Until 6 February 2026, German criminal law contained a narrow excuse for a sanctions breach committed just after a new listing. It applied if the act happened before the end of the second working day after publication, and the person did not know about the new restriction. Practitioners called it the 48-hour grace period. That exemption has been removed. The buffer for acting before you knew is gone; everything after knowledge was always yours.
Between 23 April and 7 August 2026, the EU added names to its Russia-related asset-freeze list at least six times. Each addition took effect on the day it was published. A program that re-screens weekly can leave most of a week open on each of them. A nightly run against list updates flags the match the next morning.
But acknowledging the match is only the first half. The new law puts weight on the second half: how fast a seen match becomes a stopped payment, a held shipment, and a written record.
What Did Germany Remove on 6 February 2026?
Germany rewrote its sanctions criminal law to implement Directive (EU) 2024/1226. The directive requires member states to treat intentional breaches of EU sanctions as crimes. The German implementing act entered into force on 6 February 2026 and reworked section 18 of the Foreign Trade and Payments Act (AWG).
Three changes matter here. Many breaches that used to be administrative offences are now criminal offences when committed intentionally. The maximum corporate fine for the relevant offences rose from EUR 10 million to EUR 40 million. And the old exemption in section 18(11) was deleted.
That old exemption had two conditions, and both had to be met. The act had to happen before the end of the second working day after the new rule was published. And the person had to be unaware of the new restriction at the time of the act. Once someone knew, the cover was gone, even inside the two days.
A version of that rule survives for one narrow case. Section 18(12) still excuses a breach of a publicly announced national order under section 6 AWG for two working days, again only without knowledge. New EU listings do not come through national orders. They come through EU regulations, and for those the excuse is gone.
What Did the Old Grace Period Actually Protect?
The old rule protected a period of time. It applied during the two working days after publication, but only for as long as the person remained unaware of the new restriction. Once the person knew, the protection ended, even if the two days did not.
That matters because the lack of knowledge could come from anywhere in the chain. The list provider may not have processed the new names yet. The screening system may not have loaded the update. The alert may have fired but not yet reached the person who could act. All of those produced the same legal result under the old rule: no knowledge, no punishment, for two working days.
Take a supplier listed on a Monday under the old rule. The list provider loads the update overnight, and the alert reaches the analyst on Tuesday at 09:00. A payment that left on Monday afternoon was covered, because nobody in the company knew. A payment that left on Tuesday at 11:00, after the analyst had opened the alert, was not covered, even though the two working days had not ended.
So the old rule never gave anyone two days to investigate a match they had already seen. It protected them for up to two working days while they remained unaware of the new restriction. The new law removes that protection.
Where the Time Goes After a New Listing
A new listing reaches an operational stop through five steps.
- Publication: the regulation appears in the Official Journal and takes effect.
- Data: the new names are processed and loaded into the screening system.
- Detection: the system compares the update with the business partner base and raises a potential match.
- Knowledge: the match reaches the company and is understood as a possible sanctions issue.
The fifth step is the stop. The payment is blocked, the shipment is held, and the decision is documented.
Each step takes time, and most companies do not measure all of them.
Data availability is often the least visible step. In June 2025, a user of one screening service reported on the provider’s own support forum that new alerts appeared 35 to 48 hours after the underlying list record had changed. That is one reported case, not a market benchmark. But it shows that a delay can exist before the company even sees the alert.
Detection time and resolution time are the two measures used across these notes for the rest of the chain. Detection time runs from the list change to the seen match. Resolution time runs from the seen match to the documented decision. Both are explained in the note on what a confirmed match actually requires.
This article adds knowledge because that is the point the old German rule turned on. A system can detect a match before the right person understands its significance, and exactly when knowledge is attributed inside a company can become a legal question.
The old rule protected the period before knowledge. The new rule does not.
Thursday 23 July 2026: A Long-Standing Supplier Is Listed
On Thursday 23 July 2026, the Council added 48 persons and 168 entities to Annex I of Regulation 269/2014 through Implementing Regulation (EU) 2026/1843. The regulation entered into force on the day it was published. From that moment, Regulation 269/2014 required the funds and economic resources of the listed parties to be frozen and prohibited funds or economic resources from being made available to them, directly or indirectly.
Now imagine that one of those 168 entities has been in a manufacturer’s supplier base for six years. It has an open invoice, and the company runs payments every Friday at 10:00. Nothing about the transaction looks unusual because the order was placed in June, before the supplier was listed.
