People search for "ITAR citizenship requirements" expecting a rule that says who may or may not work on controlled projects. The ITAR does not actually contain one. It never says "only U.S. citizens may be employed." What it does is define two categories of person, a U.S. person and a foreign person, and then attach licensing consequences to what happens when controlled items or technical data reach someone in the second category. Everything in this guide follows from those two definitions, so it is worth reading them slowly.
I am Jared Clark, and the mistake I see most often is a company treating "citizenship" and "U.S. person" as the same thing. They overlap, but they are not identical, and the gap between them is where employee screening goes wrong.
What do 22 CFR 120.62 and 120.63 actually say?
Since the Department of State reorganized the ITAR definitions in 2022, the two definitions sit side by side in Part 120, Subpart C.
22 CFR 120.62 (U.S. person) covers two groups:
- A natural person who is a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20), or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3).
- Any corporation, business association, partnership, society, trust, or other entity, organization, or group that is incorporated to do business in the United States, plus any governmental entity (federal, state, or local).
The section also states that a U.S. person does not include any foreign person as defined in 120.63.
22 CFR 120.63 (foreign person) is the mirror image. It means any natural person who is not a lawful permanent resident or a protected individual, and any foreign corporation, business association, partnership, trust, society, or other entity or group that is not incorporated or organized to do business in the United States. It also covers international organizations, foreign governments, and any agency or subdivision of a foreign government, such as a diplomatic mission.
The ITAR defines a U.S. person by legal status, not by passport. A person can hold a foreign passport and still be a U.S. person under 120.62.
Who counts as a "protected individual"?
The phrase that trips up most readers is "protected individual," which the ITAR borrows from 8 U.S.C. 1324b(a)(3), the immigration statute that prohibits citizenship-status discrimination in hiring. Under that provision, a protected individual is someone who is:
- a citizen or national of the United States,
- an alien lawfully admitted for permanent residence,
- an alien admitted as a refugee under 8 U.S.C. 1157, or
- an alien granted asylum under 8 U.S.C. 1158.
Section 1324b(a)(3) also contains naturalization-window exclusions: a lawful permanent resident who does not apply for naturalization within six months of becoming eligible, or who applied but was not naturalized within two years (unless the government caused the delay), falls outside the statute's "protected individual" definition. Those exclusions matter for 1324b discrimination protection, not for ITAR status. Section 120.62 makes a lawful permanent resident under 8 U.S.C. 1101(a)(20) a U.S. person on its own, separately from the protected-individual test, so a green card holder stays a U.S. person whether or not they have naturalized or applied to.
The practical result is that citizens, green card holders, refugees, and asylees are all U.S. persons under the ITAR. Many company policies say "U.S. citizens only," which is stricter than the regulation requires and, as discussed below, can create its own legal problem.
Who is a foreign person in practice?
Here is how common workforce situations sort out under 120.62 and 120.63:
| Individual or entity | Status under ITAR | Basis |
|---|---|---|
| U.S. citizen, born or naturalized | U.S. person | 120.62; 8 U.S.C. 1324b(a)(3) |
| U.S. citizen living or working abroad | U.S. person | Status follows legal category, not location |
| Lawful permanent resident (green card) | U.S. person | 8 U.S.C. 1101(a)(20) |
| Refugee or asylee | U.S. person | 8 U.S.C. 1324b(a)(3) |
| H-1B, L-1, TN, or F-1 (OPT) visa holder | Foreign person | Not a permanent resident or protected individual |
| Dual national, U.S. citizen and another country | U.S. person | A U.S. citizen is a protected individual |
| Foreign national employee at a U.S. company's overseas subsidiary | Foreign person | Individual is a foreign person regardless of employer |
| Company incorporated in a U.S. state | U.S. person | 120.62 entity prong |
| Foreign-incorporated subsidiary of a U.S. parent | Foreign person | Not incorporated to do business in the U.S. |
| U.S. branch office of a foreign company | Depends on facts | Confirm how the entity is organized; do not assume |
| Foreign government or embassy | Foreign person | 120.63 |
| Federal, state, or local agency | U.S. person | 120.62 |
Two rows deserve emphasis. The first is dual nationals: a U.S. citizen who is also a citizen of another country is still a U.S. person, and a dual national is not treated as a foreign person just because of the second citizenship. The second is foreign subsidiaries. A subsidiary organized under foreign law is a foreign person even if a U.S. company owns all of it, so sending technical data to it is an export that needs authorization.
