ITAR Compliance: What it Requires, and How to Verify it
Ask a defense supplier for its ITAR certificate, and a well-run one will tell you there is no such thing.
Compliance with the International Traffic in Arms Regulations (ITAR) is not a status anyone awards.
It is a program a company runs: registering with the Directorate of Defense Trade Controls (DDTC), licensing its transfers, controlling who sees its technical data, and keeping the records to prove all of it.
What Being ITAR Compliant Actually Means?
Being ITAR compliant means meeting the continuing obligations that apply to anyone handling defense articles, defense services, or technical data described on the US Munitions List (USML). It covers registration, licensing, control over who can access the material, and records that evidence all three.
There is no ITAR certification. No body audits or certifies compliance, and no certificate exists to be issued. DDTC's own registration letters describe registration as a precondition for licensing, not an approval in itself. A supplier calling itself "ITAR certified" is using a phrase with no defined meaning. The checkable facts are its registration and the controls it actually runs.
The obligations reach:
manufacturers of defense articles, whether or not they export
exporters, temporary importers and brokers of defense articles
providers of defense services
suppliers and subcontractors that make defense articles or receive controlled technical data
companies storing or sharing that data in the cloud, unless it is encrypted end to end to the standard the regulation sets
Whether an item is ITAR-controlled at all is a separate question, settled before any of this applies.
The Four Things Compliance Requires
Three obligations sit at the center. A fourth exists to prove the other three were met.
Requirement | What it means | The point most guides miss |
|---|---|---|
| Manufacturers, exporters, and brokers of defense articles or defense services must register before applying for a license or using an exemption. | Registration is required whether or not anything has been exported. It is a prerequisite for licensing, not a consequence of it. |
| Transfers of USML items, technical data, and defense services need a license unless a specific exemption applies. | The application names the foreign consignee and the foreign end user, so both must be identified before it is filed. |
| Access to controlled technical data is restricted to US persons unless an authorization is in place. | This covers physical access, system access and conversation. Releasing technical data to a foreign person is itself an export. |
| Registration details, licenses, classifications, screening results and training must be kept, generally for five years, and produced on request. | A step that cannot be evidenced is very hard to defend. |
Registered is Not the Same as Compliant
Registration is filed through the Defense Export Control and Compliance System (DECCS), DDTC's online platform, on a Statement of Registration (Form DS-2032) with supporting documents and a fee.
An authorized senior officer certifies the filing. It must be renewed every year, with renewal submitted 30 to 60 days before expiry. Registration confirms that a company is on DDTC's register. It does not confirm that classification, licensing, access control, or records are in order, and a registered company can still be non-compliant.
ITAR Requirements for Employees: The US Person Rule
ITAR is not restricted to US citizens. It restricts the release of controlled technical data to foreign persons. The protected category is US persons, a term the regulation defines and which is broader than citizenship.
Releasing controlled data to anyone outside that category requires a license or other authorization, even when the person works in a US office.
Category | Status under ITAR | What it means in practice |
|---|---|---|
US citizens | US person | No authorization needed for access on the basis of status. |
Lawful permanent residents | US person | Green card holders are US persons under ITAR. Treating them as foreign persons is a common and incorrect practice. |
Protected individuals, including people granted asylum or refugee status | US person | Defined by reference to US immigration law. Confirm status against the regulation rather than assuming. |
Everyone else | Foreign person | Release of controlled technical data requires a license or an applicable exemption, wherever the person is located. |
How to Check Whether a Company is ITAR Registered?
There is no public list of ITAR companies.
DDTC does not publish a searchable directory of registrants, and no certification database exists, so a supplier's registration cannot be confirmed by looking it up. The check has to come from the supplier.
What to ask for:
The DDTC registration code and a copy of the current registration letter, which shows the expiry date. Codes begin with M for manufacturers and exporters and K for brokers.
The name of the company's empowered official, the person authorized to sign license applications.
Evidence of controls rather than assurances. That means classification records, license references for the relevant transfers, the access arrangement covering the technical data, and records of screening the parties to a transfer.
For a licensed transfer, confirmation that the parties in your transaction are the parties named on the license. A license naming different consignees does not cover yours.
Where Compliance Programs Fail?
Most failures happen inside companies that believe they are compliant:
Technical data moving through ordinary tools.
Drawings go out by personal email, specifications sit in consumer file storage, and design discussions happen in standard messaging apps.
Access that was never reviewed.
Permissions are granted for a project and left in place, or shared folders go unaudited.
Nationality handled as a hiring question rather than an access question.
Status is recorded at onboarding and never revisited.
Registration allowed to lapse.
A lapse removes the basis for licensing and for any exemption being relied on.
Activity that happened but cannot be shown.
Screening was done without a record, classification without a written basis, training without an attendance log.
Willful violations are criminal matters. When regulators set the civil and criminal exposure under each regime, whether a working compliance program existed is one of the factors they weigh.
Where the Shipment Sits?
An ITAR compliance program is internal. The shipment is not, and the line between the two decides who does what.
