ITAR Definitions and Technical Data · 2 of 5

Dual national and third-country national employees

← All Insights

In short

  • Foreign control is presumed at 25 percent foreign ownership, unless an American holder has as much.
  • Employers relying on screening must check staff for substantive contacts with listed countries.
  • Allied nationals may receive unclassified items without approval if five conditions are met.
Published1 October 2026
Last reviewed1 October 2026
Sources current as of1 October 2026

1. Who counts as an American person

The International Traffic in Arms Regulations (ITAR) define two kinds of person. An American person is a lawful permanent resident as defined in 8 U.S.C. 1101(a)(20), or a protected individual as defined in 8 U.S.C. 1324b(a)(3) (22 CFR 120.62). The term also covers any corporation, partnership, trust or other organization incorporated to do business in the United States, and any federal, state or local government entity. It does not include any foreign person.

A foreign person is any natural person who is not a lawful permanent resident or protected individual (22 CFR 120.63). The term also covers any foreign company or other group not incorporated or organized to do business in the United States. International organizations, foreign governments and their agencies, such as diplomatic missions, are foreign persons too.

2. Who counts as a regular employee

Several exemptions turn on whether someone is a regular employee. The term first means an individual permanently and directly employed by the company (22 CFR 120.64(a)(1)). It can also mean someone in a long term contractual relationship with the company, if a set of conditions is met (22 CFR 120.64(a)(2)). The individual must work at the company’s facilities, under its direction and control, full time and only for that company. The individual must also sign nondisclosure certifications for the company. The staffing agency that seconded the individual may have no role in the work beyond supplying the person. It also may not have access to controlled technology, unless a license specifically authorizes it.

3. Foreign ownership and foreign control

Two related terms describe companies. Foreign ownership means one or more foreign persons own more than 50 percent of a firm’s outstanding voting securities (22 CFR 120.65(a)). Foreign control means one or more foreign persons have the authority or ability to set or direct the firm’s general policies or day-to-day operations (22 CFR 120.65(b)). Foreign control is presumed where foreign persons own 25 percent or more of the voting securities, unless one American person controls an equal or larger share.

4. Why nationality matters abroad

Nationality matters because of how a release abroad is classified. Handing technical data, outside the United States, to an employee from a third country counts as a deemed reexport (22 CFR 120.51(a)(2)). The release is treated as a reexport to each country of the employee’s past or present citizenship and of present permanent residency (22 CFR 120.51(b)). If the employee is a citizen or permanent resident of the host country, the release is a retransfer (22 CFR 120.52(a)(2)). The definitions are covered in what counts as an export under the ITAR. Reexports and retransfers generally are covered in reexports, retransfers and end use assurances.

5. Transfers inside the foreign employer

Section 126.18 gives two ways to let dual and third-country national employees work with controlled items (22 CFR 126.18(a) and 22 CFR 126.18(d)). The first applies where the second cannot be used because of applicable domestic laws (22 CFR 126.18(a)). In that case, no approval from the Directorate of Defense Trade Controls (DDTC) is needed to transfer unclassified defense articles, including technical data, to or within an authorized foreign end user or consignee. The end user may be a foreign business, a foreign government entity or an international organization, including approved sublicensees. The transfer may go to dual nationals or third-country nationals who are bona fide regular employees, directly employed by that consignee or end user.

The transfer has to stay in one place (22 CFR 126.18(a)). It must happen entirely within the country where the end user is located, where the government entity or international organization conducts official business, or where the consignee operates. It must also be within the scope of an approved license, other export authorization or exemption.

6. Screening for diversion risk

The receiving organization must have effective procedures to prevent diversion to destinations, entities or purposes the authorization does not cover (22 CFR 126.18(b)). It can meet that condition in two ways before any transfer (22 CFR 126.18(c)). One is a security clearance approved by the host government for its employees (22 CFR 126.18(c)(1)). The other is a screening process together with a nondisclosure agreement, in which the employee promises not to pass defense articles on without the employer’s specific authorization (22 CFR 126.18(c)(2)).

Screening looks for substantive contacts with the restricted or prohibited countries listed in section 126.1 (22 CFR 126.18(c)(2)). Substantive contacts include regular travel there, recent or continuing contact with agents, brokers and nationals of those countries, and continued demonstrated allegiance to them. They also include business relationships with people from those countries, a residence there, salary or other continuing pay from them, and acts otherwise suggesting a risk of diversion. Nationality alone does not bar access. An employee with substantive contacts with persons from countries listed in section 126.1(d)(1) is presumed to raise a risk of diversion, unless DDTC decides otherwise. The employer keeps a technology security and clearance plan and keeps screening records for five years, available to DDTC for law enforcement purposes on request. The country list itself is covered in the ITAR policy of denial.

7. The route for allied nationals

The second route needs no domestic law trigger (22 CFR 126.18(d)). No DDTC approval is needed to reexport unclassified defense articles or defense services to dual or third-country national employees of an authorized end user, foreign signatory or consignee, if five conditions are met. The individuals must be regular employees of that organization (22 CFR 126.18(d)(1)). They must be nationals only of member countries of the North Atlantic Treaty Organization or the European Union, or of Australia, Japan, New Zealand or Switzerland (22 CFR 126.18(d)(2)). They must be within the territory of one of those countries, or of the United States, during the reexport (22 CFR 126.18(d)(3)).

The last two conditions concern paperwork and hardware. Each individual must sign a nondisclosure agreement, unless the employer is a signatory or sublicensee to an approved agreement under section 124.1 covering those articles or services (22 CFR 126.18(d)(4)). The individuals also may not receive any permanent transfer of hardware (22 CFR 126.18(d)(5)). Agreements under section 124.1 are covered in what a defense services agreement is.

8. Classified articles for Australian and British citizens

A narrower rule covers classified material (22 CFR 126.18(e)). No license is needed to reexport or retransfer classified defense articles to Australian or British citizens who are also nationals of another country. They must be Australian or British parties described in section 126.7(b)(2)(ii) or (iii), which covers the trilateral exemption, or regular employees of those parties. They must hold an Australian, British or American security clearance equal to Secret or above. They must also be within Australia, the United Kingdom or the United States, or serve in one of those countries’ armed forces and act in an official capacity. The trilateral exemption is covered in streamlined pathways for close allies.

Key terms

American personA lawful permanent resident, protected individual, American-incorporated entity or American government entity.
Foreign personAnyone or any entity outside the American person definition, including foreign governments.
Regular employeeA direct, permanent employee, or a closely controlled long term contractor.
Deemed reexportA release of technical data abroad to a foreign person from a third country.
Substantive contactsTies to listed countries that screening must look for, some of which create a presumed risk of diversion.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Mixed-nationality teams on the ground need these rules built into how work is staffed. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.