ITAR Certified, What Does It Mean?
Posted in 2016, very relevant today and worth a second read!
Updated by Jenny Hahn, President
Today many prime defense contractors and others involved in the manufacture and sale of defense articles regulated by the ITAR require evidence that companies in their supply chain are registered with the Department of State, Directorate of Defense Trade Controls (DDTC), or, my personal favorite, be “ITAR Certified.” “ITAR Certified” is not defined within the regulations, thus creating more confusion among the small and medium size companies as they try to understand how to become “Certified”.
A company cannot become “ITAR Certified”, although its trade compliance employees can take courses in which they can receive titles like CUESCO, which means they individually are a "certified" export compliance officer. The better question is how did “certification” become an expectation imposed on supply chain?
ITAR Certification is a misnomer; you cannot gain an ITAR Certification like you can an ISO Certification or a CMMI rating. There isn’t a specific standard or set of criteria to be rated against to achieve “ITAR Certification.” Of course, you can include your ITAR Compliance program in the ISO Certification and auditing process but that’s not going to prove you are following the ITAR regulations; it will only demonstrate that your Company is following the Company’s policy, procedures and work instructions consistently.
Some companies have believed that being registered with DDTC is all that is required to allow them to complete the prime contractor questionnaire that will demonstrate they are “ITAR Certified”.
The reality is much more than a simple registration with DDTC. The ITAR imposes a requirement for companies to register, if they meet one of three conditions, manufacture defense articles, export defense articles or furnish defense services, or broker defense articles.
In our experience, many companies do not have a clear understanding of what they are signing up for when registering with DDTC. Just Google “ITAR Certified” and click on Images; you will find many companies have posted their DDTC registration letters with their registration codes. This doesn't make them "ITAR Certified". In fact, a seasoned trade compliance professional will wonder what the company doesn't know by this bold statement.
When a company registers with DDTC, its certifying that a corporate officer or board member of the company understands the obligations of the ITAR, and has established an export compliance program, which includes designation of an ITAR Empowered Official and a trade compliance program. Each year with a company registers or renews its registration with DDTC, DDTC will provide the company with the letter acknowledging their registration and a 4 page compliance program guideline.
What the prime contractors are really concerned with beyond the registration of your company with DDTC, is does my supplier understand that the ITAR imposes licensing obligations if they have a foreign person working at their facility that have access to and release of my technical data? Does my supplier understand if they send my technical data offshore to fulfill the purchase order or contract obligation that an ITAR export license is going to be required? Is my supplier in any way ineligible to participate in an ITAR export transaction because they have become ineligible under the ITAR?
In addition to the prime contractor concerns triggering the "ITAR Certified" form, once a company registers with DDTC, DDTC expects that the Company will stand up a Trade Compliance Program that is clearly documented in writing, tailored to the business, regularly reviewed/updated and fully supported by management. Your program should address these basic elements:
Determine export jurisdiction of your products, data and services;
Know the end user and end use of defense articles and services (not limited to international transactions);
Know the intermediate parties to a transaction, including supply and title chain
Know what countries are prohibited destinations
Conduct denied party screening of all parties to the transaction, this includes banks, freight forwarders, supply chain (U.S) and all foreign parties;
Ensure party names and address are accurate;
Licensing of items when/if being exported or use an exemption if its applicable to the transaction and conditions imposed in the ITAR;
Ensuring reporting requirements related to the payment of fees and commissions associated with the export transaction are researched and made as part of licensing filing;
International travel by employees
Foreign Visitors to the company facilities
Marking of export controlled materials internally and externally for domestic use and for exports;
Maintaining records of the manufacture and disposition of defense articles. Having a policy that addresses which records need to be maintained, who is responsible and where they are to be maintained;
Ensuring administrative reporting requirements of the ITAR are met, such as the reporting of the initial export of technical data or the performance of defense services against an ITAR license, submitting executed Technical Assistance Agreements, providing annual sales reports for Warehousing Distribution Agreements or Manufacturing License Agreements or making semi annual reports related to exports authorized by the ITAR 126.5 Canadian Exemption;
Training employees on the basic elements of the regulations and how to comply. Irregardless of the size of you company, if your employees don’t understand the many ways an export can take place how are they going to know what to watch out for?
