On May 16, 2011, BAE Systems plc (BAES UK), a multinational defense contractor headquartered in the United Kingdom, entered into a Consent Agreement (Agreement) with the US Department of State, Directorate of Defense Trade Controls (DDTC). BAES UK settled 2,591 alleged violations of the International Traffic in Arms Regulations (ITAR), 22 CFR Parts 120-130, as described in a Proposed Charging Letter. Pursuant to the Agreement and Order, BAES UK agreed to pay $79 million in civil penalties and undertake extensive remedial compliance measures for a period of four years. DDTC also issued a policy of denial for new license applications regarding three BAES UK non-US affiliates: BAE Systems CS&S International, Red Diamond Trading Ltd., and Poseidon Trading Investments Ltd. The Agreement does not allege ITAR violations against BAE Systems, Inc., which is the US subsidiary of BAES UK and one of the United States’ largest domestic defense contractors.

This civil enforcement case, resulting in significant penalties and other remedial measures, is important for several reasons. First, it involves a non-US person’s alleged violations of the brokering provisions in ITAR Part 129, which appears to be the first of its kind. Second, it is one of two proposed charging letter cases that involve any person’s failure to submit mandatory reports of “fees or commissions” or “political contributions” as required under ITAR Part 130 —the other significant action being against L-3 Communications Corporation/L-3 Titan Corporation in 2006. Third, the civil settlement amount is the highest monetary penalty ever imposed by DDTC, nearly doubling the amount of the next largest civil penalty of $42 million imposed in 2010 against Xe Services LLC. Fourth, because this case stems from US Department of Justice (DOJ) and the UK Serious Fraud Office (SFO) criminal proceedings/resolutions last year, it demonstrates the increasing interplay between export controls and anti-corruption law. Finally, the consent agreement imposes an extensive set of compliance requirements as part of the settlement.


The allegations follow a March 2, 2010 Plea Agreement between BAES UK and the DOJ for conspiracy to make false statements and to violate Section 2779 of the Arms Export Control Act (AECA) involving, in part, leases and sales of Gripen fighter jets from Sweden to the Czech Republic and Hungary. Under the Plea Agreement, BAES UK agreed to pay a $400 million criminal penalty and undertake substantial compliance improvements. (See our previous advisory on that settlement here). BAES UK also settled similar charges with the SFO for £30 million in February 2010.

Following the settlements, on March 10, 2010, DDTC requested information from BAES UK regarding its failure to disclose payments as required under ITAR Part 130 in connection with the leases and sales of the Gripen jets. DDTC asserted that BAES UK was “incapable or reluctant to provide further, meaningful detail on its payment of fees or commissions,” partly as a result of UK law and advice from the UK government. Based on a visit in November 2010 to BAES UK’s facilities in the United Kingdom, DDTC concluded that BAES UK “had a limited, but insufficient, ITAR compliance program before 2007.”

As part of its enforcement decision, DDTC considered mitigating factors, such as changes in BAES UK’s senior management and members of the board of directors, as well as remedial compliance measures implemented after 2007. However, DDTC concluded that those mitigating factors were outweighed by aggravating factors, including BAES UK’s alleged: (1) failure to cooperate fully for a period of 14 months after DDTC initiated its directed review; (2) incomplete responses to DDTC’s requests for information; and (3) failure to maintain or produce relevant records. DDTC reported that these circumstances contributed to an incomplete investigation and the “inability to assess fully the potential harm to US national security.” In addition, DDTC apparently decided that a penalty was warranted given the frequency and type of the violations, which “were systemic, widespread, and sustained for more than 10 years;” because the former most senior management of BAES UK allegedly authorized certain ITAR violations; and since BAES UK did not voluntarily disclosed nearly all violations, but rather DOJ or DDTC directly sought information about circumstances giving rise to apparent ITAR violations.

BAES UK’s Alleged Violations

The following is a summary of BAES UK’s alleged violations, along with commentary regarding the circumstances reported by DDTC in the Proposed Charging Letter.

Unauthorized Brokering. Under ITAR Part 129, a foreign person who engages in “brokering activities” must register with DDTC as a “broker." Thereafter, brokers must obtain licenses, and/or file certain notifications, prior to engaging in brokering activities related to Significant Military Equipment and other items controlled by the US Munitions List. Also, registered brokers are required to submit annual reports to DDTC.

