4 Aug 2026 BAE Systems, Inc.DDTC: USD 36 million against BAE Systems for ITAR violations, including a China link USAExport control and dual-use goods €31.3m

The DDTC settled with BAE Systems, Inc. for a civil penalty of USD 36 million. The allegations concerned unauthorised exports and retransfers of defence articles to several countries, in one case to the People's Republic of China, the unauthorised furnishing of defence services and breaches of authorisation provisos. USD 18 million is suspended for approved compliance measures and USD 18 million is payable in three instalments; the agreement requires, among other things, an external compliance audit. The authority allegedly made the findings set out here; this account is not based on a final judgment.

What organisations can take from it

Retransfers by recipients must be controlled contractually and organisationally just as strictly as one's own exports.

Relevance to training and awareness

ITAR compliance: retransfers, defence services and authorisation provisos

Authority / court: U.S. Department of State, Directorate of Defense Trade Controls (DDTC)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Arms Export Control Act § 38 (22 U.S.C. § 2778); ITAR, 22 C.F.R. Parts 120–130, insbesondere Part 127 und § 128.11
Action: Fine
Status of proceedings: final
Sector: Defence and security
Mitigating circumstances: The company reported the matters in voluntary disclosures and in response to a disclosure directed by the DDTC, and cooperated with the review.

Original amount 36,000,000 USD, converted at the ECB reference rate of 4 Aug 2026.

Sources

U.S. Department of State, Order, In the Matter of BAE Systems, Inc. Decision of an authority
U.S. Department of State, Consent Agreement, BAE Systems, Inc. Decision of an authority
DDTC, Penalties & Oversight Agreements Enforcement database of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

18 Jun 2026 LOGZONE Inc.LOGZONE pays 507,144 USD over lack of cybersecurity in Navy contracts USAOther €442,495

The Huntsville-based defence services provider allegedly invoiced two Navy contracts from May 2021 to March 2025 even though it had not implemented the security controls under NIST SP 800-171 required by the contracts. The settlement under the False Claims Act with the U.S. Department of Justice amounts to 507,144 USD.

What organisations can take from it

Companies that commit to cybersecurity requirements in government contracts must document their implementation verifiably – otherwise every invoice becomes a liability risk.

Authority / court: U.S. Department of Justice (Civil Division) / USAO Northern District of Alabama
Area of law: Other
Legal basis: False Claims Act (31 U.S.C. §§ 3729 ff.); DFARS-Cybersicherheitsklauseln
Action: Other
Status of proceedings: final
Sector: Defence and security
Published: 18 Jun 2026

Original amount 507,144 USD, converted at the ECB reference rate of 18 Jun 2026.

Sources

Alabama Defense Contractor Agrees to Pay $507,144 to Resolve False Claims Act Liability Relating to Cybersecurity Violations Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

16 Jun 2026 Securitas Sverige AktiebolagSecuritas Sverige: reprimand over cameras in company vehicles without legal basis SwedenVideo surveillance Reprimand or warning

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

What organisations can take from it

Dashcams in company cars also need a verified legal basis and a balancing against the interests of employees and passers-by.

Relevance to training and awareness

Use of cameras in vehicles

Authority / court: Integritetsskyddsmyndigheten (IMY)
Area of law: Data protection · Video surveillance
Legal basis: DSGVO Art. 6 Abs. 1
Action: Reprimand or warning
Status of proceedings: final
Sector: Defence and security

Sources

IMY – Tillsyn Securitas Sverige Aktiebolag Decision of an authority
IMY – Beslut Securitas Sverige AB Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

1 May 2026 Ultra Electronics Holdings Limited (vormals plc)Ultra Electronics: DPA of around 10.1 million GBP over bribery in Algeria and Oman United KingdomBribery of public officials €11.6m

The British defence supplier failed to prevent bribery by agents in connection with three public contracts in Oman and Algeria (including a contract with the Omani Ministry of Transport worth up to 200 million GBP). The DPA approved by Southwark Crown Court provides for a penalty of 10,083,150 GBP; in addition, the company is bearing around 4.8 million GBP of the SFO's investigation costs and must report on its compliance programme for three years.

What organisations can take from it

Companies that use agents for government contracts must be able to demonstrate adequate procedures – otherwise the company is liable under Section 7 Bribery Act even without any intent to bribe on its own part.

Relevance to training and awareness

Use of sales agents in public contracts

Authority / court: Serious Fraud Office (SFO)
Area of law: Bribery and corruption · Bribery of public officials
Legal basis: Section 7 Bribery Act 2010 (Failure to prevent bribery); Deferred Prosecution Agreement
Action: Fine
Status of proceedings: final
Sector: Defence and security
Culpability: intentional
Mitigating circumstances: Self-report of the Algerian matters in 2018; restructuring of ownership and leadership; 45 % discount on the penalty.
Published: 1 May 2026

Original amount 10,083,150 GBP, converted at the ECB reference rate of 30 Apr 2026.