Auditing of Company compliance program, exports and any USG authorizations in place;
Last but not least, having a specific policy regarding what the Company will do when a potential issue of non-compliance is raised. Who will conduct the investigations, provide the reports to management and prepare the voluntary disclosure to the DDTC?
If you have a compliance program that addresses these elements and have appointed trade compliance responsibilities within your company and on your organization chart, when asked to complete the forms for “ITAR Certification” you can do so with more confidence.
In the end, let’s call “ITAR Certification” by its real name, a Trade Compliance Program, and no matter your company size it really boils down to risk adversity. While the regulations don’t specifically state you must have a documented program in place but with the DOJ taking a position regarding the individual responsibility of Corporate employees [see (Yates, 2015) Memo] and DDTC and BIS both detailing their expectations for compliance programs on their websites, how can you not?
Contact FD Associates at 703-847-5801 or Tell Us Your Needs, for support in enhancing your compliance program so you can be more confident when requested to complete the “ITAR Certified” forms for your customers.
To Register or Not, That Is The Question …
By Jenny Hahn, President
Do I need to register or maintain registration with the Department of State (“DOS”)? Companies may find themselves asking this question, as a result of Export Control Reform. There are several factors to consider before deciding that your company should or should not register or maintain its registration with the Department of State.
- Are you a manufacturer of defense articles (items identified on the US Munitions List)? The USML can be found in the Part 121 of the International Traffic in Arms Regulations (“ITAR”). If yes, you have a regulatory obligation under the ITAR, Part 122, to be registered and maintain registration with the Department of State, as long as you continue to manufacture defense articles. Remember, a manufacturer of an article on the USML, needs to be registered whether it exports or not. Under the ITAR, even the manufacture of one defense article, requires registration.
- Have all of the articles you manufacture transferred to a 600 or 515 series ECCN (Export, Control Classification Number) on the Commerce Control List? If yes, you will no longer need to be registered with DOS but you will want to document your review. (Remember: not all categories have been revised and some of the old “catch‐all’ provisions remain). Additionally, you should ask yourself the question: do you provide defense services, e.g. assisting a foreign customer with integration of the non‐ITAR hardware into an end item/platform, which is described on the USML and therefore your actions are subject to ITAR controls. If yes, you should consider maintaining your registration for the purposes of obtaining licenses/agreements to perform these defense services.
- Are you an exporter of defense articles? Today that question is a little easier to answer, as the USML in most instances, clearly defines the articles that are subject to the ITAR. If yes, you should obtain or maintain your registration with DOS as an exporter, so that you may apply for or continue to apply for export licenses.
- And then there is the broker registration with DOS: Changes October 25, 2013 to ITAR Part 129 made more clear who is required to register with DOS as a broker. All persons located in the US (US and foreign), who are not the OEM, may be deemed to be conducting brokering activities, if they assist US or foreign manufacturers with marketing and selling their products. These companies/persons should register as brokers as required by ITAR Part 129.3. Foreign persons not located in the US and not owned or controlled by US persons assisting in the marketing or selling of US origin products do not need to register with DOS as a broker unless they actually conduct brokering activities in the US.
- If your company provides processing, inspection or testing services or other engineering and technical services as a support function to a US manufacturer of defense articles, you will also need to register if you were are exporting. How might you do that? Employ a foreign person and assign them to ITAR designated programs or send ITAR work offshore. These are just two examples of how an export may occur. Your company would need to be registered to be able to apply for an export license under these circumstances or any time it provides ITAR controlled technical data or defense services to a foreign person.
While Export Control Reform has made significant changes to the USML, these changes have not changed the requirements for US companies involved in defense work or persons engaged in brokering activities to obtain or maintain registration with DOS. On a brighter note, the number of licenses companies are required to seek from the Department of State has been reduced and thus the annual registration fee for companies may be less than past years.
Do you have questions about your obligation to register with DOS or any other export compliance matter? Contact the export experts at FD Associates to navigate your regulatory obligations.