According to DDTC, BAES UK engaged in brokering activities for 14 years, but never registered as a broker—in contrast to some of its other subsidiaries in Australia, the United States, and the United Kingdom. As a result of this failure to register, BAES UK never filed annual brokering reports, even though DDTC concluded that BAES UK was required to do so since 1998. In addition, BAES UK never sought or obtained required approvals from DDTC, despite engaging in numerous alleged brokering activities that involved US-origin defense articles and services, including:

  • From 1995-2004, BAES UK’s joint venture with SAAB AB, SAAB-BAE Systems Gripen AB, and a related entity, Gripen International KB, apparently engaged in marketing, sales, and after-sales support for Gripen jets. Although DDTC stated in several footnotes that SAAB AB was not a subject of its investigation, it appears that SAAB-BAE Systems Gripen AB and Gripen International KB would be engaging in brokering activities based on the recited facts.
  • In 2005, SAAB AB began to lead the marketing effort for Gripen jets sales to three countries, but DDTC alleged that BAES UK also reportedly provided marketing support for efforts related to South Africa, Hungary, and the Czech Republic. DDTC does not describe what BAES UK’s marketing entailed, even though it seems DDTC concluded that such marketing constituted brokering activities.
  • From 1994-2005, SAAB AB obtained eight approvals through General Correspondence requests to market Gripen aircraft incorporating US-origin defense articles; defense services also were provided to modify the aircraft to integrate major US systems and sub-systems. These activities involved Hungary, Poland, Czech Republic, Chile, Philippines, Brazil, South Africa, and Thailand. BAES UK allegedly also engaged in marketing services with these countries. DDTC does not provide details regarding what BAES UK’s marketing or other brokering activities involved.
  • From 1998 until approximately 2008, DDTC alleged similar violations against BAES UK for marketing or exporting: (1) Hawk aircraft involving Indonesia, Australia, Canada, Bahrain, South Africa, and India, (2) Typhoon aircraft involving Australia, Czech Republic, Greece, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Austria, Denmark, Japan, and Switzerland; and (3) frigates involving Chile.
  • From 1998-2007, BAES UK engaged in brokering activities directly, or caused others to broker, by providing finance payments for the supply of military systems with ITAR-controlled defense articles and/or furnishing defense services. Although it appears full records were not available, DDTC estimated that BAES UK made at least 100 payments to brokers during this time period.

Causing Unauthorized Brokering. DDTC asserted that BAES UK used at least 140, and as many as 300, unregistered “advisers” to help BAES UK market US-origin defense articles overseas from 1998-2007. DDTC viewed the advisers as analogous to brokers, based on the nature of the adviser’s activities. DDTC asserted that most, but not all, of the advisers would have been obligated to register as brokers under ITAR Part 129, but failed to do so. It appears that DDTC found that BAES UK’s use of these advisers who were not registered as brokers, but reportedly engaged in brokering activities without prior approval from DDTC, “caused” unauthorized brokering.

Unauthorized Brokering by BAES UK Subsidiary Red Diamond. In 1998, BAES UK allegedly engaged a trust company in Liechtenstein to create Red Diamond, a British Virgin Islands company, in part, “to conceal [BAES UK’s] brokering relationships.” Although not a subsidiary, DDTC asserted that Red Diamond “was structured in a manner so that it could not act without [BAES UK’s] written agreement.” DDTC estimated that Red Diamond facilitated no less than 1,000 payments to nearly 300 third-party brokers or advisers hired by BAES UK. Red Diamond apparently provided financing through these brokers pursuant to “covert” agreements made at the specific direction of BAES UK senior management. Such financing involved military systems incorporating ITAR-controlled defense articles or utilizing US-origin defense services. Thus, DDTC asserted that Red Diamond “operated with intent to circumvent the normal payments reviews.” DDTC does not describe how these agreements were covert.

