Export controls within the United States are responsive to national security imperatives and foreign policy objectives. They are mainly controlled by the Department of State’s Directorate of Defense Trade Controls (DDTC) and the Department of Commerce’s Bureau of Industry and Security (BIS). The DDTC administers the International Traffic in Arms Regulations (ITAR), which controls defense services and articles on the United States Munitions List (USML).[1] The BIS administers items considered to be “dual use,” both military and commercial applications, under the Export Administration Regulations (EAR), which are detailed in the Commerce Control List (CCL).[2] While the bifurcation of jurisdiction can confuse contractors, businesses, and individuals looking to export certain technologies, specifications, or hardware for the first time, the legal obligation is ultimately the same. These entities must seek and receive authorization from the U.S. government before exporting anything controlled by the USML or CCL.[3]

Determining the applicability of export control compliance to a particular business model depends on the business's desire to export its products and how the United States Government defines the term “export.” Even companies manufacturing defense items without plans to export their items abroad must still register with DDTC[4]. They must also have a robust export control compliance program in place to prevent the accidental export of any of its hardware, software, specifications, or technologies via email, non-secure cloud environments, overseas information technology consultants, or a multitude of other potential vulnerabilities.

Section 120.50 of ITAR defines “export” as:
(1) An actual shipment or transmission out of the U.S.
(2) Releasing or otherwise transferring technical data to a foreign person in the U.S. (a deemed export)
(3) Transferring control of an item by a U.S. person to a foreign person
(4) Releasing or transferring an item to an embassy within the U.S.
(5) Performing a defense service on behalf of a foreign person, whether in the U.S. or abroad, or
(6) Releasing previously encrypted technical data[5]

As you can see, the term export is broadly defined in the statutory language yet still does not encompass other regulated activities like reexports, retransfers, brokering, or temporary imports of defense articles and services. So how do businesses comply with U.S. export controls and not risk the steep civil and criminal penalties imposed by the federal government for violations?

WHAT ARE THE STEPS TO REGULATORY COMPLIANCE UNDER ITAR?

The first step in any export compliance program is determining whether your product is on the USML and thus subject to ITAR or is located on the CCL and, therefore, subject to the EAR. Prime contractors or suppliers may refer to this as the “export jurisdiction” or the “export classification” of your product. You should first see if your item is on the USML, as it is the highest level of control and subject to the most restrictions and penalties for violations. If your product is not on the USML, you will look to the CCL to determine classification. This process must be followed iteratively to avoid misclassification. Sometimes, however, the specifications subjective to a product are not inherently obvious and cannot be easily confined within the USML or CCL. How should you proceed in this case?

Luckily, the State Department’s DDTC has a procedure known as a Commodity Jurisdiction Request that tells you whether your item is on the USML. These requests must be carefully worded, contain legal standards applicable to the product, and describe the product in enough detail to determine classification. The resulting Commodity Jurisdiction Determination you receive is a legally binding document you can show to governmental regulators, prime contractors, and suppliers that definitively determines the level of control applicable to your product.

The second step in an export compliance program is the application process. This step focuses on licensing exporters to engage in business with foreign persons when they are subject to ITAR restrictions. As mentioned above, entities dealing in items contained on the USML must first register with DDTC, regardless of their intentions to export. However, if they plan on exporting their product, the entity in question would need appropriate licensure from DDTC before any export. Export authorization comes in many forms, typically a license permitting the export, reexport, retransfer, temporary import, or brokering of a specific defense article or service. Exemptions, manufacturing licensing agreements, technical assistance agreements, and distribution agreements are other means of authorization. Importantly, and often overlooked by applicants during this step of the process, is the ability of DDTC to issue advisory opinions as to “whether [DDTC] would likely grant a license or other approval for a particular defense article or defense service to a particular country.”[6] A request for an advisory opinion must be made in writing and contain as much factual information as possible. Unfortunately, these advisory opinions do not constitute an authorization to export nor bind DDTC to grant or deny any future application for licensure concerning the same or similar products. However, they can provide exporters with valuable insight into whether DDTC would approve a specific shipment before that entity submits a full application for authorization.

The third step is the establishment of a compliance program. Implementing a compliance program ensures that your company constantly abides by the many strictures imposed on exporters. Additionally, it shows the Government that such a program exists if a violation were ever to occur. In the case of a violation, the State and Commerce Departments frequently reduce penalties if a functioning compliance program is in place. The sophistication of a given compliance program is fact and circumstance dependent. Usually, it includes written documentation outlining compliance procedures, systems in place to verify the citizenship of employees and visitors, robust data and cyber security environments to protect and encrypt technical data, and regular audits to ensure continued compliance. Recordkeeping is also essential for businesses engaged in this space

CONCLUSION

Given the immensity of compliance obligations and the stiff penalties[7] for violations of the export control laws, many people wonder if exporting products and services is even worth it to small or medium-sized businesses. The answer is yes. Most items exported from the U.S. do not require an export license.[8] According to the U.S. Chamber of Commerce, small and medium-sized enterprises accounted for $460 billion of known export value in 2019.[9] Companies that do require a license can often obtain one as long as they are not selling products to a sanctioned country or foreign government such as the Syrian Arab Republic, the Democratic People’s Republic of North Korea, the Russian Federation, or (depending on the article or service being exported) the People’s Republic of China.[10] The key to success in the export realm is careful compliance, specifically by adhering to a dedicated compliance program and ensuring that all regulations and limitations mentioned in the license are followed. Engaging with an attorney who is up to speed with the latest developments in the export control arena can be very helpful in ensuring that a business meets its compliance needs.

FOOTNOTES
[1]https://www.pmddtc.state.gov/ddtc_public?id=ddtc_kb_article_page&sys_id=24d528fddbfc930044f9ff621f961987
[2] https://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear
[3] Certain exceptions to license requirements can apply, particularly with regard to EAR99 items on the CCL, which consist of low-technology consumer goods and generally do not require a license. However, if the end-user of the exported goods is located in an embargoed country, is on the Office of Foreign Assets Control (“OFAC”) sanctions list, or will utilize the goods in a prohibited manner, a license is required prior to any export.
[4] Section 120.13 (ITAR) – “Any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, is required to register with the Directorate of Defense Trade Controls”. “[E]ngaging in such a business requires only one occasion of manufacturing or exporting or temporarily importing a defense article or furnishing a defense service. A manufacturer who does not engage in exporting must nevertheless register”. https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-B/section-120.13
[5] See https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120
[6] 22 C.F.R. § 120.22.
[7] 22 C.F.R. § 127 – Debarment, hefty civil penalties, press releases, and imprisonment, among other remedies available at law.
[8] See https://www.trade.gov/us-export-licenses-navigating-issues-and-resources (about 95% of all exports from the U.S. do not require an export license).
[9] https://www.uschamber.com/co/start/strategy/small-business-exporting-guide
[10] There are many other restricted destinations, end users, and end uses that are beyond the scope of this blog. It is recommended that companies consult with counsel prior to export.