ITAR and EAR compliance means running every export, technical exchange, and foreign-national interaction through a defined sequence: classify the item against the United States Munitions List and then the Commerce Control List, screen every party against restricted-party lists, register with the correct agency if required, obtain a license or verify a valid exception, and preserve the records for at least five years. Two separate regulatory systems are in play. The International Traffic in Arms Regulations, administered by the State Department’s Directorate of Defense Trade Controls, govern defense articles and services. The Export Administration Regulations, administered by Commerce’s Bureau of Industry and Security, cover dual-use goods with both commercial and military applications. Civil penalties reach $1,271,078 per ITAR violation, and willful EAR violations can bring criminal fines up to $1,000,000 and up to 20 years in prison for individuals.
Which Agency Has Jurisdiction Over Your Item
DDTC’s focus is narrow. Items and services specifically designed or modified for military use, along with technical data that provides a military or intelligence advantage, sit under ITAR.1Directorate of Defense Trade Controls. Understand The ITAR If a product was built for a warfighter, DDTC almost certainly has jurisdiction.
BIS handles a broader universe: commercial products, software, and technology that could be repurposed for military, nuclear, chemical, or biological weapons programs.2Bureau of Industry and Security. Determine What is Subject to the EAR An industrial laser designed for manufacturing that could also guide a missile is the classic BIS scenario. The two agencies operate independently, with different forms, different portals, and different rules. Confusing them derails transactions quickly.
Classifying the Item
Classification is the single most consequential step, because every downstream decision depends on it. The order matters: USML first, CCL second.
The United States Munitions List
The USML, codified at 22 CFR Part 121, organizes defense articles into categories ranging from firearms and ammunition to military electronics, spacecraft, and toxicological agents.3eCFR. 22 CFR Part 121 – The United States Munitions List If your item appears on the list, ITAR applies. The test is whether the component was specifically designed or modified for a military end-use, not whether a soldier could theoretically use it. A commercial GPS receiver is not a defense article; a GPS receiver redesigned to resist jamming in a combat environment likely is.
The Commerce Control List
Items that do not appear on the USML move to the Commerce Control List at 15 CFR Part 774.4eCFR. 15 CFR Part 774 – The Commerce Control List The CCL covers ten broad categories including electronics, computers, telecommunications, sensors, navigation, marine technology, and aerospace. Each entry sets specific technical thresholds, so two items in the same product family can classify differently based on frequency, accuracy, or range.
A controlled item on the CCL receives an Export Control Classification Number, a five-character code identifying category, type, and reason for control. Items subject to the EAR that do not match any specific entry are classified EAR99. Most EAR99 items ship to most destinations without a license, but restrictions still apply for embargoed countries, sanctioned entities, and prohibited end-uses like weapons of mass destruction programs.
When Jurisdiction Is Genuinely Unclear
Some items sit between the two lists. A component originally designed for a military platform that has since found broad commercial use is a common example. When you genuinely cannot determine which regime applies, submit a Commodity Jurisdiction request to DDTC using form DS-4076 through the DECCS portal.5U.S. Department of State – Directorate of Defense Trade Controls (DDTC). Commodity Jurisdictions Registration with DDTC is not required to file. Paper submissions and emails are returned without action. A CJ determination is binding, which resolves the question rather than leaving it to your interpretation.
Deemed Exports and Technology Releases
Nothing has to cross a border for a violation to occur. Sharing controlled technical data with a foreign national inside the United States counts as an export to that person’s home country. ITAR calls this a “release” and defines it broadly: letting a foreign person visually inspect a defense article, exchanging technical data orally or in writing, or providing credentials that would let a foreign person view controlled information.6eCFR. 22 CFR 120.56 – Release
The EAR uses a parallel “deemed export” concept. A license is required when you intend to transfer controlled technology to a foreign national in the United States and transferring that same technology to the person’s home country would require a license.7Bureau of Industry and Security. Deemed Export FAQs U.S. citizens, lawful permanent residents, and individuals granted protected status under 8 U.S.C. 1324b(a)(3) are excluded. For dual nationals, the last permanent residency or citizenship obtained generally controls.
