The United States Munitions List (USML) is the federal government’s inventory of defense-related hardware, software, services, and technical knowledge that cannot be exported or shared with a foreign party without authorization. It sits at 22 CFR § 121.1, runs across twenty-one categories, and forms the operational core of the International Traffic in Arms Regulations (ITAR).1eCFR. 22 CFR 121.1 – The United States Munitions List If your company makes, sells, brokers, or even stores anything on the list, you must register with the Directorate of Defense Trade Controls (DDTC) and follow its licensing rules before any controlled item, service, or piece of technical data reaches a foreign person.
What the USML Covers
The twenty-one categories span the full range of military technology. Category I begins with firearms, close assault weapons, and combat shotguns. From there the list moves through ammunition and explosives into heavier systems: guided missiles, ballistic missiles, launch vehicles, and rockets in Category IV. Higher-numbered categories address military electronics, fire control equipment, night vision devices, guidance sensors, naval vessels, submersibles, military aircraft, and ground support equipment.1eCFR. 22 CFR 121.1 – The United States Munitions List
Category XXI is a catch-all. When the DDTC determines that an article belongs on the USML but no existing category describes it, the Director of the Office of Defense Trade Controls Policy can place it in Category XXI until the appropriate category is formally amended.2eCFR. 22 CFR Part 121 – The United States Munitions List
The list controls three distinct types of items, and the difference matters because each carries its own compliance obligations:
- Defense articles are tangible equipment or hardware designed, developed, or modified for military, missile, satellite, or other controlled purposes, including models and mock-ups.
- Defense services are assistance or training given to a foreign person involving the design, manufacture, testing, repair, or operation of a defense article. Even an informal conversation that conveys controlled technical knowledge can qualify.
- Technical data is the information used to design, manufacture, operate, repair, or modify a defense article. Blueprints, assembly instructions, maintenance manuals, and detailed software code all fall in this bucket.
That last category catches many companies off guard. You don’t need to ship a missile component overseas to trigger ITAR. Showing a foreign colleague a manufacturing diagram on your screen can be enough.
How to Tell If Your Product Is on the List
For products that sit near the boundary between military and commercial use, classification turns on the “specially designed” analysis in 22 CFR § 120.41. Practitioners sometimes call it “catch and release.”3eCFR. 22 CFR 120.41 – Specially Designed
The first stage catches an item if it was developed with properties specifically responsible for the performance described in a USML paragraph, or if it is a part, component, or accessory for use in a defense article. The focus is on why the item was originally designed, not how it happens to be used today. The second stage releases items that qualify for exclusions such as parts widely available in commercial applications or components functionally equivalent to those found in standard commercial products. Items that clear these exclusions typically land on the Commerce Control List (CCL), which governs dual-use goods. Establishing that a part has no predominant civilian application is the key threshold for keeping it on the USML rather than moving it to the CCL.
When a company genuinely cannot determine whether its product belongs on the USML or the CCL, it can file a Commodity Jurisdiction (CJ) request with the DDTC. This is the formal mechanism for resolving classification uncertainty, and it is worth using rather than guessing wrong. CJ requests go in electronically through the Defense Export Control and Compliance System (DECCS) using Form DS-4076. You do not need to be registered with the DDTC to file one. After submission you receive a case number immediately, and tracking becomes available in DECCS within 48 business hours. If the DDTC returns your request without action, the resubmission has to address whatever additional information the agency asked for, and it gets processed as an entirely new case.4Directorate of Defense Trade Controls. Commodity Jurisdiction (CJs)
The wider regulatory framework — ITAR — sits at 22 CFR Parts 120 through 130 and draws its authority from the Arms Export Control Act, 22 U.S.C. § 2778.5Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
Who Counts as a Foreign Person
One of the most misunderstood corners of ITAR compliance involves “deemed exports.” Under 22 CFR § 120.50, releasing or transferring technical data to a foreign person inside the United States counts as an export to every country where that person holds citizenship or permanent residency. No package leaves the building and no file gets uploaded overseas, but legally an export just happened.6eCFR. 22 CFR Part 120 – Purpose and Definitions
A verbal discussion, a plant tour, a shared screen, or a whiteboard session can all trigger ITAR if the person on the receiving end is not a “U.S. person.” Under 22 CFR § 120.62, a U.S. person includes lawful permanent residents, protected individuals under federal immigration law, entities incorporated in the United States, and U.S. government bodies at any level. Everyone else is a foreign person, and disclosure to them requires prior DDTC authorization.7eCFR. 22 CFR 120.62 – U.S. Person
Companies with international workforces need to take this seriously. Practical compliance means visitor screening, restricting physical and digital access to ITAR-controlled areas and files, and training employees to recognize when a conversation might cross the line. Many first-time violations happen here, often because someone assumed that sharing information with a colleague on U.S. soil didn’t count as an export.
