There is no public database you can search to check if a company is ITAR registered. The Directorate of Defense Trade Controls (DDTC), the State Department office that administers the International Traffic in Arms Regulations, does not publish its list of registrants. Verification instead relies on asking the company for its registration code and expiration date, reviewing its own documentation, and screening it against the federal restricted-party lists that are public. For anything involving defense articles, services, or technical data, doing this check is not optional; a willful violation of the Arms Export Control Act can carry fines up to $1,000,000 per violation and up to 20 years in prison.1Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
Why There Is No Public Registry
ITAR registration is administered by the DDTC within the U.S. Department of State under 22 CFR Parts 120 through 130.2U.S. Department of State. Understand The ITAR Any U.S. person or company that manufactures, exports, temporarily imports, or brokers defense articles, or furnishes defense services, must register, and this includes companies that only manufacture domestically and never export.3eCFR. 22 CFR 122.1 – Registration: Requirements, Exemptions, and Purpose The DDTC keeps the resulting registrant list internal. That is why verification has to work from the outside in.
One boundary worth naming up front: registration is not permission to export. A registered company still needs a license for each controlled transaction. So confirming a company is registered tells you it has entered the DDTC’s system; it does not tell you the company is authorized to send a specific item to a specific customer.
Ask the Company for Its Registration Code
This is the primary method, and for most routine transactions it is where verification begins and ends. Request two things:
- The company’s DDTC registration code. Every registrant receives a unique code with an “M” prefix for manufacturers and exporters, or a “K” prefix for brokers, followed by four or five digits (for example, M12345 or K-1234).
- The current expiration date. Registrations run 12 months from issuance and must be renewed annually, so a code without a current expiration date proves nothing about active status.4U.S. Department of State. Instructions for Preparing and Submitting a DS-2032: Statement of Registration
A legitimate defense contractor will hand this over without hesitation. Evasiveness, or a claim that the code cannot be shared, is a red flag. Get the code and the expiration date in writing (email, a signed compliance certification, or a clause in the underlying contract) so you have a record of what the company represented.
Review the Company’s Own Documentation
Many ITAR-compliant companies reference their registration status on their website, in capability statements, or in contract boilerplate. Look for explicit references to DDTC registration, an M or K code, or ITAR compliance clauses inside purchase orders and nondisclosure agreements. Treat these as supporting evidence, not proof. Marketing materials sometimes lag behind an actual lapse in registration, so a website mention should confirm what the company told you directly, not substitute for it.
Contract language is the more useful signal. A company that includes ITAR representations, flow-down clauses, and end-use certifications in its standard agreements has thought about the regime. A company whose paperwork is silent on ITAR while the work is clearly USML-adjacent has either not thought about it or is hoping you won’t.
Screen Against the Consolidated Screening List
What you cannot look up is whether a company is registered. What you can look up is whether a company or person has been barred from the defense trade. The International Trade Administration maintains the Consolidated Screening List (CSL), a free tool aggregating restricted-party lists from the Departments of Commerce, State, and Treasury. The CSL includes the AECA Debarred List from the DDTC, identifying persons and entities prohibited from participating in defense exports under ITAR.5International Trade Administration. Consolidated Screening List The list is updated daily and is searchable on trade.gov, downloadable as a file, or accessible through an API.
Run the company name, its parent, and its key personnel through the CSL. Also check the DDTC’s list of statutorily debarred parties, which identifies persons convicted of violating the Arms Export Control Act who are barred from any ITAR-regulated activities.6U.S. Department of State. Statutorily Debarred Parties A company can hand you a valid-looking registration code and still have an individual on the payroll who is personally prohibited from touching the work. Screening is baseline due diligence, not extra credit.
Contact the DDTC Directly
If the company will not produce a code, and you still need to move forward, the DDTC’s Office of Defense Trade Controls Management handles registration matters. The DDTC will not necessarily confirm another company’s registration status to any outside inquirer, but for legitimate compliance inquiries, particularly from another registered entity, this is a viable last resort. Treat it as the escalation path, not the default.
Ask Who the Empowered Official Is
Every registered company must designate at least one Empowered Official: a U.S. person, directly employed in a management or policy role, who is legally authorized in writing to sign license applications on the company’s behalf. The Empowered Official must understand ITAR penalties and hold independent authority to investigate proposed transactions, verify their legality, and refuse to sign without retaliation.7eCFR. 22 CFR 120.67 – Empowered Official
Asking a prospective partner to identify their Empowered Official is a fair and informative question. A company that can name the person, describe their reporting line, and explain what authority they hold has an actual compliance program. A company that answers vaguely, or names someone who turns out to be a junior contracts administrator, is telling you something useful. For foreign-person brokers the Empowered Official may be a foreign person, but that is the only exception to the U.S. person requirement.
Situations Where Verification Is Not Optional
A few contexts make skipping this check especially costly.
New Partnerships and Joint Ventures
Before entering any relationship involving defense articles or services (joint ventures, teaming agreements, co-development), confirm your counterpart’s registration. An unregistered partner creates exposure on both sides of the deal.
Supply Chain and Subcontractors
ITAR obligations run through the supply chain. If you engage a supplier or subcontractor to produce components or provide services tied to defense articles, their status becomes your problem. Prime contractors get caught here by assuming a lower-tier supplier “must be” registered because it holds defense contracts. Verify, don’t assume.
Mergers and Acquisitions
ITAR registrations do not automatically transfer when companies change hands. When a registered company merges with or is acquired by another entity, the surviving entity must notify the DDTC of the surviving registration number and any registrations being discontinued, and existing license agreements must be amended to reflect the new entity name within 60 days or they may be invalid.8eCFR. 22 CFR 122.4 – Notification of Changes in Information Furnished by Registrants If the deal involves selling ownership or control to a foreign person, the registrant must notify the DDTC at least 60 days in advance. In diligence, do not treat a target’s registration as a settled asset; treat it as something that has to be re-verified after closing.
What Failing to Verify Can Cost
Working with an unregistered company on ITAR-controlled activity, or relying on a lapsed or debarred counterpart, exposes your own organization on three fronts.
Criminal penalties apply to willful violations of the Arms Export Control Act: fines up to $1,000,000 per violation and imprisonment up to 20 years, or both. The same penalties reach anyone who willfully makes a false statement in a registration, license application, or required report.1Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
Civil penalties can reach $1,200,000 per violation or twice the value of the underlying transaction, whichever is greater, and are subject to annual inflation adjustment.1Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports Civil penalties do not require proof of willful intent, which makes them easier for the government to impose.
Debarment removes a company or individual from the defense trade entirely. The DDTC can administratively debar any person from participating directly or indirectly in ITAR-regulated activities, and statutory debarment is automatic for persons convicted of violating the Arms Export Control Act, carrying a minimum three-year prohibition during which the State Department will not consider any license applications involving the debarred party.9eCFR. 22 CFR Part 127 – Violations and Penalties For a defense contractor, debarment is usually the end of the business.
Verification takes an email and a screening search. The alternative, discovering after the fact that your counterpart was never registered or had been debarred, is not a compliance headache; it is a case file.