Hiring a foreign national engineer, hosting a foreign delegation for a facility tour, or collaborating with a foreign university researcher can each trigger licensing. Written access-control procedures need to run before anyone touches restricted data or equipment, not after.
Screening Every Party
Before any transaction, verify that every party involved is legally allowed to receive the item. The Consolidated Screening List aggregates federal restricted-party lists from Commerce, State, and Treasury into a single searchable tool.8International Trade Administration. Consolidated Screening List Key lists include the Entity List, the Denied Persons List, the Unverified List, and the Military End User List.
Screen at the initial inquiry, again before accepting an order, and again before shipment. Names change, lists update, and a customer who cleared six months ago may not clear today. Automated tools help with volume, but someone in your organization needs to review flagged matches and rule on partial hits. The Consolidated Screening List is free and public, so there is no defensible reason to skip this step.
Registration and the Empowered Official
Any entity that manufactures or exports defense articles, or provides defense services, must register with DDTC before applying for a license. The DS-2032 Statement of Registration is submitted electronically through DECCS.9eCFR. 22 CFR 129.8 – Submission of Statement of Registration, Registration Fees, and Notification of Changes in Information Furnished by Registrants The form requires detailed information on corporate ownership, every officer and director, significant shareholders, manufacturing capabilities, and the specific USML categories involved.
Registration fees follow a tiered structure. Tier 1 is $3,000 per year for new registrants or those with no favorable license determinations in the prior year. Tier 2 is $4,000 per year for registrants with five or fewer favorable determinations. Tier 3 applies above five, calculated at $4,000 plus $1,100 per determination above five.10eCFR. 22 CFR 122.3 – Registration Fees Fees are paid electronically through Pay.gov inside the DECCS portal.11Directorate of Defense Trade Controls. DDTC Public Portal
Every ITAR-registered company must designate at least one Empowered Official: a U.S. person directly employed by the company, holding a management or policy-level position, with independent authority to review any proposed export and refuse to sign off without retaliation.12GovInfo. 22 CFR 120.25 – Empowered Official The Empowered Official must understand the criminal, civil, and administrative penalties for violations and be authorized in writing to sign license applications. Outside consultants, attorneys, and foreign nationals cannot fill the role.
The EAR has no equivalent general registration requirement. Companies engage BIS directly when they need a classification, license, or advisory opinion.
Licenses, Exceptions, and Submissions
Not every controlled export needs an individual license, and overlooking that fact means waiting months for an approval you never needed.
Under the EAR, BIS publishes license exceptions in 15 CFR Part 740. Common examples include shipments below a certain dollar value (LVS), tools of trade carried by employees traveling abroad (TMP), replacements for defective parts (RPL), and certain cybersecurity items (ACE).13Bureau of Industry and Security. Part 740 – License Exceptions Each has its own eligibility conditions, destination restrictions, and recordkeeping requirements. Using one incorrectly is treated the same as exporting without a license.
ITAR exemptions are narrower, reflecting the sensitivity of defense articles. Certain temporary imports and exports for servicing, exhibition, or demonstration can proceed without an individual license when specific conditions are met, including eligibility of the importer and consistency between import and export documentation.14eCFR. 22 CFR 123.4 ITAR also provides exemptions for certain transfers to allied governments under specific agreements. Misapplying an exemption carries the same penalties as an unlicensed export.
When a license is required, ITAR applications go through the Defense Export Control and Compliance System, which handles registrations, license requests, and agreement approvals in a single portal.15Directorate of Defense Trade Controls. Defense Export Control and Compliance System After the application, technical data, and end-user documentation are uploaded, the Empowered Official signs under penalty of perjury. DDTC routes the application through interagency review that can involve the Department of Defense and the intelligence community depending on the item and destination.
EAR license applications go through SNAP-R.16Bureau of Industry and Security. SNAP-R After submission, you receive an Application Control Number for tracking.17Bureau of Industry and Security. Licensing BIS is statutorily required to resolve or refer applications within 90 calendar days, and the agency has historically reported average processing times around 38 days. Recent data suggests significantly longer waits for certain destinations, particularly transactions involving China-related end-users. Build licensing lead times into your production schedule rather than treating the license as a last-minute step.
