ITAR Changes and Updates Are Coming- Are you Ready?

They say that change is inevitable and that the only thing constant is change. Most of us do not like change. We like our world to be the way that we are used to and comfortable in, but change is inevitable. The better you are prepared for change, the easier it is to accept and succeed.

Recent and Future Changes To The ITAR Submission Process

The policies and processes dictated by the State Department’s Directorate of Defense Trade Controls (“DDTC”) as they relate to the administration of the International Traffic in Arms Regulations (ITAR) have begun to change.

The changes that have occurred and are about to occur relating to the process in which Registrations, License Applications, Advisory Opinions, Commodity Jurisdictions and Voluntary Disclosures are submitted to DDTC.

All submissions will use a new system, Defense Export Control & Compliance System (DECCS), which will become the central online platform for conducting business with DDTC. DECCS will replace the current D-Trade, the Electronic Filing System (EFS), MARY and ELLIE systems. Commodity Jurisdiction forms and Advisory Opinions have already been activated in DECCS with new electronic forms and requirements.

New Information Required For ITAR Registration

The next change scheduled to occur relates to the submission of ITAR Registrations (PART 122—REGISTRATION OF MANUFACTURERS AND EXPORTERS).

There is quite a bit of new information required (because the new DS2032 V5.2 will be used for new Registrations, Renewal of Registrations, and Amendments to current Registrations, Cancellation of Registrations and Lapsed Registrations). Currently, the DS2032 is five (5) pages long. The new DS2032 V5.2 will be nine (9) pages long.

The single most significant change, in my opinion, is the new question that must be answered on the DS2032:

10. ITAR Written Policies

Does the applicant have written policies and procedures for compliance with the ITAR (including but not limited to 22 CFR 122.5)?

Yes ____      No_____

I initially addressed the addition of this question to the new DS2032 V5.2 in a blog (“Could it Be Time for a Compliance Manual Make-Over?”) I wrote in September.

At that time, I pointed out that DDTC had advised that the reason for this question was so the answer could be used in the review and DDTC could take “appropriate action” on Registration submittals to ensure compliance with defense trade laws and regulations. DDTC has also indicated that new Registration Form, including the answer to Question 10, “…may be shared with other U.S. Government entities.”

Preparing For ITAR Changes To Come

DDTC, like other Regulatory Agencies (BIS, OFAC, FBI & SEC (for FCPA), “recommends” or strongly “suggests” that companies have a compliance plan with written policies and procedures. DDTC “strongly advises parties engaged in defense trade to establish and maintain an ITAR/export compliance program” that is:

• Clearly documented in writing
• Tailored to the business
• Regularly reviewed/updated
• Fully supported by management

Make Sure Your Company Is Compliant

DDTC even provides Compliance Program Guidelines on its web page; however, other than in situations of a Voluntary Disclosure or a Directed Disclosure, I do not remember when DDTC has ever asked a company about the existence of “ITAR Written Policies,” although they have always suggested it.

There was a time years ago that DDTC required that a list of Empowered Official(s) be submitted with Registrations and Renewals. If it was not included with the submission, DDTC would issue the Registration, but give the registrant a specified period of time to provide one.

Will the same thing happen if a new or existing Registrant (renewal) answers “No” to “Written ITAR Policies?” Possibly. The other possibility is that if the new or existing Registrant (renewal) answers “Yes”, DDTC could ask for a copy of the “Written ITAR Policies” to be provided within a specified period of time.

The third possibility is that DDTC could provide your response to other agencies (ICE, FBI, HIS, DHS, CBP, etc.) which could lead them to schedule a “company visit” (“Hi, I am from the Government and I am here to help you”) to the Registrant’s company.

Lastly, DDTC could file the information that the company has no “Written ITAR Policies” away until that day that the company has to file a Voluntary Disclosure, in which the immediate conclusion by DDTC will be that the violation very possibly never would have occurred if the company had “Written ITAR Policies”.

Think about it, if you were reviewing a Voluntary Disclosure, where would you first look? If it were me, I would check how the company answered the question about “Written ITAR Policies” and if the answer was “No,” I’d read that Voluntary Disclosure very closely.

Preparing For The Upcoming ITAR Changes

The changes are coming, so how should you prepare? Whether your company is new to ITAR transactions requiring Registration, or has been registered for years, make sure you have “Written ITAR Policies” in place before you register, renew, or amend your Registration. You want to be able to answer the question on “Written ITAR Policies” with a big “YES”.

Feeling pretty good? Not yet! Check your “Written ITAR Policies”. Do your policies still:

• Define EXPORT as: “Sending or taking a defense article out of the United States in any manner, except by mere travel outside of the United States by a person whose personal knowledge includes technical data; or Disclosing (including oral or visual disclosure) or transferring in the United States any defense article to an embassy, any agency or subdivision of a foreign government (e.g., diplomatic missions); or Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad; or Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad?” That definition was changed in 2016.
• Do your policies have an ITAR definition for “RELEASE?” That definition was added in 2016.
• Do your policies still say “specifically designed, modified or configured” for military use? That language has been replaced by “specially designed” which is now defined in the ITAR.

If your answers to any of the above are “yes”, congratulations you do have “Written ITAR Policies,” but they are outdated and need updating. Do you really want DDTC or another agency to ask for a copy of the “Written ITAR Policies” and evaluate your compliance program based on an out-of-date set of policies and procedures?

Now is the time to develop “Written ITAR Policies” if you are about to register, renew or update what you currently have. Do not get caught unprepared when the new DS2032 V5.2 is rolled out (most likely before the end of this year) and the requirements are upon you.

If you need assistance creating or updating your written ITAR Policies, please contact us for a free consultation.