A U.S. person under ITAR is a U.S. citizen, a lawful permanent resident, a refugee or asylee (each a “protected individual”), an entity incorporated or organized to do business in the United States, or a U.S. federal, state, or local government body. The definition sits in 22 CFR 120.62, and it controls one of the most consequential lines in defense trade compliance: only U.S. persons can receive ITAR-controlled technical data and defense services without a separate export authorization.1eCFR. 22 CFR 120.62 – U.S. Person
Individuals Who Qualify
The regulation reaches individuals through two categories. Lawful permanent residents qualify under the definition at 8 U.S.C. 1101(a)(20). “Protected individuals” qualify under 8 U.S.C. 1324b(a)(3), which covers citizens and nationals of the United States, lawful permanent residents, people admitted as refugees, and people granted asylum.1eCFR. 22 CFR 120.62 – U.S. Person2Office of the Law Revision Counsel. 8 USC 1324b – Unfair Immigration-Related Employment Practices
The practical takeaway: if you are a U.S. citizen by birth or naturalization, a Green Card holder, a refugee, or an asylee, you are a U.S. person under ITAR. Physical location doesn’t change that. A citizen living abroad remains a U.S. person. A foreign national visiting on a tourist visa doesn’t become one. Status turns on legal standing, not geography.
A Naturalization Wrinkle to Know About
The “protected individual” definition has a built-in expiration for some permanent residents. Under 8 U.S.C. 1324b(a)(3), a lawful permanent resident who becomes eligible to apply for naturalization but does not do so within six months of that eligibility date can lose protected individual status. Similarly, a permanent resident who applies on time but is not naturalized within two years may lose that status unless they can show they are actively pursuing the process. Government processing time doesn’t count against the two-year window.3Office of the Law Revision Counsel. 8 USC 1324b – Unfair Immigration-Related Employment Practices – Section: (a)(3) Protected Individual Defined
For ITAR purposes, this matters less than it first appears for Green Card holders. 22 CFR 120.62 lists lawful permanent residents as U.S. persons independently of the “protected individual” category, so permanent residents keep their U.S. person status regardless of naturalization timing.1eCFR. 22 CFR 120.62 – U.S. Person The clock matters most for refugees and asylees who later obtain permanent residence, since their continued protected individual status can depend on timely naturalization steps.
Businesses and Government Entities
The same section covers organizations. Any company, partnership, trust, or other entity incorporated or organized to do business in the United States is a U.S. person. So is every federal, state, and local government agency.4eCFR. 22 CFR 120.62 – U.S. Person
One distinction trips up even experienced compliance teams. A U.S.-incorporated parent company is a U.S. person, but its foreign subsidiary or branch office is not. Sending controlled technical data from a domestic headquarters to the company’s own overseas office requires a license or agreement, exactly as it would for an unrelated foreign entity. The corporate relationship doesn’t create a shortcut.
Who Is a Foreign Person Instead
The mirror definition at 22 CFR 120.63 fills in everyone else. Anyone who is not a lawful permanent resident and not a protected individual is a foreign person. Any entity not incorporated or organized under U.S. law is a foreign person. Foreign governments and international organizations fall into this bucket too.5eCFR. 22 CFR 120.63 – Foreign Person
The classification that catches most employers involves non-immigrant visa holders. Workers on H-1B, L-1, or F-1 visas are foreign persons under ITAR, no matter how long they have lived in the country or how central they are to the business. Sharing ITAR-controlled technical data with them is treated as an export to their country of citizenship. Companies need a license or a Technical Assistance Agreement from the Directorate of Defense Trade Controls before letting those employees see restricted information.
Why the Classification Matters: Deemed Exports
ITAR defines “export” more broadly than most people expect. Under 22 CFR 120.50(a)(2), releasing or transferring technical data to a foreign person inside the United States counts as a deemed export.6eCFR. 22 CFR Part 120 – Purpose and Definitions No package crosses a border. No file leaves the country. The export happens the moment a foreign person gains access.
