If your company manufactures, exports, temporarily imports, or brokers items on the U.S. Munitions List — or provides defense services involving them — you are required to complete DDTC ITAR registration before any of that activity can lawfully continue. Registration is handled by the Directorate of Defense Trade Controls, a division of the U.S. Department of State that administers the International Traffic in Arms Regulations under the Arms Export Control Act at 22 U.S.C. § 2778.1Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports The process runs through the DECCS online portal, costs at least $3,000 a year, and has to be renewed annually for as long as you remain in the business.
Who Has to Register
Under 22 CFR Part 122, any person or organization engaged in manufacturing, exporting, temporarily importing defense articles, or furnishing defense services must be registered.2eCFR. 22 CFR Part 122 – Registration of Manufacturers and Exporters Manufacturing alone triggers the requirement. You do not have to be shipping anything overseas, or planning to. If your production capabilities cover items on the Munitions List, you register.
Brokers are covered separately under Part 129. Brokering includes financing, transporting, soliciting, or otherwise facilitating the sale or transfer of defense articles or services, whether U.S.- or foreign-origin.3eCFR. 22 CFR 129.2 – Definitions A broker arranges deals; a manufacturer makes or modifies the item. Both categories need active registrations.
What Registration Does and Doesn’t Do
Registration establishes your identity with the government. That is all it does. It does not authorize any specific export, and it does not permit you to ship, transmit, or disclose anything on the Munitions List. Every transaction still requires its own license or agreement approval. What registration gives you is the ability to apply for those authorizations — nothing more. Operating without a registration when you should have one is itself a violation, separate from any unlicensed export that follows.
What You’ll Need Before You File
Registration is done on Form DS-2032, the Statement of Registration. You’ll need to supply:
- The legal name and physical address of the business.
- A description of the corporate structure and an organizational chart tracing every layer up to the ultimate parent, including subsidiaries and affiliates that may handle defense-related items.4Directorate of Defense Trade Controls. Completing the DS-2032 Statement of Registration Form
- The names of senior officers, directors, and partners, so leadership carries personal accountability.
- A valid Employer Identification Number.
- A designated Empowered Official.
The Empowered Official is not a formality. Under 22 CFR § 120.67, this person must be a U.S. person directly employed by the company, hold a management or policy-level position, be legally empowered in writing to sign license applications, understand the criminal, civil, and administrative penalties under ITAR, and have independent authority to refuse to sign any export request without retaliation.5eCFR. 22 CFR 120.67 – Empowered Official Compliance accountability sits with this role.
How to Submit Through DECCS
All registration submissions go through the Defense Export Control and Compliance System (DECCS) online portal. Your representative sets up a secure account, uploads the completed DS-2032 with the organizational chart and any supporting documentation, and the Empowered Official provides an electronic signature certifying that everything submitted is accurate. Payment runs through Pay.gov.6Directorate of Defense Trade Controls. Registration Payment
Once a registration is ready for payment, you have 21 calendar days to log in and complete it. After submission, the DDTC begins its review. The agency does not publish a guaranteed processing timeline, so build slack into any project plan that depends on being registered by a particular date. You cannot file license applications until your registration is active.
Registration Fees
As of January 2025, the DDTC uses a three-tier fee structure that scales with your export activity:6Directorate of Defense Trade Controls. Registration Payment
- Tier 1, $3,000 per year, applies to first-time registrants, stand-alone brokers, nonprofits exempt under 26 U.S.C. § 501(c)(3), and entities that received no approved licenses in the 12-month period ending 90 days before their current registration expires. A temporary discount program lets qualifying Tier 1 registrants petition for a $500 reduction, bringing the fee to $2,500.
- Tier 2, $4,000, applies to registrants who received five or fewer approved licenses or authorizations during that same 12-month lookback period.
- Tier 3 is a calculated fee for registrants with more than five approved authorizations. The formula is $4,000 plus $1,100 for each approval beyond five. If the result exceeds 3 percent of the total value of all approvals, the fee drops to either 3 percent of total approval value or $4,000, whichever is greater.
First-time applicants are always Tier 1.
Renewing and the Cost of Letting It Lapse
Registration is annual. Every year you have to renew, and you have to keep operating from an active registration to stay compliant. If you let it lapse and later try to re-register, you owe back fees for any period during which you continued to manufacture, export, or broker defense articles while unregistered. Those lapsed fees accrue at $250 per month, based on the $3,000 annual rate, starting one month after expiration, for up to five years.7Directorate of Defense Trade Controls. Lapsed Registration Fees The back fees are the smaller problem. Operating with a lapsed registration is a standalone violation, so anything you did during the gap is exposed on its own terms.
