Is There a Public ITAR Registration Database? How to Verify DDTC Registration
There is not one. DDTC keeps the registration list closed, so the question becomes what you can ask a supplier for instead, and what a real answer looks like.
Introduction
A buyer sources a part that touches a defense article, hears the supplier say "we're ITAR registered," and wants to check that claim the easy way: look it up. So they search for a public database, find nothing, and start wondering if they are missing something or if nothing is actually there.
Nothing is there. There is no government website where you type in a company name and see whether it holds an active ITAR registration. That is not a bug in your search. It is how the system is built.
This article covers how to check if a company is ITAR registered with DDTC without a public lookup tool: what the government does publish, what it deliberately withholds, and what documents and cross-checks actually tell you something. The short version is that you verify registration by asking the supplier directly and checking their answer against a couple of independent records, not by searching a database that does not exist.
The short answer: DDTC does not publish it
ITAR is the International Traffic in Arms Regulations, the US rules governing defense articles, defense services, and related technical data. DDTC is the Directorate of Defense Trade Controls, the State Department office that administers ITAR and runs the registration program. Any company that wants to legally manufacture, export, or temporarily import a defense article, or furnish a defense service, has to register with DDTC first.
The registration requirement is broad. Under 22 CFR 122.1, a single occurrence of qualifying activity triggers the duty to register. A manufacturer who has never exported anything still has to register if it makes something on the US Munitions List. There are narrow exemptions — government employees acting officially, work confined to unclassified technical data, activity already licensed under the Atomic Energy Act, and fabrication done purely for experimental or scientific research — but most companies doing defense-adjacent work fall inside the requirement, not outside it.
Despite how many companies register, DDTC does not publish the list. There is no portal, no downloadable file, no search box where a buyer can type in a company name and confirm it holds a current registration. If you searched for one and found nothing, that confirms the database does not exist — it is not a sign you searched wrong.
Why the registration list is closed
DDTC treats the details tied to a registration — the registrant's legal name, address, ownership structure, and registration code — as confidential, business-sensitive information. That information gets collected through the registration process, but it does not get published back out as a public roster.
It would be convenient to point to a specific line of the regulation that says exactly why. That exact citation was not pinned down for this article, and rather than guess at one, it is worth saying plainly: the precise statutory or regulatory basis for keeping the registrant list confidential was not established here. What is well established, and all that matters for a buyer's purposes, is the practical fact: the list is closed, and no amount of searching will open it.
What DDTC does make public
DDTC does publish one list that is relevant here, and it is not a registry of who is registered. It is the AECA Debarred Parties List — a list of persons and entities barred from participating in defense trade under the Arms Export Control Act (AECA).
Entities land on this list two ways. Statutory debarment follows a criminal conviction related to export control violations, under AECA §38(g)(4) and ITAR §127.7(c). Administrative debarment can follow a civil enforcement action, without a criminal conviction. DDTC publishes the list through the Federal Register and maintains it going forward, and it is the one piece of registrant-adjacent information that is actually public.
The Debarred Parties List, and what it tells you
This is the point buyers get backwards most often, so it is worth stating directly: a debarment list is an exclusion list, not a roster. It names the small number of parties who are barred from defense trade. It says nothing about the much larger population of companies who are, or are not, currently registered.
Checking a supplier's name against the Debarred Parties List and finding nothing is a real step — it rules out a serious, disqualifying problem. But it proves nothing beyond that. A company that has never registered with DDTC at all will also come up clean on the Debarred Parties List, because that list has no reason to mention a company it has never had cause to debar. Absence from an exclusion list is not evidence of inclusion anywhere else.
Treat a clean debarment check as clearing one specific risk, not as confirming registration. The two are separate questions, and only one of them has a public answer.
What to ask the supplier for instead
Since there is no database to check, verification runs through the supplier directly. Ask for one or more of three things: the registration code and its expiration date, a copy of the current DDTC registration letter, or a copy of the Statement of Registration itself, known as the DS-2032.
