DDTC registration under the ITAR: a guide for small manufacturers
Published 2026-10-23, 13 min read
1occasion
One job on a defense article is enough to be in the business.
22 CFR 122.1(a)
$3,000a year
The Tier 1 fee every new registrant pays.
22 CFR 122.3(a)(1)
5days
To tell DDTC about a new name, address, owner or senior officer.
22 CFR 122.4(a)
30–60days
Before expiry: the window in which a renewal is filed.
22 CFR 122.2(e)
Anyone in the US who manufactures or exports defense articles or furnishes defense services must register with DDTC; a manufacturer who does not export must nevertheless register.
Registration is filed on form DS-2032, signed by a U.S.-person senior officer; it confers no export rights and is generally a precondition to a license. The rest of this guide is the detail: who counts, who is exempt, how the filing goes, what it costs and what it does not do.
Who must register under 22 CFR 122.1
The rule is short, and its two key sentences are the ones shops skip: one occasion is enough, and not exporting is no excuse.
“Defense article” is anything on the U.S. Munitions List, plus the technical data that describes it. For a machine shop the line that matters is in 22 CFR 120.31(a)(2): forgings, castings, extrusions and machined bodies count once they are “clearly identifiable by mechanical properties, material composition, geometry, or function as defense articles.” Half-finished work can already be one. So can the drawing it came from: technical data includes “blueprints, drawings, photographs, plans, instructions, or documentation” (120.33(a)(1)). Received under a DoD contract, that drawing can also be CUI: the CUI Registry's Export Control category includes items identified in the ITAR, and FCI vs CUI shows where the line falls. Brokers register too, under part 129; this guide stays with manufacturers.
DDTC's own registration page says the same thing in plain words: manufacturers who do not engage in exporting are still required to register. The shop that builds to a prime's print and ships across town is the case the sentence was written for.
| The shop | Part 122 | Why |
|---|---|---|
| A prime's purchase order and drawing say the bracket is ITAR-controlled. You machine it and ship it to the prime, two states away. | Register | Manufacturing a defense article. Shipping inside the US changes nothing: a manufacturer who does not export must nevertheless register. |
| You cast or forge a blank that is clearly identifiable, by its geometry, as a USML part, and someone else finishes it. | Register | Forgings, castings and machined bodies count as defense articles once they reach that stage (120.31(a)(2)). |
| Your engineers only produce unclassified drawings for a defense program; you build nothing. | Exempt, with a catch | 122.1(b)(2) covers that alone. You still need a licence to export the data, and you cannot get one unless registered. |
| You help a foreign customer repair a USML part, or send its drawing to a foreign supplier. | Register, then approval | Assisting foreign persons with defense articles, or furnishing them technical data, is a defense service (120.32(a)); each needs DDTC approval. |
| Every job is commercial. Nothing you make or hold is on the USML. | Not reached | 122.1(a) is about defense articles and services. Check again when a new customer or drawing arrives. |
| You cannot tell whether a part is on the USML. | Settle jurisdiction first | File a commodity jurisdiction request (DS-4076): DDTC gives a preliminary response within 10 working days of a complete request. |
Does 22 CFR 122.1 require us to register?
Four questions. Nothing is saved or sent.
What Part 122 says on these answers
Answer the first three
The result names the paragraph of Part 122 your answers lead to.
A reading aid, not a legal determination. DDTC decides jurisdiction; your counsel advises.
The four exemptions, and why most shops have none
Paragraph (b) lists four groups the registration duty does not reach. Read the words “confined”, “all” and “solely” carefully: each exemption covers a whole line of business, not one job.
| Paragraph | Rule text | For a small shop |
|---|---|---|
| 122.1(b)(1) | Officers and employees of the U.S. Government acting in an official capacity. | Never a contractor. A government engineer on your floor is covered; your company is not. |
| 122.1(b)(2) | Persons whose pertinent business activity is confined to the production of unclassified technical data only. | A design or drafting firm that builds nothing. The moment it makes a part, the exemption is gone. |
| 122.1(b)(3) | Persons all of whose manufacturing and export activities are licensed under the Atomic Energy Act of 1954, as amended. | All of them. A shop with one non-AEA defense job is back under 122.1(a). |
| 122.1(b)(4) | Persons who engage in the fabrication of articles solely for experimental or scientific purposes, including research and development. | A lab prototype. A production run, or a prototype a customer will field, is not 'solely' experimental. |
Two of the four come with a string attached, and the rule says so in a note that sits under the list:
So the drafting firm that sends a drawing to a foreign customer still needs a licence, and to get one it must register first. The same order applies to the ITAR's own licence exemptions: under 22 CFR 120.15(a), anyone otherwise required to register must do so before using an exemption.
