ITAR - International Traffic in Arms Regulations

A comprehensive ITAR Internal Compliance Program (ICP) is essential for effective ITAR management and is heavily considered in DDTC enforcement decisions. (1) Internal Compliance Program (ICP) Elements per DDTC Compliance Program Guidelines: (a) Management Commitment - written commitment + Board approval + CEO endorsement + tone-at-the-top; (b) Risk Assessment - identification of ITAR-related risks + per business + per geography + per product + per partner; (c) Empowered Official - per 22 CFR 120.67 + US person + authority + access to records + management reporting line; (d) Policies and Procedures - written + comprehensive + reviewed annually + tracked changes; (e) Classification - jurisdictional determination per item + USML categorisation + EAR coordination; (f) Restricted Party Screening - per shipment + per party + against Specially Designated Nationals (SDN) + Denied Parties + Enti

• ICP + DDTC Guidelines + Board approved + annual review + records + ICP Manual
• Empowered Official + US person + authority + reporting line + records + appointment
• 5-year recordkeeping + comprehensive + audit ready + records + organised + accessible
• Training + annual + role-based + records + completion + refresher + sanctions
• IT Cloud + GovCloud + GCC High + NIST 800-171 + CMMC 2.0 + records + audit

• ICP absent or pro forma (no Board approval)
• Empowered Official not US person or no authority
• Recordkeeping incomplete or organised poorly
• Training annual e-learning only (no role-based)
• IT systems not ITAR-compliant (commercial cloud used)

Part 122 of ITAR (22 CFR 122.1-122.5) requires mandatory registration with the Directorate of Defense Trade Controls (DDTC) for entities engaged in (a) manufacturing of defense articles; (b) exporting or temporarily importing defense articles; (c) brokering of defense articles or defense services (per Part 129). Registration is a PREREQUISITE for export licensing - without DDTC registration entities cannot apply for export licenses. (1) Who Must Register per 22 CFR 122.1: (a) US persons that engage in the business of manufacturing defense articles + including for domestic use (manufacturing-only registration) or for export; (b) US persons that engage in the business of exporting or temporarily importing defense articles or furnishing defense services; (c) US persons engaged in the business of brokering defense articles or defense services. Registration is required regardless of whether t

• DDTC registration + DS-2032 submitted + DECCS + records + per registration year
• Annual renewal + 60-day notice + DECCS + records + audit trail
• Material change notification + 5-day + records + per change
• Empowered Official + US person + authority + access + records + appointment
• FOCI disclosure + mitigation + SCA/Proxy/SSA where applicable + records

• Manufacturers-only entity not registered (Section 122.1 violation)
• Annual renewal lapsed (registration invalid)
• Material changes not notified within 5 days
• Empowered Official not US person or no authority
• FOCI not disclosed or mitigated

Part 126 of ITAR (22 CFR 126.1-126.18) governs general exemptions + country policies + and special authorizations. (1) Section 126.1 Prohibited Exports to Embargoed Countries: ITAR prohibits exports + reexports + retransfers + brokering activities to (a) countries subject to United Nations Security Council arms embargoes including (i) Belarus + (ii) Burma (Myanmar) + (iii) Central African Republic + (iv) China (PRC) (most) + (v) Cuba + (vi) Cyprus (with exceptions) + (vii) Democratic Republic of the Congo + (viii) Eritrea + (ix) Haiti + (x) Iran + (xi) Iraq + (xii) Lebanon + (xiii) Libya + (xiv) North Korea (DPRK) + (xv) Somalia + (xvi) South Sudan + (xvii) Sudan + (xviii) Syria + (xix) Venezuela (Maduro regime); (b) countries subject to US-specific embargoes per Department of State; (c) policy of denial countries per DDTC. Embargoes apply to most defense articles + services + technical

• Section 126.1 embargoed countries screening + per transaction + records + per destination
• Country-specific exemptions + Canada Sec 126.5 + Australia/UK 126.16/17 + records
• Open General Licenses + AUKUS OGL-1 + records + per export + audit trail
• Defense cooperation treaty + DTCT-AUS + DTCT-UK + records + per transaction
• DDTC country policies + internal guidance + records + monitoring

• Embargoed country screening absent (export to prohibited)
• Country-specific exemptions not utilised (over-licensing)
• AUKUS OGL not utilised (Australia/UK over-licensed)
• Defense cooperation treaties unknown (US-only mindset)
• DDTC policies not monitored (license denials unexpected)

Part 127 of ITAR (22 CFR 127.1-127.12) establishes the violations + penalties + and enforcement framework. (1) Section 127.1 Violations: prohibited acts including (a) export + temporary export + retransfer + reexport of defense articles or technical data without required license or other DDTC authorization; (b) furnishing defense services without authorization; (c) brokering activities without authorization; (d) making false statement or omission in license application; (e) using a license for activities outside the scope; (f) attempting or conspiring to violate; (g) violating any term + condition + or proviso of license + agreement + DDTC order; (h) failing to register; (i) failing to maintain required records; (j) failing to report Brokering activities; (k) reexporting from third country without DDTC authorization. (2) Civil Penalties per 22 CFR 127.10 + AECA + International Emergency

• Violation risk assessment + civil penalty USD 1.2M + criminal 20 years + Board awareness
• Voluntary disclosure procedure + DDTC engagement + counsel + records + per incident
• Debarment risk + Statutory + Administrative + records + Board awareness
• Settlement strategy + Consent Agreement risk + records + counsel + monitor
• DOJ + FBI + HSI coordination + criminal risk + counsel + records

