How ITAR Regulations Apply to UK Entities: AUKUS, DDTC, and Brokers

If your UK company handles any US-origin defense article, technical data, or defense service, the International Traffic in Arms Regulations apply to you directly, and how ITAR applies to UK companies is essentially the same way it applies to a US exporter: the item stays controlled wherever it travels, you cannot move it, re-sell it, or show it to the wrong person without approval from the US State Department’s Directorate of Defense Trade Controls (DDTC), and willful violations carry fines above $1 million per incident and up to 20 years in prison.¹ Since September 2024, an AUKUS license exemption has removed some of the paperwork for qualifying transfers between authorized users in the US, UK, and Australia, but the underlying obligations have not gone away.

Why ITAR Follows US Items Into the UK

Under 22 CFR Part 120, both US-origin and foreign-origin items described on the US Munitions List count as defense articles subject to ITAR, regardless of where they physically sit.² A UK company holding a controlled article cannot ship it, change its end use, or share it with another party without DDTC authorization.

Two definitions do most of the work outside the United States. A reexport under 22 CFR § 120.51 happens when a UK entity sends a controlled item from the UK to a third country, or releases technical data to a foreign person who is not a UK citizen or permanent resident. A retransfer under 22 CFR § 120.52 covers a change in end use or end user, a temporary transfer to a third party inside the UK, or releasing technical data to a foreign person who is a UK citizen or resident.² Both need prior authorization unless a specific exemption fits.

What Actually Counts as Controlled

Every controlled item appears on the United States Munitions List at 22 CFR § 121.1, across 21 categories covering firearms, ammunition, aircraft, military electronics, and much more.³ A UK manufacturer needs to check everything from finished platforms down to individual subcomponents.

The See-Through Rule

A US-origin defense article does not stop being a defense article when it is built into something larger. DDTC has stated that the regulations “see through” the end item and continue to control the underlying US-origin component.⁴ A British-built satellite carrying one American sensor still needs DDTC approval before sale to a third country. This is the rule that catches UK companies most often, especially in aerospace and electronics supply chains where US-origin parts are common.

Significant Military Equipment

Certain USML items carry an extra designation as Significant Military Equipment (SME), marked with an asterisk on the list. All classified USML articles are automatically SME.⁵ Technical data directly related to manufacturing an SME item is itself SME. SME transactions get more scrutiny during licensing, and manufacturing SME abroad has to meet the specific requirements of 22 CFR § 124.11.

When You Are Not Sure: Commodity Jurisdiction

If your team cannot tell whether an item sits on the USML or falls under the Commerce Department’s Export Administration Regulations instead, file a Commodity Jurisdiction determination request under 22 CFR § 120.4.⁶ DDTC’s own guidance puts the CJ process at roughly 45 to 55 business days, with newer or more complex technologies taking longer.⁷ It is cheaper to ask up front than to discover mid-contract that you needed a license.

Technical Data and the Deemed Reexport Trap

ITAR reaches beyond hardware. Technical data, defined at 22 CFR § 120.33, includes information required for the design, production, repair, testing, or modification of defense articles, so blueprints, engineering drawings, manufacturing instructions, and related software all qualify.⁸

The concept that trips UK employers up is the deemed reexport. Under 22 CFR § 120.51, releasing technical data outside the United States to a foreign person counts as a reexport to every country where that person holds or has held citizenship or permanent residency.⁹ If a UK contractor lets an engineer with third-country citizenship view controlled schematics, the company has effectively reexported that data to the engineer’s home country, and it does not matter that the engineer never left the office in the UK. In practice this means knowing the citizenship history of everyone who could touch the data.

A Technology Control Plan

UK firms handling US-origin technical data should have a written Technology Control Plan spelling out how access is prevented. A workable plan covers physical security (restricted rooms, locked storage for hard copies), information security (encryption, password control, no controlled data over unsecured email), personnel screening against US denied-parties lists, and a briefing process for everyone granted access. Update it whenever staff changes or a new controlled project starts.

The AUKUS License Exemption

On September 1, 2024, a new exemption at 22 CFR § 126.7 took effect under the AUKUS partnership among the United States, United Kingdom, and Australia.¹⁰ Where it applies, no DDTC license or approval is required for exports, reexports, retransfers, temporary imports, defense services, or brokering between authorized users.

To qualify, the transfer has to stay within the physical territory of Australia, the UK, or the US. Both sender and recipient must be authorized users, meaning DDTC-registered US persons, US or allied government departments, or entities identified as authorized through the DDTC website. And the article or service must not appear on the Excluded Technology List in Supplement No. 2 to Part 126.¹⁰

That Excluded Technology List is substantial. It removes from the exemption items such as Missile Technology Control Regime articles (annotated “MT” on the USML), articles with anti-tamper features developed under a US Department of Defense Program Protection Plan, cluster munitions, F-22 aircraft components, and certain manufacturing know-how in specific USML categories.¹¹ Check it before assuming a transfer qualifies. If the item is on the list, the ordinary licensing process still applies.

The UK-US Defense Trade Cooperation Treaty

A separate license-free pathway exists under the Defense Trade Cooperation Treaty, implemented at 22 CFR § 126.17. This predates AUKUS and allows movement of certain defense articles between an “Approved Community” of specified government agencies and vetted private contractors.¹² It is narrower than AUKUS: the transfer must support shared government end uses or combined military operations, and both parties must belong to the Approved Community. Joining involves security vetting, treaty-specific markings on the transferred items, and detailed transaction records. For UK-US government cooperation projects that fall outside AUKUS, this treaty may still be the route.