For both regimes, applications need the ultimate destination, the end-user, and the specific intended use. Foreign government or military buyers typically require an end-user certificate, a formal pledge that the recipient will not re-export or transfer the items without prior U.S. government approval. Intermediate consignees and freight forwarders must also be identified.
Recordkeeping
Both regimes require at least five years of records, but the clock starts differently. Under ITAR, the five years run from the expiration of the license or the date of the transaction, whichever applies.18eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants Under the EAR, the five years run from the latest of several events: the export itself, any known re-export or in-country transfer, or any other termination of the transaction.19eCFR. 15 CFR 762.6 – Period of Retention A later re-export resets the clock.
Required records include commercial invoices, shipping documents, license copies, classification determinations, end-user certificates, and correspondence with government agencies. Electronic or paper formats both work if they are exact duplicates and retrievable during an audit.
Penalties
ITAR civil penalties reach up to $1,271,078 per violation or twice the transaction value, whichever is greater. Criminal convictions for willful ITAR violations carry the fines and imprisonment prescribed by the Arms Export Control Act.20eCFR. 22 CFR Part 127 – Violations and Penalties Willful EAR violations under the Export Control Reform Act can bring criminal fines up to $1,000,000 and up to 20 years in prison for individuals.21Office of the Law Revision Counsel. 50 USC 4819 – Penalties
A criminal conviction under the Arms Export Control Act also triggers statutory debarment. Debarred persons are prohibited from participating directly or indirectly in any ITAR-regulated activity, including exporting, brokering, and accessing controlled technical data. Debarment remains in effect indefinitely until the State Department approves a reinstatement application.22U.S. Department of State. U.S. Department of State Debars Seventeen Persons for Violating or Conspiring to Violate the Arms Export Control Act Every ITAR-subject company must verify that no employee, subcontractor, or business partner appears on the debarment list; doing business with a debarred person is itself a violation. BIS can separately deny export privileges entirely, cutting a company off from international markets for dual-use goods.
Voluntary Self-Disclosure
If you find a violation after the fact, both agencies encourage voluntary disclosure. Under the EAR, BIS treats voluntary disclosure as a mitigating factor and treats a deliberate decision not to disclose a significant violation as an aggravating factor.23eCFR. 15 CFR 764.5 – Voluntary Self-Disclosure The initial notification goes to the Office of Export Enforcement, and you then have 180 days to submit a complete narrative account of what happened, how it happened, and what corrective actions you have taken. Missing that deadline can reduce or eliminate the mitigating benefit.
DDTC operates a parallel voluntary disclosure process for ITAR violations. The same principles apply: disclose early, explain thoroughly, and demonstrate that the underlying problem is fixed. A well-handled disclosure of a minor or technical violation can result in a warning letter rather than a penalty. For more serious violations, disclosure typically produces a significantly reduced penalty compared to what the agency would seek if it discovered the violation itself. If the government is already investigating when you disclose, most of the benefit is lost.
Tying It Together With an Internal Program
Agencies look at whether a functioning compliance program exists when deciding how hard to come down on a violation. BIS publishes eight elements of an effective export compliance program: management commitment, regular risk assessments, export authorization procedures, recordkeeping, training, audits, violation response and corrective action, and continuous program maintenance.24Bureau of Industry and Security. Export Compliance Programs Risk assessments should run at least annually. Training must cover every employee whose work touches export activity, including support staff. Audits should test whether written procedures actually get followed.
BIS offers a free review of your compliance program. Submit your written program to EMCD@bis.doc.gov, and the agency returns feedback within roughly 30 calendar days. Each organization is limited to one review.
For ITAR-controlled items, companies typically implement a Technology Control Plan to prevent unauthorized access to controlled technical data. A TCP identifies every person authorized to access the information, specifies physical security measures like badge access and locked storage, sets information security standards including encryption requirements, and establishes screening procedures to verify authorization. Restricted-access signage, labeled documents, and written briefings for every project member are standard components. The TCP needs to be updated whenever personnel, technology, or facilities change.