the applicant.

Directive (EU) 2024/1226 requires EU Member States to ensure that the intentional breach or failure to comply with conditions imposed under authorisations granted by NCAs for activities that would otherwise violate a prohibition or restriction constituting a Union restrictive measure is treated as a criminal offence under national law.

In the United States and the United Kingdom, breach of the conditions of a licence also constitutes an offence and may result in civil monetary penalties and criminal sanctions.

Appeals and judicial review

The systems of legal protection against unlawful NCA decisions or inaction in the United States and the United Kingdom are characterised by the near absence of internal administrative appeal mechanisms, meaning that applicants generally proceed directly to court.

The threshold for judicial intervention is high. Courts do not reassess the merits or expediency of the decision itself but review it against general public-law standards, including legality, rationality and procedural fairness.

By contrast, in the EU, the availability of two parallel avenues of challenge — administrative or pre-trial review and judicial review — is the general and most common approach.

Administrative review serves as an important procedural filter, enabling the NCA itself, or the authority to which it is subordinate, to correct an error, reassess the evidence or take account of new circumstances without the need for court proceedings.

Only in some EU Member States does legislation expressly prohibit, or simply not provide for, administrative or pre-trial review of an NCA decision refusing an authorisation, in which case the applicant must proceed directly to court.

• 1. The authorisation mechanism within sanctions policy should be regarded not as a relaxation of the sanctions regime, but as a necessary condition for its proper functioning, a safeguard that prevents sanctions from losing their legitimacy and effectiveness, and an instrument for reconciling sanctions policy with the principles of a democratic legal order.

• 2. The regulatory framework of Ukraine’s sanctions policy requires substantial revision.

First, the types of restrictive measures provided for in the Law of Ukraine “On Sanctions” should be reviewed to ensure alignment with their European counterparts and to eliminate duplicative and legally uncertain sanctions.

Second, the issue of domestic NCAs in the field of sanctions policy should be regulated depending on the institutional approach selected: centralised or decentralised.

A centralised model would require establishing the status of a single NCA. One option could be the National Security and Defence Council of Ukraine (NSDC), a body with constitutional status, which would participate not only in the imposition of sanctions and maintenance of the sanctions register, but also in monitoring sanctions implementation, ensuring reporting and, potentially, performing other functions, including licensing, developing secondary legislation and issuing guidance. This would require amendments not only to the Law of Ukraine “On Sanctions”, but also to the Law of Ukraine “On the National Security and Defence Council of Ukraine”.

Another option would be to establish an Interagency Sanctions Council under the Cabinet of Ministers of Ukraine, composed of representatives of key ministries and government-controlled authorities responsible for implementing particular types of sanctions. The Council could also include representatives of the relevant law enforcement authorities, following the Maltese Sanctions Monitoring Board model. In this case, amendments to the Law of Ukraine “On the Cabinet of Ministers of Ukraine” would also be required.

A further alternative would be to establish a separate executive authority vested with the full range of relevant powers, except for the actual imposition of sanctions and designation of sanctioned persons, for example, a Sanctions Policy Bureau. Such an approach would require the adoption of a separate law.

A decentralised approach should provide for a clear allocation of powers between two or more NCAs, together with delegated authority to adopt secondary legislation ensuring legal certainty, including in the area of sanctions authorisations. The experience of EU Member States shows that the key competent authorities responsible for financial sanctions are usually units within ministries of finance and, less frequently, national central banks, while economic or trade sanctions are generally administered by units within ministries of economy.

• 3. Irrespective of the institutional model of sanctions administration ultimately introduced in Ukraine, the NCA should be empowered to issue explanations and/or methodological guidance on the granting of authorisations, actively provide financial institutions, businesses and other stakeholders with access to explanatory information through dedicated communication channels, and maintain its own website with a separate section devoted to derogations.

• 4. It is necessary to determine which derogations should operate automatically as exemptions and which should require prior authorisation as derogations in the strict sense.

Under Part 4 of Article 4 of the Law of Ukraine “On Sanctions”, the sanctions provided for by the Law do not apply to:

1. payment of taxes, fees and other mandatory payments to the state and/or local budgets, the unified social security contribution, as well as monetary liabilities determined by the controlling authority;

2. repayment or recovery of tax debt, arrears of the unified social security contribution, and payment of monetary liabilities or tax debt of a taxpayer and/or amounts of the unified social security contribution subject to instalment or deferral arrangements, including those established by a court decision.