Sources

SFO secures £10m from British defence supplier Press release of an authority
SFO DPA with Ultra Electronics Holdings Limited (formerly plc) Decision of an authority
Serious Fraud Office v Ultra Electronics Holdings [2026] EWCR 4 (Approved Judgment, 1 May 2026) Court decision
SFO-Ultra Indictment (Crown Court at Southwark) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

30 Apr 2026 „Вазовски машиностроителни заводи“ ЕАД (VMZ)Arms manufacturer VMZ used a partner’s know-how for disposable grenade launchers – 50,855 EUR BulgariaCompetition law €50,855

On application by a client, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that VMZ had used technical documentation on disposable grenade launchers that had been provided in confidence (trade secret) contrary to the confidentiality agreements and good commercial practice (Art. 37(1) ZZK – Bulgarian Protection of Competition Act). Sanction of 50,855.09 EUR and obligation to cease, with immediate enforceability. Appeals have been lodged against the decision.

What organisations can take from it

Design documents provided in confidence may only be used within the agreed scope – especially in sensitive industries.

Relevance to training and awareness

Handling confidential know-how of business partners

Authority / court: Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)
Area of law: Competition law
Legal basis: Art. 37 Abs. 1 ZZK (Geschäftsgeheimnisse)
Action: Fine
Status of proceedings: under appeal
Sector: Defence and security

Sources

КЗК Публичен електронен регистър – Производство (Решение № 389 от 30.04.2026; Volltext als PDF im Register) Official register or notice

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

17 Apr 2026 General Electric CompanyDDTC: USD 36 million against General Electric for technical data exports to China USAExport control and dual-use goods €30.5m

The DDTC settled with General Electric Company for a civil penalty of USD 36 million for ITAR violations: unauthorised exports of technical data to the People's Republic of China, breaches of authorisation provisos, unauthorised exports of defence articles and failure to report material changes to its ITAR registration. USD 18 million is suspended for approved compliance measures and USD 18 million is payable in three instalments. The authority allegedly made the findings set out here; this account is not based on a final judgment.

What organisations can take from it

Changes to one's own ITAR registration must also be reported and belong in the compliance calendar.

Relevance to training and awareness

ITAR registration and control of technical data with a China link

Authority / court: U.S. Department of State, Directorate of Defense Trade Controls (DDTC)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Arms Export Control Act § 38 (22 U.S.C. § 2778); ITAR, 22 C.F.R. Parts 120–130, insbesondere Part 127 und § 128.11
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Mitigating circumstances: The allegations are based on facts that the company itself disclosed to the DDTC.

Original amount 36,000,000 USD, converted at the ECB reference rate of 17 Apr 2026.

Sources

U.S. Department of State, Order, In the Matter of General Electric Company Decision of an authority
DDTC, Penalties & Oversight Agreements Enforcement database of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

9 Apr 2026 Electro Optic Systems Holdings LimitedElectro Optic Systems: 4 million AUD for late correction of revenue guidance AustraliaDisclosure and reporting obligations €2.41m

The Federal Court of Australia, on application by the Australian Securities and Investments Commission (ASIC, Australia's corporate, markets and financial services regulator), imposed an allegedly agreed penalty of 4 million AUD on the listed manufacturer of defence, space and communications technology. By 25 July 2022 the company knew that its 2022 revenue was likely to fall materially short of its published guidance of at least 212.3 million AUD, but did not correct the guidance until 31 October 2022; the court found a continuing breach of the continuous disclosure obligation.

What organisations can take from it

Once it becomes apparent that published guidance will be materially missed, the correction must be disclosed without delay.

Relevance to training and awareness

Continuous disclosure: handling deviations from guidance and escalating them internally to those responsible for disclosure

Authority / court: Federal Court of Australia (auf Antrag der Australian Securities and Investments Commission, ASIC)
Area of law: Capital markets and financial supervision · Disclosure and reporting obligations
Legal basis: Corporations Act 2001 (Cth) s 674A(2) i. V. m. s 1317QA
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Liability of senior managers: Measures against individuals are not set out here.
Published: 9 Apr 2026

Original amount 4,000,000 AUD, converted at the ECB reference rate of 9 Apr 2026.

Sources

ASIC 26-068MR – Electro Optic Systems Holdings ordered to pay $4 million penalty for continuous disclosure breaches (09.04.2026) Press release of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

26 Feb 2026 Teledyne FLIR LLCTeledyne FLIR: thermal imaging cameras incorrectly assessed and supplied to Entity List address USAExport control and dual-use goods €846,453

The manufacturer of militarily relevant thermal imaging technology admitted 19 violations to the US Commerce Department's Bureau of Industry and Security (BIS): incorrect de minimis calculations for cameras that went to China via Sweden, pricing arranged with a Chinese drone manufacturer to circumvent the licence requirement, missing records and eight deliveries in 2024 to a Hong Kong address on the Entity List that the screening software did not detect.

What organisations can take from it

Actively incorporate new forms of listing, such as address-only entries, into screening; do not rely solely on the software provider.

Relevance to training and awareness

De minimis calculation, address-based Entity List entries in screening

Authority / court: U.S. Department of Commerce, Bureau of Industry and Security (BIS)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Export Administration Regulations, §§ 734.4 (De minimis), 744.16, 764.2(a), (b), (h), (i)
Action: Fine
Status of proceedings: final
Sector: Defence and security
Mitigating circumstances: Voluntary self-disclosures for some of the violations
Published: 26 Feb 2026

Original amount 1,000,000 USD, converted at the ECB reference rate of 26 Feb 2026.

