Quarterly Compliance Round-up: September 2026

The third quarter of 2026 kept up the pace of enforcement and rulemaking. Regulators stayed focused on export controls, sanctions, anti-boycott, and anti-corruption. Key developments that stood out:

The Commerce Department’s Bureau of Industry and Security (BIS) and the State Department’s Directorate of Defense Trade Controls brought notable export cases, including a $36 million International Traffic in Arms Regulations (ITAR) settlement with BAE Systems and BIS settlements with Plexon and Container Manufacturing Ltd.
The CFTC paid out more than $150 million in whistleblower awards and adopted a rule to speed up smaller awards.
Boeing and MAAG Gala settled anti-boycott charges arising from unreported boycott requests.
The Treasury Department’s Office of Foreign Assets Control (OFAC) penalized Rice Lake Weighing Systems for its Italian subsidiary’s Iran sales.
DOJ formally launched its new National Fraud Enforcement Division, with trade fraud, health care, tax, and corporate misconduct among its priorities.
DOJ secured a Foreign Corrupt Practices Act (FCPA) deferred prosecution agreement (DPA) with Scoular.
The EU adopted its 21st Russia sanctions package, its largest designation round in four years, and its revised foreign direct investment (FDI) screening regulation, which governs national security reviews of foreign investments in EU companies, entered into force.

A common thread: regulators are calling out understaffed compliance teams and weak oversight of subsidiaries and third parties.

Here’s what happened.

U.S. export control enforcement: medical tech, distributors, and a major ITAR case

In 2022, Lisa Monaco, the Biden Administration’s Deputy Attorney General, described the area of export controls as the “new FCPA.” Four years later, enforcement actions reflect her comments and illustrate that this risk area isn’t limited to high tech or big companies.

BIS kept up its focus on Entity List violations, reaching beyond semiconductors into research and medical technology. The State Department also brought its biggest ITAR case in years:

BAE Systems, Inc. ITAR settlement (announced August 13, 2026): The State Department concluded a $36 million settlement with BAE Systems, Inc. to resolve 104 violations of the Arms Export Control Act and ITAR, covering conduct over nearly six years, from May 2019 through March 2025.

The violations included unauthorized exports of technical data, including to China, and breaches of license terms and conditions.
BAE voluntarily disclosed all but one violation. The Department suspended $18 million of the penalty on condition it is spent on remedial compliance measures.
BAE must retain a Special Compliance Officer, implement an automated export compliance system, and undergo an external audit.
The charging letter pointed to insufficient written procedures, inexperienced trade compliance staff, and weak systems for tracking authorizations.

Plexon Inc. (August 14, 2026): BIS settled with Plexon, a Dallas-based neuroscience equipment maker. Between February 2022 and August 2023, Plexon exported eight neural recording systems, worth about $180,000, through its Asian distributor to China’s Academy of Military Medical Sciences. AMMS has been on the Entity List since December 2021.

The $1.7 million penalty is suspended for five years, conditioned on an external compliance audit and no further violations.
BIS also imposed a suspended five-year denial of export privileges.
The case shows that research and medical products pose a trade controls risk, that small-value shipments can entail significant penalties, and that distributors must be on board with export restrictions.

Container Manufacturing Ltd. (August 24, 2026): BIS announced a $1 million settlement with Container Manufacturing Ltd. for shipping aluminum can-making spare parts to Russia without the requisite export license. Even EAR99 (i.e., decontrolled) items cannot be shipped to sanctioned entities. The company also misrepresented a distributor as a direct customer to circumvent the restrictions.

Regulatory easing: Not every change tightened controls. On July 14, 2026, BIS moved the UAE into Country Group A:5, opening up license exceptions and access to advanced computing items. Firearm suppressors will also move from the Munitions List to the Commerce Control List on November 20, 2026.

AI chip licensing: On May 31, 2026, shortly before the quarter began, BIS issued guidance confirming that a license is still required to export advanced AI chips and related computing items to any entity headquartered in China (or another Country Group D:5 country or Macau), or whose ultimate parent is headquartered there, wherever the entity is located. That requirement reaches Chinese-owned subsidiaries in Europe, Southeast Asia, and elsewhere. Data centers already holding such items without a license are not required to stop using them for now.