After Registration: Licenses, Agreements, and Exemptions
Being registered is not permission to export. Physical shipments of unclassified defense articles typically move under a DSP-5 for permanent export or a DSP-73 for temporary export.8Directorate of Defense Trade Controls. License Guidance Sharing technical data or defense services with a foreign person requires a Technical Assistance Agreement, and having a foreign entity produce defense articles abroad using U.S.-origin technology requires a Manufacturing License Agreement.9eCFR. 22 CFR Part 124 – Agreements, Off-Shore Procurement, and Other Defense Trade Authorizations Hardware moves under licenses; knowledge moves under agreements. Filing a DSP-5 when a TAA was required is still a violation.
A handful of exemptions allow specific transfers without a license — most notably the Canadian exemption under 22 CFR § 126.5 and the AUKUS exemption under § 126.7 for defense trade among authorized parties in Australia, the United Kingdom, and the United States.10eCFR. 22 CFR Part 126 – General Policies and Provisions Each carries narrow conditions on who qualifies, which items are covered, and what documentation is required. Misapplying an exemption is treated the same as exporting without a license.
The Deemed Export Trap
The most common compliance failure among registered companies has nothing to do with shipping. Under ITAR, releasing or transferring technical data to a foreign person inside the United States is itself an export, treated as an export to every country where that person holds citizenship or permanent residency.11eCFR. 22 CFR Part 120 – Purpose and Definitions Showing controlled engineering drawings to a colleague on a work visa, or granting a foreign national access to a shared drive containing controlled files, requires the same authorization as physically shipping a defense article overseas.
The definition of “foreign person” under 22 CFR § 120.63 does not include lawful U.S. permanent residents or protected individuals under federal immigration law, but it does include employees on work visas.12eCFR. 22 CFR 120.63 – Foreign Person Green card holders are not foreign persons; visa holders are. Any registration that isn’t backed by access controls reflecting this distinction is a registration waiting to produce a violation.
Narrow carve-outs exist for technical data already in the public domain, results of fundamental research at accredited academic institutions, and general educational information. The carve-outs are defined precisely, and claiming them incorrectly does not shield you from liability.
Recordkeeping and Written Compliance
The DDTC expects every registrant to maintain a written compliance program tailored to the company’s operations, reviewed regularly, and supported by senior management.13U.S. Department of State. Getting and Staying in Compliance with the ITAR At a minimum, the agency’s guidelines call for knowing the relevant USML category for every item you handle, screening all transaction parties, verifying end users and end uses, understanding which exemptions apply to your work, and making sure every license application is accurate.
All records related to ITAR-controlled transactions must be kept for five years, measured from the expiration of the relevant license or, if an exemption was used, from the date of the transaction.14govinfo. 22 CFR 122.5 – Maintenance of Records by Registrants Electronic records must be stored so they can be reproduced on paper with high legibility. The DDTC, U.S. Immigration and Customs Enforcement, and U.S. Customs and Border Protection can inspect and copy those records at any time.
If Something Goes Wrong: Voluntary Self-Disclosure
If you find a potential violation, the Department of State strongly encourages voluntary disclosure. Under 22 CFR § 127.12, a voluntary disclosure is treated as a mitigating factor in penalty decisions, and failing to report a known violation is treated as an aggravating factor.15eCFR. 22 CFR 127.12 – Voluntary Disclosures
The process starts with an initial notification to the DDTC as soon as the violation is discovered. You then have 60 calendar days to file a full written disclosure. If you cannot meet the deadline, an Empowered Official or senior officer can request an extension in writing, explaining what information is still outstanding and why. Every disclosure must include a certification from an Empowered Official or senior officer attesting that the representations are true. A late, incomplete, or uncertified disclosure risks losing its mitigating weight entirely.
Penalties for Non-Compliance
Civil penalties under 22 CFR § 127.10 can reach $1,271,078 per violation of 22 U.S.C. § 2778, or twice the value of the underlying transaction, whichever is greater.16eCFR. 22 CFR 127.10 – Civil Penalty The ceiling is adjusted for inflation over time. A single compliance failure that spans multiple shipments or disclosures can produce penalties in the tens of millions.
Criminal penalties apply to willful violations. Under 22 U.S.C. § 2778(c), each count carries a fine of up to $1,000,000 and imprisonment of up to 20 years.1Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports A materially false statement in a registration form, license application, or required report carries the same criminal exposure.
A conviction also triggers statutory debarment. Under 22 CFR § 127.7, anyone convicted of violating the Arms Export Control Act is barred from participating directly or indirectly in any ITAR-regulated activity for a minimum of three years.17eCFR. 22 CFR 127.7 – Debarment Reinstatement is not automatic; the debarred party has to petition the Department of State and receive approval before engaging in any controlled activity. For most defense contractors, losing the ability to operate in the market is a worse outcome than any fine.