Under the International Traffic in Arms Regulations, the ITAR U.S. person definition covers four groups: U.S. citizens and nationals, lawful permanent residents, protected individuals such as refugees and asylees, and any business entity or government body incorporated or organized in the United States. The rule sits at 22 CFR 120.62 and controls who can see defense articles, technical data, and defense services without an export license. Misclassify someone and the exposure is real: civil penalties above $1.27 million per violation and criminal penalties reaching $1 million and 20 years in prison.122 CFR 120.62
Individuals Who Qualify
The regulation defines a U.S. person by cross-referencing two federal immigration statutes rather than listing categories in plain English. Three groups of individuals fall inside the definition.
The first is U.S. citizens and nationals. The reference to 8 U.S.C. 1324b(a)(3) reaches them by defining a “protected individual” to include any citizen or national of the country. Citizenship travels with the person: a U.S. citizen working at a facility in Germany for a decade remains a U.S. person for ITAR purposes.
The second is lawful permanent residents — anyone holding a valid Green Card. The regulation names them directly and also points to the statutory definition at 8 U.S.C. 1101(a)(20).
The third is refugees admitted under 8 U.S.C. 1157 and individuals granted asylum under 8 U.S.C. 1158. Both qualify as protected individuals under 8 U.S.C. 1324b(a)(3)(B) and therefore count as U.S. persons, even before they hold citizenship or permanent residency.
One wrinkle worth flagging for permanent residents. The “protected individual” definition at 8 U.S.C. 1324b(a)(3) excludes a permanent resident who fails to apply for naturalization within six months of first becoming eligible. That exclusion doesn’t strip ITAR U.S. person status, because 22 CFR 120.62 independently covers all lawful permanent residents whether or not they’ve applied. The six-month timeline still matters for other employment protections, but not for ITAR classification.
Who Doesn’t Qualify: Foreign Persons
22 CFR 120.63 defines a “foreign person” as anyone who is not a lawful permanent resident or protected individual — the mirror image of the U.S. person definition. Every foreign national in the country on a temporary visa is a foreign person under ITAR, regardless of how long they’ve lived here or how senior the role.
The visa categories that most often trip up employers include H-1B (specialty occupation), H-1B1 (free trade agreement workers), L-1 (intracompany transferees), and O-1A (extraordinary ability). USCIS requires petitioners filing Form I-129 for these classifications to certify whether a license is needed before sharing controlled technology with the worker, because these visa holders are foreign persons for export control purposes.
Students on F-1 or J-1 visas, TN workers under USMCA, and anyone on a tourist or business visitor visa (B-1/B-2) also sit outside the U.S. person definition. Physical presence, U.S. tax payments, or years of continuous residency on a temporary visa change nothing. Legal status is the only fact that counts.
Entities and Government Bodies
The definition extends past individuals. Under 22 CFR 120.62, any business entity incorporated to do business in the United States qualifies, including corporations, partnerships, and trusts. The controlling fact is where the entity was legally formed, not where its headquarters sit or who owns its shares. A company incorporated in Delaware but wholly owned by a foreign parent is still a U.S. person.
Incorporation doesn’t erase every foreign-influence concern, though. When a foreign interest has the power to direct decisions affecting a U.S. entity’s management or operations, the entity may be treated as under Foreign Ownership, Control, or Influence (FOCI). Under 32 CFR 117.11, a company determined to be under FOCI is ineligible for facility security clearances, and therefore ineligible for classified contracts, unless it puts acceptable mitigation measures in place. An existing clearance can be revoked if the company won’t or can’t negotiate those measures. FOCI does not remove U.S. person status under ITAR, but it can close off classified defense work entirely.
Foreign branches or subsidiaries of a U.S. parent do not inherit the parent’s U.S. person status if they are incorporated under another country’s laws. Even with 100% ownership by a domestic parent, a foreign-incorporated subsidiary is a foreign person, and transferring defense articles or technical data to it requires proper export authorization.
Federal, state, and local government bodies all qualify as U.S. persons. The classification attaches to the entity, not to individual employees inside it. A state transportation agency is a U.S. person even if some of its staff are foreign nationals. Those individual employees remain foreign persons, and sharing controlled technical data with them still triggers the deemed export rule.
Why the Definition Matters: The Deemed Export Rule
This is where the classification bites in daily operations. Under 22 CFR 120.50, releasing or transferring technical data to a foreign person inside the United States counts as an export. The regulation treats it as an export to every country where the foreign person holds or has held citizenship or permanent residency.
If an engineer on an H-1B visa from India and Pakistan sits down at your facility and reviews ITAR-controlled schematics, you have made a deemed export to both countries. Without prior authorization from the Directorate of Defense Trade Controls (DDTC), that’s a violation, even though the data never left the building.
That’s why companies working with defense articles need to know the ITAR status of every person who might access controlled information. It isn’t only a hiring question. It covers visitors, consultants, temporary workers, and anyone else who could see or hear technical data. Most companies manage this through a Technology Control Plan that restricts physical and electronic access, limits who can enter certain areas, and documents every access decision.
Documents That Prove U.S. Person Status
There’s no single ITAR-specific verification form. Employers build internal processes using the existing identity and immigration documents that match each category.
For U.S. citizens and nationals, standard proof is a valid U.S. passport or a certified birth certificate showing birth in the United States or a U.S. territory. A Certificate of Naturalization (Form N-550) or Certificate of Citizenship (Form N-560) works for naturalized citizens.
For lawful permanent residents, the primary document is a current Permanent Resident Card (Form I-551). An expired card doesn’t necessarily mean the person has lost status — just that the document needs renewal.
For refugees and asylees, relevant documents include asylum grant letters, refugee travel documents, or an Employment Authorization Document (EAD) with a category code indicating refugee or asylee status. These come from USCIS or an immigration court.
For business entities, verification relies on formation documents filed with a Secretary of State or equivalent authority: Articles of Incorporation for corporations, Articles of Organization for LLCs, or partnership agreements with a state registration filing. A certificate of good standing from the state of incorporation confirms the entity remains active.
Keep ITAR Verification Separate From the I-9
The Department of Justice has issued explicit guidance warning employers not to combine ITAR status verification with the Form I-9 employment eligibility process. They are legally distinct, and mixing them creates real discrimination risk.
The I-9 process verifies that a person is authorized to work in the United States. Workers choose which documents to present from the approved list, and employers cannot demand specific documents. ITAR verification asks a narrower question: whether someone meets the U.S. person definition for a role involving controlled articles or data.
According to the DOJ’s Civil Rights Division, employers violate the Immigration and Nationality Act when they limit job postings to U.S. citizens based on a misreading of export control rules. ITAR and the Export Administration Regulations do not contain hiring requirements. They regulate access to controlled items, not who you can employ. A company can hire an H-1B worker for a role that includes some ITAR-controlled work; it just needs either the appropriate export authorization or a structure that keeps the worker away from controlled data.
The DOJ’s recommended approach has a few elements. Run export compliance assessments only for positions that actually involve controlled items. If you collect documents to determine whether a worker is a U.S. person, tell them explicitly that the request is for export compliance, not I-9 purposes. Store those documents separately from I-9 files. Never annotate a Form I-9 with export control notes.
Dual Citizens and Third-Country Nationals
A U.S. citizen who also holds citizenship in another country is still a U.S. person. Dual citizenship doesn’t trigger additional ITAR licensing requirements for access to defense articles inside the United States.
The more involved scenario arises with foreign employees overseas. When a foreign business or government entity that is an authorized end-user employs dual nationals or third-country nationals, 22 CFR 126.18 provides an exemption that permits sharing unclassified defense articles with those employees without separate DDTC approval, but only if specific conditions are met.
The employer must have effective procedures to prevent diversion. That means screening employees for “substantive contacts” with countries restricted under 22 CFR 126.1: regular travel to restricted countries, continuing relationships with nationals of those countries, maintaining a residence there, or receiving compensation from entities based there. An employee with substantive contacts involving countries on the 126.1(d)(1) list is presumed to pose a diversion risk unless DDTC decides otherwise.
A streamlined version of the exemption sits at 22 CFR 126.18(d) for employees who are nationals exclusively of NATO members, EU countries, Australia, Japan, New Zealand, or Switzerland. No DDTC approval is needed for those individuals as long as they are regular employees, physically located in one of those countries or the United States, and have signed a non-disclosure agreement. This exemption does not cover permanent hardware transfers.
What Violations Cost
ITAR violations carry both civil and criminal penalties, and the government treats U.S. person verification failures as seriously as any other unauthorized export. From a regulatory standpoint, that’s what sharing technical data with someone who turns out to be a foreign person is.
Civil penalties under 22 CFR 127.10 currently reach up to $1,271,078 per violation, or twice the value of the underlying transaction, whichever is greater. They can be imposed alongside other administrative action, and DDTC can condition future license approvals on payment of outstanding penalties.
Criminal penalties under 22 U.S.C. 2778(c) apply to willful violations: up to $1,000,000 in fines and 20 years of imprisonment per violation. A conviction also triggers automatic statutory debarment under 22 CFR 127.7, barring the person from participating directly or indirectly in any ITAR-regulated activity for three years. Reinstatement isn’t automatic. The debarred person must apply to the Department of State and receive approval before re-engaging in any defense trade activity.
Companies that discover a violation have a strong incentive to self-report. Under 22 CFR 127.12, DDTC considers voluntary disclosure a mitigating factor in setting penalties. Initial notification must be filed immediately after discovery, with a complete disclosure following within 60 days. Failing to report is treated as an aggravating factor.