The DS-2032 is the form a company files with DDTC to register in the first place, submitted through DDTC's online portal (DECCS). It requires the registrant's legal name and any DBAs, its addresses, its EIN, the USML categories it works in, its empowered official, details of its ownership structure including any foreign ownership, its subsidiaries and affiliates, and disclosure of any prior violations or debarments. A copy of this form, or the resulting registration letter, is the closest thing to primary-source proof a buyer can get.
Be clear-eyed about what any of these documents actually prove. They show that a specific legal entity was registered as of a point in time, under a specific name, through a stated expiration date. They do not prove the company is in good standing today beyond that expiry, and they say nothing about whether the specific part you are buying is correctly classified under ITAR. Registration and compliance are different questions — a company can be fully registered and still get the classification of a given item wrong. That distinction matters here only enough to flag it; it is not what this article is about.
How to read a DDTC registration letter
The exact visual layout of a DDTC registration letter was not verified for this article, so this section covers what to check for, not what the page is designed to look like. Treat any description of the letter's design elsewhere as informed guesswork, not a confirmed template.
What a buyer should expect to find on a registration letter, regardless of its exact formatting, are three pieces of information: the registrant's name, a registration code specific to that registrant, and an expiration date. Read all three together. The name has to match the entity actually doing your work, the code has to be legible and specific rather than vague, and the expiration date has to be in the future — a registration code with no expiration date attached to it is not something you can verify as current.
If a supplier cannot produce a letter or a DS-2032 with these three elements, that is itself useful information. A company that is actually registered should be able to produce this without much friction, since it is paperwork they already have on file.
Cross-checking against SAM.gov and the CAGE code
A registration letter only answers the question if it is for the right entity. The most common failure mode here is not a forged letter — it is a real letter for the wrong company: a parent company, a sister company, an old legal name, or a DBA that does not quite match who is actually quoting your job.
SAM.gov, the System for Award Management, is the federal government's registry of entities that do business with it, and it is public and searchable. Pull up the supplier's exact legal name there and compare it character for character against the name on the registration letter or DS-2032. Then check the CAGE code — a Commercial and Government Entity code, a short identifier tied to one specific legal entity and location — and confirm it matches the entity you are actually contracting with, not a related company that happens to share a name or a building.
This cross-check is standard contracting and compliance practice rather than a step DDTC spells out in a published procedure. It is also the single most effective thing a buyer can do with public records, because SAM.gov and CAGE lookups are free, fast, and genuinely public, unlike the registration list itself.
Red flags in a supplier's answer
Some answers from a supplier should prompt a follow-up question rather than a checked box. The table below lines up common claims against what they actually establish.
| What a supplier said | What it actually proves | Basis |
|---|---|---|
| "We are ITAR certified" | Nothing — no ITAR certification exists; DDTC does not issue one. The phrase itself suggests the speaker may not understand their own compliance status. | Sourced |
| "Here's our registration code," with no expiration date given | Only that a code exists. Without an expiry or a letter to confirm it, there is no way to tell if the registration is still current. | Practice |
| A registration letter naming a different legal entity (a parent, a DBA, an old name) | That the named entity is registered — not necessarily the company quoting your job, unless the legal names and addresses match exactly. | Sourced element (registration is entity-specific) / practice as a red flag |
| "We're ITAR compliant," with no further detail | An unverified self-claim. Compliance is self-assessed and internally run; ask what their program actually contains before taking the claim at face value. | Practice |
None of these answers are automatically disqualifying on their own. They are prompts to ask a more specific follow-up question and look at the underlying document rather than the sentence someone said out loud.
Conclusion
There is no public ITAR registration database, and there likely will not be one — DDTC treats registrant details as confidential, and the one list it does publish, the AECA Debarred Parties List, is built to exclude bad actors, not to confirm good ones. Checking that list is worth doing, but a clean result only rules out debarment. It does not confirm registration.
Verification instead runs through the supplier and a couple of public cross-checks: ask for the registration code and expiry, the registration letter, or the DS-2032 itself, and read it for the registrant name, the code, and the expiration date. Then confirm that name against SAM.gov and check that the CAGE code matches the entity actually doing your work, not a related company standing nearby. None of this is as convenient as a search box, but it answers the question a search box never could.