Most companies find out about ITAR registration the same way. A prime contractor sends a supplier questionnaire, or a customer asks for a DDTC registration code, or a shop owner realizes that the brackets they have been machining for two years are on the U.S. Munitions List. By then the question is no longer "should we register?" but "how long have we been out of compliance, and what do we do first?"
This guide walks through 22 CFR Part 122, titled Registration of Manufacturers and Exporters, section by section. I'll cover who has to register, what the filing involves, what you owe the Directorate of Defense Trade Controls (DDTC) after you're registered, and the mistakes I see most often. If you want the broader picture first, our overview of ITAR registration is a good companion to this one.
What Is ITAR Part 122?
Part 122 of the International Traffic in Arms Regulations (ITAR) implements the registration requirement in section 38(b)(1)(A) of the Arms Export Control Act, codified at 22 U.S.C. 2778(b)(1)(A). It tells you who must register with DDTC, how to submit the registration statement, what it costs, what changes you must report, and what records you must keep.
Registration is the front door to the whole ITAR system. Under 22 CFR 122.1, registration with DDTC is generally a precondition to the issuance of any license or other approval to export defense articles or furnish defense services. Without it, you cannot apply for a DSP-5, a DSP-73, or a technical assistance agreement, and you cannot use most ITAR exemptions.
Registration also does not authorize anything on its own. Section 122.1(c) states that registration confers no export rights or privileges. It identifies you to the government and subjects you to its oversight, and that is all it does.
Who Must Register Under 22 CFR 122.1?
Section 122.1(a) requires any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, to register with DDTC.
The part people miss is the word "or." A company that manufactures defense articles must register even if it never exports anything. A machine shop that makes parts to a defense prime's drawings and ships them only to that prime in Ohio is still a manufacturer of defense articles, and registration is still required. The ITAR treats the act of manufacturing as the regulated business activity, whether or not the product ever leaves the country.
I think this is the single most common misunderstanding among small suppliers, and it's the reason our guide on why ITAR applies to small machine shops exists. Owners hear "export" and assume it doesn't apply to them, when the regulation is written around manufacturing first.
What counts as a defense article or defense service?
A defense article is anything on the U.S. Munitions List (USML) in 22 CFR Part 121, including related technical data. A defense service includes furnishing assistance, such as training or technical support, to foreign persons relating to defense articles. Whether your product is actually on the USML is a classification question, and it should be answered before you file, not after. Our breakdown of the USML categories is a useful place to start.
Who is exempt from registration?
Section 122.1(b) lists a short set of exemptions. Registration is not required for:
- Officers and employees of the U.S. Government acting in an official capacity
- Persons whose pertinent business activity is confined to the production of unclassified technical data only
- Persons all of whose manufacturing and export activities are licensed under the Atomic Energy Act of 1954
- Persons who engage only in the fabrication of articles for experimental or scientific purposes, including research and development
Read these narrowly. The R&D exemption covers fabrication for experimental or scientific purposes. It does not cover a company that builds prototypes on the way to a production run for a defense customer. The technical-data exemption covers businesses that only produce unclassified technical data, not businesses that make hardware and also write the data about it. If you're relying on any of these, write down why, because an auditor or DDTC will want to see the reasoning.
Do foreign companies register?
No. Registration is a U.S. person requirement. A foreign person generally cannot hold a DDTC registration, and a foreign entity that is the actual manufacturer of ITAR-controlled items does not register under Part 122. Foreign ownership or control of a U.S. registrant triggers the notification rules covered below.
What about brokers?
Brokering activities are governed separately by 22 CFR Part 129, which has its own registration requirement. A company that both manufactures defense articles and brokers them needs to satisfy both parts. Part 122 registration alone does not cover brokering.
Part 122 Registration at a Glance
| Topic | Regulation | What it requires |
|---|---|---|
| Who must register | 22 CFR 122.1(a) | Persons in the U.S. who manufacture, export, or temporarily import defense articles, or furnish defense services |
| Exemptions | 22 CFR 122.1(b) | Government employees, unclassified technical data only, Atomic Energy Act licensees, experimental or scientific fabrication |
| Effect of registration | 22 CFR 122.1(c) | Precondition to licenses; confers no export rights |
| Submission | 22 CFR 122.2 | Statement of Registration (Form DS-2032), supporting documents, certification by a senior officer |
| Fees | 22 CFR 122.3 | Tiered fee, with the tier depending on licensing volume |
| Changes | 22 CFR 122.4 | Notify DDTC within 5 days of specified events; 60 days advance notice for sale or transfer to a foreign person |
| Recordkeeping | 22 CFR 122.5 | Maintain records for five years from expiration of the license or approval |
How Do You Submit the Registration Statement (22 CFR 122.2)?
