ITAR registration is the process of registering with the Directorate of Defense Trade Controls (DDTC), the Department of State office that administers the International Traffic in Arms Regulations (ITAR). If your company is engaged in the business of manufacturing, exporting, temporarily importing, or brokering defense articles or defense services, the ITAR requires you to register with the DDTC, file a Statement of Registration (form DS-2032), and pay a yearly registration fee.
Two things surprise many defense companies. Registration applies to manufacturers who never export. And the fee schedule changed in 2025, so much of what’s published online is out of date. This guide covers who must register, the registration process, current fees, brokers, how to verify someone else’s registration, and what ITAR compliance requires afterward. It’s general information, not legal advice. Have export counsel confirm your obligations under the ITAR regulations.
Understanding ITAR Registration: What It Is and What It Isn’t
The ITAR implements the Arms Export Control Act. The purpose of ITAR is to protect national security and foreign policy by controlling defense-related items and keeping sensitive military technology out of the wrong hands, and registration is primarily how the government learns who is involved in manufacturing and exporting defense articles and services. Three clarifications save a lot of confusion.
Registration is not a license. Registration confers no export rights or privileges. It’s generally a precondition to the issuance of any license or other approval, so registration is essential before you apply for export licenses, but each controlled export still needs its own authorization.
Registration is not certification. The ITAR doesn’t certify companies. DDTC issues a registration, and there is no “ITAR certified” credential. We explain the difference in our guide to ITAR certification.
Registration is not compliance. Registration and compliance are separate. Being registered tells the government what you do. It doesn’t prove adherence to ITAR, which is the ongoing work of controlling technical data, access, and exports. We cover that below and in our guide to ITAR requirements.
Who Needs to Register With DDTC?
The ITAR requires registration from any person engaged in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services. Companies that need to be registered include manufacturers of defense articles, exporters, and others engaged in defense trade. A few points matter:
- Manufacturing alone triggers it. A company that doesn’t export must still register if it makes defense articles. DDTC’s regulations have long treated even one occasion of manufacturing or exporting as engaging in the business, so any company involved in defense work should check early.
- Defense articles are items on the United States Munitions List (USML). If a part you make is listed on the USML, you’re involved in the manufacture of a defense article. See our guide to the U.S. Munitions List and how the ITAR differs from the EAR in ITAR vs. EAR.
- Defense services count too. Furnishing defense services to a foreign person, such as training or technical assistance, can trigger registration.
- Narrow exemptions exist. One example is fabrication solely for experimental or scientific purposes, including research and development.
There’s one more wrinkle. DDTC has acknowledged that some companies require suppliers to register even when the ITAR doesn’t legally require it. If a prime or customer asks you to register, that may be a business requirement, and it’s worth asking whether the ITAR requires it for you too.
In one engagement, a company whose defense work was about a fifth of its revenue ran ITAR registration as its own workstream, separate from its CMMC program. The first questions were eligibility and fees, and the company named a primary and a backup owner for its ITAR responsibilities.
The DDTC Registration Process, Step by Step
The registration process runs through DDTC’s online Defense Export Control and Compliance System (DECCS).
Confirm you need to register. Check what you make against the USML and what activities you perform. If you’re unsure whether a product is subject to ITAR, DDTC can issue a commodity jurisdiction determination.
Name your officials. The Statement of Registration must be signed by a senior officer, such as a CEO, president, partner, or general counsel, who is a U.S. person and has been empowered to sign. License applicants must appoint an authorized employee as Empowered Official to review exports, understand penalties, and reject applications. A title isn’t enough. The authority has to be real.
Open your DECCS account. Registration and licensing are done through DECCS.
File the DS-2032. Gather proof that you’re incorporated or authorized to do business in the United States, the names of your senior officers and directors, and ownership details.
The form requires companies to disclose export-control convictions, federal contracting restrictions, and foreign ownership or control status whether the company is foreign owned or controlled.
Pay the registration fee. Fees are tiered, as covered below.
Renew every year. More on that next.
After approval, DDTC assigns a registration code, sometimes called the registration number. Allow time for the review, and don’t plan a contract start date that depends on a same-week approval.
DDTC Registration Fees and Annual Renewal
The fee schedule changed in a final rule published in December 2024, with the new fees taking effect in January 2025. Many online guides still show the old figures.
| Tier | Who pays it | Annual fee |
| Tier 1 | New registrants, plus renewing registrants with no favorable license determinations in the review period | $3,000 |
| Tier 2 | Renewing registrants with five or fewer favorable determinations | $4,000 |
| Tier 3 | Renewing registrants with more than five favorable determinations | $4,000 plus $1,100 for each determination over five |
A registrant that doesn’t export falls in Tier 1. The agency said it would offer Tier 1 registrants whose fee is 1% or more of total revenue a petition for a $500 discount, as a one-year initiative, so check its website for whether that’s still available. It also plans to analyze fees every two years, so confirm the current amount before you budget.
