To verify a machine shop’s ITAR registration, request a copy of their current DDTC registration letter showing an active M-series registrant code and expiration date, confirm the entity name matches their legal business name, and cross-check their record in SAM.gov. The US State Department does not publish a public list of ITAR registrants, so direct documentation is the only reliable proof (Directorate of Defense Trade Controls, 2026). Registration must be renewed annually, costs $3,000 to $4,000 per year depending on tier (Federal Register, December 2024), and an expired letter means the shop cannot legally manufacture USML defense articles. Unauthorized handling exposes your program to civil penalties of up to $1,271,078 per violation (22 CFR §127.10, 2025).
Why Can’t You Just Look Up ITAR Registration Online?
The DDTC does not maintain a public, searchable database of ITAR registrants. Registration records are held by the State Department and disclosed only to the registrant, which means buyers must verify status through documentation supplied by the shop itself (DDTC, 2026). This is the single most misunderstood fact in defense sourcing.
Plenty of procurement teams assume there’s an official registry similar to the IAQG OASIS database used for AS9100 certificates. There isn’t. SAM.gov tells you whether a company is registered to do business with the federal government and whether it’s excluded from contracting, but SAM.gov does not confirm ITAR registration. The two systems are separate, and a shop can appear in SAM.gov while holding zero standing with the DDTC.
That gap is exactly where bad sourcing decisions happen. A shop’s website saying “ITAR compliant” carries no legal weight. The registration letter does.
What Documents Prove a Machine Shop Is ITAR Registered?
A valid DDTC registration letter is the only document that proves ITAR registration. It shows the registrant’s legal entity name, a unique M-series registrant code, the registration tier, and an expiration date (DDTC, 2026). Shops obtain it by filing Form DS-2032 with the State Department and paying the annual fee, which runs $3,000 for Tier 1 registrants and $4,000 for Tiers 2 and 3 under the fee schedule that took effect January 9, 2025 (Federal Register, December 2024).
Three details on that letter deserve close attention. First, the entity name must match the legal name of the company quoting your work, not a parent company or a sister shop across town. Second, the expiration date must be current, because registration lapses annually and a lapsed registration means the shop is operating outside the law if it continues USML work. Third, the registrant code itself, which you can reference in your purchase order and quality agreement.
If a shop hesitates to share a redacted copy of its registration letter under NDA, treat that as a disqualifying signal. Legitimate registrants share this document routinely.
The 5-Step ITAR Verification Checklist
A complete verification takes under one business day and requires five steps: request the DDTC registration letter, match the legal entity name, check the expiration date, cross-reference SAM.gov for exclusions, and confirm US-person access controls in writing (Rapidcision sourcing protocol, 2026).
| Step | What to Check | Pass Criteria | Source |
| 1. Registration letter | Current DDTC letter with M-series code | Letter dated within registration year | DDTC |
| 2. Entity match | Legal name on letter vs. name on quote | Exact match, no DBA confusion | State filings |
| 3. Expiration date | Annual renewal status | Date not passed; renewal in process if within 60 days | DDTC letter |
| 4. SAM.gov exclusions | Debarment or suspension records | No active exclusions | SAM.gov |
| 5. US-person controls | Written confirmation of access restrictions | Documented policy covering technical data | Shop’s compliance manual |
Table: ITAR verification steps for machining buyers. Sources: DDTC registration requirements (22 CFR Part 122), SAM.gov exclusion records, 2026.
Step 5 matters more than most buyers realize. ITAR restricts defense technical data to US persons, defined as US citizens and lawful permanent residents (22 CFR §120.62). A registered shop that lets foreign-person employees view your controlled drawings is committing a deemed export violation with your data. Ask for the shop’s written technical data handling policy before the first file transfer.
What Questions Should You Ask Beyond Registration?
Registration proves legal standing, not operational security. Ask five follow-up questions: who is the shop’s Empowered Official, how is controlled technical data segregated, what cybersecurity framework covers their network, how long are export records retained, and has the shop filed any voluntary disclosures (DDTC compliance guidelines, 2026).