Accordingly, the current Law of Ukraine “On Sanctions” already provides for two types of exemptions, or automatic derogations.

Draft Law No. 12406 of 14 January 2025 “On Amendments to the Criminal Code of Ukraine, the Criminal Procedure Code of Ukraine and the Law of Ukraine ‘On Sanctions’ regarding the Establishment of Liability for Violations of Special Economic and Other Restrictive Measures (Sanctions)” in the version prepared for the second reading proposes supplementing Part 4 of Article 4 of the Law with five additional exemptions:

1. voluntary and gratuitous alienation or transfer to the State of Ukraine of assets by a person subject to sanctions;

2. payment of fines and penalties for violations of legislation to the state and local budgets, the Pension Fund of Ukraine, and accounts of state authorities and local self-government bodies;

3. transfer of funds to the special account of the National Bank of Ukraine for raising funds in support of the Armed Forces of Ukraine and/or to accounts of the Cabinet of Ministers of Ukraine, ministries and other state authorities opened for voluntary contributions or charitable donations in support of Ukraine;

4. payment for housing and utility services;

5. conclusion with a natural and/or legal person subject to sanctions of an agreement for professional legal assistance in accordance with the Law of Ukraine “On the Bar and Practice of Law”, and performance of such an agreement.

The first three proposed exemptions do not raise significant concerns. However, under EU sanctions regulations and the national practice of EU Member States, the final two fall within the category of derogations rather than exemptions, because automatically excluding such activities from sanctions prohibitions creates a significant risk of sanctions circumvention.

Furthermore, the proposed provision under which the procedure for payment for professional legal assistance and the methodology for calculating lawyers’ remuneration for providing legal assistance to natural and/or legal persons subject to sanctions would be approved by the Cabinet of Ministers of Ukraine does not effectively prevent sanctions circumvention. This is because the draft law recognises as lawful both the conclusion of an agreement for legal assistance and its performance.

At the same time, new legislation should include a safeguard providing that a sanction in the form of a prohibition on concluding agreements or entering into transactions does not apply where such agreements are concluded for the purpose of complying with Article 59 of the Constitution of Ukraine, which guarantees everyone the right to professional legal assistance.

• 5. A procedure for obtaining authorisations, or a licensing mechanism, should be introduced. The Law of Ukraine “On Sanctions” still does not provide a mechanism for granting authorisations to derogate from imposed restrictive measures, despite already containing two exemptions.

This legislative gap is inconsistent with Ukraine’s European integration commitments and with the principle of the rule of law. A substantial proportion of the provisions of EU sanctions regulations is devoted specifically to derogations. In addition, Directive (EU) 2024/1226 requires Member States to criminalise breaches of or failure to comply with the conditions of authorisations.

Introducing strict criminal liability in the absence of an authorisation mechanism would risk undermining the legitimacy of the sanctions regime as a whole.

• 6. The Law of Ukraine “On Sanctions” should be supplemented with a separate article establishing the basic elements of the authorisation mechanism, including the persons entitled to apply, the content of and grounds for submitting a request, the time limits for its consideration, the possible decisions following consideration, the grounds for refusal, the content of an authorisation, and mechanisms for reporting and monitoring compliance with its conditions.

Detailed requirements governing the request, the procedure for its consideration, decision-making, use of an authorisation and monitoring compliance with its conditions should be established in a separate piece of secondary legislation.

Based on the findings of the analytical study of authorisation or licensing mechanisms within the sanctions policies of the European Union, the United States and the United Kingdom, the following wording of an article of the Law of Ukraine “On Sanctions” is proposed:

“Article __. Authorisations to perform actions prohibited or restricted by a sanction

1. Natural and legal persons, as well as persons subject to individual sanctions, shall have the right to submit to the competent authority a request for authorisation to perform actions prohibited by an imposed sanction.

An authorisation may be granted for the entire duration of the sanction, for a specified period, or for the performance of specific actions or transactions.