Filing the DS-2032 through DECCS
The Statement of Registration is Department of State form DS-2032, filed electronically in DDTC's Defense Export Control and Compliance System (DECCS). The rule sets what the statement must contain (22 CFR 122.2); DDTC's portal pages set the clicks. Here is the sequence as DDTC describes it, with the paragraph behind each step.
Enrol in DECCSDDTC
Check first that the company has no registration code already. Each user sets up multi-factor authentication.
Name the CA and the AppSODDTC
At least one corporate administrator (manages users) and one applicant senior officer (signs). Both enrol with the email on the application.
Fill Blocks 1–11122.2(a)
The DS-2032 statement, with the proof that you may do business in the US and an org chart if you list a parent, subsidiaries or affiliates.
AppSO signs and submits122.2(a)(1), (b)
A U.S.-person senior officer empowered to sign, who also makes the eligibility and foreign-ownership certification.
DDTC reviews122.2(c)
Up to 30 days, says DDTC. An incomplete statement comes back with what is missing, or as the whole package.
Pay in DECCSDDTC
A Make Payment button appears on the registration dashboard. Electronic payment only; unpaid after 21 calendar days, the registration is returned without action.
Keep the letterDDTC
The registration acknowledgement letter appears in the Details tab after payment.
The certification in 122.2(b) is where a small company should slow down. The senior officer certifies whether the company, its listed parent, subsidiaries or affiliates, or any senior officer or director of them, has ever been indicted, charged or convicted under the U.S. criminal statutes listed in 22 CFR 120.6, or is ineligible to contract with, or receive an export or import licence from, any U.S. agency. The officer also certifies whether the company is foreign owned or foreign controlled, and if so, explains who ultimately owns or controls it.
Those two words have numbers behind them in 22 CFR 120.65. Foreign ownership means more than 50 percent of the voting securities are held by foreign persons. Foreign control is presumed where foreign persons own 25 percent or more, unless one U.S. person controls an equal or larger share. A shop with a foreign investor at 30 percent and three U.S. founders splitting the other 70 is presumed foreign controlled, because no single founder holds 30 percent. If one founder held 51, the presumption would not arise.
Keep the acknowledgement letter where you can find it. Microsoft says validation for its government cloud may require proof of registration with the U.S. Department of State for ITAR data, so a shop applying for GCC High may be asked for it.
DDTC registration: what to have before you open DECCS, cuideck.com
People
- Applicant senior officer (AppSO): a U.S.-person senior officer the company has empowered to sign 122.2(a)(1)
- Corporate administrator (CA): whoever will manage the company's DECCS users DDTC
- Both enrolled in DECCS with MFA, using the email on the application DDTC
Papers
- Proof you may do business in the US: articles of incorporation or organization, or a partnership agreement 122.2(a)(2)
- Org chart through the ultimate parent, if you list a parent, subsidiaries or affiliates DDTC
- Every subsidiary and affiliate you control, on this one statement 122.2(a)
Answers the officer certifies
- Any indictment, charge or conviction under the statutes in 120.6, for the company, its affiliates, officers or directors 122.2(b)(1)(i)
- Any ineligibility to contract with a U.S. agency, or to receive an export or import licence 122.2(b)(1)(ii)
- Foreign ownership (over 50%) or control (25% or more, presumed), and who ultimately owns or controls 122.2(b)(2); 120.65
After you submit
- Watch the DECCS dashboard and email: pay within 21 calendar days of the Make Payment button DDTC
- File the acknowledgement letter; put the expiry date and the 60/30-day renewal window in the calendar 122.2(e)
Stuck on a field? DDTC's Response Team answers process questions at 202-663-1282.
What it costs: the three fee tiers in 122.3
The fee is set by how many licences and other approvals DDTC granted you, not by your headcount or sales. New registrants pay the Tier 1 fee of $3,000 per year. After that, the tier is read from a 12-month window that ends 90 days before your registration expires. The tiers, word for word:
For the shop that builds to print, never exports and asks DDTC for no other authorization, that settles it: no applications means no favorable determinations, so every renewal stays at Tier 1. The tiers start to matter once you export.
DDTC registration fee calculator, 22 CFR 122.3
Pick your case and enter the count.
