What Is an ITAR Voluntary Disclosure and Why It Matters
When a defense contractor discovers a potential violation of the International Traffic in Arms Regulations, the instinct is often to quietly fix the problem and move on. That instinct is understandable, but it is frequently the wrong call. The Directorate of Defense Trade Controls (DDTC) has a formal voluntary disclosure program that, when used correctly, can significantly reduce penalty exposure, preserve registrant status, and demonstrate the kind of good-faith compliance behavior that regulators reward.
Filing an ITAR voluntary disclosure is not an admission of guilt in the criminal sense. It is a proactive communication to DDTC acknowledging that a potential violation occurred, explaining the circumstances, and describing the remediation steps your organization has taken or is taking. Companies that self-report violations consistently receive more favorable outcomes than those where DDTC discovers the issue through an audit, a third-party complaint, or an enforcement referral from another agency.
This guide walks compliance managers and executives through the decision to disclose, the preparation process, and the submission mechanics. If you are working through a live incident right now, the most important message is this: do not delay, do not destroy records, and do not communicate externally about the incident without legal counsel involved.
When You Are Required to File
ITAR voluntary disclosures are not technically mandatory under the Arms Export Control Act in every scenario, but DDTC's guidance and enforcement history make the calculus clear. If you have credible evidence of a violation, disclosure is almost always in your organization's best interest. Situations that typically require serious consideration of voluntary disclosure include:
- Unauthorized export or re-export of defense articles or technical data to a foreign national or foreign country
- Unlicensed transfers of ITAR-controlled technical data via email, cloud platforms, or physical media
- Expired or improperly used export licenses
- Failure to obtain required DDTC authorization before conducting brokering activities
- Violations discovered during an internal audit, merger due diligence, or employee departure
- Inadvertent disclosure of controlled technical data to foreign nationals without a valid license or applicable exemption
If you are unsure whether your situation rises to the level of a reportable violation, that uncertainty itself is a signal to engage qualified ITAR and export controls compliance support immediately. Attempting to make that determination internally without regulatory expertise is one of the most common mistakes we see.
For additional context on the types of violations that lead to DDTC enforcement actions, review our detailed post on ITAR violations and compliance guidance for managers.
Step 1: Contain the Incident and Preserve Evidence
Before you write a single word of a disclosure, you need to stop the bleeding and preserve the record. This means:
- Suspend the activity that caused or contributed to the potential violation immediately.
- Secure all relevant records including emails, shipping documents, technical data transfers, license files, visitor logs, and access control records.
- Issue a litigation hold notice to relevant personnel instructing them not to delete, alter, or discuss the matter outside of privileged communications.
- Restrict internal communications about the incident to those directly involved in the response, and ensure those communications flow through legal counsel to preserve privilege where possible.
What you do in the first 48 to 72 hours after discovering a potential violation will significantly shape your disclosure narrative and your regulatory outcome. Sloppy evidence preservation or premature internal communications that later surface in a DDTC review can undermine an otherwise well-structured disclosure.
Step 2: Conduct a Privileged Internal Investigation
A voluntary disclosure must be factually accurate and complete. DDTC does not look favorably on disclosures that are later found to have omitted material facts. This means you need to understand the full scope of what happened before you submit anything.
Your internal investigation should answer these questions:
- What specific ITAR-controlled item, technology, or technical data was involved?
- What U.S. Munitions List (USML) category applies?
- Who was involved, including foreign nationals, foreign entities, or foreign governments?
- What was the timeline of the violation, from origination to discovery?
- Was a license required, and if so, was one in place?
- What was the root cause: process failure, training gap, technology misconfiguration, or deliberate misconduct?
- Has this type of violation occurred before, and if so, was it previously disclosed?
Conduct this investigation under the direction of legal counsel to protect the findings from discovery. Engage your compliance team and, where appropriate, outside ITAR export controls compliance consultants to help assess the regulatory implications of your findings.
Step 3: Determine the Scope and Structure of Your Disclosure
DDTC accepts two types of voluntary disclosures: initial notifications and final disclosures. Understanding both is important.
Initial Notification
If your investigation is ongoing but you have enough information to confirm that a potential violation occurred, you should file an initial notification with DDTC promptly. This notification establishes the disclosure date, which protects you in the event DDTC learns of the issue through another channel before your final submission is ready. The initial notification does not need to contain every detail, but it must convey the nature of the violation and confirm that a full disclosure is forthcoming.
