Manufacturing License Agreements (MLAs) Under ITAR: How They Work
%20Under%20ITAR_featured.jpg)
Article Summary
A Manufacturing License Agreement is a DDTC-approved agreement that permits a foreign entity to manufacture U.S.-origin defense articles using controlled technical data — required whenever a U.S. company seeks to authorize cross-border defense production, because transferring the technical data, defense services, or hardware necessary for that manufacturing without an MLA constitutes an unauthorized export under ITAR.
A TAA generally covers the provision of defense services or know-how, while an MLA explicitly authorizes production — including the transfer of technical data, defense services, and in some cases hardware necessary for manufacturing — making the MLA the appropriate authorization when the foreign party's role involves actually producing defense articles rather than receiving technical support or training.
An MLA must identify exactly what defense articles can be manufactured, where production can occur, and who is authorized to participate — because any activity outside the approved scope, including manufacturing additional components or involving unauthorized subcontractors, requires a formal amendment and prior DDTC approval before proceeding, regardless of how closely related the activity appears to the authorized scope.
All foreign signatories must be identified and vetted before approval — including manufacturers, subcontractors, and sometimes end users — because the U.S. company bears responsibility for conducting due diligence to ensure none of the parties are prohibited or restricted, and DDTC independently reviews these parties as part of its approval process before authorization is granted.
Defense articles and technical data produced under an MLA cannot be retransferred to third parties or reexported to other countries without prior U.S. government approval — because even when manufacturing occurs abroad, the U.S. retains control over where and how the resulting products are ultimately used, making retransfer restriction one of ITAR's core safeguards in the MLA framework.
Companies must maintain detailed records of all transfers and activities conducted under the agreement, submit periodic reports to DDTC in some cases documenting quantities produced and technical data transferred, monitor expiration dates, submit amendments for scope changes or new parties, and implement internal controls including employee training and access restrictions — because MLA approval is the beginning of the compliance obligation, not the end of it.
Introduction
Manufacturing License Agreements (MLAs) are a central mechanism under the International Traffic in Arms Regulations (ITAR) that allow U.S. companies to authorize foreign parties to manufacture defense articles abroad. Administered by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC), MLAs are designed to balance two competing priorities: enabling international defense collaboration and protecting sensitive U.S. military technology. Understanding how MLAs function is essential for companies engaged in cross-border defense production, as noncompliance can result in severe civil and criminal penalties.
What Is an MLA?
An MLA is a specific type of agreement approved by DDTC that permits a foreign entity to manufacture U.S.-origin defense articles using controlled technical data. Unlike a Technical Assistance Agreement (TAA), which generally covers the provision of services or know-how, an MLA explicitly authorizes production. This includes the transfer of technical data, defense services, and sometimes the export of hardware necessary for manufacturing.
How the Process Works
To implement an MLA, a U.S. exporter must first draft the agreement outlining the scope of manufacturing, the foreign parties involved, the technical data to be transferred, and any limitations on use or retransfer. The agreement is then submitted to DDTC for review and approval. Once approved, the U.S. company can begin transferring the authorized technical data and supporting materials, provided all activities remain within the scope of the agreement.
Key Details to Understand
1. Scope and Limitations Are Strictly Defined
MLAs are highly specific. They identify exactly what defense articles can be manufactured, where production can occur, and who is authorized to participate. Any activity outside the approved scope—such as manufacturing additional components or involving unauthorized subcontractors—requires an amendment and prior approval. This precision ensures that sensitive technologies are not diverted or misused.
2. Technical Data Transfer Is Controlled
At the heart of an MLA is the transfer of ITAR-controlled technical data. This may include blueprints, specifications, or engineering instructions necessary for production. The agreement governs how this data is shared, stored, and used. Companies must implement robust compliance measures, including access controls and employee training, to prevent unauthorized disclosures.
3. Foreign Parties Must Be Screened and Approved
All foreign signatories to the MLA must be identified and vetted before approval. This includes manufacturers, subcontractors, and sometimes end users. The U.S. company is responsible for conducting due diligence to ensure that none of the parties are prohibited or restricted. DDTC reviews these parties as part of the approval process, adding an additional layer of oversight.