Registration is submitted to DDTC through its Defense Export Control and Compliance System (DECCS) using Form DS-2032, the Statement of Registration. Before you can file, your company needs a DECCS account, which itself requires identity verification of the individuals who will be submitting. Start that early. In my experience the account setup is where first-time filers lose weeks, not the form itself.
What the DS-2032 asks for
The statement covers the details DDTC needs to understand who you are and who controls you:
- Legal name, address, and corporate structure of the applicant
- Ownership and control, including any foreign ownership
- Senior officers, directors, and the people who will act as Empowered Officials
- Subsidiaries and affiliates
- Whether the applicant or its officers have been indicted for or convicted of certain offenses, or are ineligible to contract with or receive licenses from the U.S. Government
- A general description of the defense articles and services you manufacture, export, or provide
A senior officer of the company must certify the statement. That certification matters. It is a signed representation to a federal agency, and inaccurate statements in it carry the same kind of exposure as any other false statement to the government.
Empowered Officials
The ITAR defines an Empowered Official in 22 CFR 120.67 (the number reflects the 2022 reorganization of Part 120). This person is directly employed by the company in a position of authority, is legally empowered to sign license applications, understands the ITAR, and has independent authority to inquire into any aspect of a proposed export and to refuse to sign an application without prejudice or other adverse consequences.
That last clause is the one I'd underline. An Empowered Official who can be overruled by the sales vice president is not really an Empowered Official, whatever the org chart says. Pick someone with real standing, and give them real time to do the job. Our ITAR compliance program page covers how this role fits into a working program.
Eligibility problems
Registration is not available to a person who is ineligible under the ITAR, which includes parties debarred under 22 CFR Part 127 and those statutorily barred. The statement asks directly, and the answers are checked. If any officer or director has a conviction or indictment that touches these provisions, talk to counsel before you file, not after.
What Does ITAR Registration Cost (22 CFR 122.3)?
Section 122.3 sets a tiered registration fee. The base tier applies to registrants that don't apply for licenses, and higher tiers apply based on the number of license applications and other approvals the registrant submitted in the prior year. Fees are paid at the time of submission and are not something to guess at, because DDTC adjusts the schedule from time to time and the current numbers belong on the DDTC website, not in a blog post. I've written separately about what defense contractors actually pay for ITAR registration, including the costs that sit outside the DDTC fee, such as internal time, consulting support, and the compliance program you'll need to build around it.
How Long Does Registration Last, and When Do You Renew?
A registration is valid for 12 months. Under 22 CFR 122.3, a registrant should submit its renewal no earlier than 60 days and no later than 30 days before the registration expires. Miss that window and the registration lapses. A lapsed registration means you cannot lawfully apply for new licenses, and any pending applications can be affected, so a lapse during an active program is a real operational problem and not just a paperwork annoyance.
A practical habit: put the renewal window on two calendars, one owned by the Empowered Official and one by someone else. Renewal is also the moment to confirm that the information in your registration is still true, because an annual filing that repeats last year's stale answers is its own kind of risk.
What Changes Must You Report to DDTC (22 CFR 122.4)?
This is the section that trips up registered companies, because the obligations run continuously rather than once a year. Section 122.4 requires registrants to notify DDTC of changes in the information in their registration statement.
| Event | Deadline | Regulation |
|---|---|---|
| Change in name, address, or legal structure; change in senior officers or directors; establishment, acquisition, or divestiture of a subsidiary or affiliate | Within 5 days of the event | 22 CFR 122.4(a) |
| Indictment or conviction of the registrant or an officer for specified offenses, or ineligibility to receive licenses | Within 5 days of the event | 22 CFR 122.4(a) |
| Intended sale or transfer to a foreign person of ownership or control of the registrant or any entity it owns or controls | At least 60 days before the transaction | 22 CFR 122.4(b) |
The 60-day rule deserves special attention in M&A. If a foreign investor is acquiring a controlling stake in a registered company, the notice must reach DDTC before the deal closes, and in practice it needs to be built into the transaction timeline from the term sheet stage. I have seen deals where nobody on the deal team had heard of 122.4(b) until the week before closing. Planning that far ahead is not optional, since 60 days is what the regulation says.
The five-day rule is quieter but more common. A new president, a new facility, or a new subsidiary is exactly the kind of ordinary business event that nobody connects to a federal filing. If your HR, legal, and corporate development teams don't know that those events create a DDTC deadline, build a short trigger list and circulate it.
What Records Must Registrants Keep (22 CFR 122.5)?
Section 122.5 requires a registrant to maintain records concerning the manufacture, acquisition, and disposition of defense articles, the provision of defense services, the export and temporary import of defense articles and technical data, and related activities. The retention period is five years from the expiration of the license or other approval, and the records must be available for inspection by DDTC on request. The rule also contemplates that records can be kept electronically, as long as they're legible and retrievable.