Sources

BIS Reaches Administrative Enforcement Settlement with Teledyne FLIR LLC and its affiliates (26.02.2026) Press release of an authority
BIS Order Relating to Teledyne FLIR LLC (26.02.2026) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

24 Feb 2026 Vizocom ICTVizocom: blueprints for military antenna sent to China and copies supplied to the US Navy USAExport control and dual-use goods €317,971

The Californian dealer had won a Navy contract for 450 VHF/UHF antennas from a US manufacturer, but in 2019 uploaded the export-controlled production specifications of the purely military antenna without a licence to the portal of a Chinese manufacturer, had the antennas produced there for 6 USD each and supplied them to the Navy with false manufacturer information for 165,109.50 USD. The Bureau of Industry and Security (BIS, the export control agency of the US Department of Commerce) imposed 374,474 USD in 20 instalments and a denial of export privileges suspended for five years.

What organisations can take from it

Do not send specifications of military goods to foreign manufacturers without a licence – even uploading a drawing to a supplier portal is an export.

Relevance to training and awareness

Technical drawings and specifications as export-controlled technology

Authority / court: U.S. Department of Commerce, Bureau of Industry and Security (BIS)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Export Administration Regulations, 15 C.F.R. § 764.2(a), §§ 742.4, 742.6 (ECCN 3E611)
Action: Fine
Status of proceedings: final
Sector: Defence and security
Culpability: intentional
Liability of senior managers: Measures against individuals are not reported here.
Published: 25 Feb 2026

Original amount 374,474 USD, converted at the ECB reference rate of 24 Feb 2026.

Sources

BIS Reaches Administrative Enforcement Settlement with Vizicom ICT Press release of an authority
Order Relating to Vizocom ICT (24. Februar 2026) mit Settlement Agreement Decision of an authority

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

16 Dec 2025 Unternehmen für private Sicherheitsdienste (anonymisiert)Luxembourg security services firm: EUR 2,784 for incomplete record of processing LuxembourgData protection €2,784

The CNPD (Luxembourg data protection authority) imposed a fine of EUR 2,784, a reprimand and an order on a Luxembourg private security services company with more than 250 employees because its record of processing activities did not fully contain the information required by Art. 30(1) GDPR. Within one month it had to describe the security measures for its whistleblowing report handling, or state expressly that there were none.

What organisations can take from it

The record of processing must contain, for every processing operation – including the handling of whistleblower reports – complete information on purposes, recipients, erasure periods and security measures.

Authority / court: Commission nationale pour la protection des données (CNPD), formation restreinte
Area of law: Data protection
Legal basis: Art. 30(1)(a), (c), (d), (e), (f) und (g) DSGVO; Art. 58(2) und 83 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Defence and security

Sources

CNPD, Délibération n° 4FR/2025 du 16 décembre 2025 (version pseudonymisée) Decision of an authority
CNPD, Décisions – Délibération n° 4FR/2025 Enforcement database of an authority

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

3 Dec 2025 The Boeing Company und Spirit AeroSystems Holdings, Inc.Boeing/Spirit AeroSystems: takeover only with divestiture of Airbus supplier plants USAMerger control Order

For the 8.3 billion USD takeover of the fuselage and wing supplier Spirit AeroSystems, the Federal Trade Commission (FTC) required Boeing to divest Spirit’s Airbus businesses to Airbus and the plant in Subang, Malaysia, to CTRM, to provide transitional services and to continue supplying defence competitors. A monitor oversees implementation.

What organisations can take from it

Vertical acquisitions of a supplier on which competitors also depend often only go through with divestitures and supply commitments.

Authority / court: Federal Trade Commission (FTC)
Area of law: Competition law · Merger control
Legal basis: Section 7 Clayton Act; Section 5 FTC Act (Consent Order)
Action: Order
Status of proceedings: unknown
Sector: Defence and security
Employees: 10,000 or more

Sources

FTC Requires Boeing to Divest Several Spirit Assets to Proceed with Merger (03.12.2025) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

1 Dec 2025 British exporter pays 620,515 GBP for unlicensed exports of military goods United KingdomExport control and dual-use goods €706,898

In September 2025, an unnamed British exporter paid a compound settlement of 620,515.04 GBP to HM Revenue & Customs (HMRC) for unlicensed exports of military goods. HMRC offers such settlements only for unintentional breaches or weaknesses in internal controls and following voluntary disclosure (date = publication).

What organisations can take from it

Weaknesses in internal export control become expensive even without intent – disclosing breaches early can avoid prosecution.

Relevance to training and awareness

Classification of goods and licensing requirements for military goods

Authority / court: HM Revenue & Customs (HMRC) / Export Control Joint Unit
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Export Control Order 2008
Action: Fine
Status of proceedings: final
Sector: Defence and security
Culpability: negligent
Mitigating circumstances: Voluntary disclosure (prerequisite for the compound settlement)
Published: 1 Dec 2025

Original amount 620,515.04 GBP, converted at the ECB reference rate of 1 Dec 2025.

