For years, sanctions compliance in software companies has been somebody else’s job. The working assumption ran roughly as follows:
- do not take payment from a designated customer;
- screen the customer list;
- get a legal and finance deal with the US Sanctions agency, the Office of Foreign Assets and Control (OFAC).
A £1m penalty from the UK’s sanctions regulator suggests that division of labour no longer holds. Blocking payments is not enough, and screening is useful only if it triggered the rapid suspension of the service. The people who most need to read the decision are engineers rather than compliance officers.
What happened
The Office of Financial Sanctions Implementation imposed a penalty of £1,000,920.59 on Sabre Global Technologies Limited, the UK arm of the travel technology group, published in June for three breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations). It is the largest UK penalty for a Russia sanctions breach since the 2022 invasion and OFSI’s first circumvention penalty.
Sabre reported the breaches voluntarily, cooperated fully with the investigation and settled the case. OFSI applied a 20 per cent reduction under the transitional arrangements to reflect the voluntary disclosure and settlement.
Sabre operates a global distribution system, the booking and inventory infrastructure that connects airlines to travel agents. One of its customers was Ural Airlines, which the UK designated in 2022. Access continued for roughly seven months after designation and even briefly beyond the contract’s stated expiry date. OFSI assessed the case at the most serious level.
Why the software was the economic resource
OFSI found three breaches: making funds available to a designated person, making economic resources available to one, and circumventing the prohibitions. The second is the finding that should concern technology providers. OFSI treated continued access to a live software platform as the provision of economic resources, because the platform enabled a designated entity to sell seats and sustain its operations.
The prohibition does not ask whether you were paid. It asks whether something of economic value reached the designated party. That reasoning is not confined to airline distribution systems. It potentially reaches hosted services, SaaS licences, APIs and cloud tenancies. A frozen receivable is not necessarily a defence. A running service can itself be the breach.
OFSI also highlighted the seriousness of what Sabre proposed to do once its position became difficult. Having had payments from Ural Airlines blocked by its UK bank on sanctions grounds, Sabre personnel explored whether payment could instead be received through its US bank accounts, where similar restrictions might not be triggered, and Ural Airlines sent a $200 test payment. OFSI made clear that this constituted unlawful circumvention, contrary to regulation 19 of the Russia Regulations, and treated it as an aggravating factor.
The ban on sectoral software
Dealing unlawfully with designated persons, here Ural Airlines, is not the only sanctions risk. Sabre concerned the provision of an economic resource to a designated person, but separate trade sanctions can apply more broadly to persons connected with Russia. Regulation 54C of the Russia Regulations restricts specified services including IT consultancy and design, while the sectoral software rules prohibit the supply of certain business enterprise, industrial design and oil and gas software to persons connected with Russia or for use there, subject in each case to applicable exceptions and licences.
The guidance on the sectoral software rules gives downloading, Software as a Service and access via an app as its examples, and a person connected with Russia includes a UK company’s Russian subsidiary.
The ban covers any supply, direct or indirect. Software providers should therefore diligence and keep an audit trail of whether licensees are in fact front entities or agents for persons connected with Russia. Arrangements intended to circumvent regulation 54C are separately prohibited by Regulation 55. New sanctions end-use controls also allow the Government to notify a supplier that specified items are, or may be, intended for a sanctioned destination or sanctioned end use. Once informed, the supplier must not continue the relevant supply without authorisation. Even where no notification has been issued, the supplier still bears responsibility for knowing its customer and understanding why the software is being bought.
Why that is an engineering problem
A designation can take effect overnight. The practical question is whether your platform allows you to suspend a single named customer, and every account linked to it, within hours rather than at the next contract renewal. Many enterprise systems are not built for that. Entitlements may sit with a reseller rather than the vendor, or access may be provisioned at organisation level with no clean way to isolate one subsidiary.
Those are design decisions taken years earlier by people who were not thinking about sanctions, and each becomes a live exposure the moment a customer’s status changes. Screening that runs periodically, against exact names only, will not reliably catch a customer that is owned or controlled by a designated person, or otherwise connected with Russia.
Software as an export
Making software available overseas may itself constitute an export. Even where nothing physical is shipped and access is provided online or by remote download, a licence may be required where the software is caught by the relevant military or dual-use control lists or where an end-use control applies.
The point was illustrated in June 2026, when the US Department of Commerce ordered Anthropic to suspend access to its Claude Fable 5 and Mythos 5 models by any foreign national, including the company’s own non-US employees. Unable to verify user nationality in real time, Anthropic suspended both models for every user worldwide. Commerce lifted the controls on 30 June and access was restored from 1 July, with Mythos 5 remaining limited to approved organisations. The reported trigger was a technique for bypassing one of Fable 5’s safeguards, whose severity the company disputed, and the episode remains contested.
The operational lesson is the same. A restriction that cannot be applied to the relevant customer, territory or class of user may force a provider to suspend access much more broadly.
Three questions to ask on Monday morning
The Sabre penalty points to three:
- Can you identify every customer that is designated, owned or controlled by a designated person, or otherwise connected with Russia?
- Can you suspend their access within hours?
- Has anyone actually tested that process?
If the answer to any of them is no, the gap is in the build rather than the policy, and no amount of redrafting will close it. Sanctions compliance for a technology business is not only a matter for the legal and finance functions. It is a property of the product. If the service cannot be turned off quickly, the policy that says it will be is worth very little.
Paul Henty is a partner at Beale & Co, specialising in EU and UK sanctions, export control, competition, procurement, and regulatory law. He is dual-qualified in England and Wales and in Ireland.
