UIF freeze communications — art. 7 D.lgs. 109/2007

In Italy, applying an asset freeze is half the job: article 7 of Legislative Decree 109/2007 then requires a written communication to the UIF, with names, amounts and the nature of the funds, within 30 days. Since 24 January 2026 a missing or incomplete communication can also be a crime. This guide covers who files, what the UIF expects and through which channel, how the communication differs from a suspicious transaction report, and what the UIF’s communication of 7 May 2026 says payment firms should watch for.

1. The legal frame: D.lgs. 109/2007

Legislative Decree no. 109 of 22 June 2007 is Italy’s statute for freezing measures against terrorism financing, proliferation financing and the activity of countries that threaten international peace and security. It gives effect in Italian law to designations made by the UN Security Council and the European Union, and to national measures adopted by ministerial decree under its articles 4 and 4-bis. The Comitato di Sicurezza Finanziaria (CSF), set up at the Ministry of Economy and Finance, coordinates the system.

Article 5 sets the substance. Frozen funds and economic resources cannot be transferred, disposed of or used, and acts done in breach are void (paragraphs 1 to 3). Making funds or economic resources available to a designated person, directly or indirectly, is prohibited, and so is taking part in activity whose object or result is to get around a freeze (paragraphs 4 and 5). Paragraph 8 protects the firm that freezes, or refuses a financial service, in good faith: no liability follows unless the freeze resulted from negligence.

The communication duties apply to the obliged entities listed in article 3 of Legislative Decree 231/2007 — banks, payment institutions, e-money institutions, their agents and the rest of the AML population. An EU payment or e-money institution operating in Italy through a branch or an agent network is inside that list for its Italian business.

2. Article 7: what must be communicated, and when

Article 7 creates three separate obligations. The UIF describes them on its financial-sanctions page, and each has its own trigger and clock.

The decree defines “funds”, “economic resources” and the freezing of each in article 1, paragraph 1, letters b, c, f and i. For a payment or e-money institution, almost everything held is “funds” — account balances, e-money, pending credits. The economic-resources limb, and the second recipient it brings, matters mainly where the firm holds collateral or goods, which is rare in a pure payments model.

The 30-day period starts from entry into force of the measure, not from the day your screening produced an alert. If an EU listing enters into force on a Friday and your batch screening only catches the customer on the following Thursday, the clock has already been running for six days. Firms that run batch screening weekly have been surprised by this arithmetic.

3. How to send it

There is no template and no Infostat-UIF form for these communications. The UIF asks for a free-format communication containing the information article 7 requires, sent either by e-mail to NCI.ROI.congelamenti@bancaditalia.it or by certified e-mail (PEC) to uif@pec.bancaditalia.it. The same NCI.ROI mailbox handles requests for assistance. The UIF runs a separate page for the communications linked to the Russia and Belarus regimes.

Free format does not mean free content. A communication that the UIF can use, and that you can defend later, carries at least:

• the designated person’s identifiers as you hold them, and the list entry you matched — regulation, annex and entry number, or the UN reference;
• each relationship frozen — account or IBAN, card, wallet — with the balance at the date of freezing;
• the nature of the funds (current-account balance, e-money, incoming credit held, card authorisation reserve);
• the date and time of the freeze and the legal measure that triggered it;
• any transactions blocked or rejected after the freeze, and any attempt to move funds;
• a named contact at the firm.

The UIF publishes links to the UN and EU consolidated lists to help operators. It also links to other lists, such as OFAC’s, but states that those are there only to support the assessment of whether a transaction is suspicious: a name on a non-EU, non-UN list does not create a freezing obligation in Italy.

4. A freeze communication is not a suspicious transaction report

The UIF is explicit that the article 7 communications are distinct from, and independent of, suspicious transaction reports (segnalazioni di operazioni sospette, SOS) under article 35 of D.lgs. 231/2007. It asks operators not to file SOS without a properly described suspicion as a substitute for, or a supplement to, the communications they owe.

An SOS is still required where the article 35 conditions are met. For banks and financial intermediaries, the UIF points to three specific links: terrorism financing under article 35(1) of D.lgs. 231/2007, and the proliferation regimes in Article 30(6)(d) of Regulation (EU) No 267/2012 (Iran) and Article 23(1)(e) of Regulation (EU) 2017/1509 (North Korea). Under the UIF’s provision of 12 May 2023 on anomaly indicators, transactions linked to persons on public sanctions lists are one of the indicators to weigh — indicator 34.