Undisclosed Payments. Part 130 imposes requirements on an “applicant” or a “supplier” that pays, or offers or agrees to pay, to (1) foreign officers “political contributions” of $5,000 or more and/or (2) any person “fees or commissions” of $100,000 of more, (in specified, aggregate amounts) in order to secure a sale of defense articles or defense services valued at $500,000 or more to the “armed forces” of a foreign country. The rules apply to direct commercial sales and foreign military sales. The reports are mandatory for applicants and suppliers, who also are obligated to furnish required reports, if applicable, by their “vendors.” DDTC license applications contain Part 130 certifications. ITAR Part 130 has an important overlay with US Foreign Corrupt Practices Act compliance.

BAES UK voluntarily disclosed making payments to brokers relating to reexports of Gripen aircraft from Sweden to the Czech Republic and Hungary. DDTC alleged that these reexports required prior approval due to their incorporation of US defense articles, but BAES UK failed to disclose the payments as required by §130.9.

Additionally, in 2002, SAAB NA obtained a license to export $160 million worth of ITAR-controlled defense articles to support the manufacture of Gripen aircraft for sale to South Africa. The license application apparently contained a negative Part 130 certification. DDTC stated that this license formed part of a £1.6 billion transaction involving Hawk and Gripen aircraft for South Africa. Red Diamond allegedly made an unspecified amount of “payments” to brokers for securing this sale. Thus, DDTC concluded that BAES UK failed to disclose the payments pursuant to §130.9.

For this transaction, it appears that SAAB NA was the “applicant” and may have provided the incorrect certification in the proposed license. It is unclear whether DDTC considered BAES UK to be a “vendor,” which might require a §130.9 report and certification requirement. It is possible BAES UK could be a vendor if it was a manufacturer or distributor of defense articles for an applicant, or furnisher of defense articles or defense services to an applicant. (BAES UK would not have been a “supplier” because there was no contract with the US Department of Defense regarding this transaction.) It also is unclear in the Proposed Charging Letter whether SAAB NA ever sought information from BAES UK regarding reportable fees, commissions, or political contributions, even though the Plea Agreement with DOJ suggests that BAES UK failed to make required statements, or made false statements, which caused an incorrect certification. Interestingly, DDTC based these allegations on the involvement of BAES UK’s “broker,” Red Diamond, and does not specify how the “payments” constituted a “fee or commission” or “political contribution.” It appears that DDTC is juxtaposing concepts in Part 129 with Part 130 requirements. Although the text and legislative history of section 2779 of AECA provide legal support for these charges, it is not clear that the relevant provisions and definitions of the ITAR do.

Record-Keeping. Finally, DDTC alleged that BAES UK and Red Diamond failed to maintain records on its brokering activities, its financing of third party brokering, and its reporting obligations under §130.9.

Notable Features of the Agreement

The office of Defense Trade Controls Compliance (DTCC) will oversee BAES UK’s adherence to the Agreement, as follows.

Time Period. The Agreement is to remain in effect for four years. Most consent agreements last for only two to three years.

Appointment of a Special Compliance Official (SCO). BAES UK agreed to appoint, with the approval of DTCC, an SCO from outside the company for at least three years from the date of the Order. The SCO may not have been previously employed by BAES UK, and may not work for the company for at least five years after the engagement. After three years, the SCO of BAES UK and DTCC may elect to appoint an Internal SCO (ISCO) for the remainder of the Agreement’s term, i.e., the final, fourth year. The SCO/ISCO will report to DTCC, and the ISCO would report to both DTCC and BAES UK’s chief executive. (Both the SCO and ISCO are referred to simply as “SCO” below). (It is worth noting that some consent agreements, e.g., that of Northrop Grumman in 2008, allow for the appointment of an ISCO in the first instance rather than an external SCO).

SCO’s Areas of Responsibility. The SCO has three primary responsibilities:

