ITAR Foreign National Hiring: Deemed Exports & DSP-5

Can You Hire a Foreign National Under ITAR?

Yes, you can, and I want to say that first because the search term I see most often around this topic is "ITAR citizenship requirements," and the phrase leads people to the wrong conclusion. ITAR does not contain a rule that says only U.S. citizens may work for a defense company. What it controls is access: who can see, hear, or touch technical data and who can receive defense services. A foreign national can sit in your engineering department for years as long as you either keep ITAR-controlled information away from them or get State Department authorization before it reaches them.

That authorization usually comes in the form of a DSP-5 license from the Directorate of Defense Trade Controls (DDTC). The rest of this guide walks through when you need one, how to figure out who counts as a "foreign person," what the application involves, and what to build into your hiring process so the problem is caught before an offer letter goes out.

What Is a Deemed Export Under ITAR?

A deemed export is the release of controlled technical data to a foreign person inside the United States. The regulation treats that release as if the data had been shipped to the person's home country. The operative language is in 22 CFR 120.50(a)(2), which lists "releasing or otherwise transferring technical data to a foreign person in the United States" as an export. Paragraph (b) of the same section says that release is deemed to be an export to all countries in which the foreign person has held or holds citizenship, or holds permanent residency.

Two definitions do most of the work here:

• Technical data (22 CFR 120.33) is information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. Drawings, specifications, models, and engineering notes can all qualify.
• Release (22 CFR 120.56) includes visual or other inspection by a foreign person that reveals technical data, and oral or written exchanges with a foreign person in the United States or abroad. A whiteboard in a shared hallway can be a release. So can a screen visible over someone's shoulder.

Because the definition reaches visual access and conversation, a deemed export does not require anyone to hand over a file. In my experience that surprises hiring managers more than anything else in this area. They picture an export as a box on a dock, and the regulation pictures it as a person in a room.

The deemed export concept appears in the Commerce Department's rules too (15 CFR 734.13(a)(2)), but the two regimes do not count nationality the same way. Under the ITAR you look at every country of citizenship or permanent residency the person has held. Under the EAR the analysis generally turns on the most recent citizenship or permanent residency. If you work under both systems, you will need your HR screening to capture the more demanding standard. Our deemed exports overview covers the broader picture.

Who Is a "U.S. Person" and Who Is a "Foreign Person"?

This is the classification step that determines whether you need a license at all, and it is where most hiring mistakes begin. Under 22 CFR 120.62, a U.S. person includes a U.S. citizen, a lawful permanent resident (green card holder) as defined in 8 U.S.C. 1101(a)(20), and a protected individual as defined in 8 U.S.C. 1324b(a)(3), which covers refugees and asylees. A foreign person under 22 CFR 120.63 is anyone who is not one of those, and that definition also reaches foreign corporations and foreign governments.

Two details trip people up. The first is that a pending green card application changes nothing. The employee becomes a U.S. person on the day permanent residency is granted, not on the day the employer files the petition. The second is that dual citizenship cuts differently depending on the second country. A U.S. citizen with a second passport is still a U.S. person, but a Canadian citizen on an H-1B who also holds Iranian citizenship is a foreign person with an Iranian nexus, and that second nationality has to be disclosed and analyzed.

When Does a Foreign National Employee Need a DSP-5?

You need authorization when two conditions are both true: the person is a foreign person, and their job duties will give them access to ITAR-controlled technical data or involve a defense service. If either condition is missing, no license is required.

The practical test I use is to walk the position through three questions.

1. Does the role touch a defense article or its technical data? A defense article is anything on the U.S. Munitions List at 22 CFR 121.1. If you have not classified your products and data against the USML categories, you cannot answer this question, and that gap is usually the first thing I fix. Our USML categories page is a reasonable starting point.
2. Can the person get access without an assigned task? Shared drives, PLM systems, shop floor traffic, and meeting rooms all create access that no job description mentions.
3. Would the work amount to a defense service? Under 22 CFR 120.32, furnishing assistance, including training, to foreign persons in the design, development, engineering, or use of defense articles is a defense service, whether it happens in the United States or abroad.

If the answer to the first question is no, the hire is straightforward from an ITAR perspective. If the answer to any of them is yes, you either restrict the role, segregate the data, or apply for authorization.

