DDTC Registration Explained

Fortunately, figuring out whether registration applies is reasonably manageable once you understand the rules. We'll cover who needs to register, how the process works, what it costs, and what responsibilities come with maintaining your registration.

The Directorate of Defense Trade Controls (DDTC) is the office within the U.S. Department of State that administers the International Traffic in Arms Regulations (ITAR). Among other things, ITAR regulates defense articles on the U.S. Munitions List (USML), related technical data, and defense services.

You've probably heard a company described as "ITAR registered," or seen the term on a supplier qualification form. That means the company is registered with DDTC under ITAR. "ITAR registered" is the common industry shorthand, while DDTC registration is the more precise term.

DDTC registration tells the State Department which businesses carry out certain defense-related activities. If your company manufactures USML defense articles, exports or temporarily imports them, or furnishes defense services, the registration rules in ITAR Part 122 may apply. Companies involved in brokering have a separate set of rules under Part 129.

DDTC registration is just that, a registration in a database. It doesn't establish that a company has all the compliance procedures it needs. Those requirements are completely separate, and depend on the work being performed and the controlled information involved.

Start by understanding two terms ITAR uses, then look at the activities your business performs and whether an exemption applies.

1. What Are Defense Articles and Defense Services?

If your company manufactures or purchases something listed on the U.S. Munitions List (USML), or works with ITAR-controlled technical data related to those items, you're dealing with products or information subject to ITAR.

ITAR uses the term defense articles for items and technical data designated on the USML. These can include complete systems, specially designed components, certain unfinished items, and controlled technical data such as manufacturing drawings and specifications. Under ITAR, qualifying technical data is itself a defense article, even when it's stored as an electronic file.

Defense services generally involve providing technical assistance or training to foreign persons concerning defense articles, or furnishing them with ITAR-controlled technical data. These activities can take place in the United States or abroad.

You may also receive drawings, specifications, or other documents from a customer that are stamped or marked "ITAR controlled." Treat those documents as controlled technical data and restrict access and sharing accordingly. If you believe a document has been marked incorrectly, clarify its classification with the sender before handling it differently. The marking itself doesn't determine the legal classification, but you shouldn't disregard it without a proper review.

Read More: ITAR vs. EAR: What's the Difference?

2. What Activities Does Your Business Perform?

Once you understand what constitutes a defense article or defense service, the next question is what your company does.

DDTC registration is generally required if your company engages in any of the following activities:

• Manufacturing: Making defense articles, even if you never export them.
• Exporting: Sending defense articles abroad or making controlled technical data available to foreign persons in circumstances covered by ITAR.
• Temporarily importing: Bringing defense articles into the United States on a temporary basis.
• Providing defense services: Furnishing covered assistance, training, or technical data to foreign persons.
• Brokering: Arranging or facilitating covered transactions involving defense articles or defense services. Separate registration rules apply under ITAR Part 129.

A single covered activity can be enough to require registration, subject to the exemptions discussed below. Simply purchasing a controlled item or receiving technical data doesn't automatically trigger registration, although other ITAR requirements may still apply.

Consider an OEM that outsources production of an ITAR-controlled PCB assembly to a U.S. contract manufacturer. The contract manufacturer is performing covered manufacturing and generally needs to register, even when the finished boards stay in the United States. The OEM's own registration requirement depends on the activities it performs. Meanwhile, a distributor selling standard commercial capacitors for that assembly generally wouldn't need to register based on those sales alone.

Read More: ITAR Compliance for OEMs With Outsourced Electronics Supply Chains

3. Does an Exemption Apply?

ITAR Part 122 has a short list of registration exemptions. One covers fabrication of articles solely for experimental or scientific purposes, including research and development. That provision deserves a look if your startup is still building experimental hardware.

Suppose the engineering team is making test units to evaluate a new design. The R&D exemption may apply if the actual work meets its conditions. Once you move into manufacturing outside that scope, you'll need to reassess registration before the build proceeds. A prototype label on the traveler won't settle the question.

Other exemptions cover certain U.S. Government personnel, businesses whose pertinent activity is limited to producing unclassified technical data, and specified Atomic Energy Act activities. There is no general exemption for startups, small companies, or subcontractors.

Keep in mind that a registration exemption can coexist with export-control obligations. The regulations also require certain exempt persons to register before they can receive a DDTC export license or approval. And a defense customer may impose registration as a contract condition even when your own activities don't independently trigger Part 122.