Renewal is annual. A registration is valid for one year. A registrant must request annual registration renewal at least 30 days, but no earlier than 60 days, before the expiration date, and the agency sends notice of the fee at least 60 days before expiration. About 14,500 registrants paid fees in fiscal year 2023. If you let a registration lapse and later re-register, you owe fees for any part of the gap during which you were in the business.
Report changes. Registrants must notify the agency of certain changes, generally within five days, and give 60 days’ notice before a sale or transfer to a foreign person. Check 22 CFR 122.4 for the exact list.
Common mistakes. Assuming no exports means no registration. Naming an Empowered Official who can’t actually refuse a shipment. Missing the renewal window. Forgetting to report a change.
ITAR Brokers: Do You Need Broker Registration?
Brokering is a separate activity under the ITAR, and many companies never think about it. It generally means acting for others to negotiate or arrange contracts, purchases, sales, or transfers of defense articles or services, often for a fee or commission, even without handling the product. A company that only sells its own parts isn’t brokering. One that connects a foreign buyer with another manufacturer might be.
Part 129 requires anyone engaged in brokering activities to register, and many such activities also need DDTC approval in advance. It’s separate from manufacturer registration, though DDTC’s rules allow the two to be combined, and renewals pay the Tier 1 fee. If you’re not sure whether an activity counts, DDTC offers advisory opinions on brokering questions.
How to Verify ITAR Registration
A question we hear from manufacturers is how to know whether a supplier or customer is ITAR registered. There is no public directory of registrants. Instead:
- Ask for the registration code and its current expiration date, in writing.
- Document it. One manufacturer added ITAR registration verification and citizenship-based access checks to vendor surveys before sharing controlled files.
Verification matters because of what comes next. Controlled technical data should only go to the people and companies you’ve confirmed are eligible to receive it.
ITAR Requirements After You Register: How to Ensure ITAR Compliance and Avoid Penalties
Registration is the first step in ITAR compliance, not the finish. To comply with ITAR regulations, you need to get three things right:
- Know what’s controlled. Classify your products and technical data against the USML.
- Control who can access it. Limit controlled technical data to authorized people, and write down how you do it. That’s what a technology control plan is for, and why releasing data to a foreign national can be a deemed export.
- Get authorization before you export, and keep records. Controlled exports need an export license or other approval, and registrants must maintain records under 22 CFR 122.5.
Most registrants implement an ITAR compliance program: written policies, named roles, ongoing training, and recordkeeping. Compliance with ITAR is easier to sustain when it’s written down. For a small shop the program can be modest, but it should name who is responsible, with a backup, and tie into your export compliance procedures.
On a client call earlier this year, we put the difference plainly: ITAR is mostly policy and procedure, while CMMC is the more IT-intensive framework. The IT side of ITAR is narrower, but it’s real: who can reach controlled data, how it’s stored and shared, and whether you can prove it. And the penalty for getting this wrong is serious. Under the Arms Export Control Act, a willful ITAR violation is punishable by up to $1,000,000 per violation and up to 20 years in prison, and we walk through the statute in our technology control plan guide.
If you’re not sure whether your company has to register, who your Empowered Official should be, or whether your systems keep controlled data away from the wrong people, that’s the place to start. Our team works with manufacturers in the DoD supply chain on exactly this kind of practical access control.
Schedule a free consultation with our team to talk through your ITAR registration and the IT controls behind it.
FAQs
Who is eligible to register with DDTC?
A company in the United States engaged in the covered activities, signed by a senior officer who is a U.S. person. The Statement of Registration must disclose any indictments or convictions for certain export-control crimes, any ineligibility to contract with the federal government, and any foreign ownership or control.
How do I know if a product is subject to ITAR?
Check whether it’s listed on the USML. If you can’t tell, DDTC offers a commodity jurisdiction determination. Our guide to ITAR vs. EAR explains how the two regimes divide.
Does ITAR registration expire?
Yes. It’s valid for one year. Request renewal at least 30 days, but no earlier than 60 days, before it expires, and expect DDTC’s fee notice at least 60 days beforehand.
Do I still need an export license if I’m registered?
Yes. Registration doesn’t authorize any export. You still need a license or other approval for each controlled export, and registration is generally a precondition to getting one
