For years, one of the key attractions of resolving a UK sanctions or export control breach through a compound settlement was anonymity.
That has now changed.
In June 2026, HMRC publicly named Petrofac Facilities Management after it agreed on a £569,157 compound settlement for breaches of the UK Russia sanctions regime. HMRC made clear that, where appropriate, naming the company would now be included as a condition of future compound settlements involving strategic export and sanctions offences.
Just weeks later, the significance of the policy became even clearer. On 8 September 2026, HMRC published details of a £7.44 million settlement with Illumina Cambridge involving the indirect supply of sanctioned goods through companies within its corporate group.
Sanctions compliance is not only about avoiding a fine or criminal prosecution. It is also about managing reputational risk, understanding complex international supply chains and being able to demonstrate that sanctions and export control systems are really effective.
A major change to UK sanctions enforcement
The UK’s sanctions regime has become more sophisticated since Russia’s invasion of Ukraine. Enforcement is no longer focused solely on the obvious scenario of a UK company directly exporting goods to a sanctioned country. Regulators are increasingly examining how goods, technology, services and funds move through international corporate structures and third countries.
At the same time, the UK’s enforcement architecture has changed. The Office of Trade Sanctions Implementation (OTSI), launched in October 2024, has strengthened the UK’s ability to enforce trade sanctions through civil penalties, while HMRC continues to play a major role in criminal enforcement and strategic export controls.
This creates a more complex enforcement environment for businesses. A company may face different regulators and different enforcement routes depending on the nature of the suspected breach.
It also means companies need to understand not just what the sanctions rules prohibit but how those rules are enforced and what can happen when a breach is identified.
From anonymous settlement to public accountability
The Petrofac case represents a significant policy shift.
Petrofac’s breaches occurred in 2022 and 2023 while the company was winding down its Russian operations. The company supplied sanctioned industrial goods to individuals connected to Russia and provided technical assistance relating to those goods. Petrofac voluntarily disclosed the breaches and cooperated with HMRC. Nevertheless, the company was publicly identified when the £569,157 settlement was announced.
HMRC explained that its previous policy of anonymising compound settlements would no longer apply. Where appropriate, naming a company can now form part of the conditions attached to a compound settlement for strategic export and sanctions offences.
That brings HMRC’s approach more closely into line with other UK sanctions enforcement bodies, particularly the Office of Financial Sanctions Implementation (OFSI) and OTSI, where public enforcement action is already an established feature of the regime.
Previously, companies saw a compound settlement as a way of resolving a potentially serious sanctions or export control matter without the reputational consequences of a criminal prosecution or public enforcement action.
That assumption can no longer be made. A company that voluntarily discloses a breach, cooperates with HMRC and reaches a settlement may still find itself publicly named.
The Illumina case: the third-country supply chain problem
Illumina Cambridge Limited paid £7,438,840.13 after HMRC found that it had breached the Russia sanctions regulations through the supply of sanctioned goods from one overseas company within its corporate group to another overseas group company, for export to Russia and other destinations.
Crucially, no goods were exported from the UK. That demonstrates why companies cannot assume that UK sanctions are irrelevant because goods originate outside the UK or never physically pass through the UK.
Companies need to understand where UK sanctions impact their activities. Transactions between overseas subsidiaries may need to be assessed just as carefully as direct UK exports.
Illumina voluntarily disclosed the matter, fully cooperated with HMRC and took remedial action, including ceasing all business involving Russia. Once again, the settlement was still substantial.
The case also highlights that sanctions compliance increasingly requires businesses to understand the end use and end user rather than just screening the immediate customer.
For companies with complicated distribution networks, sanctions screening needs to sit alongside broader transactional due diligence. Businesses need to understand who is ultimately receiving the goods, where they are likely to go and whether the commercial circumstances make sense.
This is especially important where a transaction involves a jurisdiction that could potentially be used as a route for sanctions circumvention.
The rise of trade sanctions enforcement
There is another story behind these cases. UK sanctions enforcement is increasingly focused on trade.