Sources

NTE 2025/31: UK exporter pays compound settlement for breaches of export controls Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

31 Jul 2025 Aero Turbine Inc.; Gallant Capital Partners LLCAero Turbine and Gallant pay 1.75 million USD after self-disclosure on cyber obligations USAOther €1.53m

From 2018 to 2020, the engine maintenance company allegedly failed to implement the NIST controls of an Air Force contract and, in 2019, together with its private equity owner, passed files containing sensitive defence data to an unauthorised software company in Egypt. The companies had made several written self-disclosures, cooperated and remedied the issues promptly; the U.S. Department of Justice (DOJ) granted them cooperation credit for this. Settlement of 1.75 million USD.

What organisations can take from it

Companies that pass controlled defence data to service providers must check their authorisation – self-disclosure and cooperation significantly reduce the consequences.

Relevance to training and awareness

Handling controlled defence data and service providers

Authority / court: U.S. Department of Justice (Civil Division) / USAO Eastern District of California
Area of law: Other
Legal basis: False Claims Act; NIST SP 800-171
Action: Other
Status of proceedings: final
Sector: Defence and security
Mitigating circumstances: Several written self-disclosures, cooperation and prompt remedial measures.
Published: 31 Jul 2025

Original amount 1,750,000 USD, converted at the ECB reference rate of 31 Jul 2025.

Sources

California Defense Contractor and Private Equity Firm Agree to Pay $1.75M to Resolve False Claims Act Liability Relating to Voluntary Self-Disclosure of Cybersecurity Violations Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

9 Jul 2025 Department of National Defence (Kanada)Canada's Department of National Defence pays 10,000 CAD for destroyed hawk nest Canada, ABEnvironment and sustainability €6,238

During fence removal work at Canadian Forces Base Suffield, heavy machinery destroyed an occupied nest of the protected ferruginous hawk together with three eggs. The Department of National Defence pleaded guilty to two counts under the Species at Risk Act and was fined 10,000 CAD.

What organisations can take from it

Construction and dismantling work on military land also requires a prior species protection assessment and briefed machine operators.

Relevance to training and awareness

Species protection during construction work

Authority / court: Alberta Court of Justice (Anklage: Environment and Climate Change Canada)
Area of law: Environment and sustainability
Legal basis: Species at Risk Act, s. 32(1) und s. 33
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Published: 30 Jul 2025

Original amount 10,000 CAD, converted at the ECB reference rate of 9 Jul 2025.

Sources

Department of National Defence fined $10,000 for violating the Species at Risk Act in Alberta Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

22 May 2025 L3 Technologies Inc.L3 Technologies pays 62 million USD over false cost data for communications technology USAOther €54.8m

Between October 2006 and February 2014, the Communications System West division allegedly failed to disclose complete and current cost and pricing data when selling ROVER, VORTEX and SIR receivers to the Air Force, Army, Navy and other agencies. Settlement under the False Claims Act and the Truth in Negotiations Act of 62 million USD.

What organisations can take from it

In fixed-price negotiations with the government, costing data must be disclosed completely and on a current basis; price review processes belong in the compliance system.

Authority / court: U.S. Department of Justice (Civil Division) / USAO District of Utah
Area of law: Other
Legal basis: False Claims Act; Truth in Negotiations Act
Action: Other
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Published: 22 May 2025

Original amount 62,000,000 USD, converted at the ECB reference rate of 22 May 2025.

Sources

L3 Technologies Inc. Agrees to Pay $62,000,000 to Resolve False Claims Act Allegations arising from Submission of False Cost or Pricing Data on Defense Contracts Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

1 May 2025 Raytheon Company; RTX Corporation; Nightwing Group LLC; Nightwing Intelligence Solutions LLCRaytheon and Nightwing pay 8.4 million USD over cybersecurity deficiencies in DoD contracts USAOther €7.39m

Between 2015 and 2021, the companies allegedly failed to prepare a system security plan for an internal development system used for 29 Department of Defense contracts and did not comply with the clauses DFARS 252.204-7012 and FAR 52.204-21. Settlement under the False Claims Act of 8.4 million USD; a former employee received 1.512 million USD as a whistleblower.

What organisations can take from it

Internal development environments are also covered by contractual cybersecurity obligations and need a documented security plan.

Authority / court: U.S. Department of Justice (Civil Division) / USAO District of Columbia
Area of law: Other
Legal basis: False Claims Act; DFARS 252.204-7012; FAR 52.204-21
Action: Other
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Published: 1 May 2025

Original amount 8,400,000 USD, converted at the ECB reference rate of 30 Apr 2025.

Sources

Raytheon Companies and Nightwing Group to Pay $8.4M to Resolve False Claims Act Allegations Relating to Non-Compliance with Cybersecurity Requirements in Federal Contracts Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

9 Apr 2025 Britisches Exportunternehmen, Militärgüter (anonymisiert)UK exporter pays £3.23m for unlicensed exports of military goods United KingdomExport control and dual-use goods €3.74m

A UK company not named by HMRC paid a compound settlement of £3,231,762.40 in February 2025 in lieu of prosecution over the alleged export of military goods without the licence required under the Export Control Order 2008. HMRC set out the facts in these terms. It was the largest of three settlements totalling close to £3.7 million that HMRC concluded between January and March 2025; no sanctions offences were involved.