Final Disclosure
The final disclosure is the comprehensive document that DDTC will evaluate. It must include:
- A complete factual description of the violation, including who, what, when, where, and how
- The specific ITAR provisions believed to have been violated, including the relevant USML category and regulatory citations
- The number of transactions or instances involved
- The identities of all parties involved, including foreign recipients where known
- A description of the corrective actions already implemented
- A plan for any remediation still in progress, with timelines
- Supporting documentation, including transaction records, communications, and internal investigation findings
DDTC expects disclosures to be thorough, organized, and professionally presented. A poorly structured submission signals weak compliance infrastructure and can invite more scrutiny rather than less.
Step 4: Implement Corrective Action Before You Submit
One of the most effective ways to demonstrate good faith in a voluntary disclosure is to show that your organization did not wait for DDTC to tell you what to fix. Remediation actions that are already implemented at the time of submission carry significantly more weight than plans that have not yet been acted upon.
Corrective actions may include updating or creating written ITAR compliance policies, conducting targeted employee training, revising access controls for ITAR-controlled technical data, implementing new license tracking procedures, or restructuring how your organization handles foreign national access. If your compliance program lacks foundational structure, this is also the time to engage outside support for compliance program development so that your disclosure reflects a program moving toward maturity rather than one that is reactive.
For companies that need practical training resources to support remediation, our ITAR Compliance Made Easy guide and ITAR and Export Controls Fundamentals reference are tools your team can deploy quickly.
Step 5: Submit the Disclosure to DDTC
Voluntary disclosures are submitted to DDTC's Office of Defense Trade Controls Compliance. Submissions must be made in writing and addressed to the Director of the Office of Defense Trade Controls Compliance. DDTC now accepts electronic submissions through its online portal in addition to paper submissions.
Your submission package should include a cover letter, the disclosure narrative, all supporting documentation organized by exhibit, and any prior correspondence with DDTC related to the matter. If an initial notification was filed, reference it in your final submission with the original submission date.
After submission, DDTC will acknowledge receipt and assign a case number. The review timeline varies depending on the complexity and severity of the violation, but routine cases are often resolved within six to twelve months. DDTC may request additional information, conduct interviews, or issue a charging letter if it determines the matter warrants a penalty. In many voluntary disclosure cases, DDTC issues a warning letter, a directed compliance review, or closes the matter with no formal action.
Common Mistakes That Undermine Voluntary Disclosures
Having reviewed and supported numerous voluntary disclosure processes, the mistakes that most consistently damage outcomes include:
- Filing an incomplete initial notification that omits key facts discovered later, creating the appearance of a staged or strategic disclosure
- Submitting a final disclosure before the internal investigation is truly complete
- Overstating or understating the scope of the violation in ways that are contradicted by the documentary record
- Failing to implement any corrective action before submission
- Allowing the disclosure narrative to be written by someone without ITAR regulatory expertise
- Missing the connection between the violation and a systemic compliance weakness that DDTC will independently identify
Understanding how DDTC examines these submissions requires familiarity with the agency's enforcement priorities and disclosure review criteria. Our blog post on the 15 items DDTC examiners look for in an ITAR export control compliance audit provides useful context for how reviewers approach the record.
The Role of a Compliance Program in Disclosure Outcomes
DDTC explicitly considers the strength of an organization's compliance program when determining enforcement outcomes. A company with a documented, functioning ITAR compliance program that experienced an isolated violation will consistently fare better than a company with no meaningful compliance infrastructure. This is not a theoretical point. It is reflected in consent agreements, charging letters, and DDTC guidance documents.
If your organization is navigating a disclosure and your compliance program is underdeveloped, the time to address that is now, not after DDTC concludes its review. Our team at Cleared Systems provides ITAR and export controls compliance services specifically designed to help organizations build defensible programs that hold up under regulatory scrutiny.
Organizations in the aerospace and defense sector facing disclosure scenarios will also find sector-specific context in our overview of aerospace and defense compliance considerations.
Work With Experienced ITAR Voluntary Disclosure Support
Filing a voluntary disclosure is one of the most consequential compliance actions your organization can take. Getting it right requires regulatory knowledge, factual discipline, and a clear understanding of how DDTC evaluates both the violation and the organization behind it. At Cleared Systems, we provide hands-on ITAR voluntary disclosure support from initial incident assessment through final submission and DDTC follow-up. If you are dealing with a potential ITAR violation right now, do not wait for the situation to escalate. Contact us to request a confidential consultation and let our team help you protect your registration, your contracts, and your reputation.