How are slow over rates penalised in ODIs and T20Is?

There are two penalties: one during the match and one afterwards.

During the innings: the fielding side must be in position to bowl the first ball of the final over by the scheduled (or rescheduled) cessation time. If it isn't, then from the next over until the end of the innings only four fielders may be outside the 30-yard fielding circle. In an interrupted match where 3 or more overs have been cut, the target is the first ball of the penultimate over. This in-match penalty doesn't apply if the innings is cut to fewer than 25 overs (ODI) or 10 overs (T20I), unless it was already in force, or if the innings ends before the cessation time.

Minimum over rates:

Time is allowed for injuries, reviews and referrals, batters wasting time and other things outside the fielding side's control.

After the match: if the rate is still short, every player in the fielding side is fined 5% of their match fee per over short, up to a maximum of 50%. No demerit points are given for over-rate offences. There's no fine if the fielding side bowls the batting side out within the time allowed for the innings.

Stop clock: the fielding side must start each new over within 60 seconds of the last one finishing. Failing to do so brings a warning, then a final warning, then 5 penalty runs to the batting side for the third and any later offence in the innings.