Strong answers look like this. The Empowered Official is a named senior employee, not “our quality manager handles that.” Technical data lives on access-controlled servers aligned with the 110 security controls in NIST SP 800-171 Rev. 2, the framework defense primes increasingly require of their supply chain (NIST, 2020). Records are kept for the five-year minimum that ITAR mandates (22 CFR §122.5). And a past voluntary disclosure is not automatically a red flag, because the DDTC treats self-reporting as a mitigating factor; a shop that found a problem and disclosed it often runs a more mature program than one claiming a spotless record it never audited.
What Are the Risks of Working With an Unverified Shop?
Sending USML technical data to an unregistered or non-compliant shop exposes the data owner to civil penalties of up to $1,271,078 per violation or twice the transaction value, whichever is greater, plus criminal penalties of up to $1 million and 20 years imprisonment per willful violation (22 CFR §127.10; 22 U.S.C. 2778, 2025). Liability does not stop at the shop. The party that exported the data carries exposure too.
Beyond penalties, there’s the debarment risk. Companies found in violation can lose export privileges entirely, which for a defense supplier is a business-ending outcome. Prime contractors know this, which is why flow-down clauses in defense subcontracts increasingly require documented verification of every shop in the chain. If your customer audits your supplier file and finds a screenshot of a website badge instead of a registration letter, you fail that audit.
Understanding the quality standards a shop holds — AS9100D, ISO 9001, NADCAP — is important, but none of those certifications substitute for ITAR registration. AS9100D governs quality management systems; ITAR governs who is legally permitted to handle defense articles. They answer different questions, and your compliance file needs both. For a deeper look at how these certifications stack up across suppliers, see our comparison of the top aerospace CNC machining companies in the USA.
How Does Rapidcision Handle ITAR Program Verification?
Rapidcision maintains active DDTC registration, AS9100D certification, and ITAR designation at the point of CAD upload, with controlled files routed exclusively to US-person engineering review (Rapidcision, 2026). Buyers receive the registration letter, entity documentation, and the written technical data handling policy during supplier onboarding, before any controlled file changes hands.
The quoting system flags ITAR programs at upload so controlled data never enters the standard international quoting pool. That separation is structural, not procedural, which removes the single most common failure mode in distributed manufacturing networks: controlled files touching uncontrolled infrastructure. To see how ordering works from file upload through delivery, visit our process overview.
Have an ITAR-controlled program to verify and quote? Upload your STEP file at rapidcision.com and request our registration documentation in the same step.
Questions fréquemment posées
Is there a public list of ITAR registered companies? No. The DDTC does not publish a registrant list (DDTC, 2026). Verification requires requesting the shop’s current registration letter directly. SAM.gov confirms federal contracting status and exclusions but does not confirm ITAR registration, so use it as a supplement, never a substitute.
How much does ITAR registration cost a machine shop in 2026? Tier 1 registrants pay $3,000 per year and Tier 2 and Tier 3 registrants pay $4,000 per year under the fee schedule effective January 9, 2025, the first increase since 2008 (Federal Register, December 2024). Tier 3 registrants also pay $1,100 per favorable determination beyond five.
How often must ITAR registration be renewed? Annually. A shop whose letter has expired cannot legally manufacture defense articles until renewal completes (22 CFR Part 122). Always check the expiration date on the letter, not just its existence.
Does ITAR registration mean a shop is ITAR compliant? No. Registration is a legal filing; compliance is the daily practice of access controls, recordkeeping, and licensed exports. A registered shop with weak controls is still a violation risk. Verify both the letter and the written compliance program.
What is an M-series registrant code? The unique identifier the DDTC assigns to each registered entity, printed on the registration letter. Reference it in purchase orders and quality agreements so your supplier file ties the shop to a specific, verifiable registration.
Can a foreign-owned machine shop be ITAR registered? US-located entities with foreign ownership can register, but access to technical data still requires US persons, and foreign ownership triggers additional DDTC scrutiny (22 CFR §122.2). Ask directly about ownership structure during onboarding.
What records must an ITAR shop keep, and for how long? Records of manufacturing, exports, and related transactions must be maintained for five years (22 CFR §122.5). Ask how records are stored and produced during an audit.