ITAR Recordkeeping Requirements Under 22 CFR §122.5

Recordkeeping is one of the most frequently overlooked — and most frequently cited — areas of ITAR compliance. DDTC audits, voluntary disclosures, and enforcement actions regularly surface recordkeeping deficiencies as either the primary violation or as an aggravating factor. For companies registering with DDTC for the first time, understanding what records you must keep is a compliance fundamental.

This guide covers what 22 CFR §122.5 requires, which records are covered, retention periods, and how to build a documented recordkeeping program.

Who Is Subject to 22 CFR §122.5?

The recordkeeping obligation under §122.5 applies to all persons required to register with DDTC under 22 CFR Part 122. That means:

• U.S. persons who manufacture or export defense articles
• U.S. persons who furnish defense services
• Persons who broker defense articles or defense services

Registration is not optional if you are in the business of manufacturing or exporting USML-controlled items. The requirement applies to the registrant — the legal entity holding the DDTC registration — and its compliance program extends to all employees and agents who handle ITAR-controlled transactions.

What Records Must Be Kept?

Under 22 CFR §122.5, registrants must maintain records of all transactions involving:

• Defense articles — the export, temporary import, or transfer to a third country of USML-controlled hardware
• Defense services — the furnishing of technical assistance, training, or other services related to USML articles
• Brokering activities — facilitating the transfer of defense articles or services between foreign parties

The regulation covers the full transaction record, which typically includes:

Export and transfer records:

• Export licenses (DSP-5, DSP-73, DSP-85) or license exemption citations used
• Shipper's export declarations or Electronic Export Information (EEI) filings
• End-user statements and delivery verification (when required by license conditions)
• Commercial invoices, packing lists, and shipping documentation
• License application records and DDTC correspondence

Technical data and defense services:

• Records of technical data disclosures (drawings, specifications, manufacturing data) to foreign persons
• Defense services agreements and contracts with foreign parties
• Records of ITAR technical data transmitted electronically (including email, cloud file sharing, remote access)

Licensing correspondence:

• All communications with DDTC, including commodity jurisdiction requests, advisory opinions, and license applications
• Records of license conditions and compliance with those conditions

How Long Must Records Be Retained?

The regulation specifies a retention period of five years. The trigger date is generally calculated from the date of the transaction or export, though the specific calculation (from export date, license issuance date, or license expiration date) can vary by record type. Consult the actual regulation and qualified counsel to confirm the applicable trigger for your specific records.

The practical implication: a company that received a DDTC export license in 2021 and shipped under it in 2022 should expect that the complete licensing and shipping record set must be available through at least 2027.

Five years is the minimum. Many compliance programs extend records retention to seven or ten years to provide additional margin, particularly for transactions involving sensitive USML categories or countries with heightened scrutiny.

Format and Availability Requirements

22 CFR §122.5 does not specify a required storage format. Records may be maintained in paper or electronic form, provided they are:

1. Complete and accurate — the record must reflect the actual transaction, not a summary
2. Legible — records must be readable and able to be produced in a form DDTC can review
3. Available upon request — DDTC has the authority to inspect records, and your program must be able to produce requested records promptly

Electronic recordkeeping systems are standard at most DDTC-registered companies. If using a document management system, ensure that records are stored in a tamper-evident or immutable format where possible — any alteration of export records after the fact can be read as evidence of attempted concealment and significantly increases enforcement exposure.

The ITAR Screen Screening Record

ITAR Screen's classification records are designed with 22 CFR §122.5 in mind. Every classification is:

• Timestamped at the moment of generation, with the exact input, AI model version, and USML category output recorded
• Immutable — records cannot be edited or deleted after creation
• Exportable as PDF or XML for inclusion in your DDTC audit file or legal review binder
• Retained for 10 years — double the regulatory minimum

For defense contractors using ITAR Screen as part of their product classification program, the platform's screening records support the recordkeeping obligation for classification screening results. It does not replace records of the underlying export transactions (licenses, EEI, shipping docs), which must be maintained separately in your broader ITAR compliance program.

Common Recordkeeping Failures

Failure to capture technical data disclosures. Many companies track hardware exports carefully but fail to record ITAR technical data furnished to foreign persons — including foreign national employees, foreign customers receiving drawings, and foreign partners under development agreements. Every disclosure of ITAR-controlled technical data to a foreign person (physically present in the U.S. or abroad) is a transaction that must be recorded.

Inadequate license condition compliance documentation. Export licenses frequently contain conditions — delivery verification requirements, end-use monitoring, or reporting obligations. Failing to document compliance with license conditions is a recordkeeping deficiency in addition to potentially being a substantive violation.

Retention gaps during system migrations. When companies switch ERP systems, compliance software, or document management platforms, records from legacy systems can be lost or become inaccessible. Migration planning must explicitly include the preservation of ITAR records through their full retention period.

No records for exempt transactions. License exemptions don't eliminate the recordkeeping requirement. Transactions conducted under 22 CFR Part 123 exemptions must still be documented — the exemption used, the basis for eligibility, and the transaction details.

Missing predecessor records after M&A. When a company acquires another DDTC registrant, ITAR compliance obligations — including recordkeeping responsibilities for pre-acquisition transactions — transfer with the registration. Due diligence and post-acquisition compliance reviews should verify that acquired records are complete and accessible.

Building a Documented Program

A basic ITAR recordkeeping program should include:

1. A records inventory — what categories of records you generate, where they live, and who is responsible for each
2. A retention schedule aligned to the 5-year regulatory minimum with internal policy typically at 7–10 years
3. An annual records review to identify and address gaps before an audit or voluntary disclosure
4. Access controls — ITAR records should not be accessible to foreign nationals without appropriate license or exemption authority
5. Legal hold procedures — the ability to suspend automatic deletion in the event of a government inquiry or internal investigation

ITAR recordkeeping failures, even when they don't reflect underlying substantive violations, signal to DDTC that a company's compliance program is inadequate. Documenting your classification decisions, export transactions, and technical data disclosures proactively is far less painful than reconstructing records during an audit.

This article is for informational purposes only and does not constitute legal advice. Consult qualified export control counsel before making compliance decisions.