The timeline could look like this. The list provider processes the update on Thursday evening. A screening run at 02:00 on Friday compares the new data with the existing supplier base and raises a potential match. At 08:00, the analyst opens the queue. Between 08:00 and 10:00, the company has to confirm whether it is the same entity, identify the open payment and reach whoever has authority to stop it.
Two hours may be enough if that chain already exists. It may not be enough if the analyst first has to find out who controls the payment run, or if the stop request lands in a mailbox that nobody reads until after lunch.
Under the old §18(11) AWG, a person could avoid criminal punishment for a payment made during the protected period if they still did not know about the new restriction. Since 6 February 2026, that protection is gone. The practical questions are now more important: when did the company become aware, who knew, and what happened next?
More alerts make that Friday morning harder to manage. A sanctions package may create several potential matches across an existing business-partner base, while only some of those partners have payments or shipments due immediately. The company therefore needs a way to prioritise the cases that can result in funds or goods leaving first. A partner in that morning’s payment run cannot sit behind twenty lower-risk alerts simply because it entered the queue later.
Immediate Obligation, Not Automatic Criminal Liability
The EU restriction applies from the moment the listing takes effect. Under Regulation 269/2014, funds and economic resources belonging to a newly listed party must be frozen, and companies must not make further funds or economic resources available to that party. That was already the rule before February 2026. What Germany changed was the criminal-law protection for someone who acted shortly after publication without knowing about the new restriction.
German criminal liability is a separate question. Section 18(1) AWG generally requires an intentional sanctions breach. Put simply, the person must know what they are doing and at least accept that it may breach the sanctions rule. When companies and the Bundesrat argued that the grace period should remain, the legislature pointed to this intent requirement and to prosecutors’ ability to discontinue minor cases.
There is a narrower exception for certain dual-use trade prohibitions. Section 18(8a) AWG also covers reckless conduct where the violation concerns dual-use goods listed in Annex I or IV of Regulation 2021/821. This is a lower threshold than intent, but it applies to that specific category rather than to sanctions breaches generally.
Exactly whose knowledge counts inside a company can become a legal question. If an analyst sees the alert but the Accounts Payable processing the payment does not, the answer is not something a screening policy should try to define on its own. The operational goal is simpler: get the alert to someone who can assess it and stop the transaction before it leaves.
The financial exposure for companies has also increased. The maximum corporate fine can now reach EUR 40 million where there is an underlying intentional sanctions offence or a corresponding breach of supervisory duties. The previous ceiling was EUR 10 million.
What the Records Must Show
A policy tells a prosecutor what should have happened. The records show who checked, who stopped the transaction, and who released it.
In a sanctions case, the basic facts can be simple: a listed name, a payment and a date. What matters next is whether the company can show what happened in the hours after the alert.
Take the Friday case again, with the payment stopped at 09:40. Six months later, a bank flags the relationship and the authority asks what the company knew and when. A good record answers clearly:
List update received Thursday at 23:10. Match raised Friday at 02:14. Opened by the analyst at 08:05. Payment removed from the run at 09:40 by the accounts payable lead. Decision and reasoning recorded at 10:30.
A weak record has the screening log and nothing else. The log proves that the screening happened. It does not show who reviewed the match, what they decided, or how quickly the company acted. Those are the same questions that matter when auditors review a cleared or confirmed sanctions match, but here the consequences may be much more serious.
Once the match is confirmed, a second process begins. Freezing the funds and reporting to the competent authority follow their own rules and deadlines. The record from the first hours shows whether the company moved from alert to action in time.
Where the New Law Leaves Your Program
Germany removed the protection for acting before you knew about a new restriction. It did not shorten a two-day decision period after knowledge, because that period never existed. Once the person knew about the restriction, the old protection was already gone. What has changed is that there is now no buffer at the start of the chain.
That chain has two parts worth measuring. Detection time runs from publication of the new listing to the point where the match is seen. How often the program re-screens affects that time, but so does the speed at which new list data reaches the screening system. The second part runs from the acknowledged match to action: confirming the match, stopping any open payment or shipment, and recording the decision.
The number that matters is the total time from a new listing to a documented response. For a business partner with an open transaction, that also means knowing how long it takes to stop the payment or shipment. If that time is measured in days, the transaction may leave before anyone acts. If it is measured in hours, with a clear owner at each step, the company has both the control and the evidence.
The protection for acting before you knew is gone. Everything after knowledge was already the company’s responsibility, and that is the part its records need to explain.
The list can update in hours. The alert can arrive minutes later. Neither matters if the payment still leaves before someone can act.