ITAR (International Traffic in Arms Regulations) Compliance

Trade, Export Controls & Sanctions

🇺🇸 ITAR

The September 2025 USML Revisions Amended 15 of 21 Categories. Do You Know Which Items Just Shifted Into—or Out of—ITAR Jurisdiction?

ITAR compliance requires end-to-end control of defense articles, technical data, and defense services across your entire supply chain—with DDTC registration, export licensing, foreign person access restrictions, and five-year recordkeeping. Civil penalties exceed $1.27 million per violation. Criminal penalties reach $1 million and 20 years imprisonment.

Certivo automates ITAR compliance evidence management from supplier classification to audit-ready export documentation.

Key Data

• 21: USML categories controlling defense articles and services
• $1.27M: Maximum civil penalty per violation (2025, adjusted for inflation)
• 5 years: Minimum recordkeeping requirement for all ITAR transactions

Regulation Overview

• Jurisdiction: United States (extraterritorial reach to all foreign recipients of US defense articles)
• Regulatory Body: Directorate of Defense Trade Controls (DDTC), U.S. Department of State
• Regulation Number: 22 CFR Parts 120–130 (Arms Export Control Act, 22 U.S.C. § 2778)
• Effective Date: 1976 (ongoing revisions; major USML amendments effective September 15, 2025)
• Official Source: DDTC
• Key Threshold: Any item on the U.S. Munitions List (USML) triggers full ITAR obligations

What is ITAR?

ITAR is the US regulatory framework controlling the export and import of defense articles, defense services, and related technical data listed on the United States Munitions List. For supply chain and compliance teams, the primary obligation is ensuring that every item, document, and interaction involving USML-controlled technology is properly classified, licensed, and documented. The USML contains 21 categories spanning firearms, ammunition, military vehicles, aircraft, naval vessels, satellites, electronics, and related technical data. DDTC's September 2025 final rule amended 15 of 21 categories—adding newer technologies and removing outdated entries. Companies must register with DDTC, obtain export licenses before transferring controlled items, and prevent unauthorized access by foreign persons—including employees and visitors. ITAR compliance requires classification-level data from every supplier in the defense supply chain. When USML categories are revised, your entire product portfolio requires reclassification assessment.

Key Components / Sub-Frameworks

• Classification: Determines all downstream ITAR obligations.
• USML (U.S. Munitions List): 21 categories of controlled defense articles and services.
• DDTC Registration: Mandatory registration for manufacturers, exporters, brokers of defense articles.
• Export Licenses (DSP-5, DSP-73, etc.): Authorization to export defense articles or technical data.
• Technical Assistance Agreements (TAA): Agreements for providing defense services to foreign persons.
• Deemed Exports: Disclosure of technical data to foreign nationals within the US.
• Recordkeeping (§ 122.5): Retention of all transaction records.

Key Compliance Requirements

Who Must Comply

• US manufacturers of defense articles listed on the USML
• Exporters and importers of USML-controlled items, technical data, or defense services
• Brokers of defense articles between foreign persons or governments
• Subcontractors and suppliers in the defense supply chain handling ITAR-controlled items
• Companies employing foreign nationals with access to ITAR technical data (deemed exports)
• Universities and research institutions working on USML-related technologies

Key Thresholds

• Any USML item: Presence of a defense article on the USML triggers full ITAR jurisdiction.
• $3,000/year: Minimum annual DDTC registration fee (Tier 1); up to $4,000+ for Tier 2/3.
• $1,271,078: Maximum civil penalty per violation (2025, inflation-adjusted).
• 20 years: Maximum criminal imprisonment per willful violation.

Core Obligations

1. DDTC Registration

   • Register with DDTC if manufacturing, exporting, or brokering defense articles.
     DEADLINE: Before commencing any ITAR-controlled activity.

2. Commodity Jurisdiction

   • Determine whether items fall under ITAR (USML) or EAR (CCL).
     DEADLINE: Before export or transfer.

3. Export Licensing

   • Obtain DSP-5, TAA, or other authorization before exporting controlled items.
     DEADLINE: Before any transfer to foreign person or entity.

4. Foreign Person Screening

   • Prevent unauthorized access to ITAR data by foreign nationals.
     DEADLINE: Ongoing—applies to employees, visitors, and suppliers.

5. Recordkeeping

   • Maintain all export transaction records, licenses, and correspondence.
     DEADLINE: Minimum 5 years after license expiration or transaction.

ITAR-Specific Pain Points

The Classification Uncertainty

DDTC revised 15 of 21 USML categories in September 2025. Your product line includes 300 components from 80 suppliers. Some items moved from ITAR to EAR jurisdiction. Others moved in. Your classification records are 18 months old. Without a systematic reclassification review, you may be exporting under the wrong authority—and every shipment is a potential violation.

The Deemed Export Trap

A foreign national engineer on your team accesses a shared drive containing ITAR technical data. No export license was obtained. Under ITAR, this "deemed export" carries the same penalties as shipping a missile component overseas. Your IT systems don't distinguish between ITAR-controlled files and general engineering data. Your access controls are based on job title, not citizenship verification.

The Supply Chain Flow-Down Gap

Your prime contractor requires ITAR compliance across all sub-tier suppliers. Supplier 1 has DDTC registration but no documented compliance program. Supplier 2 manufactures a component that was recently reclassified onto the USML. Supplier 3 uses a foreign-owned subcontractor you didn't know about. Without multi-tier supply chain transparency, one non-compliant link can trigger debarment for your entire program.

The Audit Trail Deficit

DDTC requests records for a license issued three years ago. You need the original application, all amendments, end-use certificates, delivery verification, and correspondence. Records are scattered across email, file shares, and a retired licensing system. Assembling a complete audit trail takes weeks—and incomplete records are themselves a violation.

Certivo in Action

Certivo collects supplier export control evidence, extracts DDTC registration and classification data, validates against current USML categories, and generates customer-ready compliance documentation automatically. When DDTC amends the USML, Certivo reassesses your supplier base and alerts you—before your next shipment.

Key Statistics

• 21: USML categories tracked with automatic amendment sync
• 99.2%: Classification data extraction accuracy from supplier documents
• 95%: Supplier response rate with CORA-powered campaigns

Frequently Asked Questions

Who must comply with ITAR?
Any US person or entity that manufactures, exports, imports, or brokers defense articles, defense services, or related technical data listed on the USML must register with DDTC and comply with ITAR. This extends to subcontractors and suppliers in the defense supply chain—including companies that never export but manufacture USML-controlled items domestically.

What are the penalties for ITAR violations?
Civil penalties reach $1,271,078 per violation (2025, inflation-adjusted) or twice the transaction value. Criminal penalties include up to $1 million in fines and 20 years imprisonment per willful violation.

How does the September 2025 USML revision affect existing classifications?
The September 2025 final rule amended 15 of 21 USML categories, adding newer technologies while removing outdated entries. Items removed from the USML transition to EAR jurisdiction under the Commerce Department.

How does Certivo manage ITAR flow-down compliance across the supply chain?
Certivo collects DDTC registration status, USML classification data, and export control certifications from every supplier in your chain.

How does ITAR relate to EAR and other export control frameworks?
ITAR controls defense articles on the USML; EAR controls dual-use and commercial items on the Commerce Control List. Jurisdiction determination—deciding whether an item falls under ITAR or EAR—is a critical first step.