ITAR Registered vs. ITAR Compliant vs. "ITAR Certified"
Three phrases, one of which is not a thing. What registration actually covers, what compliance means without it, and which of them a purchase order should be asking for.
Introduction
A supplier tells you they're "ITAR certified." A sourcing manager asks if a vendor is "ITAR compliant." A purchase order says a part must come from an "ITAR registered" shop. These three phrases get used as if they were interchangeable. They are not, and the gap between them is where buyers get burned.
ITAR is the International Traffic in Arms Regulations, the US export control regime covering defense articles and defense services on the United States Munitions List, or USML. DDTC, the Directorate of Defense Trade Controls at the State Department, administers it. Registration with DDTC is a specific, fee-based filing. Compliance is a company's internal program for following the rules. "Certified" is neither — it describes nothing that any government body actually issues.
The difference between ITAR registered and ITAR compliant matters because one is a fact you can check and the other is a claim you have to evaluate. Knowing which one a supplier is actually telling you about changes what you should ask for next.
Registered: a fee, a filing, and a letter
Registration is the one term with a hard legal basis. Under 22 CFR 122.1, any person in the United States that manufactures, exports, or temporarily imports defense articles, or furnishes defense services, must register with DDTC. The regulation does not require a pattern of activity. One occasion is enough. A shop that machined a single defense article five years ago and has never touched an export since is still required to register, because manufacturing alone triggers the duty. This is the part both buyers and suppliers routinely get wrong — people assume registration is only about shipping parts overseas.
Brokers — companies that arrange, negotiate, or facilitate defense trade deals without manufacturing or exporting anything themselves — register under a related but separate requirement. A handful of exemptions exist: US government employees acting in an official capacity, people confined to unclassified technical data production, activity already licensed under the Atomic Energy Act, and fabrication done purely for experimental, scientific, or academic research.
Registration happens through a form called the DS-2032, "Statement of Registration," filed through DDTC's online DECCS portal. It asks for the registrant's legal name and any DBAs, addresses, EIN, the USML categories the company deals in, an empowered official, ownership structure including any foreign ownership, affiliated entities, and disclosure of past violations or debarments. Registration is annual and tied to a specific legal entity, not a brand name or a parent company.
It also is not free, and the current fee schedule took effect January 9, 2025, after a Federal Register final rule published the previous December. Tier 1 registrants pay a flat $3,000 a year, with a one-year discount petition available that brings it down to $2,500. Tier 2 is a flat $4,000, and applies to registrants with five or fewer favorable licensing determinations in the prior twelve months. Tier 3 is calculated using a $1,100 multiplier under 22 CFR 122.3(a)(3), and applies once a registrant exceeds that threshold. No later rule has superseded these figures as of this writing.
What you get back is a registration letter with a registrant-specific code and an expiration date. That letter proves the named entity filed and paid. It does not prove anything about how well that entity actually controls exports.
| Term | Who issues it | What it costs | What it proves |
|---|---|---|---|
| ITAR Registered | DDTC, via a DS-2032 filing | $3,000/year (Tier 1, or $2,500 with a one-year discount petition), $4,000 flat (Tier 2), or a calculated fee using a $1,100 multiplier (Tier 3), effective Jan 9, 2025 | The named legal entity filed a registration, valid through a stated expiry. Not a compliance finding or a license. |
| ITAR Compliant | No one — it's a self-run internal program | No fixed cost; whatever it costs to build and run the program | That the company operates an internal compliance program. Not independently verified by any outside party or government body. |
| "ITAR Certified" | No one — the certification does not exist | N/A | Nothing. The phrase has no regulatory meaning. |
Compliant: a programme, not a document
Registration is a filing. Compliance is a program, and nobody besides the company itself builds and runs it. Industry guidance describes an ITAR compliance program, often shortened to ICP, as a set of ongoing practices: an empowered official who signs off on export decisions, a process for classifying which products and technical data fall under the USML, screening of parties before sharing controlled information, recordkeeping, employee training, and periodic internal audits.
None of that produces a certificate. It produces a set of procedures a company either follows consistently or doesn't. When a supplier says "we're ITAR compliant," they are describing an internal state, not handing you a document. There is no agency that inspects an ICP and signs off that it meets a bar. A company can have a strong program and never say so loudly, and another can claim compliance while running nothing more than a one-page policy nobody reads. Registration status is a fact you can verify against a letter and an expiry date. A compliance claim is something you have to probe — ask what the program actually contains, who the empowered official is, and how classification decisions get made and documented.
"Certified": the one that does not exist
Of the three phrases, this is the one that is simply not a thing. No government body, including DDTC, runs an ITAR certification program or issues a certificate of compliance. Registration itself is explicitly not a certification — being on DDTC's registrant rolls does not mean the government has evaluated or endorsed the effectiveness of a company's compliance program.
