7/21/25 4:15 PM7 min read

Addressing FAQs About the Consequences of ITAR Violations

Addressing FAQs About the Consequences of ITAR Violations - Export Compliance Training Institute

8:50

Every item on the U.S. Munitions List (USML) has been deemed by the U.S. government to have national security implications, so exporting products, services and technologies that are subject to the ITAR is serious business. The people in the private sector who have responsibility for export compliance take that to heart.

The first thing to know is that the rules are actively enforced, with both the State Department and the Department of Justice putting manpower to the task.

At ECTI’s ITAR-related seminars, both at home and abroad, we get a lot of questions about the penalties for export violations under the ITAR. So addressing the most frequently asked questions seems like a good topic for a blog too.

[See a list of on-demand webinars related to exports subject to the ITAR]

Who bears responsibility for violations?

The first assignment of responsibility for export violations under the ITAR’s authorizing statute – the Arms Export Control Act (AECA) – is simple: It’s the individual or entity who took whatever action violates the regulations. So a business that exports any item found on the USML is responsible for any rules that may be broken. It gets worse – the regulations also hold the exporter responsible for acts of employees, agents, brokers, and all authorized persons that touch the defense article.

And there’s more. It is also a violation to conspire to export, import, reexport, retransfer, furnish anything subject to the ITAR without authorization, or to knowingly or willfully attempt, solicit, cause, or aid, abet, counsel, demand, induce, procure, or permit the commission of any act prohibited by, or the omission of any act required by the AECA or the ITAR. So downstream parties providing goods or services related to an ITAR export transaction also need to know and follow the rules.

And because the ITAR also regulates the reexport and retransfer of items after they’ve been exported, foreign companies and individuals can also find themselves subject to penalties.

In 2020, for example, France-based Airbus agreed to pay nearly $4 billion in penalties for using third-party business partners to help win contracts by bribing foreign government officials. The penalty was apportioned among the United States, France and the United Kingdom, each of which has its own anti-bribery law.

It’s a nuance that the ITAR doesn’t actually prohibit bribery; that’s a violation of the Foreign Corrupt Practices Act (FCPA).

But the ITAR does require disclosure of any commissions or payments made to third parties—without regard to their legality. So the ITAR violation allowed regulators to open the case and investigate further. It’s comparable to Al Capone going to prison for tax evasion rather than the bootlegging, gambling and other criminal activities.

Are violations civil or criminal?

Violations under the ITAR may be treated as either civil or criminal, with intent being a major factor in the decision.

Investigations often begin with the State Department—which oversees ITAR administration through its Directorate of Defense Trade Controls (DDTC). For most civil violations, it has a low standard to meet: evidence that someone exported an item on the USML without a license or other form of written approval.

If the State Department believes a violation was intentional or part of a pattern of behavior, it may refer the case to the Justice Department for criminal investigation and prosecution. That comes with a higher burden of proof that the violation was willful.

Violations that are listed in Part 127.1 of the ITAR. The big categories include:

Attempting to export, re-export or retransfer a defense article, service or data without proper approval.
Engaging in brokering [see related article: Arms Brokering and the ITAR] of defense articles without a valid registration—which requires annual renewal and payment of a fee.
Manufacturing even a single item on the USML without a current registration as a manufacturer of defense articles.
Misrepresenting or omitting facts from required disclosures and filings.
Violating the terms of a valid export license.

The most common violations tend to involve the omission of information from license applications or other filings. For example:

Leaving out an intermediary party to the transaction that you think the DDTC wouldn’t approve of.
Glossing over details about the end-user.
Failing to disclose other possible end-uses of a controlled item.

Any of these violations might be pursued as either civil or criminal—depending on the specifics.

The important learning point is that there’s real risk in trying to massage the information you provide in order to get the approval you want. The best practice is to put all the details on the table and let the chips fall.

What are the consequences of a violation?

Criminal violations of the AECA can carry a fine of up to $1 million per incident and imprisonment for up to 20 years. But in high-profile cases, the fines are often much higher because they can involve the FCPA and other laws. For example, defense contractor Raytheon Co. (a subsidiary of the company now known as RTX) agreed in October 2024 to pay a $950 million settlement in a case that involved both criminal charges and civil complaints around not only the ITAR and AECA, but also the FCPA, the Federal Acquisition Regulation and the False Claims Act (enacted in 1863 to address defense contractor fraud during the Civil War).

While the criminal cases draw a lot of attention, most people are trying to comply with the rules. Some may not have the resources they need to do the job; others may be undertrained or even negligent. And sometimes there are simply oversights or inadvertent omissions of information. Violations in these categories don’t usually get charged with a crime.

As of 2025, the civil penalty for AECA/ITAR violations was $1,271,078 per violation, or twice the value of the transaction that is the basis for the violation. (The maximum fine is routinely adjusted for inflation, which is why it’s not a round number.)

But fines and prison aren’t the only possible consequences. Goods can be detained or seized by U.S. Customs and Border Protection or Homeland Security Investigations, and after due process may be forfeited.

In criminal cases, individuals and organizations alike may face statutory debarment, which prohibits them from participating even indirectly in any activities subject to the ITAR.

For civil cases, administrative debarment carries the same consequence, though it’s rare for the State Department to take that action.

Other consequences include reputational harm and the high cost – in time and money – to defend against a civil violation or criminal referral.

What are the most effective ways to mitigate risk?

The first and best protection against costly ITAR violations is competence. People who handle export compliance under the ITAR need to receive ongoing training, practice and support in their work.

They also need proper tools for managing the compliance process [see related article: Key Components of an Export Compliance Program].

If an error or omission is discovered in a transaction, the DDTC offers a voluntary disclosure process that’s designed to serve “as a mitigating factor in determining the administrative penalties, if any, that should be imposed.”

Voluntary disclosure isn’t intended as a whistle-blower outlet; it’s designed to encourage self-reporting and it only applies “when information is received … [before any] department of the United States Government obtains knowledge of either the same or substantially similar information from another source and commences an investigation….”

The rule states that disclosure must be made as soon as a violation is discovered. Once reported, the rule allows another 60 days to collect and file all the information required by DDTC.

The process is used hundreds of times a year, and as long as DDTC determines the disclosure is complete and truthful, these cases rarely result in penalties.