Registering With DDTC

Before applying for any license or using most exemptions, a UK entity has to register with DDTC by submitting Form DS-2032 through the Defense Export Control and Compliance System (DECCS) portal.¹³ The form asks for corporate structure, ownership, foreign affiliates, and the controlled activities the company intends to perform.

The Empowered Official Requirement

Every registrant has to designate an Empowered Official under 22 CFR § 120.67. That person must be a US person directly employed by the company in a policy or management role, empowered in writing to sign license applications, knowledgeable about export controls, and given independent authority to investigate a proposed transaction and to refuse to sign without retaliation.¹⁴ A foreign broker may designate a foreign person as its empowered official if the criteria are otherwise met, but for a UK company that is not solely a broker, this ordinarily means finding a qualified US person inside the organization or a US subsidiary.

Registration Fees, Effective January 2025

DDTC restructured registration fees on January 9, 2025 into three tiers.¹⁵

Tier 1 is $3,000 per year for new registrants and those with no favorable license determinations in the prior 12-month measurement period. A small business can petition for a $500 discount if the fee exceeds 1% of total revenue.
Tier 2 is $4,000 for renewing registrants with five or fewer favorable determinations in the measurement period.
Tier 3 applies to registrants with more than five favorable determinations. The formula is $4,000 plus $1,100 for each determination above five, with a cap-relief discount available if the total fee exceeds 3% of the value of those authorizations.

Tax-exempt entities under 26 USC § 501(c)(3) get the Tier 1 rate regardless of license activity.¹⁵

Applying for a License

Once registered, license applications go through DECCS. The most common forms are the DSP-5 for permanent export of unclassified defense articles and the DSP-61 for temporary import of unclassified defense articles.¹⁶ Based on DDTC’s published data, average review times have historically run in the range of 38 to 45 calendar days, though individual cases vary with complexity and USML category.¹⁷

If You Are a Broker Rather Than an Exporter

UK companies that facilitate defense trade without directly moving items can still fall under the brokering rules in 22 CFR Part 129. Brokering covers acting as an intermediary in a sale, arranging financing or insurance, and facilitating transportation of defense articles to foreign consignees. Brokers register separately with DDTC, and registration by itself does not authorize any particular transaction.¹⁸

Companies engaged only in financing, insuring, transporting, customs brokering, or freight forwarding are generally exempt when their involvement stays within those functions. Legal advice on compliance is also generally exempt, though that exemption falls away if the attorney solicits buyers, markets controlled items, or structures transactions. If the role is unclear, submit an Advisory Opinion request under 22 CFR § 129.9.¹⁸

What Noncompliance Costs

Enforcement runs on two tracks. Criminally, a willful violation of the Arms Export Control Act or ITAR carries a fine of up to $1,000,000 per violation, up to 20 years in prison, or both, and making false statements in a registration or license application triggers the same range.¹

Civil penalties are assessed separately. Under 22 CFR § 127.10, the maximum civil fine is the greater of $1,271,078 or twice the value of the underlying transaction, per violation.¹⁹ Civil and criminal penalties can run alongside each other.

Debarment is the other consequence. Under 22 CFR § 127.7, the State Department can debar a violator indefinitely from all ITAR-regulated activity until it approves a reinstatement application.²⁰ For a UK defense contractor, debarment effectively ends any work involving US-origin technology or US-connected supply chains.

Keeping the Records

Every registrant must maintain records of controlled activities for at least five years from the expiration of the license or other authorization, or from the date of a transaction where an exemption was used.²¹ The obligation covers manufacturing, acquiring, and disposing of defense articles, defense services, technical data handling, and brokering. DDTC can require longer retention in individual cases. Treat five years as the floor: an investigation that turns up missing records tends to be nearly as damaging as the underlying violation.

1
Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
2
eCFR. 22 CFR Part 120 – Purpose and Definitions
3
eCFR. 22 CFR Part 121 – The United States Munitions List
4
U.S. Department of State Directorate of Defense Trade Controls. ITAR / USML Updates FAQs
5
eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.36
6
eCFR. 22 CFR 120.4 – Commodity Jurisdiction
7
Directorate of Defense Trade Controls. Commodity Jurisdictions (CJs) FAQs
8
eCFR. 22 CFR 120.33 – Technical Data
9
eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.51
10
Federal Register. International Traffic in Arms Regulations: Exemption for Defense Trade and Cooperation Among Australia, the United Kingdom, and the United States
11
eCFR. Supplement No. 2 to Part 126 – Excluded Technology List
12
eCFR. 22 CFR 126.17 – Exemption Pursuant to the Defense Trade Cooperation Treaty Between the United States and the United Kingdom
13
eCFR. 22 CFR 129.8 – Submission of Statement of Registration
14
eCFR. 22 CFR 120.67 – Empowered Official
15
Federal Register. International Traffic in Arms Regulations: Registration Fees
16
U.S. Department of State Directorate of Defense Trade Controls. License Guidance
17
Directorate of Defense Trade Controls. License Processing Times
18
Directorate of Defense Trade Controls. Registration
19
eCFR. 22 CFR 127.10 – Civil Penalty
20
eCFR. 22 CFR Part 127 – Violations and Penalties
21
eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants