The United States Munitions List is the federal government’s official catalog of weapons, military equipment, defense services, and related technical data that cannot leave the country without specific authorization from the Department of State. It is maintained under the Arms Export Control Act and codified at 22 CFR Part 121, and it organizes controlled items into twenty-one numbered categories.1Office of the Law Revision Counsel. 22 U.S. Code 2778 – Control of Arms Exports and Imports2eCFR. 22 CFR Part 121 – The United States Munitions List Any company that manufactures or exports items on the list must register with the Directorate of Defense Trade Controls (DDTC), and violations can carry civil fines above $1.2 million per incident or up to twenty years in federal prison.
What Is on the List
The twenty-one categories run from conventional weapons through highly specialized technology:
- Categories I–V: firearms, artillery, ammunition, guided missiles and bombs, and explosives and propellants.
- Categories VI–VIII: naval vessels, ground vehicles (including tanks and armored personnel carriers), and military aircraft.
- Categories IX–X: military training equipment and personal protective equipment.
- Categories XI–XII: military electronics and fire control, sensors, and night-vision equipment.
- Categories XIII–XIV: miscellaneous military materials and toxicological agents.
- Categories XV–XVI: spacecraft and nuclear-weapons-related articles.
- Categories XVII–XVIII: classified articles and directed-energy weapons.
- Categories XIX–XX: gas turbine engines and submersible vessels.
- Category XXI: a catch-all for articles, technical data, and defense services not listed elsewhere but determined to warrant control.
Each category captures not just finished systems but also components, parts, accessories, and attachments that contribute to military function.3Directorate of Defense Trade Controls. Latest USML Updates A controlled guidance module, for example, does not lose its USML status because someone installs it in an otherwise commercial product. Regulators look past the finished item to the controlled component inside, a principle sometimes called the “see-through” rule.
Defense Services and Technical Data Are Covered Too
The list is not limited to physical hardware. Training foreign personnel, providing engineering assistance, and advising on the use of any listed item are treated as regulated defense services. Technical data — blueprints, engineering drawings, performance specifications, and operating instructions — is regulated with the same rigor as the hardware itself.
This has consequences inside your own office. Under 22 CFR 120.50, releasing controlled technical data to a foreign person on U.S. soil counts as an export to that person’s country of citizenship.4eCFR. 22 CFR 120.50 – Export A contractor that lets a foreign engineer view controlled design files at a domestic facility has made a “deemed export” and needs the same authorization it would need to ship those files abroad. Companies with multinational workforces are frequently caught off guard by this rule.
USML or Commerce Control List?
Not every controlled item sits on the USML. The Department of Commerce maintains a separate Commerce Control List (CCL) under the Export Administration Regulations for dual-use items with both civilian and military applications. The line matters, because USML items face far stricter licensing and most Commerce-side exemptions do not apply.
When there is genuine doubt about which list governs an item, the formal resolution is a Commodity Jurisdiction determination. You submit Form DS-4076 electronically to DDTC, describing the item’s form, function, and development history. DDTC then consults with the Departments of Defense and Commerce and decides. Registration with DDTC is not required before filing a CJ request. If a company wants an item moved from the USML to the CCL, the same CJ process applies, but State must give Congress at least thirty days’ notice before any item comes off the munitions list.5eCFR. 22 CFR 120.12 – Commodity Jurisdiction Determination Requests6eCFR. 22 CFR 120.4 – Commodity Jurisdiction Treating a USML item as a Commerce-controlled item, even by accident, is a violation.
Countries You Cannot Ship To
DDTC maintains a list of nations subject to a blanket policy of denial. License applications for those destinations will almost certainly be rejected. As of 2026, that group consists of Belarus, Burma, China, Cuba, Iran, North Korea, Syria, and Venezuela.7eCFR. 22 CFR 126.1 – Prohibited Exports, Imports, and Sales To or From Certain Countries
A second tier faces country-specific restrictions that may allow limited transactions on a case-by-case basis, including Afghanistan, Russia, Iraq, Libya, Somalia, and South Sudan. Restrictions shift as geopolitical conditions change. Cyprus, for instance, has its denial policy suspended through September 30, 2026. Always check the current version of 22 CFR 126.1 before pursuing any transaction.
Who Has to Register
Any person or company in the United States that manufactures or exports defense articles, temporarily imports them, or furnishes defense services must register with DDTC. Registration is not limited to active exporters. A manufacturer that never ships a single item overseas still has to register.8eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose Brokers of defense articles have a separate registration obligation under Part 129. Active registration is a prerequisite for requesting any export authorization.
Registration means submitting Form DS-2032 (Statement of Registration) through DDTC’s online system. The form asks for details on corporate structure, subsidiaries, affiliates, and senior leadership.9U.S. Department of State Directorate of Defense Trade Controls. Completing the DS-2032 Statement of Registration Form Each registrant must also designate at least one Empowered Official, a U.S. person employed by the company with independent authority to review proposed exports, verify their legality, and sign license applications. An Empowered Official must be able to refuse to sign an application without facing retaliation.10eCFR. 22 CFR 120.67 – Empowered Official
Registration Fees
Since January 2025, DDTC uses a three-tier fee structure.11U.S. Department of State. Registration Payment Tier 1 is the base fee of $3,000 per year. Tier 2, at $4,000 per year, applies to registrants that received five or fewer approved authorizations during the twelve-month period ending ninety days before their current registration expires. Tier 3 applies to registrants with more than five approved authorizations: the fee is $4,000 plus $1,100 for each approval beyond five. If that total exceeds three percent of the value of all approved transactions, the fee drops to three percent or $4,000, whichever is greater. High-volume exporters pay substantially more than companies with limited defense trade activity.
Getting Authorization to Export
Registration alone does not authorize any transfer. You need specific authorization for each proposed export of defense articles, services, or technical data.
For the permanent export of unclassified defense articles, related technical data, and limited defense services, the standard authorization is Form DSP-5.12Directorate of Defense Trade Controls. License Guidance The application requires you to identify the USML category covering the item, the foreign end-user, the intended end-use, and supporting documentation such as purchase orders and technical specifications.
When the transaction is an ongoing relationship rather than a one-time shipment — helping a foreign company manufacture a defense article, for instance, or providing sustained technical support — a Manufacturing License Agreement or Technical Assistance Agreement is required instead, and it must be approved by DDTC before any defense services begin.13eCFR. 22 CFR 124.1 – Manufacturing License Agreements and Technical Assistance Agreements Once approved, the defense services described in the agreement can generally proceed without a separate license for each individual transfer. Changes to the scope require a new approval.
All applications go through the Defense Export Control and Compliance System (DECCS), DDTC’s centralized online portal.14Directorate of Defense Trade Controls. DECCS – Defense Export Control and Compliance System Review involves interagency consultation with the Department of Defense and, depending on the destination country and technology, other agencies. In early 2026, DDTC’s average processing time for license applications was roughly 38 to 39 days.15Directorate of Defense Trade Controls. DDTC Public Portal Cases involving classified technology, sales requiring Congressional notification, or countries under elevated scrutiny take considerably longer.
Exemptions for Close Allies
Not every defense export needs an individual license. Part 126 carves out exemptions for U.S. Government transfers, defense trade with Canada, dedicated exemptions under the AUKUS partnership among the United States, Australia, and the United Kingdom, and comprehensive export authorizations available for NATO members, Australia, Japan, and Sweden. Separate treaty-based exemptions cover certain transfers to Australia and the United Kingdom.16eCFR. 22 CFR Part 126 – General Policies and Provisions These exemptions are not blanket permissions. Each has specific conditions, and using one incorrectly is treated the same as exporting without a license.
Recordkeeping and Internal Compliance
Every registrant must keep records of all defense trade activity — manufacturing, acquisitions, exports, technical data transfers, brokering activities, and related documentation — for at least five years from the expiration of the license or the date of the transaction.17eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants DDTC can extend or shorten that period in individual cases, but five years is the baseline auditors expect.
DDTC also expects a functioning internal compliance program. Its guidance describes four characteristics of an effective program: written documentation, tailoring to the company’s actual operations, regular review and updating, and full management support.18U.S. Department of State – Directorate of Defense Trade Controls (DDTC). Getting and Staying in Compliance With the ITAR A program that exists on paper without executive backing is worse than useless when regulators arrive. It becomes evidence that the company knew what it should have been doing.
Penalties
Consequences for unauthorized exports break into three tracks, and all three can apply to the same conduct.
Civil penalties reach up to $1,271,078 per violation, or twice the value of the transaction, whichever is greater. The figure adjusts periodically for inflation.19eCFR. 22 CFR Part 127 – Violations and Penalties Civil penalties do not require proof that the violation was intentional; inadvertent exports of controlled items still count.
Willful violations carry criminal exposure. Anyone who knowingly violates the Arms Export Control Act, or who deliberately makes a false statement on a registration or license application, faces a criminal fine of up to $1,000,000 per violation and up to twenty years in federal prison.1Office of the Law Revision Counsel. 22 U.S. Code 2778 – Control of Arms Exports and Imports
A conviction under the Arms Export Control Act also triggers statutory debarment. For a minimum of three years after conviction, State will not consider any license applications involving the convicted person or company, and the person is barred from participating directly or indirectly in regulated defense trade activity.20eCFR. 22 CFR 127.7 – Debarment For a defense contractor, debarment is often the most damaging penalty of the three, because it effectively shuts down international business for years.
Voluntary Self-Disclosure
If you discover an ITAR violation inside your company, consider filing a voluntary disclosure with DDTC. The regulations explicitly treat self-reporting as a mitigating factor when the government decides on penalties. Failing to report a known violation is treated as an aggravating factor.21eCFR. 22 CFR 127.12 – Voluntary Disclosures
The process runs in two stages. Notify DDTC immediately after discovering a potential violation, then follow with a full written disclosure within sixty days. An Empowered Official or senior officer can request a written extension if more time is needed, but missing the deadline without one may cause DDTC to disregard the disclosure as a mitigating factor. In evaluating a disclosure, DDTC considers whether the violation was willful, whether management was aware, what remedial steps have been taken, and whether a compliance program was in place. Where a violation was clearly inadvertent and the company demonstrates genuine commitment to fixing the problem, DDTC has the discretion to impose no penalty at all.