What organisations can take from it

Before every export, check whether the goods are military-listed and obtain the appropriate licence.

Relevance to training and awareness

Classification of goods and licensing requirements for military goods

Authority / court: HM Revenue & Customs (HMRC)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Export Control Order 2008; Customs and Excise Management Act 1979
Action: Fine
Status of proceedings: final
Sector: Defence and security
Published: 9 Apr 2025

Original amount 3,231,762.4 GBP, converted at the ECB reference rate of 9 Apr 2025.

Sources

DBT/ECJU: NTE 2025/08: agreed compound settlement for breaches of export control (HTML, 09.04.2025) Official register or notice
DBT/ECJU: Notice to exporters 2025/08: agreed compound settlement for breaches of export control (Publikationsseite, 09.04.2025) Official register or notice

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

8 Apr 2025 Securitas Sicherheitsdienstleistungen GmbH, Securitas ABSecuritas: €540,000 fine for collusion in tenders for security services AustriaCartels and collusion €540,000

The Kartellgericht (Cartel Court) imposed a fine of 540,000 EUR, jointly and severally, on Securitas Sicherheitsdienstleistungen GmbH and Securitas AB. From August 2019 to December 2022, an employee coordinated prices and strategic information with a competitor in three private tenders for manned security services. The Bundeswettbewerbsbehörde (BWB, Federal Competition Authority) granted a reduction for the consensual termination of the proceedings.

What organisations can take from it

Even a few coordinated bids in private tenders are enough for a fine; sales teams need clear rules on contacts with competitors.

Relevance to training and awareness

Information exchange with competitors in tenders

Authority / court: Oberlandesgericht Wien als Kartellgericht (Antrag der Bundeswettbewerbsbehörde)
Area of law: Competition law · Cartels and collusion
Legal basis: § 1 Abs. 1 KartG; § 29 Z 1 lit. a KartG
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 1,000 to 9,999
Culpability: intentional
Repeat case: no
Mitigating circumstances: Reduction for the consensual termination of the proceedings.
Published: 12 Feb 2026

Sources

Ediktsdatei, Veröffentlichung gemäß § 37 KartG: OLG Wien als Kartellgericht, 127 Kt 1/25x Court decision

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

6 Feb 2025 Lockheed Martin CorporationLockheed Martin pays 29.74 million USD over inflated price proposals for the F-35 USAOther €28.7m

From 2013 to 2015, Lockheed Martin allegedly failed to provide the Joint Program Office with accurate cost and pricing data for five production and sustainment contracts for the F-35 programme and thereby obtained inflated prices. The settlement amounts to 29.74 million USD, in addition to 11.3 million USD that had already been paid to the Department of Defense; it was triggered by a qui tam action.

What organisations can take from it

Whistleblower actions from within the company make pricing errors costly even years later – internal reporting channels must pick up such issues early.

Authority / court: U.S. Department of Justice (Civil Division) / USAO Eastern District of Texas
Area of law: Other
Legal basis: False Claims Act; Truth in Negotiations Act
Action: Other
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Published: 6 Feb 2025

Original amount 29,740,000 USD, converted at the ECB reference rate of 6 Feb 2025.

Sources

Lockheed Martin Corporation Agrees to Settle False Claims Act Allegations of Defective Pricing Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

26 Nov 2024 Evolv Technologies Holdings, Inc.FTC: Evolv to let schools exit contracts – alleged overstated advertising for AI weapons scanners USAAI systems Order

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), Evolv advertised that its AI-powered security scanners would detect all weapons, ignore harmless items and be more accurate and faster than metal detectors; according to the complaint, the devices at one school missed a knife in October 2022 that was used to stab a student. The settlement order filed together with the complaint at the federal court in Massachusetts is to allow schools with contracts from April 2022 to June 2023 to cancel and to prohibit unsubstantiated claims about detection performance, false alarms and staffing costs; according to the FTC case page, court approval was still pending in March 2025.

What organisations can take from it

Keep performance claims for safety-critical AI accurate – overstated claims become a contractual risk, and customers can be released from contracts based on them.

Relevance to training and awareness

Performance claims for AI security technology

Authority / court: Federal Trade Commission (FTC)
Area of law: AI and digital regulation · AI systems
Legal basis: Section 5 FTC Act; Stipulated Order for Permanent Injunction
Action: Order
Status of proceedings: unknown
Sector: Defence and security
Published: 26 Nov 2024

Sources

FTC Takes Action Against Evolv Technologies for Deceiving Users About its AI-Powered Security Screening Systems Press release of an authority
FTC v. Evolv Technologies Holdings, Inc. Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

16 Oct 2024 RTX Corporation (Raytheon Company)RTX (Raytheon) pays around 369 million USD for bribing a Qatari military official USABribery of public officials €338.4m

From 2011 to 2017, Raytheon paid almost 2 million USD via sham subcontracts to Qatari military and other public officials and more than 30 million USD to an agent from the ruling family. SEC order: disgorgement of 37,400,090 USD, interest of 11,786,208 USD and a penalty of 75 million USD (of which 22.5 million USD was credited against the DOJ payment); under the DPA with the DOJ, 267,096,068 USD (230.4 million penalty, 36,696,068 forfeiture) is attributable to the FCPA part, combined with an Arms Export Control Act violation and a three-year monitorship. Total without double counting: 368,782,366 USD.