4. Reporting and Recordkeeping Requirements Apply
MLAs come with ongoing compliance obligations. Companies must maintain detailed records of all transfers and activities conducted under the agreement. In some cases, periodic reports must be submitted to DDTC, documenting quantities produced, technical data transferred, and any deviations from the original plan. These requirements ensure transparency and accountability over the life of the agreement.
5. Retransfer and Reexport Restrictions Are Critical
Defense articles and technical data produced under an MLA cannot be retransferred to third parties or reexported to other countries without prior U.S. government approval. This restriction is one of ITAR’s core safeguards. Even if the manufacturing occurs abroad, the U.S. retains control over where and how the resulting products are ultimately used.
Common Challenges
Companies often face challenges in drafting MLAs due to their complexity and the level of detail required. Misunderstanding the distinction between an MLA and other agreements, such as TAAs, can lead to compliance gaps. Additionally, managing foreign partners and ensuring ongoing adherence to ITAR requirements can be resource-intensive.
Conclusion
Manufacturing License Agreements are a powerful tool for enabling international defense production while maintaining strict control over U.S. military technology. By clearly defining the scope of authorized manufacturing, regulating technical data transfers, and imposing rigorous compliance obligations, MLAs help mitigate the risks associated with global collaboration. For companies operating in the defense sector, a thorough understanding of MLAs—and a strong compliance framework to support them—is essential for navigating ITAR successfully and avoiding costly enforcement actions.
Key Points
What is a Manufacturing License Agreement and what legal framework requires it?
- An MLA is a formal written agreement approved by DDTC that permits a foreign entity to manufacture U.S.-origin defense articles using controlled technical data — it is the specific authorization mechanism ITAR provides for cross-border defense production, distinct from the one-time export licenses and TAAs that cover other categories of ITAR-controlled activity
- ITAR controls extend to the knowledge and services that enable defense production — the same regulatory framework that governs export of physical defense articles also governs the transfer of technical data, blueprints, specifications, and engineering instructions that make foreign manufacturing possible, meaning the authorization requirement applies to the full scope of what the foreign party needs to produce the article, not just the hardware itself
- Without an MLA, routine manufacturing collaboration activities constitute unauthorized exports — providing a foreign manufacturer with engineering drawings, specifications, or technical support for production of a defense article is a regulated activity under ITAR regardless of whether it occurs through formal data transfer, email, virtual meetings, or in-person collaboration
- MLAs differ from TAAs in their explicit authorization of production — a TAA generally covers defense services and know-how, while an MLA authorizes the foreign party to actually manufacture the defense article, making the distinction between the two agreement types a substantive compliance determination rather than a formatting choice
- Noncompliance with MLA requirements can result in severe civil and criminal penalties — the ITAR enforcement framework does not distinguish between intentional and inadvertent violations in the penalty structure, making proactive compliance program investment significantly less costly than enforcement exposure
How does the MLA approval process work and what must the agreement contain?
- The U.S. exporter must draft the agreement before submission to DDTC — the agreement must outline the scope of manufacturing authorized, the foreign parties involved, the technical data to be transferred, and any limitations on use or retransfer, with the level of specificity required by DDTC reflecting the sensitivity of the authorized production
- Scope precision is the most critical drafting challenge — an MLA must identify exactly what defense articles can be manufactured, where production can occur, and who is authorized to participate, with vague or generic scope descriptions creating ambiguity that restricts operational flexibility and invites DDTC questions that delay approval
- Activities outside the approved scope require amendment and prior approval — the MLA authorization covers only what the agreement explicitly describes, and proceeding with manufacturing of additional components, involving unauthorized subcontractors, or expanding production to unauthorized locations constitutes an unauthorized export under ITAR regardless of how closely the additional activity relates to the approved scope
- Both overly narrow and overly broad scope drafting create operational problems — a scope that is too narrow forces amendment cycles that delay production, while language that is too vague may fail DDTC review or create post-approval ambiguity about what activities are actually covered
- Once approved, the U.S. company can begin transferring authorized technical data and supporting materials provided all activities remain within the agreement's scope — the approval creates the authorization but does not eliminate the ongoing obligation to verify that specific activities are covered before they proceed
What technical data controls apply under an MLA?