How the DSP-5 Works for a Foreign Person Employee

The DSP-5 is the license for permanent export of unclassified defense articles and related unclassified technical data. The authority is 22 CFR 123.1 for hardware and 22 CFR 125.2 for technical data. When an employer wants to give a foreign national employee access to technical data in the United States, the DSP-5 is the standard vehicle, because the release is treated as a permanent export of that data to the employee's country or countries.

Several features of the license shape how you plan for it:

• Registration comes first. The applicant must be registered with DDTC under 22 CFR Part 122 before submitting any license application. See our ITAR registration guide if you are not yet registered.
• The license is employee-specific and data-specific. It authorizes release of particular technical data to a named individual, typically in connection with a stated job function and USML category. A new project with different data generally means an amendment or a new application.
• Licenses are valid for four years under 22 CFR 123.21, which means you need a renewal calendar for every foreign person employee you cover.
• Applications are filed electronically through DECCS, the DDTC Export Control System, and include the certifications required by 22 CFR 126.13.

I will be careful here about what goes in the package, because DDTC revises its application guidance from time to time. In general you should expect to provide the employee's full legal name, all current and former nationalities, immigration status and visa details, a description of the position and the specific technical data the employee will receive, the USML category involved, and a statement of the safeguards you will use to keep the data from being passed to anyone else. Check DDTC's current published guidance on foreign person employee licensing before you file, since the attachments requested are the part most likely to have changed.

Step-by-Step: Authorizing a Foreign National Hire

1. Classify the work. Identify the USML category and the specific technical data the role needs. If the answer is "I don't know yet," pause the offer.
2. Collect nationality information early. Ask for all citizenships and permanent residencies held, present and past, in a consistent HR form. Do this in a way your employment counsel has reviewed (see the discrimination note below).
3. Screen against 22 CFR 126.1. If any nationality falls on the proscribed list, assume a license will be denied and plan the role accordingly.
4. Decide whether to restrict or license. Many roles can be reshaped so the person works only on non-controlled portions of a program. If the job truly requires controlled data, move to the application.
5. Prepare and file the DSP-5 in DECCS. Include the supporting documents DDTC currently requests and the required certifications.
6. Do not release anything until the license is issued. The approval is the start date for access, not the offer acceptance date.
7. Implement the license provisos. DDTC frequently attaches conditions. Those become binding operational requirements, so someone in your company needs to own them.
8. Maintain records. 22 CFR 122.5 requires you to keep records for five years from the expiration of the license or other approval.

Does ITAR Have Another Route Besides the DSP-5?

Sometimes. The DSP-5 is the default, but a few other authorizations or exemptions can apply in narrow situations, and a few commonly assumed exemptions do not apply at all.

The university exemption in 125.4(b)(10) has conditions that are easy to miss: the employee's permanent abode throughout the period of employment must be in the United States, the person cannot be a national of a country listed in 126.1, and the institution must tell the individual in writing that the technical data may not be transferred to other foreign persons without DDTC's prior written approval. If you are a private manufacturer, that exemption is simply not yours to use.

I also hear people argue that an H-1B petition or an I-129 filing somehow takes care of export control. It does not. Immigration approval and export authorization are separate systems with separate agencies, and the I-129 form does contain an export control certification that asks the employer to state whether a license is needed for the beneficiary's access. That certification is signed under penalty, so the classification work needs to be done before the petition is filed, not after.

What About Nationalities That Fall Under 22 CFR 126.1?

Section 126.1 sets out countries for which the United States maintains a policy of denial for defense exports, and it applies to deemed exports as well. If an applicant is a national of one of those countries, the practical expectation is that a DSP-5 for technical data will be denied. Some countries on the list have different levels of restriction, so read the current text of the section instead of relying on a memo from a few years ago, since the list has been amended over time.

For hiring managers, the takeaway is that nationality must be reviewed before the interview process gets far along. Finding out in week six that the finalist has a second citizenship in a 126.1 country, after everyone has mentally closed the requisition, is a painful way to learn it.

How Do You Avoid Discrimination Claims While Screening?

This is the part of the process where export compliance and employment law run into each other. The Immigration and Nationality Act, at 8 U.S.C. 1324b, prohibits citizenship status discrimination against protected individuals, and it also prohibits national origin discrimination. At the same time, 8 U.S.C. 1324b(a)(2)(C) provides that the prohibition does not apply where discrimination is required to comply with law, regulation, or a government contract.