Ethena tip: Know your end users as well as your distributors. And as the Bosch (reported previously) and BAE cases show, a thin or inexperienced trade compliance team is a weakness that regulators will call out.

Related training: Ethena Export Controls

Whistleblower programs: the CFTC steps up

The CFTC led whistleblower developments this quarter, with a major payout and a rule designed to speed up awards.

$150 million in awards: On September 14, 2026, the CFTC announced 10 whistleblower awards totaling more than $150 million, issued in final determinations between July and September 2026.
30% presumption rule: On September 11, 2026, the CFTC approved a final rule creating a presumption that eligible whistleblowers will receive the statutory maximum of 30% of the monetary sanctions collected when that award would total $5 million or less (modeled on the SEC’s Rule 21F-6(c)).
Why it matters: Roughly 80% of CFTC awards between 2012 and 2025 were $5 million or less. A predictable top-rate payout makes reporting to the regulator more attractive for tipsters in commodities, derivatives, and crypto markets.

These actions build on the FinCEN AML and sanctions whistleblower rule and DOJ programs covered in our last update. FinCEN’s AML and sanctions whistleblower rule is still at the proposal stage: the comment period closed June 1, 2026, and FinCEN won’t pay awards until the rule is final.

Ethena tip: Regulators are making it faster and more predictable to get paid for a tip. Make sure your internal channel is easy to use and a trusted option for employees: acknowledge reports, follow up, and protect reporters from retaliation.

Related: Ethena’s new AI-enabled hotline, which helps employees report misconduct

Anti-boycott: Boeing and MAAG Gala settle

As we noted in our previous updates, anti-boycott enforcement is picking up pace. BIS’s Office of Antiboycott Compliance has now announced four public settlements in 2026, two of them this quarter.

Each involved boycott requests the company failed to catch and handle properly, most often by failing to report them. Although the fines are low, every settlement is public, requires the company to admit wrongdoing, and can bring reputational damage and put certain U.S. tax benefits at risk.

MAAG Gala, Inc. (June 18, 2026): MAAG paid $67,500 for 18 failures to report boycott requests. The requests appeared in the standard terms of purchase orders from a single Qatari customer between 2021 and 2024, totaling about $115,000 in sales. That’s roughly 59 cents in penalties for every dollar of revenue.
The Boeing Company (July 31, 2026): Boeing paid $41,000 for two violations. A Boeing employee completed a trade-show logistics provider’s shipping template for the 2019 Dubai Airshow, certifying that the goods contained no Israeli-origin content and that no one involved was on the Arab League boycott blacklist.

All four 2026 anti-boycott respondents, including Thales and Colt earlier in the year, voluntarily self-disclosed, admitted the conduct, and paid a penalty.

Ethena tip: Boycott language can show up in third-party documents your legal team never sees: freight forwarder templates, purchase order boilerplate, and letters of credit. Train your sales, logistics, and order-management teams to spot it and escalate it, and remember that receiving a request is reportable even if you refuse it.

Related training: Ethena US Anti-Boycott

Sanctions enforcement updates

OFAC’s public enforcement slowed after the large Adani settlement, but the summer cases carry a familiar lesson: U.S. parents are liable for what their foreign subsidiaries do.

Rice Lake Weighing Systems (August 12, 2026): The Wisconsin scale maker paid $60,764 to settle eight apparent violations of Iran sanctions. Its Italian subsidiary, Dini Argeo, kept selling weighing equipment through a UAE distributor to a longtime Iranian customer between 2019 and 2021, knowing the goods would end up in Iran.

Rice Lake had emailed the subsidiary in 2018 that Iran sales were now prohibited. OFAC found that wasn’t enough to ensure the subsidiary understood and followed the rules.
OFAC treated the case as non-egregious and as a voluntary self-disclosure.

Ethena tip: A memo to an existing or acquired subsidiary isn’t a compliance program. Regularly train subsidiaries, and after an acquisition, extend your sanctions policies, training, screening, and audits to the new entity, and verify that local management follows them.

