1. Overview

The Republic of Cyprus has enacted Law 149(I)/2025, introducing criminal liability for any breach of EU restrictive measures.

The new law reinforces obligations already arising under:

• Regulation (EU) No. 269/2014 – the asset-freeze regime; and
• Regulation (EU) No. 833/2014 – the sectoral and services restrictions.

The purpose of this guide is to highlight key areas of potential concern, while recognising that each case turns on its own facts and that limited exceptions may apply.

Our readers can click here for further guidance in respect with the provisions of Law 149(I)/2025.

2. Employment and Professional Engagements

Providing employment or consultancy services to Russian-linked companies can raise issues under both regimes, depending on the circumstances.

• If the employer is a listed entity (under Regulation 269/2014):

Any payment could amount to making funds or economic resources available, unless covered by a specific authorisation.

• If the work involves restricted services (under Regulation 833/2014):

Certain categories of services — including accounting, business consulting, IT, engineering, and PR - are restricted when supplied to entities established in Russia or controlled by them.

Key consideration: assess both who the counterparty is and what service is being provided. Where legitimate activity cannot be clearly excluded, professional advice or an authorisation request to the competent authority may be appropriate.

3. Provision of Services

The EU services bans are broad but not absolute.

• Services provided to listed persons remain subject to the asset-freeze.
• Services provided to non-listed Russian entities may still be caught if they fall within a restricted category or benefit a listed person.
• Legal representation in judicial or administrative proceedings is specifically exempted — this “due-process” exception preserves access to justice.

4. Corporate Roles and Shareholdings

Participation in the management of listed entities, or entities they control, can constitute a sanctions breach, especially where it enables the designated person to obtain funds, goods or services. However, the distinction between passive and active involvement is important. In borderline cases, the decisive factors are control and effect.

5. Commercial and Contractual Arrangements

Joint ventures, partnerships, and co-production projects involving Russian entities should be reviewed carefully.

The applicable regime depends on the counterparty:

• If listed, the asset-freeze applies.
• If non-listed, the sectoral bans still restrict certain goods, technologies, or services.
• Exemptions exist for humanitarian purposes, energy security, and certain critical raw materials, subject to prior authorisation.

Given the frequent changes to annexes and guidance, ongoing monitoring of counterparties and supply chains is essential.

6. Banking and Financial Dealings

Financial activity remains one of the most sensitive areas of sanctions compliance.

Two distinct regimes apply - the asset-freeze under Regulation 269/2014 and the sectoral financial restrictions under Regulation 833/2014. Financial exposure commonly arises through relationships with Russian banks or clients.

• Under Regulation 269/2014, assets of listed persons and institutions are frozen; it is generally prohibited to make funds available to or for the benefit of such banks, or to deal with their frozen assets without a licence.
• Under Regulation 833/2014, EU financial institutions face additional deposit, lending, and securities restrictions, albeit exceptions do exist.
• Use of online banking or payment systems from within the EU for the benefit of a listed bank can, in some cases, trigger liability.

7. Legal and Advisory Work

Legal services merit particular attention.

• Permitted: representation of clients (even listed ones) in judicial, arbitral, or administrative proceedings - the “access to justice” safeguard.
• Restricted: non-contentious legal services (e.g. transaction structuring).

Each engagement should be documented, and where necessary, cleared with the competent authority to ensure compliance with the “due-process” exception.

8. Circumvention and “Best Efforts” Obligations

Both Regulations expressly prohibit circumvention, including indirect or deliberate structuring to avoid restrictions.