CLIENT UPDATE
ITAR Compliance Update: Take Stock of Your Empowered Officials, Written Policies and Procedures
For companies engaged in International Traffic in Arms Regulations (“ITAR”) business, recent actions by the Directorate of Defense Trade Controls (“DDTC”) highlight the importance of two key elements of an effective ITAR compliance program: (1) Empowered Official(s) who meet the ITAR qualification requirements and are adequately trained to perform their role; and (2) written policies and procedures for complying with the ITAR.
DDTC fines company for ITAR violations including failure to have qualified Empowered Official
In February, DDTC entered into a public consent agreement with Darling Industries, Inc. (“Darling Industries”) settling charges that the Arizona company violated the ITAR by making unauthorized ITAR exports of missile components and technology to Canada, UK and Italy and—notably—by appointing an unqualified Empowered Official who did not meet the ITAR’s qualification requirements. Specifically, DDTC alleged in its proposed charging letter that the company’s appointed Empowered Official was not in a position of having authority for policy or management within the company, did not understand export laws, did not receive ITAR training from the company, and prepared, signed and submitted license applications that reflected deficient understanding of the ITAR and the licensing process. As part of its settlement with DDTC, Darling Industries agreed to pay $400,000 in civil monetary penalties and, perhaps more onerously, to implement a number of DDTC-directed improvements to its compliance program and be subject to an exacting program of outside auditing and DDTC monitoring for a period of eighteen months.
This case demonstrates the importance of having Empowered Officials who are qualified and trained. The ITAR requires that an Empowered Official be someone who:
(1) Is directly employed by the applicant [i.e., the registrant] or a subsidiary in a position having authority for policy or management within the applicant organization; and
(2) Is legally empowered in writing by the applicant to sign license applications or other requests for approval on behalf of the applicant; and
(3) Understands the provisions and requirements of the various export control statutes and regulations, and the criminal liability, civil liability and administrative penalties for violating the Arms Export Control Act and the International Traffic in Arms Regulations; and
(4) Has the independent authority to:
(i) Inquire into any aspect of a proposed export, temporary import, or brokering activity by the applicant;
(ii) Verify the legality of the transaction and the accuracy of the information to be submitted; and
(iii) Refuse to sign any license application or other request for approval without prejudice or other adverse recourse.
22 C.F.R. § 120.25. Note that except in the case of a foreign broker, an Empowered Official must also be a U.S. person as defined by the ITAR (i.e., a U.S. citizen, lawful permanent resident, or holder of certain temporary protected status).
As the Darling case illustrates, a company’s ITAR Empowered Officials should be individuals who hold a position of sufficient authority within the company (e.g., an individual in an officer or senior manager position) such that they meet these qualifications. Additionally, it is critical that the company furnish Empowered Officials with adequate training and other resources to ensure they understand and stay up-to-date with the ever-changing export laws and regulations. Common resources include attendance at advanced training seminars, periodic refresher training and advanced training provided by personnel with ITAR expertise, and support of outside counsel or consultants. Note in this regard that the ITAR requires an understanding of the “various export control statutes and regulations,” which encompass export control regimes other than the ITAR, like the Export Administration Regulations (“EAR”). Thus, advanced Empowered Official training should include at least some basic elements on EAR as well as related subjects like antiboycott regulation and trade sanctions. Finally, the Darling case illustrates that DDTC takes note of the quality of licensing and other submissions. Empowered Officials who prepare, sign and/or submit routine license applications should take care to ensure that these submissions are completed correctly and evidence a solid understanding of the ITAR and the licensing process.
ITAR registration renewal will soon require indicating whether applicant has written policies and procedures
Separately, another recent development highlights the importance of having written ITAR policies and procedures. Soon, businesses applying for or renewing their ITAR registrations will be required to expressly tell DDTC whether they have such policies and procedures.
As part of its IT Modernization effort, DDTC has been preparing and testing a number of updated forms and electronic applications, with the goal of moving them to a new central, cloud-based online platform called the Defense Export Control and Compliance System (“DECCS”). While these changes primarily affect the form and manner of application submissions, DDTC’s proposed update to at least one of these forms, the DS-2032 Statement of Registration, introduced a significant substantive addition.
The DS-2032 is used across the board by businesses registering under the ITAR for the first time as well as by currently registered businesses renewing their ITAR registration annually. The proposed new DS-2032 Statement of Registration will include a new Question 10 which asks: “Does the applicant have written policies and procedures for compliance with the ITAR (including but not limited to 22 CFR 122.5)?” (ITAR § 122.5 is the provision setting forth requirements for the maintenance of records.) At this time, DDTC has provided no substantive gloss on this addition. A published version of the proposed instructions to accompany the new DS-2032 merely references DDTC’s compliance program guidelines. It is more or less up to the applicant to decide whether what it has in place is sufficient to warrant checking “Yes.”
Regardless of how one interprets the question, there is obviously only one “correct” response. DDTC has announced that the new DS-2032 will launch in 2019. Industry testing was completed in December 2018 and as of mid-March 2019, DDTC has completed the required notice and public comment processes, so the new form may be formally published and implemented, in theory, any day now. The new DS-2032 also includes expanded questions requiring more detail than ever before on foreign ownership and control as well as the relationship between parent and subsidiary/affiliate entities.
In anticipation of the new registration form, this is an excellent time to take stock of your written policies and procedures and ensure that your company is prepared to answer this question in the affirmative if the new form is implemented by the time of your next ITAR registration renewal. Moreover, a common cause of export errors is the failure to keep written procedures updated to match evolving business realities, particularly personnel turnover. If your company does have written policies and procedures but they have not been updated in some time, there is no time like the present to dust them off and make sure that: (1) they are being followed; and (2) they are still appropriate and adequate in light of the company’s current business practices.