On 30 July 2026, His Majesty’s Revenue and Customs (HMRC) announced that Airbus Operations Limited (Airbus) had paid £6,409,388 to settle multiple breaches of the UK’s strategic export control regime, a sum it describes as the highest compound settlement it has reached for offences of this class.1
The published material identifies no unlicensed export and no diversion of controlled goods. What it records are repeated failures to keep the requisite records and registers, together with one breach, of undisclosed character, of an individual licence. The question for exporters on both sides of the channel is what administrative noncompliance under an open licence now costs, and how the decision to disclose voluntarily is altered once those who settle are named.
Background
The framework principally engaged is the Export Control Act 2002 and the Export Control Order 2008, with licensing and compliance sitting with the Export Control Joint Unit (ECJU) and criminal enforcement with HMRC. The bargain underlying an Open General Export Licence (OGEL) is this: in place of the advance authorisation a Standard Individual Export Licence (SIEL) requires, the exporter assumes the record-keeping and audit obligations by which the ECJU verifies, after the event, that the licence has been used within its terms. Those obligations sit in Article 29, which requires detailed registers or records of each authorised act, capturing the act, the goods or technology, the dates and quantity, the identities of licence user, consignee, supplier and end-user so far as known, and whatever further information the licence itself requires. Records are kept for three years from the end of the relevant calendar year, four where the licence authorises an act otherwise prohibited by the Part 4 trade controls and longer where a licence so prescribes, as those covering military technology commonly do. Breach of a licence condition, or of an Article 29 obligation, is an offence under Article 38(1), carrying up to two years on indictment and section 152(a) of the Customs and Excise Management Act 1979 permits the commissioners to compound proceedings, so that a settlement is an alternative to prosecution rather than a species of civil penalty.2
The breaches
On multiple occasions the company failed to keep accurate records of transfers of controlled technology as three of its OGELs required, contrary to Article 29(2)(a) to (g); to keep the registers those licences required, contrary to Article 29(3) and to keep records as one licence specifically required, engaging Article 29(2)(i). It breached a SIEL condition once. The three licences are not identified, and nothing published indicates that a licence was suspended, that an unlicensed export occurred or that controlled goods reached an unauthorised destination. The offences are those of Article 38(1), not Article 34(5), under which knowing involvement in a prohibited activity with intent to evade attracts up to 10 years.3 The matter concerns record-keeping and licence administration rather than evasion, though the nature of the SIEL breach has not been disclosed.
The fine
The sum is without precedent: approximately double the £3,231,762.40 paid in February 2025 for unlicensed exports of military goods, and approaching the £6,900,587.14 that 22 settlements produced across the whole of 2022. Repeated record-keeping failures have therefore attracted a sum comparable to a full year of enforcement in previous years, notwithstanding the voluntary disclosure, cooperation and remediation of the notice records. HMRC publishes the criteria for setting a compound sum, among them the type and value of the goods and the offender’s previous history, but not how they are to be calculated.4 Neither their weighting, nor the number of transfers concerned nor the nature of the technology has been disclosed. The published material supports no attribution of the sum to any single factor, and no conclusion confined to any sector.
Character and publicity
A compound settlement is not a conviction, and no court makes any finding. Airbus is nonetheless recorded as having admitted the breaches, and HMRC compounds only where the evidence would support a prosecution, the breach was inadvertent or attributable to weak internal control and the exporter disclosed voluntarily. Until recently the identity of an exporter accepting a settlement was not published. That changed when HMRC named Petrofac Facilities Management Limited over a settlement of £569,157.07 concerning the Russia sanctions regime, and naming will now, according to HMRC, form a condition of the offer where appropriate. According to HMRC’s own press release, “Naming the company marks a shift in how HMRC handles compound settlements in relation to strategic exports.”
Intangible transfers of technology
Technology here is the specific information necessary for the development, production or use of controlled goods or software, and a transfer is a transmission by electronic or non-electronic means from a person or place in the UK to a person or place outside it.5 Where the data is controlled, the transfers accumulate quietly. Engineering data crossing a federated product-lifecycle system, an attachment to an overseas affiliate, remote access granted to a person abroad or material made available through a cloud service: each may amount to a transfer, and each authorised act must be identifiable in the records. On the ECJU’s guidance the location of the server decides nothing; everything turns on where the intended recipient sits and who controls access.
Records generated at the point of despatch do not capture a transfer effected by an engineer granting access to a repository, and few enterprise systems produce, unprompted, a record containing every element Article 29 prescribes. Volume defeats manual capture. The ordinary answer, though the order nowhere requires one by name, is a technology control plan governing overseas access by employees, secondees, contractors and affiliates, supported by logs kept at the point of access rather than of shipment. Unlike under US law, the controls ask where a person is, not what nationality they carry.
Comparison
Groups established in the EU face analogous, though not identical, obligations. Article 27 of Regulation (EU) 2021/821 requires registers or records kept for at least five years from the end of the relevant calendar year, three for intraunion transfers of Annex I dual-use items and the recast regime reaches intangible transfers and technical assistance expressly. The regulation applies in Northern Ireland; the UK obligations arise under the assimilated dual-use regime. Penalties remain a matter of national law. In Germany, licensing under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz) sits with the Federal Office for Economic Affairs and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle), which has published extensive guidance on intangible transfers, and enforcement by the customs and prosecution authorities; in France, licensing sits with the dual-use goods service (Service des biens à double usage) and enforcement with the customs administration. In the UK, HMRC retains criminal enforcement and the power to bring a compound settlement, the Office of Trade Sanctions Implementation may impose civil penalties on a strict-liability basis within its remit, and the secretary of state, acting through the ECJU, may amend, suspend or revoke an open general licence as it applies to a particular user.6
Outlook
How the settlement comes to be read will depend on what follows: the cadence of named settlements, whether the ECJU tightens the record-keeping conditions attaching to open general licences and what the next UK Strategic Export Controls Annual Report discloses. Whether the sum sets a new baseline, or reflects no more than the particular facts cannot be determined from the published material. The prudent working assumption is the former, and acting on it begins with an audit of records the law already obliges the exporter to keep. What is beyond any doubt is that the sums involved in these settlements in the UK are trending upwards, with a robust compliance strategy therefore more important than ever.
HM Revenue and Customs, “Aircraft Manufacturer Breached Strategic Export Controls” (press release, 30 July 2026); Export Control Joint Unit, “Notice to Exporters 2026/17: Compound Settlement for Breaches of Export Control” (30 July 2026).
Customs and Excise Management Act 1979, s 152(a); Export Control Act 2002; Export Control Order 2008 and SI 2008/3231, arts 29, 31 and 38.
Notice to Exporters 2026/17, supra n. 1; Export Control Order 2008, supra n. 2, art 34(5) to (7).
Export Control Joint Unit, “Notice to Exporters 2025/08” (9 April 2025), collected at “Notices to Exporters”; Department for Business and Trade, United Kingdom Strategic Export Controls Annual Report 2022 (2023) and HM Revenue and Customs press release, supra n. 1.
Export Control Order 2008, supra n. 2, art 2; Export Control Joint Unit, “Export of Technology: Remote Access and the Use of Cloud Computing Services” (guidance, 22 March 2021).
Export Control Order 2008, supra n. 2, art 32; Foreign Trade and Payments Act (Außenwirtschaftsgesetz), § 4; Regulation (EU) 2021/821 [2021] OJ L206/1, art 27; Trade, Aircraft and Shipping Sanctions (Civil Enforcement) Regulations 2024, SI 2024/948.