Five years sounds simple until you realize it runs from license expiration rather than from the date of the shipment, and that some exemption-based transactions have their own documentation expectations under other parts of the ITAR. For a practical breakdown, see our guide to ITAR record-keeping requirements.
What Happens If You Should Be Registered and Aren't?
Manufacturing or exporting defense articles without registration is a violation of the ITAR, and DDTC treats it as a serious one. The practical consequences go beyond the penalty itself. An unregistered manufacturer who has been exporting has probably also exported without a license, because no license can issue to an unregistered party. That turns one violation into several.
If you discover that you should have been registered, the usual path is to stop activity that depends on registration, register as quickly as you can, and evaluate whether a voluntary disclosure under 22 CFR 127.12 is appropriate. DDTC has long said it treats voluntary disclosure as a mitigating factor in how it handles a violation, though it isn't a guarantee of any particular outcome. Our pages on voluntary disclosure and ITAR violations and penalties go into detail.
Common Registration Mistakes
A few patterns come up again and again:
- Assuming no exports means no registration. Manufacturing alone triggers 122.1(a).
- Registering the parent but not thinking about affiliates. The statement asks about subsidiaries and affiliates, and changes to that list are reportable.
- Naming an Empowered Official in title only. If they can't actually refuse a shipment, the designation won't hold up.
- Letting renewal slide. The 30-to-60-day window is short, and a lapse stops your licensing.
- Treating registration as the finish line. The filing is a few hours of work. The program you need behind it (classification, screening, technology controls, training, records) is the actual job.
- Missing foreign person access. Registration doesn't solve deemed export exposure. If foreign national employees can see technical data, that needs its own controls. See our page on deemed exports.
A Practical Sequence for First-Time Registrants
If I were walking a company through this from zero, the order would look like this:
- Classify first. Confirm what you make or do against the USML. Registration is only required if you're engaged in the business of defense articles or services, so the classification drives everything.
- Check eligibility. Review officers, directors, and owners for anything that touches the ineligibility questions on the DS-2032.
- Designate an Empowered Official and make sure the role has authority and time.
- Set up DECCS accounts early, since identity verification is slow.
- Gather corporate documents and the ownership information the statement requires.
- File the DS-2032 with the fee and the senior officer's certification.
- Build the surrounding program while you wait: written procedures, screening, training, recordkeeping, and a change-notification trigger list. The ITAR compliance checklist is a reasonable skeleton.
Notice that step 7 happens in parallel with the filing, not after it. A company that registers on Monday and receives its first license request on Friday should already know who will handle it.
Where Registration Fits With Other Obligations
Registration under Part 122 is one piece of a larger set of obligations. It sits alongside the license requirements in Part 123, the agreement requirements in Part 124, the recordkeeping and enforcement provisions of Part 127, and the broader compliance expectations DDTC describes in its published compliance program guidelines. If you also handle controlled unclassified information or work under DFARS, the cybersecurity side adds another layer, which we compare in ITAR vs CMMC.
The way I think about it, registration tells DDTC who you are, and everything else tells DDTC whether you can be trusted with that status. A clean DS-2032 and a thin compliance program is a fragile combination, because the first audit or the first disclosure will go straight to the program.
If you're unsure whether your company has to register, or if you're registered and suspect your change notifications or renewals haven't kept pace with the business, I'd rather you ask now than discover it during a customer audit. You can reach us through the contact page, and I'm glad to talk through where you stand.
Last updated: 2026-10-12
Frequently Asked Questions
Do I need to register under ITAR Part 122 if I only manufacture and never export?
Yes. Under 22 CFR 122.1(a), any person in the United States engaged in the business of manufacturing defense articles must register with DDTC, whether or not the articles are ever exported.
How long is an ITAR registration valid, and when should I renew?
A DDTC registration is valid for 12 months. Under 22 CFR 122.3, renewal should be submitted no earlier than 60 days and no later than 30 days before expiration, and a lapse stops you from applying for licenses.
What changes must I report to DDTC after registering?
Under 22 CFR 122.4(a), you must notify DDTC within 5 days of events such as a change in name, address, legal structure, senior officers, or subsidiaries, and certain indictments or convictions. Under 122.4(b), you must give at least 60 days' advance notice of an intended sale or transfer of ownership or control to a foreign person.
Does ITAR registration let me export defense articles?
No. Under 22 CFR 122.1(c), registration confers no export rights or privileges. It is a precondition to obtaining licenses and approvals, which you still have to apply for separately.
How long must registrants keep ITAR records?
Under 22 CFR 122.5, registrants must keep records for five years from the expiration of the license or other approval, and must make them available to DDTC on request.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.