Why embargo proceedings are currently increasing dramatically

Since the EU sanctions packages against Russia came into force and were expanded, investigative authorities—in particular customs investigation offices and public prosecutors—have been pushing ahead with a dramatic increase in proceedings for alleged embargo and foreign trade violations, often also referred to as sanctions violations, AWG violations, export control violations, or export violations (Sections 17 et seq. AWG). These allegations no longer concern only large exporters, but increasingly also:

• medium-sized companies,
• Companies that produce dual-use goods, e.g., machine tools, electronics & semiconductors, precision measuring and laboratory technology, valves & pumps, navigation & avionics
  , high-performance IT & cryptography, industrial components (e.g., storage technology, optoelectronics)
• car dealer,
• logistics company,
• Private individuals who only supposedly "broker" goods,
• Entrepreneurs who become involved in supply chains through third parties without their own involvement.

A recent press release from customs clearly shows the direction the authorities are taking. Customs investigations are being conducted rigorously, with high public visibility and increasingly coordinated internationally:

The Essen customs investigation office and the Frankfurt am Main public prosecutor's office conducted a joint investigation against the operator of an independent car dealership who was accused of exporting a total of 71 vehicles in circumvention of the Russian embargo. The vehicles, with a total value of around five million euros, were officially registered for third countries, but are believed to have actually been transported to Russia.

During a search in September 2023, investigators seized extensive sales documents, three high-priced vehicles, and around €130,000 in cash. After evaluating electronic and written evidence, the public prosecutor's office brought charges for 71 offenses under the Foreign Trade Act.

On July 8, 2025, the Marburg Regional Court sentenced the 56-year-old defendant to five years in prison. In addition, the court ordered the confiscation of all assets amounting to the value of the exported vehicles – also around five million euros.

The head of the Customs Criminal Investigation Office, Dr. Tino Igelmann, emphasized the high priority of sanctions compliance in exports and highlighted the importance of asset forfeiture as a clear consequence of illegal embargo violations.

Another recent case concerns the supply of dual-use goods (goods with dual purposes, i.e., civil and military):

The Federal Prosecutor's Office is currently investigating an alleged procurement network in Lübeckthat is alleged to have exported thousands of technical components to Russia via shell companies, including roller and ball bearings, photodiodes, and memory units. Five men have been arrested, including the 38-year-old managing director of a Lübeck-based company, who is considered the main suspect. A total of around 16,000 deliveries with a total value of at least €30 million are said to have been arranged. According to the Federal Public Prosecutor's Office, the exports were carried out on behalf of suspected Russian government agencies and ultimately ended up with at least 24 listed Russian arms companies.

ROSTALSKI specializes in defending clients in criminal proceedings for embargo violations

ROSTALSKI Wirtschaftsstrafrecht & Compliance, based in Cologne, is currently defending several extensive investigations in North Rhine-Westphalia and nationwide on suspicion of embargo and foreign trade violations. The investigation files available in these proceedings exemplify the intensity with which public prosecutors and customs investigation offices are cracking down on allegedly illegal exports.

Typical features of such procedures

• Evaluations of ATLAS export data (MRN numbers, FIN evaluations)
• Uncertainty among those affected about the classification of dual-use components (e.g., bearing technology, optoelectronics, IT components): In practice, these are often standard industrial components (e.g., ball bearings, photodiodes) that are used millions of times worldwide in completely harmless products.
• Investigations of international supply chains across multiple transit countries by investigative authorities
• Returning Russian registration data via databases such as nomerogram.ru or vinru.ru for vehicles
• International requests for information
• Use of FIU data (suspicious activity reports)
• Access to bank data, account movements, and private sales
• Occasionally erroneous conclusions from "hit patterns" in database searches

Typical accusations made by investigating authorities—and why they are often open to challenge

1. "You are registered as an exporter in ATLAS."

At first glance, the accusation that someone is listed as an "exporter" in the ATLAS export documents seems clear-cut – but in practice, this is not necessarily the case. The ATLAS system reflects the formal data record of an export, but not necessarily the actual responsibility for the export. Exporter details are often automatically transferred, duplicated, or reused from old data records by freight forwarders, service providers, or intermediaries. In many cases, such entries are even based on pure "default" settings in the freight forwarding software or on incorrect transmissions, without the person concerned being actively involved in the export. For investigating authorities, an ATLAS hit often means the beginning of a suspicious situation – from a defense perspective, however, it is regularly a target for the defense.