Here's a quick comparison of situations you're likely to encounter:

If the classification or scope of work remains uncertain, get a documented review from someone qualified in export controls. That's a much better place to spend time than untangling a registration problem after you've placed the production order.

Once you've established that registration is required, you'll apply through the Defense Export Control and Compliance System (DECCS). The process is online, although you'll still need the usual corporate paperwork and someone senior enough to sign on behalf of the company.

Step 1: Create an Account in DECCS

Check whether your organization already has a DDTC registration code before starting a new application. Then set up the appropriate DECCS accounts and designate a Corporate Administrator (CA) and an Applicant Senior Officer (AppSO).

The Corporate Administrator manages DECCS user accounts and permissions. The Applicant Senior Officer is the person authorized to review, sign, and submit the company's registration application. Both need activated DECCS accounts.

The AppSO must be a senior company executive who qualifies as a U.S. person and has been empowered by the company to sign registration documents. In a startup, that's often the founder/CEO or president. At a larger company, the role might be filled by the corporate secretary, treasurer, or general counsel. A partner or LLC member can also qualify if they meet the requirements.

Your compliance or procurement team can help assemble the application, but an eligible AppSO must review and sign it. It's worth identifying that person early so the application doesn't get held up waiting for someone with the proper authority.

Step 2: Complete the DS-2032 Registration Form

The electronic DS-2032 Statement of Registration asks for your company's legal identity, addresses, regulated activities, corporate relationships, ownership and control, and information about senior officers and other principals. It also includes certifications about specified criminal and export-related matters.

Get the ownership information settled before filing. Startups with investors, parent companies, or multiple legal entities may need more time to assemble an accurate picture than they expect.

Step 3: Submit Supporting Documents

Depending on the business, supporting documents may include articles of incorporation or organization and a chart showing parent companies, subsidiaries, or controlled affiliates. The Applicant Senior Officer reviews, signs, and submits the application. Part 122 requires an empowered U.S.-person senior officer for that certification.

Outside counsel can help prepare the filing, but the person signing still needs to know what they're certifying.

Step 4: Complete DDTC Review and Payment

DDTC may return the application for corrections or request additional information. Watch the registration dashboard in DECCS. After DDTC completes its review, you'll see the payment option; once payment is processed, the acknowledgment letter becomes available in the portal.

Save that letter somewhere the person qualifying suppliers and the person managing compliance can both find it. Your registration expiration date belongs on the company calendar too.

Under the fee schedule effective January 9, 2025, a first-time DDTC registration costs $3,000 at the standard Tier 1 rate. Registration is an annual expense, and renewal fees depend in part on the number of favorable DDTC authorization determinations during the relevant period.

The calculation uses a 12-month lookback ending 90 days before the current registration expires. Favorable determinations concern DDTC licenses and other authorization requests. Your customer's purchase orders don't count.

Budget $3,000 for a first registration at the standard rate. Eligible Tier 1 registrants may qualify for a $500 discount under DDTC's published pilot, and some other registrants may qualify for fee adjustments. Check the current criteria before counting on a reduction.

DDTC says it can take up to 30 days to review and analyze a new registration. That's guidance for planning, so leave room for corrections, supporting documents, or a signature that hasn't made it through the internal approval process yet.

Once your registration is ready for payment, you have 21 calendar days to pay through DECCS. If you miss that deadline, DDTC can Return Without Action the application, leaving you to resume and resubmit it.

Manufacturing schedules have enough surprises already. If covered production is on the NPI calendar, work backward from the proposed start date and allow time for registration. Any export license the program needs has its own approval process.

Registration lasts 12 months. The renewal application must reach DDTC no earlier than 60 days and at least 30 days before expiration; DECCS generally lets you start preparing about 90 days beforehand.

Renewal isn't the only date to watch. Certain changes to the registered company's name, address, legal structure, ownership, covered affiliates, or senior personnel require notice to DDTC within five days. Planned transfers of ownership or control to a foreign person generally require at least 60 days' advance notice.

That five-day clock can become a headache during fundraising or a reorganization, when everyone is focused on the transaction documents. Make sure whoever handles export compliance hears about corporate changes early enough to act.

If registration lapses while your company continues covered activities, you may face a violation and owe fees for the period of continued work.

