ITAR Countries: Denial Policy, Exemptions, and Penalties

ITAR countries fall into three groups that determine what you can ship where. Eight are under a blanket policy of denial, meaning the State Department starts from “no” on any license application. A second group faces targeted restrictions on specific categories of defense equipment rather than an across-the-board ban. A third group — the closest U.S. defense allies — enjoys treaty-based exemptions that let many transfers move without individual licenses. Getting the tier right on the front end matters, because a shipment to the wrong destination can trigger civil penalties above $1.27 million per violation and up to 20 years in federal prison.

The Eight Countries Under a Full Denial Policy

The core country list sits in 22 CFR 126.1(d)(1). For these destinations, the State Department’s default position is that any license application will be rejected, and an applicant carries an extremely heavy burden to overcome that default.¹ The eight countries currently on the list are:

Belarus
Burma (Myanmar)
China
Cuba
Iran
North Korea
Syria
Venezuela

A policy of denial does not mean no exception exists in theory. In practice, approvals for these destinations are extraordinarily rare and reserved for situations with a strong foreign policy justification. Attempts to work around the list through intermediary countries, transshipment, or front companies draw the full weight of federal criminal enforcement.

The President has authority under the Arms Export Control Act to add or remove countries as conditions shift, with changes published in the Federal Register.² Check the current version of 126.1 before every transaction rather than relying on memory or an older compliance manual.

Countries With Targeted Restrictions

A second tier appears in 22 CFR 126.1(d)(2). These countries face denial policies for specific categories of defense items rather than a total prohibition, and the targeted embargoes often track United Nations Security Council resolutions.

Russia is the most prominent example. Under 22 CFR 126.1(l), U.S. policy is to deny licenses for defense exports to Russia, with a narrow exception allowing case-by-case approval for government space cooperation.¹ Other countries in this tier face restrictions that vary by equipment type, intended end-use, and whether the transfer supports humanitarian or peacekeeping operations versus combat applications.

Evaluation for these destinations pulls in multiple federal agencies looking at end-use, including whether the equipment could contribute to internal repression or violate international human rights standards. The same hardware might clear review for a peacekeeping mission and fail for the same country’s internal security forces. Because this tier changes more frequently than the full-denial list, current text of 126.1 controls.

Allied Countries With Licensing Exemptions

At the other end of the spectrum, the United States maintains treaty-based arrangements with its closest defense partners so that many transfers move without a traditional export license. These exemptions exist because the defense industrial bases of these allies are deeply integrated with the American system.

Canada

The Canadian Exemptions under 22 CFR 126.5 permit unclassified defense articles to move between the United States and Canada without an individual license, provided the items are destined for Canadian federal or provincial government use or for a Canadian-registered person.³ The exporter still has to confirm the recipient is eligible and that the specific item is not on the excluded list. Classified items and certain particularly sensitive technology categories fall outside the exemption.

United Kingdom and Australia

Bilateral Defense Trade Cooperation Treaties with the United Kingdom and Australia create “Approved Communities,” vetted networks of government and private entities authorized to receive defense articles without individual licenses. The UK treaty is implemented through 22 CFR 126.17, and the Australia treaty through 22 CFR 126.16.⁴⁵ Transfers within these communities still require strict record-keeping and marking protocols, and items must stay inside the Approved Community. An unauthorized re-export triggers the same penalties as any other ITAR violation.

NATO and Other Close Allies for Employee Access

A separate exemption reaches employees who are nationals exclusively of NATO member states, EU countries, Australia, Japan, New Zealand, or Switzerland. Under this pathway, such employees can receive unclassified defense articles and services without DDTC approval, provided they are regular employees of the authorized entity, are physically located within those countries or the United States, and have signed a non-disclosure agreement. No permanent hardware transfers are allowed under this exemption.

Trade with allied countries remains heavily regulated even where exemptions apply. Every participant must be registered with the Directorate of Defense Trade Controls and maintain an internal compliance program. Companies that cut corners on documentation or allow items to drift outside the approved network can lose access to these streamlined pathways.

Sharing Technical Data Inside the United States Still Counts

The country tiers do not only apply to physical shipments. Sharing controlled technical data or providing a defense service to a foreign person inside the United States counts as an export to that person’s country, a concept known as a deemed export. A conversation in a conference room, an email attachment, or granting a foreign national employee access to certain files can trigger the same licensing requirements as sending hardware overseas.

ITAR defines a foreign person as any individual who is not a U.S. citizen, not a lawful permanent resident, and not a protected individual under federal immigration law. The definition also covers foreign corporations, organizations, and governments.⁶ Employees, contractors, or visitors who meet that definition need a license or an applicable exemption before they can access ITAR-controlled technical data.

22 CFR 126.18 provides a limited pathway for employers to share unclassified technical data with employees who hold citizenship in a proscribed country, without obtaining an individual license, if a screening plan demonstrates the information will not flow back to the restricted country.⁷ Background checks, non-disclosure agreements, and ongoing monitoring are standard components. Nationality-based restrictions on access to controlled data are legally permissible under ITAR, but the justification must be documented and tied to specific regulatory requirements rather than applied as a blanket policy.

Penalties for Shipping to the Wrong Country

Enforcement runs on two tracks: criminal and civil. Willful violations of the Arms Export Control Act, its implementing regulations, or a material misstatement on a registration or license application carry up to $1,000,000 in criminal fines per violation and up to 20 years in federal prison.² The Department of Justice pursues cases where individuals route shipments through third-party intermediaries, shell companies, or non-proscribed countries to reach a restricted destination. The willfulness threshold is lower than many assume: the government does not need to prove you knew the specific regulation, only that you knew your conduct was unlawful.

The State Department can also impose civil fines without a criminal conviction. The baseline civil penalty is $1,271,078 per violation, or twice the value of the underlying transaction, whichever is greater, and the figure adjusts annually for inflation.⁸ Each unauthorized transfer counts as a separate violation, so a single shipment containing multiple controlled items can generate penalties well beyond the value of the deal. Deemed export violations carry the same per-occurrence amount.

A criminal conviction under the Arms Export Control Act also triggers automatic statutory debarment. Under 22 CFR 127.7, a debarred person cannot export, temporarily import, broker, or provide defense services for a minimum of three years following conviction, and reinstatement requires an approved petition to the State Department.⁹ Debarred names are published in the Federal Register, and every company in defense trade is expected to screen partners against that list.

Companies that catch a violation internally can file a voluntary self-disclosure with DDTC. The regulations do not guarantee a specific outcome, but DDTC has stated that it strongly encourages self-disclosure, and a timely, thorough submission with corrective measures generally results in more favorable treatment than a violation surfaced through an investigation or a tip.

Keeping the Country Analysis Current

The country lists are not static. The full-denial list, the targeted-restrictions list, and the eligible-ally lists all change as the executive branch responds to sanctions, treaty developments, and shifting foreign policy. Any export compliance workflow needs a step that pulls the current text of 22 CFR 126.1 and confirms the destination country’s tier before the transaction moves. A country that was exportable last quarter may not be exportable today, and the penalties assume you checked.