ITAR compliance is the set of obligations the International Traffic in Arms Regulations impose on any U.S. business that manufactures, exports, temporarily imports, or brokers defense articles, defense services, or related technical data. If your products or technical data appear on the United States Munitions List, you must register with the Directorate of Defense Trade Controls (DDTC) at the State Department, control who inside and outside your company can see the technology, obtain a license before any export, keep detailed records for five years, and report both corporate changes and suspected violations. Getting it wrong is expensive: criminal penalties reach $1,000,000 and 20 years in prison per violation, and civil fines can exceed $1.2 million per incident.1eCFR. 22 CFR Part 127 – Violations and Penalties
Who Has to Comply
Any person who engages in the business of manufacturing or exporting defense articles, temporarily importing them, or furnishing defense services must register with DDTC. A single instance of any of those activities is enough to trigger the requirement, and manufacturers must register even if they never ship anything overseas.2eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose Component makers who supply a prime contractor often assume the prime’s registration covers them. It does not.
The trigger is the United States Munitions List (USML) in 22 CFR 121.1, which sorts controlled items into 21 categories covering firearms, ammunition, military vehicles, aircraft, naval vessels, space-related equipment, toxicological agents, military electronics, and more.3eCFR. 22 CFR 121.1 – The United States Munitions List A defense article is anything on that list, including technical drawings, digital models, unfinished forgings or castings identifiable as defense-related by their properties, and mockups that reveal controlled technical data.4eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.31 Basic marketing materials describing a product’s general function are not.
A defense service reaches further than most companies expect. It covers assisting a foreign person in designing, developing, manufacturing, repairing, or operating a defense article, whether that help is delivered inside the United States or abroad, along with furnishing controlled technical data to foreign persons and providing military training to foreign units.5eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.32 Having a foreign national employee troubleshoot USML-controlled equipment can qualify.
ITAR or EAR
Not every export-controlled item is ITAR. The Export Administration Regulations (EAR), run by the Commerce Department’s Bureau of Industry and Security, govern commercial and dual-use items on the Commerce Control List. ITAR covers items specifically designed for military use and listed on the USML. If you cannot tell which applies, file a Commodity Jurisdiction (CJ) request with DDTC using form DS-4076 through the Defense Export Control and Compliance System (DECCS). Paper submissions are returned without action, and you do not need to be registered to file one.6U.S. Department of State – Directorate of Defense Trade Controls. Commodity Jurisdictions Misclassifying a product between the two regimes is one of the most expensive mistakes companies make, because the registration, licensing, and penalty structures differ.
Registering With DDTC
Registration is filed on the Statement of Registration, Form DS-2032, submitted electronically through DECCS.7Directorate of Defense Trade Controls. Completing the DS-2032 Statement of Registration Form You provide your Employer Identification Number, a description of the defense articles or services you handle, the relevant USML categories, and a detailed picture of corporate structure. If parent entities, subsidiaries, or affiliates exist, an organizational chart must show every layer through the ultimate parent. Subsidiaries and affiliates owned or controlled by the registrant cannot register separately. Processing typically takes about 30 days, after which you receive a registration code used for all future license applications.8Directorate of Defense Trade Controls. Registration Renewal
The Empowered Official
Every registrant must designate at least one Empowered Official: a senior employee directly employed in a policy or management role, authorized in writing to sign license applications, and knowledgeable about export control law and its penalties. This person must be a U.S. person, and must have independent authority to investigate any proposed export, verify its legality, and refuse to sign without facing retaliation.9eCFR. 22 CFR 120.67 – Empowered Official The role carries personal exposure to criminal and civil liability if the company violates ITAR on their watch.
Registration Fees
DDTC charges an annual fee in three tiers, effective as of January 2025:10Directorate of Defense Trade Controls. Registration Payment
- Tier 1 is $3,000 and applies to first-time registrants, stand-alone broker renewals, and registrants who received no approved licenses during the 12 months ending 90 days before their current registration expires. Nonprofits exempt under 26 U.S.C. 501(c)(3) qualify with proof of status. A one-year discount initiative lets qualifying Tier 1 registrants petition for a $500 reduction, bringing the fee to $2,500.
- Tier 2 is $4,000 for registrants who received five or fewer approved licenses or authorizations during the same measurement period.
- Tier 3 applies to registrants with more than five approvals. The formula is $4,000 plus $1,100 for each approval beyond five, capped so that if the calculated fee exceeds 3 percent of the total value of all approvals, the fee drops to 3 percent or $4,000, whichever is greater.11eCFR. 22 CFR 122.3 – Registration Fees
Controlling Access Inside the United States
This is where compliance programs most often break down. Releasing controlled technical data to a foreign person inside the United States counts as an export to every country where that person holds citizenship or permanent residency.12eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.50 This is a “deemed export.” Handing a foreign national colleague a controlled technical manual at your office in Ohio can require the same license as shipping that manual overseas.
Screen employees and contractors against the ITAR definition of “U.S. person” in 22 CFR 120.62, which covers U.S. citizens, nationals, lawful permanent residents, asylees, and refugees.13eCFR. 22 CFR 120.62 – U.S. Person Anyone outside that definition is a foreign person, and giving them access to ITAR-controlled data triggers deemed export licensing. Practical triggers include sharing source code, providing equipment training, giving access to controlled user manuals, and even oral discussions of controlled technical details. Non-disclosure agreements reinforce boundaries but do not substitute for the licensing requirement.