Financial sanctions remain critical, but the sanctions environment has expanded into areas such as strategic technologies, semiconductors, energy, shipping and other goods and services that can support sanctioned regimes.
The UK’s enforcement structure reflects that shift. OTSI is responsible for civil enforcement of a range of trade sanctions, while HMRC retains significant responsibilities for sanctions relating to goods and technology moving to or from the UK, as well as strategic export controls.
The result is a sanctions environment in which companies need to think beyond financial sanctions screening. A business might have a strong system for checking customers against the UK Sanctions List and still have weak trade sanctions controls. Export classifications, licences, end-use checks, distributors, technical assistance, technology transfers and record-keeping can all become enforcement issues.
Airbus: control failures can be costly
In July 2026, Airbus Operations Limited paid more than £6.4 million to HMRC after admitting multiple breaches of strategic export controls. It was the largest compound settlement reached by HMRC for strategic export offences at the time.
The breaches included failures to keep accurate records of transfers of controlled technology and failures to maintain registers required under Open General Export Licences. Airbus self-reported the breaches and fully cooperated with HMRC.
The case demonstrates that sanctions and export control enforcement is not necessarily about deliberately circumventing the rules. A company can have an established compliance programme and an intention to comply, yet still face serious consequences because its internal controls are inadequate.
A policy sitting on an intranet does not prevent a breach if employees do not understand it, systems do not capture the necessary information or nobody is checking whether licence conditions are actually being followed.
New end-use controls increase the pressure
The UK’s sanctions environment is also expanding through new end-use controls.
In May 2026, the Government introduced Sanctions End-Use Controls, creating a new licensing requirement for exports to a non-sanctioned third country where the exporter has been informed by the Government that there is a risk of ultimate diversion of the goods or related technology to a sanctioned destination. Essentially, the country named on the shipping documentation may not tell the whole story.
Businesses need to consider what happens after goods leave their immediate control. This makes end-use checks, distributor due diligence and escalation procedures important.
The new naming policy and voluntary disclosure
Companies may now have to weigh the benefits of voluntary disclosure against the possibility of reputational damage, contractual consequences, investor scrutiny and wider stakeholder attention.
There is also an important question about the timing of the policy change. HMRC’s announcement raised concerns about cases where companies had already made voluntary disclosures at a time when the longstanding expectation was that their identity would remain confidential. If those companies can subsequently be named, the change could have implications beyond future disclosures.
But the removal of anonymity doesn’t necessarily make voluntary disclosure less important. Self-reporting and cooperation are still significant factors in HMRC’s assessment of enforcement outcomes. Compound settlements can still provide a route to resolving serious breaches without criminal prosecution, and cooperation can affect the financial consequences of an investigation.
But companies can no longer treat anonymity as part of the deal.
Prevent the breach before you have to disclose it
The strongest response to the change is to reduce the likelihood that a breach happens in the first place. That requires businesses to look carefully at how they are managing sanctions compliance.
Companies should be asking whether their supply chains have been properly mapped and whether they understand the role of distributors, agents, intermediaries and end users. They should be reviewing transactions involving higher-risk third countries and checking whether products could realistically be diverted to sanctioned destinations.
Corporate groups should also examine whether sanctions controls are consistent across subsidiaries and whether overseas entities understand the obligations that may arise from their connection to a UK business.
Licence management deserves particular attention. The Airbus case shows that it is not enough to obtain an export licence. Businesses also need systems that ensure the conditions of that licence are understood, monitored and documented.
Training is also important. Sanctions compliance cannot sit exclusively with the legal or compliance department. And companies need a clear breach-response process. When a potential breach is identified, there should already be an understanding of who investigates it, who preserves the relevant records, who makes the legal assessment and who determines whether regulatory disclosure is necessary.
Waiting until HMRC comes knocking is not an optimal sanctions strategy.
These latest cases show that enforcement is moving beyond straightforward exports to encompass third-country transactions, corporate group structures, end-use risks, controlled technology and internal control failures.