Related training: Ethena Export Controls & Sanctions

DOJ reorganizes fraud enforcement

DOJ now has a dedicated National Fraud Enforcement Division. On August 18, 2026, DOJ published a rule formally establishing the division, effective August 24. First announced in April 2026, it takes over criminal cases involving health care fraud, tax, trade fraud, and fraud involving federal money.

Priorities: An August 13 memo from Assistant Attorney General Colin McDonald named five: public trust and financial integrity, health care, tax, global trade and commerce, and corporate misconduct.
Data-driven detection: The division plans to use data analytics, a National Fraud Detection Center, and a team of data scientists to identify fraud.
Who handles what: On August 10, the Criminal Division’s Fraud Section was renamed the White Collar and Corporate Enforcement Section with jurisdiction over private-sector fraud, securities, and FCPA cases.
Higher-risk companies: Government contractors, federal grant recipients, health care billers, importers, and tax advisers face the most exposure.

Ethena tip: Trade fraud now sits with a dedicated DOJ fraud division. If you import goods, revisit controls over customs classification, country-of-origin claims, and tariff declarations, and include them in your fraud risk assessment.

FCPA enforcement update

FCPA enforcement is narrower than in past years, but it hasn’t stopped. This quarter brought DOJ’s first corporate deferred prosecution agreement of 2026:

The Scoular Company (July 17, 2026): The Omaha-based agricultural supply chain company entered a three-year DPA and will pay over $10 million. DOJ alleged that from 2013 to 2019, Scoular relied on third parties to bribe Mexican officials so its corn and other shipments could enter Mexico.

Some of the bribe money flowed to cartel associates, which DOJ treated as aggravating even though Scoular employees were not aware of the link. The case thus illustrates DOJ’s stated priority on bribery linked to cartels.
Employees’ WhatsApp messages discussing the bribes were key evidence.
Scoular got partial credit for cooperation and remediation. No monitor was imposed.

The SEC, by contrast, has brought no new FCPA enforcement actions so far in 2026 (and settled the long-running civil securities fraud case with Gautam and Sagar Adani in May).

Ethena tip: Third-party intermediaries remain the biggest bribery risk, and what they do with your money is your problem. Vet agents and customs brokers carefully and set clear rules on business use of messaging apps like WhatsApp.

Related training: Ethena Anti-Bribery & Corruption

EU tightens Russia sanctions and locks in new foreign direct investment screening rules

The EU adopted its largest Russia sanctions package in years and brought its revised foreign investment screening regime into force. Both expand what companies must screen, report, and address.

21st Russia sanctions package

On July 23, 2026, the Council of the EU adopted its 21st sanctions package against Russia, with parallel measures on Belarus. The measures took effect July 24, 2026.
The package adds 218 asset-freeze listings (48 individuals, 170 entities), the largest round in four years. Banks and other financial institutions dominate the list, including the Moscow Exchange.
New transaction bans cover additional Russian banks, crypto and payment platforms, oil traders, a refinery, ports, and airports.
A new mechanism lets the Council ban all transactions with third-country crypto service providers that systematically fail to prevent circumvention.
The package adds 51 entities to Annex IV’s list of military end users and widens advanced-technology export controls.

Revised FDI Screening Regulation now in force

Our June update covered the Council’s June 8 adoption of the revised FDI Screening Regulation. Since then, its implementation dates have been fixed:

Regulation (EU) 2026/1386 was published in the Official Journal on June 26, 2026, and entered into force on July 16, 2026.
It becomes fully applicable on January 17, 2028. By then, every Member State must run a screening mechanism that meets the new minimum standards.
The minimum scope includes military and dual-use items, critical raw materials, AI, energy, transport, and digital infrastructure, including investments made through EU-based subsidiaries.

Anti-corruption and sanctions enforcement at Member State level

The EU Anti-Corruption Directive entered into force on May 31, 2026. It allows corporate fines of up to 5% of worldwide turnover, and treats a genuine compliance program as a mitigating factor.
Member States continue to roll out tougher national penalties under the EU Sanctions Directive. Germany, for example, raised the cap on corporate fines for intentional sanctions offenses from €10 million to €40 million.

Ethena tip: Refresh your screening lists and payment controls for the new EU listings and bank transaction bans. Check crypto and payment providers in your supply chain, not just traditional banks.

Related training: Ethena Export Controls & Sanctions