State Department Revises ITAR Voluntary Disclosure Rules

60-Day Deadline Imposed

On December 13, the U.S. Department of State announced changes to the Voluntary Disclosure provisions of the International Traffic in Arms Regulations (ITAR), effective immediately. The amended regulations now impose a requirement that a complete voluntary disclosure be submitted within 60 calendar days of initial notification to State of the discovery of a violation, which must be supplied immediately after the discovery.

The voluntary disclosure regulations, found at 22 C.F.R. § 127.12, are designed to encourage disclosure to the Directorate of Defense Trade Controls (DDTC) of any violations of the export control provisions of, or any authorizations issued under the authority of, the Arms Export Control Act. Specifically, the regulations provide that a disclosure may be considered a mitigating factor in determining whether and to what degree administrative penalties may be imposed for the violation. In practice, many companies have found the voluntary disclosure program to be an effective tool, and have taken advantage of the opportunity to benefit from penalty mitigation in exchange for explaining to DDTC their prior violations and how they will be prevented from recurring.

As the focus on compliance has increased in recent years, so has the number of disclosures submitted to DDTC and the time involved in managing the program. In order to expedite the process, and to eliminate perceived abuses by exporters, DDTC has amended the regulations to require full disclosure within the 60 calendar day period following initial notification. A failure to complete full disclosure to DDTC’s satisfaction within the 60-day period may result in a determination by DDTC not to consider the notification as a mitigating factor in its assessment of the appropriate penalties. An allowance has been made for the request of an extension of the period where a full investigation and reporting of the violation cannot be completed within the 60 days.

The specific amendments to the ITAR regulations are as follows:

• A new section, 127.12(c)(1)(i) - Where the initial notification to DDTC is not a full disclosure of the violation, the full disclosure must be submitted to DDTC within 60 calendar days of the initial notification. If full disclosure is not completed within the 60 days, DDTC “will not deem the notification to qualify as a voluntary disclosure.”
• A new section, 127.12(c)(1)(ii) - Where full disclosure cannot be completed within 60 calendar days of the original notification, an empowered official or senior officer may request an extension of the 60- day period. Such request must be in writing and must specify what information ordinarily required in a disclosure cannot be immediately provided and the reasons why.
• A new section, 127.12(c)(1)(iii) - Before approving a request for extension under Section 127.12(c)(ii), DDTC may require a certification in writing from the requester that the full disclosure will be completed within a specified time period.
• A new section, 127.12(c)(1)(iv) - Failure to complete a disclosure within a “reasonable time” may result in a determination by DDTC not to consider the notification as a mitigating factor. This section also authorizes the DDTC, in its discretion, to direct the discloser to furnish DDTC all relevant information surrounding the violation.

DDTC has also amended the regulations to clarify and expand upon the information required to be included in any voluntary disclosure. The amended disclosure content regulations are found in Sections 127.12(c)(2) and (3), and are as follows:

• Section 127.12(c)(2)(iii) - Formerly required the provision of information on individuals and entities “involved in the activities giving rise to the violation,” and is now expanded to include “all persons known or suspected to be involved in the activities giving rise to the violation.” The term persons as used here includes natural and corporate persons. In addition, whereas previously the regulations required the provision only of the addresses of those involved, they now require the provision of “any known information” regarding those named, to include mailing, shipping, and e-mail addresses, telephone and facsimile numbers.
• Section 127.12(c)(2)(vi) - Expands the former requirement to provide a description of corrective actions already undertaken in response to the violation to a requirement to provide a description of corrective actions that clearly identify new compliance measures implemented to address the specific violation, a reporting of disciplinary action taken, and an explanation of how the corrective and disciplinary actions will deter a recurrence of the particular violation.
• Section 127.12(c)(3) - Expands the factors to be addressed in a voluntary disclosure to include “whether the violations are systemic; and the details of compliance measures, processes and programs, including training, that were in place to prevent such violations, if any.”

Finally, DDTC has amended the certification requirements for voluntary disclosures, Section 127.12 (e), to ensure that the highest levels of management take responsibility for compliance with the ITAR. Whereas previously voluntary disclosure certifications were required to be signed by the empowered official, DDTC may now require the certification of a senior officer of the company where it deems the violation to have been major, or the disclosure reveals systemic patterns of violations or the absence of an effective compliance program. DDTC has not indicated whether preliminary notifications of voluntary disclosures submitted prior to the effective date of the new regulations are to be considered retroactively subject to the regulations. This regulatory revision obviously increases the time pressure on companies that use the DDTC voluntary disclosure provisions. Even with the increased pressure to complete the investigation surrounding a violation and submit the final report, the benefits of voluntary disclosure will likely continue to outweigh the risk of administrative penalties for the subject violations.

Source: Pillsbury Law

— Thomas M. deButts & Michael J. Noonan, pillsburylaw.com