What organisations can take from it

Subcontracts without verifiable services are a classic vehicle for bribes – defence exporters must also disclose payment flows to export control authorities.

Relevance to training and awareness

Sham subcontracts and agents in defence transactions

Authority / court: U.S. Securities and Exchange Commission (SEC); U.S. Department of Justice
Area of law: Bribery and corruption · Bribery of public officials
Legal basis: FCPA (Anti-Bestechung, Buchführung, interne Kontrollen, Sections 30A, 13(b)(2)(A)/(B) Exchange Act); Arms Export Control Act; DPA
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Culpability: intentional
Published: 16 Oct 2024

Original amount 368,782,366 USD, converted at the ECB reference rate of 16 Oct 2024.

Sources

SEC Order In the Matter of RTX Corporation, Release No. 101353 (16.10.2024) Decision of an authority
SEC Enforcement Actions: FCPA Cases Enforcement database of an authority
DOJ Criminal Division: U.S. v. Raytheon Company, Docket No. 24-CR-399 (RER) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Report an error

29 Aug 2024 a US defence groupDDTC: USD 200 million against US defence group for ITAR violations USAExport control and dual-use goodsanonymised €180.4m

The US State Department's Directorate of Defense Trade Controls settled with a US defence group for a civil penalty of USD 200 million for violations of the Arms Export Control Act and the ITAR. The allegations concerned unauthorised exports of defence articles resulting from flawed jurisdiction and classification decisions, further unauthorised exports, including of classified defence articles, hand-carried exports by employees to countries proscribed under ITAR § 126.1, and breaches of authorisation provisos. USD 100 million is suspended provided the group spends it on approved compliance measures; USD 100 million is payable in three instalments.

What organisations can take from it

Correct jurisdiction and classification decisions are the basis of every export authorisation; errors there multiply across the portfolio.

Relevance to training and awareness

Export control for defence articles: classification, hand-carry and authorisation provisos

Authority / court: U.S. Department of State, Directorate of Defense Trade Controls (DDTC)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Arms Export Control Act § 38 (22 U.S.C. § 2778); ITAR, 22 C.F.R. Parts 120–130, insbesondere Part 127 und § 128.11
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Mitigating circumstances: The allegations are based on facts that the group itself disclosed to the DDTC.

Original amount 200,000,000 USD, converted at the ECB reference rate of 29 Aug 2024.

Sources

U.S. Department of State, Directorate of Defense Trade Controls (DDTC), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority

Checked against the official source on 8 Oct 2026 · Company name anonymised since 29 Aug 2026 · Direct link

Report an error

2 Jul 2024 three Belgian security services companiesSecurity services cartel: €47.1m against two providers, third as leniency applicant BelgiumCartels and collusionanonymised €47.1m

In a settlement procedure, the Belgian competition authority found that three security services companies (providers A, B and C), from 2008 to 2020 and across Belgium, applied minimum hourly rates from their trade association, coordinated their conduct in public and private tenders and agreed not to poach each other's staff (no-poach). The fines amount to 35,895,112 EUR jointly and severally for provider A and its parent companies and 11,200,000 EUR jointly and severally for provider B and its parent companies, allegedly 47,095,112 EUR in total; provider C and its parent company, as leniency applicants, received a fine of 0 EUR. According to the authority's press release, it thereby made clear for the first time that no-poach agreements are prohibited as restrictions by object.

What organisations can take from it

Agreements not to poach each other's employees are cartel infringements just like price-fixing and bid rigging and belong in every competition law training.

Relevance to training and awareness

Competition law: bid rigging, trade association price recommendations and no-poach agreements

Authority / court: Belgische Mededingingsautoriteit / Autorité belge de la Concurrence (BMA/ABC) – Auditorat (Vergleichsentscheidung)
Area of law: Competition law · Cartels and collusion
Legal basis: Art. IV.1 Wetboek van economisch recht / Code de droit économique (WER/CDE), Art. 101 Abs. 1 AEUV; Art. IV.59 und IV.79 § 1 WER/CDE
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Mitigating circumstances: Settlement procedure with acknowledgement of participation; provider C received full immunity from fines as leniency applicant.
Liability of senior managers: Measures against individuals are not set out here.
Published: 3 Jul 2024

Sources

ABC/BMA, Décisions (Übersicht) (Entscheidung 2024) Enforcement database of an authority

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 2 Jul 2026 · Direct link

Report an error

30 Apr 2024 a German defence groupCNMC: €13m fine on German defence group for misleading merger notification SpainMerger controlanonymised €13m

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) imposed two fines of 6,500,000 EUR each, totalling 13,000,000 EUR, on the defence group because, when notifying its acquisition of a Spanish munitions manufacturer, the group concealed the parties' activities in nitrocellulose and wet paste (a mixture of nitrocellulose and nitroglycerine). In response to a later request for information from the authority it also provided incomplete and misleading information; the acquisition had previously been cleared in phase one.

What organisations can take from it

Merger notifications must disclose every market in which the parties are active; incomplete information is punished as obstruction of the authority even after clearance has been granted.

