The Decision process related to CFSP is a complex one. Before explaining it, it is useful to briefly introduce different bodies involved in the procedure.
European Council: The European Council, made up of heads of state or government and chaired by a full-time president, sets the political orientation and the priorities of the EU’s work.
Council of Europe Union (the Council): The Council of EU, made up of representatives of the member states and in most cases chaired by a representative of the member state that holds the six-month rotating presidency, examines, negotiates, and adopts EU legislation and coordinates policies. The ministers have the authority to commit their governments to the actions agreed on in the meetings. Together with the European Parliament, the Council and the Parliament are the main decision-making bodies of the EU.
The European Parliament: The European Parliament is the EU's law-making body. It is directly elected by EU voters every 5 years. The parliament has three main roles: Legislative, supervisory, and budgetary
The European Commission: The European Commission is the EU's politically independent executive arm. It is responsible for drawing up proposals for new European legislation, and it implements the decisions of the European Parliament and the Council of the EU.
Committees and working groups: smaller groups of experts in a subject matter set up by the Council to help and coordinate the Council's activities in different areas. Some committees/working groups follow below:
Working Party of Foreign Relations Counsellors (RELEX)
Political and Security Committee
Committee of Permanent Representatives (COREPE)
It is also important to keep in mind that decisions related to CFSP should be taken unanimously. In other words, one member of the Council has the e ability to block a decision. This, however, might change in the near future as there are currently discussions around changing the decision-making system to a qualified majority voting system in specific areas of the CFSP notably sanctions. (After the Lisbon Treaty there are only a few sensitive topics that require a unanimous vote and CFSP is one of them.)
The illustration below shows the various steps for the implementation of a Decision and Regulations in the EU:
Proposal for a Council Decision made by the High Representative of the Union for Foreign Affairs and Security Policy with the support of the Commission in general (or alternatively by a Member State)
The Council of the European Union takes a decision
The proposal will be announced at Foreign Affaires Council followed by examinations by the relevant Council preparatory bodies
(e.g. the Council working party responsible for the geographical region to which the targeted country belongs, and the Political and Security Committee)
Council informing the European Parliament of the adoption of the Council's decision
An agreed-upon package (by consensus) will be sent to the Working Party of Foreign Relations Counsellors Working Party or RELEX (There is a sanctions formation within RELEX which works on decisions implying restrictive measures)
If the Council Decision requires EU Regulation to be implemented (e.g. financial sanctions), EU Parliament will pass the necessary Regulation (Measures laid down only in the CFSP decision, such as arms embargoes or travel restrictions, will be implemented by the member states, while the Commission will verify that the member states have implemented the regulations in a proper and timely manner.)
After examining the package, RELEX submits the terms of the proposed restrictive measures to COREPER II for final scrutiny before the Council's decision.
The Decision and Regulation come into force upon publication in the Official Journal of the European Union
Depending on the type of the restrictive measure, it might be necessary to have legislation at the Member States' level. In fact, similar to a federal government, the EU has certain legislative competencies. If a restrictive measure in a CFSP Decision falls outside of those competencies, then it is up to the Member States' governments to pass those measures domestically. For example, travel bans and arms embargoes require Member States' actions to be effective. Yet, other restrictive measures like financial and trade sanctions fall within the competence of the EU. In this latter case, considering the direct effect of the European law principle, the EU Parliament, in line with the Council Decision, passes a set of regulations to implement the restrictive measures in question throughout the Union. (That is why you will see a regulation along with Council decision in various sanctions regimes.)
Finally, as stated in the 2015 Update of the EU Best Practices for the effective implementation of restrictive measures, sanctions regulations require that Member States adopt legislation providing for penalties for breaching restrictive measures. without such penalties, even though the obligation to act in a certain way is imposed, there is no coercive authority behind this obligation which could turn the regulation ineffective. (An example could be the lack of local legislation to punish the breach of Council Regulation (EC) No 2271/96 or better known as the "EU blocking statute")