  1. Policy and procedure relating to AECA and ITAR compliance. The SCO is responsible for monitoring BAES UK’s compliance program. Of particular note, the SCO must focus on the following:
  • Incorporating compliance into BAES UK’s senior executive duties;
  • Hiring, compensation, and authorities of consultants, advisers, agents, and brokers;
  • Coordinating and standardizing of compliance programs across BAES UK’s businesses, divisions, units, and subsidiaries;
  • Maintaining adequate compliance staffing levels;
  • Conducting internal compliance monitoring and audits; and
  • Policies and procedures for complying with a comprehensive range of specified ITAR requirements and issues.
  1. Oversight of compliance measures stipulated in the Agreement. The SCO is responsible for monitoring, reviewing, and reporting on the following:
  • BAES UK’s maintenance of the compliance measures required by the Agreement;
  • BAES UK’s corporate oversight of AECA and ITAR compliance and its discharge of responsibilities under the Agreement;
  • Expenditures for remedial compliance measures required by the Agreement;
  • Enhancement and coordination of automated systems to track ITAR-controlled activities;
  • Internal ITAR audits; and
  • Additional policies as necessary, e.g., compliance hotlines
  1. Reporting to DTCC. The SCO is responsible for submitting reports to DTCC, as follows:
  • Tracking, evaluation, and reporting of ITAR violations and compliance resources;
  • Status and impact reports on BAES UK’s compliance program and resource levels; and
  • Analysis and conclusions concerning BAES UK’s compliance with the Agreement along with recommendations.

In performing these duties, the SCO shall have full and complete access to all company information necessary, with the exception of privileged or otherwise legally limited documents. The SCO also shall freely report its findings, conclusions, and recommendations to the chief executive of BAES UK or DTCC.

Compliance Resource and Program Enhancements. BAES UK must dedicate substantial resources to enhancing its compliance program. Within four months of the Order, BAES UK must conduct an internal review throughout its entire company of the types of violations contained in the Proposed Charging Letter. The review’s results must be reported to the SCO and DTCC. Within 12 months of the Order, BAES UK must have implemented improved compliance procedures and policies focused on addressing the causes of the violations, as well as a range of training and procedural enhancements. These policies and procedures must include reviewing BAES UK’s information technology systems for monitoring ITAR-controlled activities and enhancing such systems where necessary. BAES UK also must continue publicizing its compliance hotline to its employees and ensure that any reported information regarding potential ITAR violations be forwarded to BAES UK’s chief counsel, compliance and regulation.

Audits. BAES UK is required to undertake two audits, to be supervised by the SCO. The first audit must undertake an enterprise-wide assessment of the efficacy of BAES UK’s AECA and ITAR compliance program. The first audit also must begin within six months of the date of the Order, with a final report, including recommendations, within 12 months. The second audit will address how successfully BAES UK implemented the recommendations from the first audit report, and the effectiveness of BAES UK’s compliance with the Agreement’s requirements. It must be completed within 42 months from the date of the Order. DTCC retains the right to use information learned from these audits in any subsequent actions against BAES UK.

Penalty Structure. As noted, BAES UK agreed to pay a $79 million civil penalty to resolve ITAR violation allegations. Of this sum, $69 million must be paid to DTCC. The sum of $18 million is due within 10 days of the Order and the remaining $51 million is payable on the next three anniversary years of the Order. The penalty structure allows BAES UK to credit $10 million towards implementing compliance measures. The company can apply $3 million to improvements undertaken prior to the Agreement, with the remaining $7 million applicable toward future enhancements mandated by the Agreement. DTCC must verify and approve the sums dedicated toward compliance improvements.

Debarment. Pursuant to §127.7, DTCC also imposed a statutory debarment on BAES UK based on the Plea Agreement. However, the assistant secretary of political-military affairs exercised discretion under §38(g)(4) of AECA that BAES UK has satisfactorily begun to address law enforcement concerns, and thus reinstated BAES UK immediately. DTCC opted to place three of BAES UK’s affiliates under a policy of denial. As a result, BAES UK Systems CS&S International, Red Diamond Trading Ltd., and Poseidon Trading Investments Ltd. are prohibited from engaging in defense trade and brokering activities without a “Transaction Exception” from DTCC. The policy of denial is only prospective, however, and exports or transfers involving these companies are authorized by previously granted licenses. DTCC did not suspend such licenses, as it is empowered to do.

Reviews and Certifications. For the term of the Agreement, BAES UK agreed to arrange on-site reviews by DTCC with minimum advance notice. Three months prior to the expiration of the Agreement, BAES UK must certify to DTCC that it has implemented and complied with all the Agreement’s aspects. The Agreement will remain in force, even beyond the four year term, until such as time as DTCC finds that BAES UK has satisfied its duties under the Agreement and that its ITAR compliance program is adequate to prevent violations of the ITAR or AECA.