That characterization rests on industry compliance sources rather than a single DDTC statement using those exact words. Several independent export-compliance firms describe it the same way, which is worth something, but no primary DDTC document stating "ITAR certification does not exist" in so many words turned up in researching this piece. Treat the underlying fact — there is no certifying body and no certificate — as solid, and treat the specific phrasing as industry consensus rather than a regulatory quote.
In practice, a supplier who tells you they are "ITAR certified" is either using loose shorthand for something real, like registration or an internal program, or doesn't fully understand their own compliance status. Either way, the phrase itself should prompt a follow-up question, not a checkbox.
Who is actually required to register
The registration requirement reaches further than most buyers expect. It is triggered by any one of four activities, and only one needs to be true.
Manufacturing a defense article inside the United States triggers it, even with zero exports and even if it happened on a single occasion. Exporting or temporarily importing a defense article triggers it. Furnishing a defense service — which can include technical assistance or training tied to a controlled item — triggers it. Arranging, negotiating, or facilitating a defense trade deal as a broker triggers a related registration requirement of its own.
A company that does none of the above — one that only produces unclassified technical data, operates solely under an Atomic Energy Act license, or fabricates something purely for experimental or scientific research — is not required to register. That last category is narrow and fact-specific; it is not a general carve-out for small shops or low-volume work.
Where the three get conflated
Most of the confusion between these terms shows up in a handful of recurring statements, and each one deserves a specific response rather than a nod.
"We are ITAR certified" should be treated as a claim with no regulatory content, since no certification exists. It's worth asking what the speaker actually means — usually either registration or an internal program.
A registration code offered without an expiration date proves only that a code exists at some point. Without the expiry and the registrant name attached, there's no way to confirm the registration is still current.
A registration letter naming a different legal entity than the one quoting the job is a common and easy-to-miss mismatch. Registration is tied to a specific legal name and address from the DS-2032 filing — a parent company's registration does not cover a subsidiary, and an old company name does not cover a rebrand, even if the physical shop is the same building and the same machines.
"We're ITAR compliant," offered with no further detail, is an unverified self-claim. It may be entirely true. It's still worth asking what the program actually contains before relying on it for a sensitive part.
What a purchase order should ask for
What you ask a supplier to produce should match what the part actually requires, because registration and a compliance program answer different questions.
If the item is a defense article on the USML, the PO should require proof of current DDTC registration: the registration code, the exact legal entity name it belongs to, and its expiration date, not just a claim of being "in the ITAR business." If the work instead involves handling controlled technical data without the supplier itself manufacturing or exporting a defense article, what matters more is evidence of an active compliance program — an empowered official, a documented classification process, and screening procedures — since registration alone wouldn't apply to every party that touches the data.
Either way, cross-check the registrant's legal name against its SAM.gov entity registration and confirm the CAGE code matches the same entity. That cross-check isn't spelled out anywhere in DDTC's own procedures; it's standard contracts and compliance practice, used to catch exactly the entity-name mismatches described above.
Flow-down to your own subtier suppliers
If you hold a prime contract with export-controlled content, your obligations don't stop with your own compliance. DFARS 252.225-7048, the "Export-Controlled Items" clause, requires a DoD contractor to comply with ITAR and the Export Administration Regulations, including DDTC registration where it applies, and it requires the contractor to pass the substance of that same clause — including its own flow-down requirement — into every subcontract. That creates a chain: the prime imposes the obligation on its tier-one subcontractor, the tier-one sub imposes it on tier-two, and so on down the structure.
Where that chain actually stops is less settled than the clause itself. The obligation makes sense only as far down as a given subtier actually has access to defense articles, technical data, or defense services — a subtier making a generic, uncontrolled fastener with no visibility into the end item's controlled specifications has a different exposure than one machining a part directly from controlled drawings. But there is no single regulatory sentence that draws that line. What exists is a practice, built up across export-compliance guidance, of tying the obligation to actual access rather than to position in the supply chain. Treat "where flow-down stops" as a judgment call your own compliance program has to make for each subtier, not a rule you can quote back to a subcontractor.
Conclusion
Registered, compliant, and certified sound like three points on the same scale. They aren't. Registration is a fact you can check against a letter, a code, and an expiry date, and it has a price tag set by DDTC. Compliance is a program a company runs for itself, with no outside body signing off on it. Certification, in the sense suppliers sometimes invoke it, doesn't exist at all.
The next time a supplier hands you one of these words, ask which of the three they actually mean, and ask for the specific evidence that backs it up — a registration code and expiry, or a description of an actual compliance program. The word alone proves nothing either way.