DDTC’s clock is ticking and time is running out

The holidays are here, and many of us take this time of year to reflect on all that we have to be thankful for.  If your company is registered pursuant to §122.1 of the International Traffic in Arms Regulations (ITAR), you may well be thankful that the new DECCS Registration Form and Process haven’t been implemented yet.  (This is especially true if your organization doesn’t have written ITAR policies.)  However, all indications are that time is running out.

Export Solutions believes that the implementation of the new Registration Form and Process will occur by the end of this month, which does not leave companies much time to get prepared.  Remember, if your current registration is set to expire in 60 days, you cannot ask for a delay to give yourself time to prepare (or update) your written policies.  The time to act on this is now.

As detailed in my previous blogs — ITAR Changes and Updates Are Coming- Are you Ready? and Could it Be Time for a Compliance Manual Make-Over? – the new registration process will require companies to answer a “YES/NO” question to inform DDTC whether you have written policies for ITAR compliance.  Based on my years of experience, and having worked for years at DDTC, I can promise you that answering “NO” to this question will not simply make the matter go away.

DDTC strongly advises parties engaged in defense trade to establish and maintain an ITAR export compliance program.  Now, the stakes are higher.  They are going to ask if you actually have written policies, and if you do not, the next logical conclusion is that DDTC will want you to develop and implement written policies and procedures as an adjunct to your registration.

So, what does DDTC look for in an ITAR compliance program?  In general, they want to see a program that is:

• Clearly documented in writing
• Tailored to the business
• Regularly reviewed/updated
• Fully supported by management

Specifically, DDTC recommends that the compliance program have sections with processes to be followed to attain and maintain compliance. Those recommended sections are:

• Organization structure of individuals (including names, titles, and principal roles) with responsibilities for administering the compliance program and ensuring the company sustains compliance with the ITAR;
• A written statement by corporate senior management outlining the company’s commitment to compliance with the ITAR;
• A written methodology for the identification, receipt and tracking of ITAR controlled items (Defense Articles) and Technical Data by which the company identifies and accounts for ITAR controlled items/technical data which the company handles;
• Procedures utilized to obtain written State Department authorization prior to the retransfer or reexport to a party not approved on the original export authorization. Particular attention is to be given to the transfer of Defense Articles/Technical Data to Foreign Persons within the company, within the U.S. and outside the U.S.;
• Restricted/Prohibited Exports and Transfers – Procedures for screening customers, carriers, and countries;
• Recordkeeping procedures to meet the requirements of §122.5 and other sections of the ITAR;
• Policy and procedure for performing internal audits and assessments of your compliance program;
• A company policy for providing and maintaining records of ITAR compliance training provided to management and employees;
• Violations and Penalties – procedures for the identification, investigation, documenting, correcting and reporting ITAR violations.

Is there a difference between a general export compliance program and an ITAR compliance program?  While many of the principles and recommendations have similarities, when DDTC speaks of (and now requests confirmation of) written policies, it has to be speculated that they are looking for greater specificity where the ITAR is concerned.

Whether your company has been registered for years, or you just found out from a prime contractor that you need to be registered, the process of submitting (or renewing) your registration with DDTC is about to get more involved.  For example:  It’s likely that if you answer “NO” to the question, your company will be required to implement written policies and procedures.  On the other hand, if you answer “YES,” you may very well be required to provide DDTC with a copy of your policies and procedures for review.  And suppose those policies haven’t been updated for years?  Or (even worse) suppose they were simply “thrown together” to meet a requirement?  If you think about these potential scenarios, you can begin to see the problems involved.  The best solution is to take the time to develop thorough and accurate policies now.

How do you get ready for this?  If you have no written policies or procedures and you need to register (or renew), consider getting help.  Export Solutions has been preparing for months to best assist our current clients and new clients with this issue.  We have created an ITAR Compliance Policy, which (once tailored to fit your business) can be implemented in a relatively short amount of time.  This is a good starting point to the development of a full export compliance program and contains all the DDTC recommendations and more.  We are also continually reviewing and updating Export Management and Compliance Programs that either we developed with our clients years ago or were developed by another party.  The review/update is to ensure that the programs are current and accurately reflect the many changes that Export Control Reform has brought with it and the policies of the regulatory agencies that have changed.

In Charles Dicken’s classic story, A Christmas Carol, Scrooge goes to sleep on Christmas Eve and is famously visited by three ghosts.  Don’t wait until the “Ghost of DDTC Future” visits your company with an uncomfortable and problematic question about your ITAR compliance program.  Take action now, so you can rest easy this holiday season.

Need help?  We are experts.  Schedule a No-Charge Consultation today.