2. A request for authorisation shall contain:

• the grounds for granting the authorisation, including, but not limited to, the need to cover basic expenses, obtain legal assistance or other necessary services, maintain assets, comply with obligations established by a court decision, and similar grounds;

• the person subject to the sanction;

• the actions prohibited by the sanction;

• information on the parties that will perform the actions or transactions requiring authorisation;

• where the request concerns authorisation for a financial transaction, the amount of the proposed financial transaction, the financial institutions involved and the relevant account details;

• other information relevant to the granting of the authorisation.

3. A request for authorisation shall be considered by the competent authority within thirty calendar days from the date of receipt. In exceptional cases, the competent authority may extend this period to sixty calendar days, provided that it gives reasons for its decision and notifies the person who submitted the request.

4. A request for authorisation concerning the performance of an agreement for legal assistance, minor everyday transactions, or actions aimed at eliminating a risk to life or health shall be considered within ten calendar days from the date of receipt.

5. A request to amend or extend the validity of an authorisation shall be considered within twenty calendar days from the date of receipt.

6. When considering a request for authorisation, the competent authority may request additional information necessary to establish the circumstances set out in the request.

7. Following consideration of the request, the competent authority shall adopt a reasoned decision to:

• grant authorisation to perform the actions or transactions specified in the request;

• grant the authorisation in part, with proper reasoning for such a decision;

• refuse to grant the authorisation, with proper reasoning for the grounds of refusal.

8. An authorisation shall contain information on:

• the person to whom the authorisation is granted;

• the person subject to the sanction;

• the parties that will participate in the relevant actions or transactions;

• the list of authorised actions or transactions;

• where authorisation is granted for a financial transaction, the amount of the authorised financial transaction, the financial institutions involved and the relevant account details;

• the period of validity of the authorisation;

• the procedure and conditions for reporting;

• other conditions governing its implementation.

9. An authorisation may be refused, or a request may not be granted in full, where:

• the grounds for granting the authorisation have not been sufficiently substantiated;

• the actions prohibited by the sanction and proposed to be performed do not correspond to the grounds invoked for granting the authorisation;

• the amount of the proposed financial transaction is not substantiated or exceeds reasonable limits;

• the actions specified in the request are not prohibited by the sanction;

• the request is inconsistent with the national interests of Ukraine;

• there are reasonable grounds to suspect that the relevant action or transaction may be used to violate or circumvent sanctions.

Refusal to grant an authorisation shall not deprive the applicant of the right to submit a new request.

10. For the purpose of monitoring compliance with an authorisation, the person to whom it has been granted shall be required to submit a report.

11. The procedure for granting authorisations to perform actions prohibited by a sanction and for monitoring compliance with such authorisations shall be established by the Cabinet of Ministers of Ukraine.”

• 8. To minimise the human factor and corruption risks and to ensure the highest possible level of protection for confidential information, the authorisation procedure should be digitalised.

A single secure web portal should be developed, similar to the French Téléservice Sanctions. The system should provide for applicant identification using a qualified electronic signature or Diia.Signature, contain standardised electronic request forms tailored to each type of derogation, and enable secure uploading of supporting documents.

The same portal should also be used to submit mandatory ex post reports on the use of granted authorisations and released funds. An alternative method of submission could be provided through registered mail or email.

• 9. The NCA should position itself not solely as an enforcement and supervisory authority, but also as a service-oriented institution. In implementing European standards, the authority should regularly develop and publish guidance, detailed explanations and answers to frequently asked questions.

Advance publication of information specifying which data and supporting documents, such as audit reports, financial plans and letters of guarantee, must be provided to obtain an authorisation would help reduce the number of defective applications and ease the administrative burden on public authorities.

• 10. Consideration and adoption of legislation criminalising sanctions violations and circumvention should proceed together with the introduction of an authorisation mechanism. Intentional breach of the conditions of an authorisation should constitute a criminal offence.

It would also be appropriate to establish the following rule: actions performed on the basis of and in accordance with the conditions of a valid authorisation issued by the competent authority do not constitute a violation or circumvention of sanctions and do not give rise to administrative or criminal liability.

At the same time, knowingly providing the NCA with false or incomplete information for the purpose of unlawfully obtaining a sanctions authorisation should be recognised as a criminal offence.