Relevance to training and awareness

Complete and truthful information in merger control proceedings

Authority / court: Comisión Nacional de los Mercados y la Competencia (CNMC)
Area of law: Competition law · Merger control
Legal basis: Art. 62.3.c) und Art. 39 Ley 15/2007 de Defensa de la Competencia
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Employees: 10,000 or more
Published: 14 May 2024

Sources

CNMC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Decision of an authority

Checked against the official source on 28 Sep 2026 · Company name anonymised since 30 Apr 2026 · Direct link

Report an error

12 Mar 2024 an Italian alarm system providerAGCM fines alarm system provider €4.25m over advertising and cancellation hurdles ItalyMisleading advertising and pricinganonymised €4.25m

The provider did not make clear in its advertising that the alarm system is only lent under an open-ended security subscription, obstructed cancellations through continued invoicing and delayed removal, started providing the service during the withdrawal period without an express request and stated the competent court unclearly. The AGCM imposed fines of 1,200,000, 2,500,000, 500,000 and 50,000 EUR, a total of 4,250,000 EUR.

What organisations can take from it

Rental models must be clearly identifiable as subscriptions in advertising, and a cancellation must be implemented promptly without further billing.

Relevance to training and awareness

Transparent subscription models and smooth cancellation

Authority / court: Autorità Garante della Concorrenza e del Mercato (AGCM)
Area of law: Consumer protection and online retail · Misleading advertising and pricing
Legal basis: Art. 20, 21, 22, 24, 26 Abs. 1 lit. f, 50 Abs. 3, 51 Abs. 8, 57 Abs. 4 lit. a Nr. 2, 66-bis Codice del consumo (D.lgs. 206/2005)
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Published: 26 Mar 2024

Sources

AGCM, Suche nach Entscheidungen (Entscheidung 2024) Decision of an authority

Checked against the official source on 28 Sep 2026 · Company name anonymised since 12 Mar 2026 · Direct link

Report an error

28 Feb 2024 a US aerospace groupDDTC: USD 51 million against US aerospace group for unauthorised technical data transfers USAExport control and dual-use goodsanonymised €47.2m

The DDTC settled with a US aerospace group for a civil penalty of USD 51 million for ITAR violations: unauthorised exports and retransfers of technical data to foreign-person employees and contractors, unauthorised exports to the People's Republic of China as a proscribed country, and breaches of authorisation provisos. USD 24 million is suspended for approved compliance measures; USD 27 million is payable in three instalments.

What organisations can take from it

Access by foreign-person employees to controlled technical data is an export and requires authorisation and technical access controls.

Relevance to training and awareness

Deemed exports: foreign-person employees' access to controlled technical data

Authority / court: U.S. Department of State, Directorate of Defense Trade Controls (DDTC)
Area of law: Sanctions and export control · Export control and dual-use goods
Legal basis: Arms Export Control Act § 38 (22 U.S.C. § 2778); ITAR, 22 C.F.R. Parts 120–130, insbesondere Part 127 und § 128.11
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Mitigating circumstances: The allegations are based on facts that the group itself disclosed to the DDTC.

Original amount 51,000,000 USD, converted at the ECB reference rate of 28 Feb 2024.

Sources

U.S. Department of State, Directorate of Defense Trade Controls (DDTC), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority

Checked against the official source on 8 Oct 2026 · Company name anonymised since 28 Feb 2026 · Direct link

Report an error

21 Sep 2023 a German defence groupDefence group: €1.2m fine for market sharing in military hand grenades EU levelCartels and collusionanonymised €1.2m

According to the European Commission's findings, the group and a competitor shared the national markets for military hand grenades in the EEA between themselves from 7 November 2007 to 23 November 2021 – the Commission's first cartel case in the defence sector. In the settlement procedure, the group received a fine of €1.2m after reductions of 50% (leniency) and 10% (settlement), the amount having first been significantly increased for deterrence; the competitor, as leniency applicant, was not fined.

What organisations can take from it

In the defence sector too, sharing national markets between manufacturers is a cartel infringement.

Relevance to training and awareness

Market sharing between competitors

Authority / court: Europäische Kommission
Area of law: Competition law · Cartels and collusion
Legal basis: Art. 101 AEUV; Art. 53 EWR-Abkommen
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Mitigating circumstances: 50% reduction under the leniency programme and 10% for the settlement.
Published: 21 Sep 2023

Sources

Europäische Kommission, Presseraum (Übersicht) (Entscheidung 2023) Press release of an authority

Checked against the official source on 28 Sep 2026 · Company name anonymised since 21 Sep 2025 · Direct link

Report an error

19 Jul 2023 four Spanish defence suppliersCNMC: cartel fines on defence suppliers for sharing out army contracts SpainCartels and collusionanonymised €6.23m

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) sanctioned two cartels through which companies shared out tenders of the Spanish Ministry of Defence for the maintenance and modernisation of military vehicles and for camp containers between 2016 and 2021; almost one hundred contracts worth around 60 million EUR were affected. The fines on the companies total 6,225,076 EUR (3,302,912, 1,517,944, 1,304,220 and 100,000 EUR). The decision was forwarded to the Junta Consultiva de Contratación Pública del Estado (State public procurement advisory board) with a view to a possible debarment.