A pure name match is not a suspicion. The UIF states that mere homonymy, assessed on the information available — personal data, an economic profile inconsistent with the positions held by the designated person — removes the duty to report. Where you do file, the report must describe the elements that make the activity suspicious, not simply restate the facts that triggered the freeze communication.

5. What changed in 2026: D.lgs. 211/2025

Legislative Decree no. 211 of 30 December 2025, in force since 24 January 2026, transposes Directive (EU) 2024/1226 on the criminal-law definition of violations of Union restrictive measures. It inserted new offences into the Criminal Code:

• Article 275-bis — violating or circumventing restrictive measures;
• Article 275-ter — failing to provide the competent administrative authorities with information, known through one’s office or profession, about funds or economic resources in Italy belonging to, or owned, held or controlled by, designated persons;
• Article 275-quater — breaching the conditions of an authorisation;
• Article 275-quinquies — negligent violation.

Where the funds, goods or operations involved are worth less than €10,000, an administrative penalty applies instead, under article 13-quater of D.lgs. 109/2007 as amended. For a compliance officer, article 275-ter is the one to read twice: the communication duty in article 7 now sits next to a criminal offence for withholding the same information.

The UIF’s communication of 7 May 2026 adds that the new offences are predicate criminal activity for SOS purposes, and lists typologies seen in its own analysis and that of foreign FIUs. Several concern payment firms directly: funds triangulated through payment service providers in countries that do not apply equivalent sanctions; crypto-asset triangulation; flows routed through correspondent accounts and virtual IBANs to put intermediaries between the payer and the sanctioned beneficiary; and VPN use to hide where a customer really operates. On virtual IBANs, the UIF refers back to the guidance issued by the Banca d’Italia and the UIF on 12 December 2024.

6. Three worked scenarios

Scenario one — a new EU listing hits an existing customer. An e-money institution passported into Italy holds an account for an Italian company. A Council implementing regulation under Regulation (EU) No 269/2014 enters into force and lists the company’s sole shareholder, who owns 100% of it. Rule: the ownership-and-control criterion in the EU regime makes the company’s funds subject to the freeze; article 7(1) D.lgs. 109/2007 then requires a communication within 30 days of entry into force. What compliance does: freezes the balance the same day, records the balance and timestamp, rejects two outgoing SEPA transfers already queued, and sends the communication by PEC within the week with the balance at freezing, the rejected transfers and the ownership evidence. Outcome: the communication is on file long before day 30. Because the regime has its own two-week reporting rule, planning to the 30-day ceiling would have been wrong.

Scenario two — a near match on a UN list. An inbound transfer names a beneficiary whose name matches a person on the UN consolidated list. The customer’s date of birth differs by 20 years and their income profile is a salaried employee. Rule: the UIF’s homonymy guidance — mere homonymy, assessed on the information available, excludes the duty to report. What the analyst does: documents the mismatch with the identity document on file, clears the alert and releases the payment. No freeze was applied, so there is nothing to communicate under article 7(1). Outcome: no communication and no SOS — but the clearance record, with its evidence, is kept for inspection.

Scenario three — a frozen customer’s funds keep arriving through a vIBAN. Two months after a freeze, credits for the designated customer start arriving on a virtual IBAN issued to a corporate client, then move on to the client’s main account. Rule: article 5(4)-(5) prohibits making funds available and taking part in circumvention; article 7(2) requires prompt communication of related transactions; the UIF’s May 2026 typologies name vIBAN interposition. What compliance does: holds the credits, sends an article 7(2) communication to the UIF, and files an SOS describing the circumvention pattern. Outcome: two filings, each doing its own job.

7. FAQ

8. What to do, today

• Add the UIF freezes mailbox and PEC address to the sanctions procedure, with a named sender and a deputy.
• Build a communication template with the fields in section 3, so the 30-day clock is never spent on drafting.
• Start the clock from the entry-into-force date of the measure, and compare it with any shorter clock in the EU regulation.
• Keep the freeze communication and the SOS decision as two separate records in the case file.
• Run the UIF’s May 2026 typologies — PSP triangulation, crypto, vIBANs, VPNs — against your monitoring scenarios.

Related: EU asset-freeze reporting under Article 8 · Registre national des gels (France) · Sanctions screening for instant payments · Asset freezes in Spain — Tesoro and article 42