2. "The goods later turn up in Russia/Belarus."

Another standard argument used by the investigating authorities is that the subsequent appearance of goods—for example, a vehicle—in Russia is proof that they were originally brought there in violation of sanctions. This conclusion is not legally tenable and is highly problematic in practice. International trade in goods is characterized by multiple sales, intermediaries, export chains to third countries, and completely legal resales, which the original seller cannot and does not need to know about. Violations of the Russia embargo are often based on sales to the supposed transit countries of Kazakhstan, Armenia, Kyrgyzstan, Georgia, Turkey, the UAE, Serbia, Azerbaijan, and Belarus.

Even if, for example, a vehicle or other asset is later registered in Russia, this in itself does not constitute evidence of a prohibited export. The defense must therefore work consistently to uncover these false conclusions and bring the investigation back to an objective basis.

3. "The accused should have known that the goods would be resold."

Suspicion is often based on the hypothesis that the accused "should have known" that the goods would later be resold and exported to Russia or Belarus. This accusation is based on a retrospective attribution of knowledge that may not actually have been present. Entrepreneurs do not have to be "clairvoyant," and they are not obliged to anticipate the future behavior of their buyers. The only decisive factor is whether, at the time of sale, there were concrete objective grounds for suspicion of a use that would violate sanctions. In practice, such grounds for suspicion are regularly questionable: buyers act normally, pay market prices, have civil law reasons for the purchase, and the seller has no reason to question the subsequent use or final destination. This applies in particular to dual-use goods: many components are commercially available, universally applicable, and are used in hundreds of thousands of civilian applications. It is not usually possible to identify in advance whether they will be used for military purposes.

Investigators often construct retrospective warning signals from data traces that were not apparent to an objective third party at the time of the transaction. In such cases, the defense must clearly demonstrate that there was neither a duty to conduct further investigations nor any indication that would have justified export control relevance.

4. Cash flows = embargo actions?

Another typical investigative approach concerns supposedly "suspicious" money movements. Banks routinely report transactions above certain thresholds to the FIU, and these reports often form the starting point for larger investigations. This clearly shows the discrepancy between criminal investigators' expectations and the actual significance of payment transactions. Transactions are automatically checked by the banks' money laundering compliance systems. Following corresponding reports of suspected money laundering, the transactions can be placed in a sanctions context – even though they have no connection whatsoever to a violation of the AWG or export controls.

In practice, such transactions are often everyday occurrences: down payments, remaining purchase prices, private repayments, uses for other transactions, or simply internal reallocations. However, investigators tend to interpret such payments retrospectively as "typical of prohibited transactions." The defense must therefore explain the actual economic significance of the payments in a comprehensible manner and separate it from the narrative of the investigation. This is the only way to prevent a chain of allegedly incriminating evidence from being constructed from financial transactions that require evaluation.

Searches are the norm

In preliminary investigations into foreign trade offenses, particularly in cases of suspected sanctions, export control, or Foreign Trade and Payments Act violations, extensive search measures are often carried out at an early stage. These measures are frequently executed by surprise in the early hours of the morning. Not only are the accused's living quarters affected, but also, on a regular basis:

• Business premises and warehouses, including administrative and sales locations,
• Company and private vehicles,
• IT infrastructure such as server rooms, possibly also at the provider's premises
• private residences and secondary residences,
• Cell phones, laptops, and data storage devices belonging to family members, if applicable.
• In companies: the workplaces of employees, accounting, and export departments.

The investigating authorities—usually customs investigators, the State Criminal Police Office, and in some cases tax investigators—have a clear goal: to secure potential evidence before it can be altered, deleted, or moved, in the investigators' view.

In the event of searches, ROSTALSKI offers effective legal defense right from the start of the search: SEARCH.

What is typically sought during searches in AWG proceedings

Experience shows that searches focus on a very wide range of potential evidence. This includes in particular:

• Export and customs documents (ATLAS export declarations, freight documents, CMR, delivery notes, invoices)
• Correspondence with buyers, shipping companies, or intermediaries 
• Contract documents, in particular purchase agreements, brokerage agreements, and transport orders
• Financial documents such as bank statements, payment receipts, transfer data, FIU correspondence
• digital traces such as emails, WhatsApp chats, CRM data, files on private and business devices
• Vehicle documents (registration certificates, vehicle titles, VIN lists)
• Phone memory, especially contact lists, messenger chats, and images
• Tracking or logistics data, such as GPS data, shipping portals, or transfer confirmations
• Technical product documentation, data sheets, parts lists, and test reports, especially for electronic, optical, or storage technology components that investigators classify as "embargo-relevant."
• Correspondence regarding supply chains in supposed transit countries, such as Armenia or Kazakhstan

In practice, it is noticeable that the investigating authorities often take extremely broad action. The documents are initially taken away "for review." In the case of IT devices in particular, the entire data inventory is regularly mirrored, regardless of whether there is a direct connection to export activities. This often leads to significant interference with business activities—for example, when a laptop or company cell phone is retained as "evidence" for several weeks. 

