A frequently asked compliance question among government contracts firms is whether they are required to register under the International Traffic In Arms Regulations (“ITAR”).
ITAR are the State Department controls that regulate defense products, technical data and services. Under ITAR 22 CFR §122.1, parties that manufacture, export or temporarily import “defense articles” or furnish “defense services” are required to register with the Directorate of Defense Trade Controls (“DDTC”) within the State Department. It is important to note that even parties that engage solely in domestic manufacturing of defense articles that do not engage in any exporting or importing are required to register. Under §122.1, engaging in such activity “requires only one occasion of manufacturing or exporting, or temporarily importing, a defense article or furnishing a defense service” to trigger this registration requirement. In addition, parties that engage in defense “brokering” (see below) and freight forwarders that perform services under the Foreign Military Sales program are also required to register under ITAR.
Defense Articles. “Defense articles” are any items that are listed on the U.S. Munitions List.[1] The USML is a list of twenty-one categories of items covering a wide array of products, parts, components, technical data, software and services that are useful in defense applications. These include products in the aerospace, maritime, communications, IT/computer/software, electronics, optical, toxicological/biological and other industries. To assess if a company is required to register, it must start by reviewing the USML to determine if products or services with which it is involved are listed.
Companies that frequently are required to register under ITAR include:
- Federal contractors involved in defense, intelligence, security, homeland security and energy contracts;
- Subcontractors and second/third tier suppliers of parts, components, subsystems, accessories and attachments used in such contracts;
- IT, computer, software, data security and similar firms involved in defense applications;
- Companies engaged in projects involving classified information (USML Category XVII is “Classified Articles, Technical Data, and Defense Services”);
- Companies engaged in the repair, refurbishment and maintenance of defense products and systems, and logistics activities related to such items;
- Companies that perform military training or provide military advice; and
- Companies that receive research grants and contracts from the DOD including under SBIR and similar programs;
- Manufacturers of firearms, ordinance and related equipment, gunsmiths;[2]
- Universities (especially those that receive research grants and contracts from defense agencies); and
- Firms involved in engineering and technical services related to defense projects.
Since the USML covers not just end items but also certain subsystems, parts and components, many second and third tier suppliers that do not consider themselves to be in the defense industry are nonetheless required to register. In addition, firms that merely perform services and do not supply any products may be required to register in certain circumstances.
DFARS §225.79 and 252.225-7048. It has become common for federal prime contractors involved in defense projects to require their subcontractors to register under ITAR, and this has created significant confusion among subcontractors and suppliers. This requirement is due in part to DFARS §225.79 and 252.225-7048[3] which apply to many federal defense contracts.[4] Based on these requirements, prime contractors are increasingly concerned that if their subcontractors commit ITAR violations (such as failing to register), the prime contractors could also have liability. Consequently, prime contractors are frequently requiring that their subcontractors register under ITAR and adopt ITAR compliance programs. If a prime contractor is registered, this does not relieve the subcontractor of the responsibility to register separately – each firm must conduct its own assessment and register individually if required. Subcontractors that are registered and have ITAR compliance programs in place often create less compliance risk for prime contractors and thus are frequently more desirable candidates for subcontract awards.
ITAR registration is a mechanism for the U.S. Government to track firms involved in the U.S. defense industry. In addition, registration is a prerequisite for a company to apply to DDTC for licenses, Technical Assistance Agreements (“TAA’s”) and other authorizations. Since it takes up to 60 days for a registration to become effective, failure to register can result in significant delays in obtaining licenses, TAA’s and authorizations. DDTC also advises that registration is required for a company to rely on ITAR exemptions.
Registration Procedure. As part of the registration process, the registrant is required to submit documentation that demonstrates that it is incorporated or otherwise authorized to do business in the U.S. The registration documents must include a certification by an authorized senior officer stating if the registrant, its affiliates and officers, directors and principals (i) have ever been indicted, charged or convicted of violating certain criminal laws; or (ii) are ineligible to contract with or receive export/import licenses from the U.S. Government. In addition, the registrant must identify if it is owned or controlled by a foreign party, and if so provide an explanation of such ownership or control, including the identities of the foreign person or persons who ultimately own or control the registrant.
Penalties. Penalties for ITAR violations include civil and criminal fines of up to $1,000,000 per violation and 20 years imprisonment, including personal liability for the company’s officers, directors and employees. Failure to register is listed as an ITAR violation in 22 CFR §127.1(b)(2) and (b)(3).[5]
Exemptions and Broader ITAR Requirements. There are certain exemptions from the registration requirement.[6] However it is important to note that even if a company is exempt from the ITAR registration requirement, it may still be subject to other requirements under ITAR and this exemption does not relieve it of the responsibility for complying with these other requirements. Such requirements include: the requirement to obtain export and temporary import licenses for the export/import of defense articles, the requirement to obtain authorizations for the transfer/disclosure of ITAR-controlled technical data and software to foreign nationals in the U.S. (including foreign national employees of the U.S. contractor), the requirement to enter TAA’s authorized by DDTC for the performance of defense services, restrictions on reexports and retransfers and reporting and recordkeeping requirements. A more detailed list of requirements under ITAR are set forth in ITAR For Government Contractors.
Brokers and FMS Freight Forwarders. Registration is also required for ITAR “brokers” under ITAR §129.3. Brokers are parties that facilitate the sale or transfer of ITAR-controlled products, services and technical data by others, even if they are not direct principals in the transaction.[7] Brokers are also subject to other requirement under ITAR including the requirement to obtain advance authorization from DDTC for certain transactions, reporting requirements, recordkeeping requirements and restrictions on engaging in transactions involving countries identified in 22 CFR §126.1. In addition, as referenced above, pursuant to ITAR §126.6(c)(6)(i), U.S. freight forwarders performing services under the Foreign Military Sales (FMS) program are required to register with DDTC.
Empowered Official. As part of the registration process registrants are required to appoint an “empowered official.” This is a U.S. person directly employed by the registrant that has a position of authority for policy and management within the company and is: (i) legally empowered by the registrant to sign license applications; (ii) understands the requirements of the export laws and penalties for violating them; and (iii) has the independent authority to inquire into any aspect of a proposed transaction, verify the legality of the transaction and refuse to sign any license applications without adverse recourse from the company.
Other Requirements. Other obligations under the ITAR registration requirement that frequently apply to government contractors include:
- Amendments. If there are changes in the key information submitted in the registration statement, the registrant is required to notify DDTC of such changes in writing within five days of the event.
- Annual Renewal. The registration must be renewed annually, provided that the company continues to engage in activities that trigger the registration obligation.
- ITAR Recordkeeping Requirements. Registrants are required to maintain records of their ITAR activities for a five-year period (and longer in certain instances) pursuant to 22 CFR §122.5.
Registration is only part of the broader obligations that may apply to government contractors under ITAR. Contractors should understand the specific requirements that may arise in their particular activities and use care to comply with these in their business operations. For a more detailed discussion of these requirements see ITAR For Government Contractors.
