Small and midsize companies increasingly sell overseas, buy components from foreign suppliers and hire engineers who hold foreign citizenship. Each of those steps can bring a company within reach of federal rules that were once associated mainly with large defense contractors and multinational corporations. Colorado’s aerospace, defense and technology sectors make these questions especially common for businesses along the Front Range. This article explains how the International Traffic in Arms Regulations and the Foreign Corrupt Practices Act apply to growing companies, where compliance problems usually start, and how a basic program can reduce the risk.
What ITAR Covers
The International Traffic in Arms Regulations, administered by the State Department’s Directorate of Defense Trade Controls, govern the export and temporary import of defense articles and defense services listed on the United States Munitions List. The list covers far more than weapons. It includes components, software and technical data related to military aircraft, spacecraft, satellites, electronics, night vision and many other categories.
Companies that manufacture, export or broker items on the Munitions List generally must register with the Directorate of Defense Trade Controls, even if they do not currently export anything. Exports usually require a license or another form of approval, and the definition of export is broad. Sending technical drawings to a foreign supplier, sharing controlled data through a cloud service or giving a foreign national employee access to controlled technical information inside the United States can all count as exports under the regulations.
Businesses that are uncertain whether their products fall under ITAR or under the Commerce Department’s Export Administration Regulations often turn to ITAR compliance counsel to review classification before a shipment, a contract or a hiring decision. Classification drives everything that follows, since an item controlled under ITAR faces stricter rules than one controlled under the Commerce Control List.
Where Small Companies Get Caught
Many ITAR problems begin with ordinary business activity. A startup wins a subcontract from a defense prime and receives drawings marked as controlled technical data. A machine shop emails files to an overseas vendor for a quote. An engineering firm hires a talented engineer who is not a U.S. person and gives that employee access to the shared server. In each case, the company may have made an unauthorized export without realizing it.
Penalties can be significant. Civil penalties for ITAR violations can be substantial for each violation, and willful violations can lead to criminal prosecution. Companies that discover a problem can file a voluntary disclosure with the State Department, which is often treated as a mitigating factor. Taking that step usually requires a careful internal review first.
Hiring and Deemed Exports
Hiring decisions deserve particular care. Under ITAR, a U.S. person includes U.S. citizens, lawful permanent residents and certain protected individuals such as refugees and asylees, while other foreign nationals generally need authorization before receiving controlled technical data. The Commerce Department applies a similar concept, called a deemed export, to technology controlled under the Export Administration Regulations. Many items that were once on the Munitions List now fall under the Commerce Department’s 600 series, which carries its own licensing requirements. Employers in controlled industries often build a technology control plan that identifies which roles need access to which data, so that hiring and onboarding do not create unintended violations.
The Foreign Corrupt Practices Act
The Foreign Corrupt Practices Act has two main parts. The anti-bribery provisions prohibit offering or giving anything of value to a foreign official to obtain or retain business or secure an improper advantage. The accounting provisions require companies that issue securities in the United States to keep accurate books and records and maintain adequate internal controls. The anti-bribery provisions apply broadly, reaching U.S. companies and citizens wherever they operate, and foreign companies and individuals who act within the United States.
The term foreign official is interpreted broadly. It can include employees of state-owned or state-controlled companies, such as a national oil company, a government hospital or a state-owned telecommunications provider. Payments made through third parties, including sales agents, distributors, consultants and customs brokers, can create liability for the company that engaged them if the company knew or consciously disregarded that the payment was likely to be passed on.
Enforcement in a Changing Environment
Federal enforcement priorities have shifted in recent years. In 2025, the Justice Department issued new guidelines that narrowed its FCPA enforcement focus. The statute itself remains in force, however, and the Securities and Exchange Commission, foreign regulators and business partners continue to expect anti-corruption compliance. Many foreign countries have their own anti-bribery laws, such as the United Kingdom’s Bribery Act, that can apply to the same conduct. A company working with an fcpa attorney on a new market entry will typically look at both U.S. and local law.
Red Flags in International Deals
Certain warning signs appear frequently in corruption investigations. A sales agent who requests unusually high commissions, payment to an account in a third country, or payment in cash deserves scrutiny. So does an intermediary with close ties to government officials, a request for an unexplained success fee, or a refusal to certify compliance with anti-corruption policies. Documenting due diligence on agents and distributors, and building anti-corruption provisions into contracts, gives a company a record that it took reasonable steps.
Building a Practical Compliance Program
Compliance does not require a large legal department. For a growing company, a practical program often starts with a few elements: an accurate classification of the company’s products and technical data, written procedures for handling controlled information, screening of customers and partners against government restricted-party lists, and training for the employees who handle sales, engineering and shipping.
Access controls matter as much as policies. Marking controlled technical data, restricting access on servers and cloud platforms, and requiring approval before sharing files with foreign persons prevent many accidental exports. On the anti-corruption side, clear rules for gifts, travel and entertainment involving foreign officials, along with approval steps for engaging overseas agents, reduce the most common risks.
Contracts and Corporate Structure
Export and anti-corruption issues often arise alongside broader business questions. A company entering a teaming agreement with a defense prime, forming a joint venture with a foreign partner or accepting investment from a foreign source may face contract terms, flow-down clauses and review requirements that affect its structure. Investments involving foreign parties in companies working with critical technologies can also raise questions under the review process administered by the Committee on Foreign Investment in the United States.
Denver-area founders who are forming a company, negotiating early contracts or planning international growth often work with firms such as Sequoia Legal that handle both general business matters and international trade questions, since decisions made at formation can shape the compliance obligations that follow.
International growth brings real opportunity, and most of the associated legal risk can be managed with early attention. A company that classifies its products, controls its technical data and knows its overseas partners is far better positioned when a customer, investor or regulator starts asking questions.
This article is for general informational purposes only and does not constitute legal advice. Laws, procedures, deadlines and outcomes may vary depending on the jurisdiction and individual circumstances.