This is where the U.S. person definition has its sharpest teeth. A contractor that lets a foreign-national engineer view a controlled schematic on a shared screen has made an export. If that engineer’s country of citizenship is on a restricted list, the company may have committed a violation without anyone leaving the building. Deemed exports are among the easiest ITAR violations to commit by accident and among the hardest to detect after the fact, which is why compliance programs pay close attention to who in the room qualifies as a U.S. person.
Situations That Look Like Exceptions but Aren’t
Several ITAR provisions let foreign persons access defense articles or technical data in limited circumstances. None of them turn a foreign person into a U.S. person; they only remove or narrow the licensing requirement for specific transactions.
Fundamental Research
Under 22 CFR 120.34(a)(8), information from fundamental research falls within the public domain and is exempt. Fundamental research means basic or applied research in science and engineering where results are ordinarily published and shared broadly.7eCFR. 22 CFR 120.34 – Public Domain A foreign graduate student working on a project that will be openly published can access the associated technical data without triggering deemed export rules. But the exclusion disappears if the university or its researchers accept publication restrictions, or if the U.S. government imposes specific access controls on the funded work. Once those constraints attach, full ITAR controls apply.
Canadian Exemptions
Canada receives special treatment under 22 CFR 126.5. Canadian nationals, Canadian-registered businesses, and dual citizens of Canada and a non-restricted third country can receive unclassified defense articles and services without an individual export license, provided the end use is in Canada by Canadian government authorities or a Canadian-registered person.8eCFR. 22 CFR 126.5 – Canadian Exemptions Canadians are not U.S. persons. The exemption removes a licensing step, nothing more, and it does not cover classified defense articles or items excluded in the regulation’s supplement.
Dual Nationals Working Abroad
Foreign companies employing dual nationals or third-country nationals can use an exemption under 22 CFR 126.18. An employer may transfer unclassified defense articles to a dual-national employee without DDTC approval if the company screens the employee for ties to restricted countries, obtains a non-disclosure agreement, and keeps screening records for five years.9eCFR. 22 CFR 126.18 – Exemptions Regarding Intra-Company, Intra-Organization, and Intra-Governmental Transfers to Employees Who Are Dual Nationals or Third-Country Nationals A streamlined version applies when the employee holds citizenship exclusively in NATO member states, EU countries, Australia, Japan, New Zealand, or Switzerland; the employee needs an NDA and must be physically located in one of those countries or the United States at the time of the transfer. Employees with substantive contacts to countries on the ITAR restricted list are presumed to pose a diversion risk, and DDTC must make a separate determination before transfers proceed.
What Happens When the Classification Is Wrong
ITAR enforcement runs on two tracks. Civil penalties under 22 CFR 127.10 can reach the greater of $1,271,078 per violation or twice the value of the underlying transaction.10eCFR. 22 CFR 127.10 – Civil Penalty Criminal penalties under 22 U.S.C. 2778(c) carry fines up to $1,000,000 per violation, imprisonment up to 20 years, or both, and require proof that the violation was willful.11Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports The government can also debar a company or individual from participating in defense trade entirely, which is why civil cases are typically resolved through consent agreements combining a penalty payment with mandated compliance improvements.
When a company discovers a violation, prompt self-reporting is one of the strongest mitigating steps available. Under 22 CFR 127.12, the company must notify the DDTC immediately after discovery, with a full written disclosure within 60 calendar days if the initial notification is incomplete. Missing that window means the submission no longer counts as voluntary.12eCFR. 22 CFR 127.12 – Voluntary Disclosures The disclosure must reach DDTC before the government learns of the violation from another source, and a senior officer at the CEO, general counsel, or board level must certify that it is accurate. A disclosure made without senior management’s knowledge does not qualify as voluntary.13eCFR. 22 CFR Part 127 – Violations and Penalties