Registering With the DDTC
Before applying for any export license, a company must register with the DDTC. Registration is the gateway to every other ITAR compliance activity.
The Statement of Registration
The primary registration document is Form DS-2032, submitted electronically through DECCS. It requires a legal business name and a physical address (not a P.O. box), along with the names and identifying information of senior officers and board members. Each listed individual is checked against federal watchlists, and anyone debarred from defense trade is disqualified.8eCFR. 22 CFR 129.8 – Submission of Statement of Registration
Registration also has to identify relationships between parent companies, subsidiaries, and affiliates where the registrant owns more than 50 percent of voting securities or otherwise controls the entity. The applicant specifies whether they are a manufacturer, exporter, or broker, since the registration code issued by the DDTC corresponds to actual business activity.9Directorate of Defense Trade Controls. Create a New Registration
The Empowered Official
Every registered entity must designate at least one “empowered official,” the person authorized to sign license applications and certify filings on the company’s behalf. Under 22 CFR § 120.67, the empowered official must be a U.S. person directly employed by the company in a position with policy or management authority. They must understand ITAR’s requirements, including the criminal, civil, and administrative consequences of violations, and they must have independent authority to investigate any proposed export, verify its legality, and refuse to sign an application without facing retaliation.10eCFR. 22 CFR 120.67 – Empowered Official
If your empowered official lacks the technical knowledge to evaluate a transaction or feels pressured to approve applications without meaningful review, your compliance program has a structural problem that no amount of paperwork can fix.
Registration Fees
As of January 9, 2025, the DDTC charges a three-tier fee, replacing the previous flat $2,250 rate:
- Tier 1 is $3,000 per year, applying to first-time registrants, standalone broker renewals, and registrants who did not receive an approved license during the prior twelve-month period. A temporary $500 discount is available for qualifying Tier 1 registrants, reducing the fee to $2,500.
- Tier 2 is $4,000 per year, applying to registrants who received five or fewer approved licenses or authorizations during the twelve-month period ending 90 days before their registration expires.
- Tier 3 applies to registrants with more than five approved authorizations. The formula is $4,000 plus $1,100 for each approval over five, capped at 3 percent of the total value of all approvals or $4,000, whichever is greater.
Registration codes stay active for twelve months, and the DDTC’s review of new and renewal registrations takes up to 30 days.11Directorate of Defense Trade Controls. DDTC Registration Fees12Directorate of Defense Trade Controls. Registration FAQs
Getting Authorization to Export
Registration alone does not authorize any exports. Each transfer of a defense article, defense service, or technical data to a foreign person requires a separate authorization, and the right vehicle depends on what is moving and the nature of the arrangement.
DSP-5 for Permanent Exports
The DSP-5 is the standard application for permanently exporting unclassified defense articles. Applications go in electronically, and every field must be completed; “Not Applicable” or “See Attached” entries are rejected. Commercial sales require supporting purchase documentation such as a contract or purchase order. Exports of significant military equipment additionally require a completed Form DSP-83 (end-use certificate), and transactions valued at $500,000 or more trigger a disclosure requirement covering political contributions, fees, and commissions.13eCFR. 22 CFR Part 123 – Licenses for the Export and Temporary Import of Defense Articles
Manufacturing License and Technical Assistance Agreements
When the arrangement involves ongoing cooperation rather than a single shipment, the DDTC uses two agreement frameworks. A Manufacturing License Agreement (MLA) authorizes a foreign entity to produce a defense article using U.S. technical data. A Technical Assistance Agreement (TAA) covers the provision of defense services or technical data without granting manufacturing rights. Both require DDTC written approval before they can take effect, and neither can be amended or extended without a new approval.14eCFR. 22 CFR 124.1 – Manufacturing License Agreements and Technical Assistance Agreements
A TAA must include a specific description of the defense article involved, the technical data or assistance being provided, the duration of the agreement, and the countries where manufacturing or sale will take place. Several mandatory clauses must appear verbatim, including a statement that the agreement is subject to all U.S. export control laws.15eCFR. 22 CFR Part 124 – Agreements, Off-Shore Procurement, and Other Defense Services Once approved, both MLAs and TAAs generally allow the described defense services to be provided without additional per-transaction licensing, which is why companies prefer these frameworks for long-term programs.