• Violation risk not Board-level (civil + criminal exposure unmanaged)
• Voluntary disclosure absent (waited for DDTC enforcement)
• Debarment risk not assessed (compliance program absent)
• Settlement strategy reactive (no proactive remediation)
• DOJ + FBI coordination unprepared (no counsel retained)

Parts 123-125 of ITAR establish the export licensing framework administered by DDTC. (1) Part 123 Licensing of Defense Articles: (a) Form DSP-5 Application for Permanent Export of Unclassified Defense Articles - the basic ITAR license type + must be obtained prior to export + valid for 4 years + specific quantities + values + end users + end uses; (b) Form DSP-73 Application for Temporary Export of Unclassified Defense Articles - for short-term exports including exhibitions + demonstrations + trade shows + repair + reverse engineering + valid for 4 years + must be returned to US; (c) Form DSP-61 Application for Temporary Import of Unclassified Defense Articles - for foreign-origin defense articles temporarily imported to US for repair + modification + processing; (d) Form DSP-83 Nontransfer and Use Certificate - end-use assurance from foreign government for sensitive items; (e) Form DSP-

• DSP-5/73/61/83 + per export + license + records + per transaction + tracking
• MLA + TAA + 5-year term + provisos + records + per partner + per article
• Classified + DD-254 + Facility Clearance + ISL + records + Department of State
• Public Domain exemption + justification + records + per technical data category
• DECCS + CJ determinations + DDTC communications + records + audit trail

• Export without license (DSP-5 required for permanent)
• MLA/TAA expired without renewal
• Classified handled without DD-254 + Facility Clearance
• Public Domain claimed without justification
• DDTC communications informal (no DECCS record)

Parts 129-130 of ITAR govern brokering activities and political contributions disclosure. (1) Part 129 Brokering Activities + Registration + License: (a) Section 129.2 Brokering Definition - acting as agent for others in negotiating or arranging contracts purchase sale or transfer of defense articles or defense services in return for fee + commission + or other consideration; (b) Section 129.3 Registration - all brokers must register with DDTC + Statement of Registration DS-2032 + separate from manufacturer/exporter registration + annual fee + same FOCI considerations; (c) Section 129.4 Brokering License - many brokering activities require prior DDTC authorization + Brokering License Application Form (no specific form number, online via DECCS) + including (i) particulars of proposed brokering; (ii) parties; (iii) defense articles or services; (iv) destination; (v) end-user; (vi) end-use;

• Brokering registration + license + annual report + records + per activity
• Political contributions + Part 130 + fees + commissions + records + per sale
• 5-year recordkeeping + ITAR records + audit ready + records + organised + accessible
• FCPA + anti-bribery + third party DD + records + per relationship
• Industry cooperation + DDTC + SEC + DOJ + records + per inquiry

• Brokering activities without registration
• Political contributions not reported per Part 130
• Recordkeeping less than 5 years
• FCPA + ITAR Part 130 treated separately
• DDTC inquiries unanswered or delayed

International Traffic in Arms Regulations (ITAR) administered by the US Department of State Directorate of Defense Trade Controls (DDTC) pursuant to the Arms Export Control Act (AECA) at 22 USC 2778 + 2779 + 2780 + Executive Order 13637 (delegation of authority) + codified at 22 CFR Parts 120-130. The ITAR controls (a) export and reexport of defense articles and defense services (Part 120); (b) registration of manufacturers exporters and brokers (Part 122); (c) export licenses (Parts 123-125); (d) defense services and technical data (Part 125); (e) general exemptions and country policies (Part 126); (f) violations and penalties (Part 127); (g) brokering activities (Part 129); (h) political contributions and political activity reporting (Part 130). United States Munitions List (USML) per 22 CFR 121.1 organises controlled items into 21 Categories: (I) Firearms + Close Assault Weapons + Com

• ITAR applicability assessment + per item + per service + per data + records
• USML classification + per item + records + jurisdictional determination procedure
• Defense article + service + technical data definitions mapping + per business unit + records
• AECA + 22 CFR 120-130 compliance + records + per part + status
• DDTC engagement + Federal Register monitoring + records + amendments tracking

• ITAR applicability not assessed (defense activities without classification)
• USML classification absent (no jurisdictional determination)
• Defense definitions misapplied (e.g. technical data treated as commercial)
• AECA compliance posture pro forma (no per-part status)
• DDTC engagement absent (no Federal Register monitoring)

ITAR technical data + defense services + Deemed Export Rule require careful management of foreign person access to controlled information regardless of physical location. (1) Technical Data per 22 CFR 120.33: information + including software + that is required for the design + development + production + manufacture + assembly + operation + repair + testing + maintenance + or modification of defense articles + including engineering drawings + technical specifications + technical manuals + classified information + bills of materials + processing parameters + software source code. EXCLUDES information generally taught at accredited universities + basic marketing information + general system descriptions + Public Domain information per 22 CFR 125.4(b). (2) Defense Services per 22 CFR 120.32: furnishing of assistance + including training to foreign persons + in design + development + engineer

• Technical data inventory + per category + per USML + records + per system + classification
• Deemed Export + foreign person access + technology control plan + records + audit + DSP-5 if needed
• US persons + foreign persons + per employee + per contractor + records + I-9 + status
• FOCI mitigation + SCA/Proxy/SSA + records + DDTC + Department of Defense
• AUKUS Pillar 2 + Australia + UK partners + exemption + records + 1 Sept 2024+

• Technical data not inventoried per ITAR scope
• Deemed Export Rule not understood (foreign person access uncontrolled)
• US Persons/Foreign Persons not classified per employee
• FOCI mitigation absent or expired
• AUKUS Pillar 2 exemptions not utilised (over-licensing)