Why does the definition matter? Exports, releases, and deemed exports
The definitions only matter because of what the ITAR does with them. Under 22 CFR 120.50, an export includes sending or taking a defense article out of the United States, and it also includes releasing or transferring technical data to a foreign person in the United States. That second concept is the one most people call a deemed export. The regulation's text is blunt: a release of technical data in the United States to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency.
Compare that with the Export Administration Regulations, where the deemed export rule generally looks at the person's most recent citizenship or permanent residency. The ITAR looks at every country of citizenship or permanent residency the person has held, which means an engineer who was born in one country, naturalized in a second, and is now on a work visa in the United States brings all of those countries into the analysis. If one of them appears in 22 CFR 126.1, the licensing outlook changes dramatically. For more on the mechanics, see our overview of deemed exports under the ITAR.
"Release" has its own definition in 22 CFR 120.56. Technical data is released through visual or other inspection by a foreign person that reveals it, through oral or written exchange, or through the application of personal knowledge or technical experience acquired in the United States to situations abroad. Under 22 CFR 120.56, release turns on actual inspection or exchange that reveals the technical data, not on handing over a file alone. A foreign person who merely has technical ability to open a shared drive folder holding controlled drawings is not, by that fact alone, a release, but it is an access-control failure that should be fixed, and any actual opening of the files would be a release. Properly encrypted data can fall outside the export definition under the conditions in 22 CFR 120.54, so confirm those conditions before relying on encryption.
Is there an ITAR "citizenship requirement" for employees?
Not as such. The ITAR does not require a company to hire only U.S. persons, and it does not require a company to refuse to hire foreign persons. It requires authorization before a foreign person receives controlled technical data or defense services. A foreign person employee who never touches ITAR-controlled information needs no license. A foreign person employee who does need access can be covered by a license or agreement, most commonly a DSP-5 for the technical data release, or a technical assistance agreement where defense services are involved.
In practice, many companies choose to keep ITAR work within a U.S. person population because licensing takes time and uncertainty is expensive. That is a business decision, and a reasonable one. But it should be implemented as an access control, meaning restricting who can get into a project, a facility, or a data repository, rather than as a blanket rule in a job posting.
The reason is 8 U.S.C. 1324b. That statute makes it an unfair immigration-related employment practice to discriminate in hiring on the basis of citizenship status against protected individuals, with an exception where a law, regulation, or government contract requires the citizenship restriction. A job ad that says "U.S. citizens only" can therefore draw complaints from lawful permanent residents, refugees, and asylees who are fully eligible to work on ITAR programs. The safer wording tracks the regulation: "Must qualify as a U.S. person under 22 CFR 120.62." Your employment counsel should confirm wording for your situation, but the principle is that your screening language should match the legal definition rather than a narrower stand-in for it.
How do you screen employees for U.S. person status?
A screening process that holds up needs to be consistent and documented. This is the order I would run it in.
Step 1: Identify what needs protection
Start with the data and the items, not the people. Map which products appear on the U.S. Munitions List under 22 CFR 121.1 and which technical data relates to them. Without that map, you cannot tell which positions need screening. Our guide to the USML categories walks through the structure.
Step 2: Collect status information through a lawful, uniform process
Ask every new hire to confirm U.S. person status using the 120.62 language. Request supporting documents that establish status: a U.S. passport or birth certificate, a naturalization certificate, a permanent resident card, or documentation of refugee or asylee status. The Form I-9 documents you already hold for work authorization often establish this, but I-9 retention rules and ITAR needs are not the same thing, so confirm that you are keeping what your compliance file requires. Apply the same process to everyone. Selective questioning based on appearance, accent, or surname is both bad compliance and a legal risk.
Step 3: Record all citizenships and permanent residencies for foreign persons
If someone is a foreign person who will need access, you must know every country in which they hold or have held citizenship or permanent residency, not just the one on the visa. Under 120.50(b), that history drives the authorization request.
Step 4: Decide the access path
For each foreign person who needs access, choose one of three paths: exclude them from the data and facility, apply for a license or agreement, or confirm that an existing authorization already covers them. Document the choice in writing.
Step 5: Enforce it technically and physically
Policy is not control. Segregate repositories, use permission groups, badge access to ITAR areas, and restrict email distribution lists. A written plan tying these together is called a technology control plan, and our article on technology control plans covers how to structure one.
Step 6: Re-screen on status changes
Status is not permanent. A student on OPT may move to an H-1B, a green card applicant may become eligible to naturalize, and a green card applicant may become eligible to naturalize. A lawful permanent resident stays a U.S. person under 120.62 regardless of the 1324b naturalization windows, which affect discrimination protection only. Re-screening should catch changes that do affect ITAR status, such as a visa holder's status changing or a permanent resident card being lost or abandoned. Build re-verification into your HR change events and an annual review.