Example only- Tier 3, per year
- $7,300
- How it is worked out
- $4,000 + $1,100 × 3 determinations over five.
- DDTC may lower a Tier 3 fee to 3 percent of the value of your approvals (never under $4,000). Its figure in DECCS is the one you pay.
Renewal every year, and what a lapse costs
Registration runs for a year. Under 122.2(d) anyone who must register and pay renews and pays every year after the first. Renewal is filed at least 30 days but no earlier than 60 days before expiration, and DDTC says a renewal needs the same documentation as a new registration. Count back from the expiry date on your acknowledgement letter:
Day −90
DECCS shows your renewal fee. The fee window behind it closed today.
DDTC; 122.3(a)
Day −60
DDTC's fee notice has gone out by now. The earliest day to file.
122.2(e)
Day −30
The last day to file. DDTC takes about 30 days on average to decide.
122.2(e); DDTC
Day 0
Expiry. After it, no exports or temporary imports until DDTC reinstates you.
DDTC
Read together: file on day −60 and an average 30-day review still lands before expiry. File on day −30 and it may not.
Miss it and the registration lapses. DDTC is blunt about what follows: the registrant alone must make sure no exports or temporary imports happen until DDTC reinstates the registration, and DDTC does not retroactively cover expired periods. To register again, the DS-2032 asks you to pick one of two statements: the registration lapsed and you were not in the business during the gap, or it lapsed and you were.
Notice of changes: the five-day rule in 122.4
Registration is not filed and forgotten. A registrant must, within five days of the event, send DDTC a written notice signed by a senior officer when certain things change. Five days is not long, and the events are ordinary ones for a small company: a move, a new partner, a retirement.
| What happens | Notice due | Paragraph |
|---|---|---|
| The company changes its name | 5 days | 122.4(a)(2)(i) |
| The shop moves, or the registered address changes | 5 days | 122.4(a)(2)(ii) |
| You convert from a partnership to an LLC, or similar | 5 days | 122.4(a)(2)(iii) |
| Ownership or control changes | 5 days | 122.4(a)(2)(iv) |
| You set up, buy or sell a subsidiary or affiliate in defense manufacturing or export | 5 days | 122.4(a)(2)(v) |
| A new director, senior officer, partner or owner | 5 days | 122.4(a)(2)(vi) |
| Anyone named in the certification is charged, convicted, or made ineligible | 5 days | 122.4(a)(1) |
| A planned sale or transfer of ownership or control to a foreign person | 60 days before, registered mail | 122.4(b) |
| Any other change to the statement | At renewal | 122.4(a), Note 1 |
The foreign-sale row is different in kind. Under 122.4(b) DDTC must be told by registered mail at least 60 days in advance of any intended sale or transfer to a foreign person of ownership or control, and the notice does not replace any approval the deal itself needs, including before technical data is disclosed. A merger or acquisition also has its own list in 122.4(c): the new firm name, which registration number survives, the licences whose unshipped balances move to it, and amended agreements within 60 days.
DDTC sorts changes into three amendment types: a material change, a mergers, acquisitions and divestitures (MAD) change, and an administrative change. Material and MAD changes follow 122.4(a); administrative changes wait for the annual renewal. DDTC prefers all of them filed as amendments in DECCS.
What registration does not do
Exports still need DDTC approval first, on Form DSP-5 for an unclassified permanent export. Registration is what lets you apply.
The acknowledgement letter records that DDTC accepted your statement and fee. It says nothing about how you control drawings or parts.
It says nothing about where drawings may be stored, who may open them or how they are sent. Other rules do.
A registered shop that shows a USML drawing to a foreign national has still made an export.
It is not a licence. Under 22 CFR 123.1(a) the applicant must be registered with DDTC prior to submitting an application, and the export waits for the approval. A registered shop that ships a part to a customer abroad without one, or without an exemption that fits, has a registration and a violation.
It is not a certification. No product is ITAR certified, and Part 122 has no certification step for a shop either. Microsoft's own ITAR compliance page puts it plainly: “While there's no compliance certification for the ITAR, …” Registered is a fact about paperwork; compliant is a fact about what you do every day. Our guide to what ITAR compliance means covers the difference.