Inside the program: the company's job
DDTC registration and renewal
Jurisdiction and classification
Access control and training
Records that evidence all of it
Outside the program: the shipment
Moving the goods across borders
Clearing them at destination
The foreign consignee and a license name
600-series items licensed under the EAR
What the Shipment Needs Before It Moves
Every ITAR license names a foreign consignee and a foreign end user, and both must be in place before the application is filed. A large share of defense-sector hardware is not ITAR-controlled at all; it sits in 600-series entries under EAR licensing, which shapes how defense-sector shipments in practice are planned.
We hold importer of record registration across 170+ countries and act as Exporter of Record for EAR-controlled shipments, including 600-series items. Where a license names a foreign consignee in the destination market, we can fill that role as Importer of Record in the destination market, within the terms of the authorization. We do not run compliance programs. We move the goods after a program has cleared.
Final Thoughts
ITAR compliance is a program a company runs and evidences, not a status it holds. Registration can be checked with a code and a letter. Access is set by the US person definition, not by a passport. Everything else has to be shown on paper. For a buyer or partner, the right question is never "are you ITAR certified?" It is "show me what you register, license, and control.
The Program is Yours. The Movement is Ours.
Once your program has cleared the transfer, the shipment still needs registered parties at both ends. We classify against the right list, screen every party, file under our registration, and stand as the named consignee where a license requires one, so the goods move on the terms your authorization sets.
Direct Line
Available on request
Shared after initial assessment.BACKED BY GCE LOGISTICS
25+ Years of International Trade & Compliance Leadership
Backed by decades of experience in global trade, IOR Service delivers the compliance frameworks, regulatory oversight, and market-entry expertise required for successful international operations. From highly regulated industries to complex cross-border projects, we help organizations move forward with certainty.Frequently Asked Questions
No. The regulation protects access by US persons, a category broader than citizenship that includes lawful permanent residents and protected individuals. A citizens-only policy justified by ITAR goes further than the regulation requires. US immigration law also prohibits citizenship-status discrimination unless a law, regulation, or government contract requires it. Aligning policy with the regulatory definition is the compliance position.
No. DDTC does not publish a public directory of registrants, and no certification database exists. A company's registration cannot be verified by looking it up. The practical check is to ask for the DDTC registration code and a copy of the current registration letter showing its expiry date, since registration must be renewed every year.
Register with DDTC, license the transfer, and control who can access the controlled material. Registration comes first and is a prerequisite for licensing. Licensing covers physical shipments, technical data, and defense services. Access control restricts release to US persons unless authorized. Recordkeeping underpins all three, because a step that cannot be evidenced is very hard to defend.
No. There is no ITAR certification, and nobody issues one. What exists is registration with DDTC, which is a filing, and compliance, which is a continuing state a company maintains and must be able to evidence. A supplier describing itself as ITAR certified is using a term with no defined meaning, so ask what is registered and what controls are in place.
Latest Blogs
What is an ESMA certificate? UAE product certification explained
Many businesses preparing to sell in the UAE are told they need “ESMA approval”. They then go looking for an authority that no longer runs the scheme. The Emirates Authority for Standardization and Metrology (ESMA) was merged into the Ministry of Industry and Advanced Technology (MoIAT) in 2020. The certification it was known for still exists, and the market still calls it by the old name. Knowing where it sits now saves weeks of applying to the wrong place. An ESMA certificate, as the market calls it, is UAE product conformity approval. It shows that a regulated product meets the applicable UAE, GCC, or international standards before it is sold. Today, it is issued under two MoIAT schemes: the Emirates Conformity Assessment Scheme (ECAS) and the Emirates Quality Mark (EQM). The legal basis is Federal Law No. 28 of 2001. The schemes are federal, so the same rules apply in every emirate. Because approval comes before market entry, the scheme follows the same principle as pre-shipment conformity verification in other markets.
What is TDRA approval? UAE type approval for wireless and telecom devices
Your device may already carry CE marking, have passed its RED tests, and be sold across Europe, and still be stopped at a UAE port. Almost every device sold today has a wireless function. In the UAE, that function needs its own approval before the product can be imported, sold, or even switched on, and the application cannot start until a UAE-registered dealer is in place. TDRA approval, formally called type approval, is that authorization. It is issued by the Telecommunications and Digital Government Regulatory Authority (TDRA) and confirms that a device meets UAE technical standards and will not interfere with national networks. It applies to radio and telecommunications terminal equipment (RTTE), meaning any equipment that connects directly to a public telecommunications network or contains an intentional radio transmitter. TDRA was known as the Telecommunications Regulatory Authority (TRA) until it was renamed in 2021. It is a federal regulator, so one approval covers every emirate.
EAR99: What the Designation Means, and When it Still Needs a License
EAR99 tells you what an item is not. Under the US Export Administration Regulations (EAR), it marks goods that fall under the regulations but are not listed on the Commerce Control List (CCL). What it does not tell you is where the item may go, who may receive it, or what it may be used for. Most shipments clear all three without a license. Some do not.