No, DDTC registration does not mean your company is ITAR compliant. It means your company has registered with the State Department, and DDTC has acknowledged that registration. DDTC does not certify your compliance procedures, audit your handling of controlled information, or approve your business practices through the registration process. Registration also grants no export rights or privileges.

Suppliers frequently advertise that they're "ITAR registered" on their websites, capability statements, and qualification forms. Even when that claim is accurate, it establishes only that they've completed the DDTC registration requirement. It provides no assurance that the supplier's actual business practices comply with ITAR. A company can be legitimately ITAR registered and still violate the regulations.

This matters when you're qualifying an electronics manufacturer. Suppose a supplier proudly advertises that it's ITAR registered and offers to quote your PCB assembly. You'll need to share fabrication files, assembly drawings, and test instructions, some of which contain ITAR-controlled technical data. The supplier's registration tells you nothing about who can access those files, whether they use overseas CAM engineers or subcontractors, or what procedures they follow to prevent unauthorized disclosure.

Before sharing controlled information, you need to understand how the supplier protects it, manages access by foreign persons, maintains records, and obtains any required authorizations. A registration number on a capability statement doesn't answer those questions.

Registration is itself a legal obligation for companies whose activities require it. Meeting that obligation, however, provides no assurance that the company complies with the rest of ITAR. Treat claims of being "ITAR registered" as a starting point for supplier qualification, and evaluate the supplier's actual compliance practices before entrusting it with controlled work.

Read More: A Practical Guide to ITAR Compliance for Manufacturers and Engineers

DDTC registration becomes much easier to understand once you know which defense articles and defense services your business is involved with and what activities it performs. From there, you can determine whether registration is required, check for any applicable exemptions, and account for the filing and annual renewals before manufacturing gets underway.

You'll want to apply that same care when qualifying suppliers. A vendor that advertises itself as "ITAR registered" may have satisfied its DDTC registration obligation, but that claim tells you nothing about how it protects controlled drawings, manages access to technical data, or handles work involving overseas personnel and subcontractors. You'll need to ask those questions and evaluate the answers before sharing controlled information.

Getting these details sorted out during supplier qualification and production planning is considerably easier than discovering a problem after your build package has made the rounds.

Ready to let Cofactr handle sourcing, negotiations, storage, kitting, and delivery while your team focuses on building products? It’s free to get started with Cofactr today.

What is DDTC registration?

DDTC registration is a requirement under the International Traffic in Arms Regulations (ITAR) for certain businesses involved in manufacturing, exporting, temporarily importing, or providing services related to defense articles.

Who is required to register with DDTC?

Companies manufacturing, exporting, or temporarily importing USML defense articles generally must register with DDTC. Businesses providing defense services may also require registration, subject to applicable exemptions.

How do I register with DDTC?

Create an account in the Defense Export Control and Compliance System (DECCS), complete Form DS-2032, submit supporting corporate documents, obtain senior officer certification, and pay the registration fee.

How much does DDTC registration cost?

First-time DDTC registration costs $3,000 at the standard Tier 1 rate. Annual renewal fees range from $3,000 to $4,000 or more, depending on favorable authorization determinations.

How long does DDTC registration take?

DDTC advises allowing up to 30 days for initial registration review. Applications requiring corrections or additional documentation may take longer, so companies should apply before beginning covered activities.

When does DDTC registration need to be renewed?

DDTC registration remains valid for 12 months. Companies must submit renewal applications between 60 and 30 days before expiration to maintain registration for covered defense-related activities.

Can I manufacture ITAR-controlled products without DDTC registration?

Manufacturing USML defense articles generally requires DDTC registration, even without exports. Limited exemptions exist for qualifying experimental research, certain government activities, and other specifically defined circumstances.

Is DDTC registration the same as ITAR compliance?

No. DDTC registration establishes that a company has registered with the State Department. ITAR compliance requires appropriate technical data protections, access controls, recordkeeping, and applicable export authorizations.

Do subcontractors and suppliers need DDTC registration?

Subcontractors manufacturing USML defense articles generally require registration unless exempt. Suppliers selling standard commercial components typically do not need registration solely because their products support defense programs.

What happens if DDTC registration expires?

Companies continuing covered defense activities after registration expires may face ITAR violations and additional registration fees. Timely renewal helps prevent interruptions to manufacturing and export-related operations.