What organisations can take from it

Cover bids, non-participation agreements and misused bidding consortia in public tenders lead to fines and debarment; an effective compliance programme is taken into account when assessing the exclusion.

Relevance to training and awareness

Bid rigging in public tenders

Authority / court: Comisión Nacional de los Mercados y la Competencia (CNMC)
Area of law: Competition law · Cartels and collusion
Legal basis: Art. 1 und Art. 62.4.a) Ley 15/2007 de Defensa de la Competencia; Art. 101 AEUV; Vergabeverbot nach Art. 71.1.b) Ley 9/2017 de Contratos del Sector Público (Prüfung durch die Junta Consultiva)
Action: Fine
Status of proceedings: unknown
Sector: Defence and security
Mitigating circumstances: The CNMC assessed some of the compliance programmes submitted positively; they did not reduce the fines, but after a review in six months they may be taken into account in the decision on debarment.
Liability of senior managers: Measures against individuals are not reported here.
Published: 25 Jul 2023

Sources

CNMC, Pressemitteilungen (Übersicht) (Entscheidung 2023) Decision of an authority

Checked against the official source on 28 Sep 2026 · Company name anonymised since 19 Jul 2025 · Direct link

Report an error

16 May 2023 a Canadian provider of forensic security technologyCanadian forensic technology provider: remediation agreement over bribery in the Philippines CanadaBribery of public officialsanonymised €7.2m

Between 2006 and 2018, the company allegedly bribed Philippine public officials and defrauded the Philippine state in connection with a ballistic identification system for the national police. The four-year remediation agreement, approved by the Superior Court of Quebec in early 2023 and published on 16 May 2023, provides for a penalty of 6,593,178 CAD, a surcharge of 659,318 CAD and forfeiture of 3,296,589 CAD, as well as an independent monitor.

What organisations can take from it

In addition to payments, remediation agreements require an independent monitor – companies should set up their anti-corruption programmes in advance so that they withstand scrutiny.

Relevance to training and awareness

Government contracts for security technology abroad

Authority / court: Public Prosecution Service of Canada (PPSC); Superior Court of Quebec
Area of law: Bribery and corruption · Bribery of public officials
Legal basis: s. 3 Corruption of Foreign Public Officials Act; s. 380 Criminal Code; Remediation Agreement (Part XXII.1 Criminal Code)
Action: Fine
Status of proceedings: final
Sector: Defence and security
Culpability: intentional
Published: 17 May 2023

Original amount 10,549,085 CAD, converted at the ECB reference rate of 16 May 2023.

Sources

PPSC, Meldungen (Übersicht) (Entscheidung 2023) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 May 2025 · Direct link

Report an error

1 Feb 2023 an alarm system provider in SpainAlarm system provider in Spain: 100,000 EUR because data subject rights could only be exercised via a 902 number SpainData subject rights and transparencyanonymised €100,000

On the video surveillance signs that the alarm system provider supplies to its customers, only a chargeable 902 telephone number was given for access and objection requests. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) considered this to obstruct the exercise of rights, imposed 100,000 EUR and ordered the signs to be replaced within twelve months; the European Data Protection Board (EDPB) published the decision in September 2026.

What organisations can take from it

The route for exercising data subject rights must be free of charge and easily accessible, including on signs at customers' premises.

Authority / court: Agencia Española de Protección de Datos (AEPD)
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 12 Abs. 2, Art. 83 Abs. 5 lit. b
Action: Fine
Status of proceedings: final
Sector: Defence and security
Published: 22 Sep 2026

Sources

AEPD, Resoluciones (Übersicht) (Entscheidung 2023) Decision of an authority
EDSA (EDPB), Nachrichten (Übersicht) (Entscheidung 2023) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 1 Feb 2025 · Direct link

Report an error

18 Oct 2022 a German defence groupBaFin fines a defence group €150,000 for late ad hoc disclosure GermanyDisclosure and reporting obligationsanonymised €150,000

On 18 October 2022 BaFin (German Federal Financial Supervisory Authority) imposed a fine of 150,000 EUR on a German defence group because the company had not disclosed inside information without delay. The fine is final.

What organisations can take from it

Delays in ad hoc disclosure are sanctioned; internal decision paths for publications must be designed accordingly.

Relevance to training and awareness

Ad hoc duty: publishing inside information without delay

Authority / court: Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
Area of law: Capital markets and financial supervision · Disclosure and reporting obligations
Legal basis: Art. 17 Abs. 1 UAbs. 1 MAR (Verordnung (EU) Nr. 596/2014)
Action: Fine
Status of proceedings: final
Sector: Defence and security
Employees: 10,000 or more
Published: 1 Nov 2022

Sources

BaFin, Maßnahmen und Sanktionen (Übersicht) (Entscheidung 2022) Press release of an authority

Checked against the official source on 2 Oct 2026 · Company name anonymised since 18 Oct 2024 · Direct link

Report an error

Who was sanctioned, and for what?

Where?

What for?

Who?

When?

31 cases

Ready for training that actually lands?

Period	Cases	Total
2022	1	€150,000
2023	4	€14.7m
2024	7	€630.3m
2025	10	€97.4m
2026	9	€77.5m