Defense practice repeatedly shows that devices are seized even though less drastic measures (copying on site) would have been possible. No clear distinction is made between private and business data. This carries the risk that investigators will draw hasty conclusions from unsystematic data findings (e.g., "contact in Russia = illegal export"). Added to this is the risk of chance discoveries (tax offenses, etc.).

In the case of companies, the entire export business is often placed under general suspicion, even though only individual transactions are relevant.

Why early defense is crucial in embargo violations

Early defense— in cases of doubt, ideally before a search takes place— is of central importance in proceedings involving sanctions, export control, or foreign trade offenses.

The immediate consequences of a search

If a search takes place, far-reaching interventions follow: devices are confiscated, entire IT infrastructures are mirrored, business-critical systems are taken away, and private and operational data is read out in its entirety. This is where a specialized defense comes in. It immediately checks the legality of the seizures and, if necessary, can immediately obtain court orders for the return of the seized items.

Enforce limits on digital evaluation

Investigative authorities tend to read entire hard drives, even though they are only legally permitted to access data relevant to the investigation. The defense ensures that digital data is only evaluated to the extent permitted by law, thereby preventing private communications or internal company information from being searched without authorization.

Ensuring economic capacity to act

A search is a serious disruption, especially for companies. Many businesses rely on their IT equipment, accounting software, and communication systems. Long-term seizure poses considerable economic risks. The defense can use targeted motions to ensure expedited release or at least enforce the prompt production of copies so that business operations can continue.

Avoiding misinterpretations by investigators

Early defense prevents investigators' misinterpretations—for example, regarding export documents, cash flows, or international contacts—from leading to a consolidation of suspicion. Misunderstandings often arise because investigators misclassify complex trade structures or export processes. The faster the defense intervenes to correct this, the lower the risk of an incriminating misinterpretation.

Protection against asset seizure and economic blockades

Sanctions and AWG proceedings regularly involve substantial assets. Often, an asset freeze in the six- or seven-figure range is requested at an early stage—frequently as a lump sum equal to the value of the goods allegedly exported in violation of sanctions. Without a timely defense, account closures, insolvency, and serious economic damage are imminent. The defense immediately examines the conditions for seizure, value assessments, and questions of ownership and enrichment in order to ward off confiscation measures.

Communication with banks and business partners

FIU reports and investigative measures often trigger reactions from banks, such as account freezes or internal audits. Business partners also react with uncertainty, contract terminations, or restraint. An experienced defense attorney takes over communication in such cases, provides clarity, and prevents the investigation from developing into an economic conflagration.

Avoiding personal liability

Particularly in cases with international implications—such as exports to Russia or Belarus—public prosecutors often examine the requirements for an arrest warrant at a very early stage. An active defense ensures that unnecessary escalations are avoided and shows that the accused is accessible, cooperative, and not on the run.

The goal of criminal defense

The central goal of criminal defense in sanctions, export control, and foreign trade proceedings is to protect those affected from unjustified criminal and economic consequences and to steer the proceedings in a direction that allows for early exoneration. The defense works to ensure that the suspicion is not confirmed, but rather refuted at the investigation stage. This includes correcting incorrect assumptions made by investigators, pointing out erroneous conclusions, and developing alternative, realistic interpretations of the facts.

At the same time, the defense pursues the goal of preventing irreversible damage: averting asset seizure, securing economic capacity to act, avoiding arrest warrants, and ensuring the rapid return of confiscated items. In many cases, another important task is to protect the accused from reputational damage and to build a coherent, robust, and credible defense image vis-à-vis banks, business partners, and authorities.

The long-term goal of any defense strategy is to secure a dismissal of the case, avert or significantly reduce a confiscation order, prevent an indictment, or—if the case goes to trial—achieve the lowest possible penalty or one with the fewest consequences.

Good defense means not only legal argumentation, but also early management of a complex structure of investigators, authorities, economic interests, and the client's personal situation.