What about foreign-owned or foreign-controlled companies?
The entity prong of 120.62 is about incorporation, not ownership. A company incorporated in a U.S. state is a U.S. person even if foreign investors own it. That does not end the analysis, because ownership has separate ITAR consequences:
- Registration under Part 122 requires disclosure of foreign ownership and control. 22 CFR 122.2 asks registrants to identify certain ownership and control relationships.
- Under 22 CFR 122.4, a registrant must notify the Directorate of Defense Trade Controls of changes, including a sale or transfer to a foreign person of ownership or control of the registrant. When the change involves a foreign person acquiring ownership or control, the regulation requires advance notice of at least 60 days.
- Foreign control also affects how the company can access the data it holds. A U.S.-incorporated company controlled by a foreign parent can still be a U.S. person, but data flowing up to the parent, or to the parent's foreign employees, is an export.
If you are working through registration, our page on ITAR registration lays out the process.
What are the most common mistakes?
Treating a work visa as good enough. H-1B and L-1 holders are foreign persons. A valid I-9 shows work authorization, not U.S. person status.
Forgetting about contractors, interns, and visitors. The definitions apply to everyone with access, including temporary staff, consultants, and a customer's visiting engineers.
Ignoring access through IT. Cloud administrators, managed service providers, and offshore help desks may have access to systems that store controlled technical data. Their status matters as much as an engineer's.
What happens if you get it wrong?
An unauthorized release to a foreign person is an unauthorized export. 22 CFR 127.1 makes it a violation to export or attempt to export a defense article or technical data without the required license or approval, and the statutory criminal penalties under 22 U.S.C. 2778(c) reach $1,000,000 per violation and up to 20 years imprisonment for willful violations. Civil penalties are set under 22 CFR 127.10 and adjusted annually for inflation; this article omits the current dollar figure, so confirm it in the latest 127.10 adjustment before citing one. If you discover a misclassified employee or an access that should not have occurred, read our guide to the voluntary disclosure process before you do anything that alters the record.
ITAR U.S. person screening checklist
Use this as a working checklist for your program:
- [ ] Job postings and policies use "U.S. person under 22 CFR 120.62" and not "U.S. citizen" unless a specific law or contract requires otherwise
- [ ] Every hire completes the same status confirmation, with supporting documentation retained
- [ ] Foreign persons with potential access are logged with every country of citizenship and permanent residency, past and present
- [ ] Each foreign person's access is blocked, licensed, or covered by an existing authorization, with the decision in writing
- [ ] Contractors, interns, visitors, and IT service providers go through the same screen
- [ ] Repositories, email lists, and physical areas enforce the screening result
- [ ] Status is re-verified at HR change events and at least annually
- [ ] Ownership changes trigger a review of Part 122 notification obligations
- [ ] Records are retained consistent with 22 CFR 122.5
If you are building or reviewing this process, the broader structure is covered in our ITAR compliance program guide. I think the easiest way to stay out of trouble is to remember that the regulation asks one question about each person who might see controlled data: does this individual meet the definition in 120.62? Answer that for every person, record the answer, and make your systems match it.
Last updated: 2026-11-02
Frequently Asked Questions
Does ITAR require employees to be U.S. citizens?
No. The ITAR does not mandate U.S. citizenship for employment. It requires authorization, such as a license or agreement, before a foreign person receives controlled technical data or defense services. Employees who qualify as U.S. persons under 22 CFR 120.62 need no authorization for access.
Is a green card holder a U.S. person under ITAR?
Yes. Under 22 CFR 120.62, a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) is a U.S. person. Refugees and asylees who are protected individuals under 8 U.S.C. 1324b(a)(3) also qualify.
Is an H-1B visa holder a foreign person under ITAR?
Yes. An H-1B holder is neither a lawful permanent resident nor a protected individual, so 22 CFR 120.63 classifies them as a foreign person. Releasing ITAR technical data to them requires authorization.
How does ITAR treat dual nationals?
A person who is a U.S. citizen and also a citizen of another country is a U.S. person. For foreign persons, 22 CFR 120.50(b) treats a release as an export to every country in which the person has held or holds citizenship or permanent residency.
Is a foreign subsidiary of a U.S. company a U.S. person?
No. 22 CFR 120.62 covers entities incorporated to do business in the United States. A subsidiary organized under foreign law is a foreign person under 120.63, so transfers to it require authorization.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.