Brokering
Brokering is broader than most people assume. Under 22 CFR Part 129, it includes any action on behalf of another person to facilitate the manufacture, export, transfer, or retransfer of a defense article or service, regardless of where the item originated. Financing, insuring, transporting, negotiating, or even soliciting a deal can qualify. A single transaction is enough to make someone a broker under the regulations.16eCFR. 22 CFR Part 129 – Registration and Licensing of Brokers
Brokers must register with the DDTC unless they fall into a narrow set of exemptions. Companies that provide only freight forwarding, customs brokering, insurance, or transportation services are exempt, so long as their involvement does not extend beyond those functions. Companies already registered as manufacturers or exporters under Part 122 can add brokering to their existing registration rather than filing separately, provided they identify themselves as brokers within their Statement of Registration.
Penalties for Getting It Wrong
ITAR enforcement runs on two tracks, criminal and civil, and the DDTC uses both.
Criminal violations under the Arms Export Control Act can result in fines of up to $1,000,000 per violation, imprisonment of up to twenty years, or both. The statute reaches anyone who willfully violates its provisions or makes an untrue statement of material fact in a registration, license application, or required report.5Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
Civil penalties are adjusted annually for inflation and currently exceed $1.27 million per violation, or twice the transaction value, whichever is greater.17Federal Register. Department of State 2025 Civil Monetary Penalties Inflationary Adjustment On top of monetary penalties, the DDTC can debar individuals and companies from participating in defense trade entirely, through either track. Debarment effectively ends a defense contractor’s business.18Directorate of Defense Trade Controls. DDTC Compliance Actions
Voluntary Self-Disclosure
When a company discovers it may have violated ITAR, the DDTC strongly encourages voluntary self-disclosure under 22 CFR § 127.12. A voluntary disclosure can be a mitigating factor in the agency’s penalty analysis. Failing to disclose a known violation is treated as an aggravating factor, so ignoring a problem you have already identified makes everything worse.19eCFR. 22 CFR 127.12 – Voluntary Disclosures
The process starts with an initial written notification to the DDTC as soon as the violation is discovered. A complete disclosure — a precise description of the violation, the surrounding circumstances, the identities of all parties involved, and the corrective steps taken — must follow within 60 calendar days. If that deadline is not achievable, an empowered official can request an extension in writing. The DDTC weighs several factors when deciding how much credit to give: whether the transaction would have been authorized had a proper application been submitted, why the violation occurred, how cooperatively the company participated in the investigation, and whether senior management authorized the disclosure.
Records and Ongoing Compliance
Every ITAR registrant must keep records of all export-related transactions for at least five years from the date of the transaction or the expiration of the relevant license or authorization. Records stored electronically must be reproducible on paper, display a high degree of legibility, and sit in a format that prevents unlogged alterations. The DDTC, Diplomatic Security Service, U.S. Immigration and Customs Enforcement, and U.S. Customs and Border Protection can all request access at any time, and the company must be able to produce both the records and the personnel and equipment needed to locate and read them.20eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants
The DDTC also expects registered entities to run periodic internal audits of their compliance programs, with genuine independence between auditors and the activities they review. Final audit reports must be kept for at least five years, and any recommended corrective actions need specific timetables, an implementation plan approved by management, and documented follow-up confirming that each fix was completed.21Directorate of Defense Trade Controls. ITAR Compliance Program Guidelines An audit that identifies problems but never produces changes is worse than no audit at all, because it creates a paper trail showing the company knew about the issue and did nothing.
Protection of ITAR-controlled technical data also has a digital dimension. NIST SP 800-171 provides the baseline security requirements for controlled unclassified information in non-federal systems, and the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program began phasing in starting November 2025, with Phase 1 requiring at least Level 1 or Level 2 self-assessments in applicable solicitations through November 2026.22Department of Defense Chief Information Officer. About CMMC Companies handling ITAR technical data who also work on DoD contracts should treat CMMC compliance as an active priority rather than a future concern.