BAE Systems‘ US subsidiary has agreed to pay $36m (£26.7m) to settle BAE Systems ITAR violations spanning six years, with the US Department of State concluding that the company committed 104 breaches of American arms export law, including dozens of unauthorised transfers of technical data to China.
The settlement, announced by the State Department and concluded under ITAR section 128.11, covers conduct between May 2019 and March 2025. The Office of Defense Trade Controls Compliance within the Bureau of Political-Military Affairs led the review.
Thirty-eight unauthorised exports to a proscribed destination
The most serious thread running through the 104 charges is China. According to Global Sanctions, the Directorate of Defense Trade Controls (DDTC) charged BAE Systems, Inc. with 38 unauthorised exports of technical data to China, a proscribed destination under ITAR section 126.1. That category alone dwarfs the other breaches in severity, if not in number.
The State Department’s own account sets out the mechanics of one incident. In December 2023, BAE sent technical data relating to printed wiring boards used in military GPS equipment to a manufacturer in China. The company later acknowledged that its supply chain team did not fully understand export control regulations, and that its secure file transfer networks failed to display export control warnings before the data was transmitted.
Other breaches involved Canada, the UK, Germany, Switzerland, Italy, France, and Indonesia. A BAE subcontractor provided defence services without authorisation on more than 17 separate occasions across Italy and France. The company also sent technical data related to a US Navy guided-missile destroyer to Germany, and accidentally exported a control system for a military gas-turbine engine to Switzerland. A licence agreement covering military GPS data sent to Canada had expired by the time the transfer was made in September 2021.
BAE Systems ITAR violations: the penalty structure and what it means
Of the $36m headline figure, $18m is suspended on the condition that BAE directs those funds towards strengthening its compliance programme. The remaining $18m constitutes the cash penalty payable to the US government.
The consent agreement runs for 36 months, and for an initial period of at least 24 months BAE must retain an external Special Compliance Officer to oversee implementation. Within six months of the agreement taking effect, BAE is required to strengthen compliance procedures and training, implement an automated export compliance system, and complete an export control jurisdiction review. The DDTC publicly posted the consent agreement on 13 August 2026.
Critically, the DDTC chose not to impose debarment, citing BAE’s voluntary disclosures, cooperation, and ongoing compliance improvements. Debarment would have barred the company from ITAR-regulated exports entirely, a potentially ruinous outcome for a defence contractor of BAE’s scale. BAE voluntarily disclosed all but one of the 104 alleged violations.
The company said it had ‘thoroughly cooperated’ with the State Department’s review. ‘We have been working diligently to implement improvements to our BAE Systems Inc compliance programme over the last several years, and we will continue to do so. We take seriously our responsibility to protect critical information and support all our customers’ security,’ it added.
I’d argue the debarment decision is the real story here. The $36m is, frankly, manageable for a company of BAE’s revenues. Being locked out of US defence export markets would not have been.
A pattern the 2011 settlement did not break
It is worth placing this settlement in context. In 2011, BAE Systems plc (the UK parent, separately from the US subsidiary) paid an aggregate civil penalty of $79 million to resolve an estimated 2,591 ITAR violations, then the largest in State Department history. That settlement followed BAE Systems plc’s criminal conviction in March 2010 for conspiracy to violate the Arms Export Control Act and ITAR, covering unauthorised brokering of US defence articles and services, failure to register as a broker, failure to file annual broker reports, and failure to maintain required records.
The 2026 settlement involves a different legal entity, BAE Systems, Inc., the US arm, and a substantially smaller penalty. But the recurrence of ITAR compliance failures across the corporate family, fifteen years apart, raises a fair question: how deeply do the structural fixes ever run?
The State Department said the settlement highlighted ‘the importance of exporting defence articles pursuant only to appropriate authorisation from the department.’ A truism, perhaps. But the DDTC’s decision to embed a 36-month oversight regime, complete with an external compliance officer, suggests it is not entirely satisfied with BAE’s self-governance either. The automated compliance system BAE must now build within six months will be the test. Investors should watch whether the DDTC exercises its right to extend or escalate the consent agreement, that, more than the $18m cash penalty, is the lever that matters.