I think the safest posture is a narrow one. Limit any restriction to roles that actually require access to controlled technical data, document the business and legal reason for that role, and apply the same screening questions consistently. Do not post a blanket "U.S. citizens only" line on every opening because it feels safer. It is broader than the ITAR requires, and green card holders, refugees, and asylees are U.S. persons who may not be excluded on that basis for a role. Have employment counsel review your job postings and application forms before you roll out a screening process.

Building the Controls Around the License

A DSP-5 on file does not protect you if the employee can open every folder on the network. The license covers specified data, and anything outside it is still unauthorized. DDTC consent agreements keep returning to the same weakness: the company obtained approval for one thing and let access spread to another. The lessons from recent ITAR consent agreements are worth reading for that reason.

Controls I would expect to see for any company with foreign person employees:

• A written technology control plan that names each foreign person, the data they are cleared to receive, and the license number. Our article on technology control plans covers what it should contain.
• Role-based access in your document management, source control, and ticketing systems so access follows the license and not the org chart.
• Physical separation or escort rules for areas where controlled hardware or displays are visible.
• Notice and acknowledgment: the employee signs a statement that they understand the limits of their access and may not pass data to others.
• Cloud and email hygiene. Under 22 CFR 120.54, certain transmissions of end-to-end encrypted technical data are not exports if specific conditions are met, but those conditions are demanding, and a foreign person administrator with key access can undo the benefit.
• Onboarding and exit steps tied to HR events: visa changes, promotions, team transfers, and terminations should all trigger an access review.

Hiring Checklist for Foreign National Candidates

• [ ] Role mapped to USML category and specific technical data
• [ ] All citizenships and permanent residencies collected from the candidate
• [ ] Status confirmed as U.S. person or foreign person under 22 CFR 120.62 and 120.63
• [ ] 126.1 screening completed
• [ ] Decision documented: restrict role, segregate data, or license
• [ ] DDTC registration current before filing
• [ ] DSP-5 filed in DECCS with required certifications
• [ ] No access granted before approval
• [ ] Provisos assigned to a named owner
• [ ] Technology control plan updated
• [ ] Renewal date set before the four-year expiration
• [ ] Records retained for five years after license expiration (22 CFR 122.5)

What Happens if a Foreign Person Gets Access Without Authorization?

An unauthorized deemed export is a violation of the Arms Export Control Act and the ITAR, and the exposure is real. Criminal penalties under 22 U.S.C. 2778(c) can reach $1 million per violation and 20 years imprisonment for willful violations. Civil penalties under 22 CFR 127.10 are adjusted for inflation each year and now exceed $1.2 million per violation or twice the value of the transaction, whichever is greater, so check the current figure in the Federal Register before quoting it to your board.

If you discover an unauthorized release, the voluntary disclosure provisions of 22 CFR 127.12 are your main tool, and DDTC treats a timely voluntary disclosure as a mitigating factor. Our pages on voluntary disclosure and ITAR violations and penalties walk through the process. I will say, as a plain observation, that the most expensive deemed export cases I have read about were not exotic. They were ordinary employees with ordinary access that nobody had checked.

Frequently Asked Questions

The short answers are below, and the longer treatment sits in the sections above.

Does ITAR require employees to be U.S. citizens?

No. ITAR restricts access to technical data and defense services by foreign persons without authorization. Citizens, green card holders, refugees, and asylees are U.S. persons and need no license. Others may be employed, but they cannot receive controlled data until authorization is in place.

Is a green card holder a foreign person under ITAR?

No. A lawful permanent resident is a U.S. person under 22 CFR 120.62, so no DSP-5 is needed. A pending green card application does not count until permanent residency is actually granted.

How long does a DSP-5 for a foreign employee last?

Licenses are valid for four years under 22 CFR 123.21. Plan renewals well ahead of expiration, and remember that a change in the employee's duties or the data involved may require an amendment.

Can a foreign national work at an ITAR-registered company without a license?

Yes, if they have no access to ITAR-controlled technical data or defense services. That depends on real controls such as access restrictions and physical separation, not on the job title.

Does a deemed export cover dual nationals?

Yes. Under 22 CFR 120.50(b), the release is deemed an export to every country where the person holds or has held citizenship or holds permanent residency, so all nationalities must be reviewed.

Where to Go From Here

If you are staring at a requisition and are not sure whether it creates a deemed export, I would start by classifying the data, because everything else depends on that answer. If you want help with classification, a DSP-5 package, or a technology control plan, the export licensing page explains how we approach it. I'm Jared Clark of Certify Consulting, and I'm happy to talk through a specific hire before you commit to a start date.

Last updated: 2026-11-09