State Department Relaunches Company Visit Program to Assess ITAR Compliance

The Directorate of Defense Trade Controls (“DDTC”) within the State Department has relaunched its “Company Visit Program.”  Under the Company Visit Program, DDTC officials come to your office to review your company’s compliance activities under the International Traffic In Arms Regulations (“ITAR”).  DDTC has recently resumed conducting company visits and has issued additional information about the program - every company that is regulated under ITAR should be familiar with this.

Under the program, companies are selected for a visit under DDTC’s screening criteria.  Two or more officials from DDTC’s Compliance Office will conduct the visit.  Visits last 1-2 days.  During the visits, the DDTC officials meet with senior executives and company compliance personnel and review the company’s compliance activities.

­

DDTC has recently issued additional information about the program, including a series of Frequently Asked Questions.[1]  The following are a number of these FAQ’s that are instructive:

What is the Company Visit Program?

The Company Visit Program (CVP) entails visits by Directorate of Defense Trade Controls (DDTC) officials to U.S. entities registered with DDTC as manufacturers, exporters, or brokers of defense articles and defense services, as well as others involved in ITAR-regulated activities, to include foreign companies and foreign governments. The CVP is administered by the Office of Defense Trade Controls Compliance (DTCC); however, representatives from DDTC’s Licensing and Policy offices, or other entities in the Department or elsewhere in the U.S. government, may also participate in the visits.

What is the purpose of the Company Visit Program?

The CVP has several purposes. First, the CVP ensures DTCC understands how compliance programs are implemented in accordance with the International Traffic in Arms Regulations (ITAR). Second, the program enables DDTC to gather information to support the Directorate’s development of regulatory policy and practice. Finally, DTCC uses site visits to glean, assess, and disseminate industry best practices, provide feedback to individual companies on their compliance programs, and share information on compliance programs industry-wide. …

How is the DDTC team staffed for each CVP visit?

A CVP team typically consists of two or more staff from DTCC, depending on the size of the individual company/site being visited and number of companies/facilities visited per trip. On some CVP visits, staff members from the Offices of Defense Trade Controls Licensing and Policy, or other relevant agencies, may participate. One DTCC team member serves as team lead and primary point of contact with the company. This primary contact is responsible for coordinating the site visit with the company.

How is a CVP visit conducted and what should a company expect?

• Once a company is selected for a potential CVP visit, DTCC contacts the company. The company can elect not to participate in the visit. If the company would like to participate, DTCC will propose visit dates and begin planning with the company.
• Once visit dates are finalized, DTCC sends the company a formal visit notification letter outlining the visit. DTCC may request pre-visit materials from the company for review and preparation purposes. Before the visit, DTCC will work with the company to finalize the agenda.
• At the visit's opening, DTCC meets with senior management to explain the visit's purpose and the agenda. The company should provide an overview of its operations and export activity during opening discussions. Visits generally last one to two days, depending on the purpose, and occur on the company's premises in offices and conference rooms, and through tours of business operations within the facility (e.g., business development, contracts, procurement, design, manufacture, security, IT, personnel, and shipping).
• At the visit's conclusion, the DDTC team briefs company senior management and export control staff to share information the team gathered. DDTC invites the company to provide feedback, ask questions, or raise concerns for follow-up.
• The DDTC team returns to the Department and generates an internal report. The team also follows up on company feedback. DTCC will send a formal close-out letter to the company. Close-out letters summarize the visit, indicate best practices, recommend areas for improvement or suggest best practices, and address feedback, questions, or concerns raised by the company. DTCC also requests feedback on the visit's quality and usefulness and suggestions for improving the program.

Are Blue Lantern Checks the same as Company Visits for foreign companies?

The Blue Lantern program is not the same as the Company Visit Program. The Office of Defense Trade Controls Policy manages the Blue Lantern program; end-use checks are conducted by embassy personnel overseas and focus on end-user and end-use verifications related to DDTC authorizations.

It is important to be ready if DDTC requests a visit with your company.   Companies are advised not to wait until the last minute but rather have their ITAR compliance house in order in prior to being contacted for a visit.   This includes:

1. Having the company’s Compliance Program and policies and procedures implemented and distributed to key employees;
2. Having conducted ITAR training for key employees;
3. Making sure that the company has the proper licenses, technical assistance agreements (TAA’s), reexport/retransfer authorizations and other authorizations as required for its business;
4. Properly decrementing export and import licenses, and proper use of destination control statements;
5. Proper TAA administration (including amending TAA’s to reflect changes in programs, having TAA’s properly executed, filing TAA’s with DDTC, etc.);
6. Having proper controls in place for ITAR-controlled technical data, including for foreign national employees and controls for the company’s data system;
7. Proper compliance with the ITAR recordkeeping requirements;
8. Proper ITAR registration, including updating registration statements for changes in information contained in the company’s registration statement and registration for affiliates and brokering activities;
9. Compliance with the ITAR brokering requirements, including registration,  advanced authorization, reporting and recordkeeping requirements; and
10. Filing reports for the payment of sales commissions and payments under ITAR Part 130.

Of course, companies should be in full compliance with ITAR not just to avoid problems with DDTC office visits, but to also otherwise avoid liability for ITAR violations, including civil and criminal penalties of up to $1 million in fines and 20 years imprisonment.

The best defense is a good offense – companies should plan in advance and be prepared to avoid more serious problems later on.  And “later on” may now come sooner than you think.