It is not a security standard. Where technical data may sit is a different rule. Sending, taking or storing technical data is not an export if it is unclassified, secured with end-to-end encryption, protected by FIPS 140-2 (or successor) cryptographic modules or by other means at least as strong as AES-128, not intentionally sent to a person in or stored in a country proscribed in 22 CFR 126.1, and not sent from such a country. Choosing a system that meets that is a separate job: see ITAR-compliant file sharing, ITAR-compliant file transfer and ITAR compliance software. The same drawings are usually CUI as well: the CUI Registry's Export Control category (marking EXPT) includes items identified in the International Traffic in Arms Regulations (ITAR) and the munitions list. Our CUI guide picks up from there; where the export-control marking goes on a drawing is in CUI marking requirements, and the Is it CUI? tool sorts one document at a time.
It is not permission for foreign staff. Releasing technical data to a foreign person in the United States is a deemed export (to every country of that person's citizenship or permanent residency); using access information to let a foreign person see unencrypted technical data is a release. Registration changes none of that.
What it does start is a records duty. A registrant keeps records of manufacture, acquisition and disposition of defense articles, technical data and defense services for five years from the expiration of the license or other approval, or from the date of the transaction; electronic records must be reproducible on paper, and no entry may change without recording what changed, who changed it and when (22 CFR 122.5(a)). DDTC, U.S. Immigration and Customs Enforcement and U.S. Customs and Border Protection may inspect and copy them at any time (122.5(b)).
When to call DDTC, and when to call an attorney
Most registrations are clerical: the right people, the right papers, the fee and the calendar. A few questions are not, and this page cannot answer them for your shop. This is how to tell which is which.
- How DECCS works: enrolment, the CA and AppSO roles, a block on the DS-2032, payment
- Where your registration stands in review
202-663-1282, from DDTC's DS-2032 page.
- Whether a part or its data is on the USML at all: a commodity jurisdiction request, DS-4076
- The preliminary response comes within 10 working days of a complete request (120.12(d))
Filed electronically; you do not need to be registered to file one.
- Any yes in the 122.2(b) certification, or a foreign owner near the 120.65 lines
- A lapse you worked through (122.2(f)), a merger, or a sale to a foreign buyer (122.4(b), (c))
- A possible violation: a voluntary disclosure has its own clock, with a full disclosure within 60 calendar days of the initial notification (127.12)
- Whether an exemption really covers your whole business
Before you file or answer, not after.
The reason to pay for advice on those is the penalty scale. Each violation of the Arms Export Control Act (22 U.S.C. 2778) can draw a civil penalty of up to $1,271,078 or twice the value of the transaction, whichever is greater. Registration questions are cheap to ask before the filing and expensive after it.
Once you are registered, the everyday duties are the ones in our ITAR compliance checklist: records, screening, who sees technical data, and where it is stored.
Questions shops ask about DDTC registration
Do we need to register with DDTC if we never export?
Yes, if you manufacture defense articles. Anyone in the US who manufactures or exports defense articles or furnishes defense services must register with DDTC; a manufacturer who does not export must nevertheless register. One occasion of manufacturing is enough (22 CFR 122.1(a)).
How much does DDTC registration cost?
New registrants pay the Tier 1 fee of $3,000 per year. At renewal the fee depends on how many favorable determinations DDTC gave you in the 12 months ending 90 days before expiry: none, $3,000; five or fewer, $4,000; more than five, $4,000 plus $1,100 for each one over five (22 CFR 122.3). DDTC lists discounts on its payment page.
How long does registration take?
DDTC says its review can take up to 30 days after the senior officer submits. Then a Make Payment button appears in DECCS, and the fee must be paid within 21 calendar days or the registration is returned without action and you start again. Pay the day the button appears.
What is the difference between the DS-2032 and DECCS?
The DS-2032 is the Statement of Registration, the form the rule names in 122.2(a). DECCS is DDTC's online system where you fill it in, sign it, pay and later renew and amend it. Registration fees are paid only electronically, through DECCS.
Is a registered company ITAR compliant?
No. Registration is filed on form DS-2032, signed by a U.S.-person senior officer; it confers no export rights and is generally a precondition to a license. Compliance is the licences, records, access control and screening that follow. See what ITAR compliance means.
Can our subsidiary register on its own?
DDTC says entities you own or otherwise control, such as subsidiaries and affiliates, may not register separately: they are listed on the parent's Statement of Registration (122.2(a)). New entities may not be set up to lower the fee.
Do we have to register before asking DDTC whether a part is on the USML?
No. Registration is not required before you submit a commodity jurisdiction request on Form DS-4076 (22 CFR 120.12(f)).
When do we renew?
Every year. Renewal is filed at least 30 days but no earlier than 60 days before expiration (22 CFR 122.2(e)), and DDTC says a renewal needs the same documentation as a new registration.