Technology Control Plan and Safeguards
Registered companies need documented internal procedures. The central document is a Technology Control Plan (TCP), which maps how the organization handles restricted technical data, who can access it, and what happens when someone requests access who should not have it.
Physical safeguards include restricted areas within the facility, badge access, locked storage, visitor logs, and escort requirements for non-cleared individuals. On the digital side, electronic communications containing controlled technical data must use strong encryption, and access controls should restrict visibility based on each user’s role and citizenship status rather than job title alone. Cloud storage and collaboration platforms add risk because servers may sit outside the United States or be accessible to foreign-national employees of the provider, either of which can constitute an unauthorized export.
Licenses and Exemptions
Once registered, you need DDTC approval before exporting, re-exporting, retransferring, or temporarily importing a defense article, unless a specific exemption applies.14eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.14 DDTC uses different license forms for different transactions:15U.S. Department of State – Directorate of Defense Trade Controls. License Guidance
- DSP-5 for permanent export of unclassified defense articles, related technical data, and limited defense services.
- DSP-73 for temporary export of unclassified defense articles.
- DSP-61 for temporary import of unclassified defense articles.
- DSP-85 for permanent or temporary export, or temporary import, of classified defense articles and related classified technical data.
All applications go through DECCS. Each must identify the specific USML items, the foreign end user, the end use, and any intermediate consignees.
Certain transactions qualify for exemptions under 22 CFR Part 126 and skip the individual license. These include transfers by or for the U.S. government, exports to Canada under specific conditions, transactions under Foreign Military Sales, and defense trade cooperation under the AUKUS framework with Australia and the United Kingdom.16eCFR. 22 CFR Part 126 – General Policies and Provisions Comprehensive authorizations also exist for NATO countries, Australia, Japan, and Sweden. Relying on an exemption still requires documentation and reporting, and items on the Excluded Technology List cannot use these exemptions at all.
Recordkeeping
Registrants must keep records covering the manufacture, acquisition, and disposition of defense articles, along with technical data transfers, defense services, and brokering activities. The retention period is five years from the expiration of the license or authorization, or from the date of the transaction if an exemption was used. DDTC can prescribe a longer or shorter period in individual cases.17GovInfo. 22 CFR 122.5 – Maintenance of Records by Registrants
Electronic records must be stored in a system that can reproduce them on paper, remain legible, and log any changes with the identity of the person who made them and when. Records must be available at all times for inspection by DDTC, U.S. Immigration and Customs Enforcement, or U.S. Customs and Border Protection. On request, you must provide the records, the equipment to read them, and staff who can locate and reproduce them.
Reporting Material Changes
Registration is not a set-it-and-forget-it filing. Certain corporate changes require written notification to DDTC within five days, including changes to company name, address, legal structure, ownership or control, board members, senior officers, and the establishment or divestment of any subsidiary involved in defense-related activities.18eCFR. 22 CFR 122.4 – Notification of Changes in Information Furnished by Registrants If any person listed on your registration is indicted or convicted of certain criminal violations, that also triggers a five-day notice.
Foreign ownership changes require earlier warning. If you intend to sell or transfer ownership or control to a foreign person, you must notify DDTC by registered mail at least 60 days in advance. Mergers and acquisitions carry their own follow-up requirements for the surviving entity, including transferring license numbers with unshipped balances and amending existing agreements within 60 days unless DDTC grants an extension. All notifications under this section must be signed by a senior officer. Changes that do not fall into the five-day categories still get reported at annual renewal.
Voluntary Self-Disclosure
If your company discovers it may have violated ITAR, DDTC strongly encourages voluntary disclosure and states that it may consider such a disclosure a mitigating factor when deciding penalties.19eCFR. 22 CFR 127.12 – Voluntary Disclosures
The process runs on a two-step timeline. Notify DDTC in writing immediately after discovering the violation and begin a thorough internal review. Submit the full written disclosure within 60 calendar days of that initial notification. If you cannot meet the deadline, your Empowered Official or a senior officer can request a written extension, but the request must explain what information is missing and why. Failure to submit a complete disclosure within a reasonable time can result in DDTC refusing to treat the notification as mitigating.
The full disclosure must include a precise description of the violation, the surrounding circumstances, the identities of everyone involved, applicable license numbers or exemptions, the USML category and description of the items, and a description of corrective actions already taken. An Empowered Official or senior officer must certify that all representations are true and correct. For major violations or systemic patterns, DDTC may require certification from a more senior officer.
Penalties
Enforcement runs on two tracks that can operate at the same time.
Criminal penalties apply to willful violations: up to $1,000,000 in fines and up to 20 years in prison per violation, or both. Debarment from future defense trade is also available.20U.S. Department of State – Directorate of Defense Trade Controls. DDTC Compliance Actions
Civil penalties do not require proof of willful intent. The Assistant Secretary of State for Political-Military Affairs can impose fines up to $1,271,078 per violation, or twice the transaction value, whichever is greater, and can impose them in addition to or instead of criminal penalties.21eCFR. 22 CFR Part 127 – Violations and Penalties – Section 127.10 For companies with active export programs, debarment often hurts most, because it effectively shuts down the defense side of the business.
Penalties scale with the severity and breadth of the violation. A single inadvertent disclosure handled through voluntary self-disclosure typically resolves very differently from a pattern of unauthorized exports discovered during an investigation. A documented compliance program, prompt self-disclosure, and meaningful corrective action all factor into how DDTC and the Department of Justice handle enforcement.