- Technical data transfer is at the heart of every MLA — the agreement governs how ITAR-controlled technical data including blueprints, specifications, and engineering instructions necessary for production is shared, stored, and used by the foreign manufacturer, making data control the most operationally intensive compliance obligation in an active MLA program
- Access controls must restrict ITAR-controlled technical data to authorized personnel only — the MLA authorization covers specific named parties and specific categories of technical data, and internal access controls at both the U.S. company and the foreign manufacturer must align with those limitations to prevent authorized data from flowing to unauthorized recipients
- Employee training on the scope and limitations of the agreement is a foundational requirement — employees involved in the authorized program on both sides must understand specifically what data they can share, with whom, through which channels, and for which purposes, because ITAR violations frequently arise from employees who assumed their activities were covered without verifying that assumption against the actual agreement terms
- Informal communications remain subject to the agreement's restrictions — emails, virtual meetings, and other informal channels through which technical information is routinely shared in manufacturing collaboration are not exempt from the MLA's data control requirements, making the training obligation extend to the full range of communication formats employees use in practice
- Robust compliance measures including access controls and training are explicitly required — these are not best practice recommendations but compliance obligations that the MLA framework imposes as conditions of the authorization, meaning their absence represents a compliance failure independent of whether any unauthorized disclosure actually occurred
Who must be identified and vetted in an MLA and what happens when participants change?
- All foreign signatories must be fully identified before approval — manufacturers, subcontractors, and sometimes end users must each be named and vetted, reflecting ITAR's party-specific authorization framework in which approval that covers one named entity does not automatically extend to related entities, subsidiaries, or partners that were not individually identified
- The U.S. company is responsible for conducting due diligence on all foreign parties — this includes screening against restricted party lists and sanctions programs, verifying that no party is prohibited or restricted, and ensuring that the due diligence is documented in a way that demonstrates reasonable care in the event of a subsequent enforcement inquiry
- DDTC independently reviews all identified parties as part of the approval process — this dual-layer vetting reflects the sensitivity of the manufacturing authorization, and parties that do not survive DDTC review cannot be included in the agreement regardless of the U.S. company's own due diligence conclusions
- Failing to include all relevant parties is a common compliance issue that restricts project execution — defense manufacturing programs frequently involve subcontractors and affiliated entities whose participation was not fully anticipated at the time of initial filing, and discovering mid-production that key participants are not covered by the MLA creates both unauthorized export exposure and operational disruption
- Adding new foreign participants after approval requires a formal amendment — the amendment must be submitted and approved before the new participant begins receiving technical data or participating in manufacturing activities, and proceeding without amendment authorization constitutes an unauthorized export regardless of whether the new participant would likely have been approved
What retransfer, reexport, and recordkeeping obligations apply under an active MLA?
- Defense articles and technical data produced under an MLA cannot be retransferred or reexported without prior U.S. government approval — this restriction is one of ITAR's core safeguards and applies regardless of where manufacturing occurred, meaning the U.S. retains jurisdictional control over the disposition of defense articles produced abroad under U.S. authorization
- The retransfer restriction applies to both the physical defense articles and the technical data used to produce them — a foreign manufacturer who received ITAR-controlled technical data under an MLA cannot share that data with third parties or apply it to unauthorized programs even after the MLA expires, because the restriction attaches to the data itself rather than expiring with the authorization
- Detailed records of all transfers and activities conducted under the agreement must be maintained — this includes documentation of what technical data was transferred, to whom, when, and through which channel, creating the audit trail that demonstrates compliance with the MLA's scope and party limitations during the retention period that applies to export records
- Periodic reports must be submitted to DDTC in some cases documenting quantities produced, technical data transferred, and any deviations from the original plan — these reporting requirements are conditions of the authorization that must be identified at the time of approval and tracked throughout the agreement's term
- Expiration monitoring is a compliance obligation — operating under an expired MLA creates the same enforcement exposure as operating without authorization, and the interval between expiration and renewal represents an unauthorized gap in coverage if not managed proactively through automated retention and renewal tracking
What are the most common MLA compliance challenges and how are they addressed?
- Drafting overly narrow scopes that limit operational flexibility is one of the most common challenges — it reflects insufficient anticipation of the full range of manufacturing activities that the program will require, and it generates amendment cycles that delay production and consume compliance resources in ways that careful upfront scope drafting directly prevents
- Failing to update agreements when new parties join is a structural gap between program management and compliance functions — defense manufacturing programs evolve, and the compliance team must be proactively notified of any new entities entering the manufacturing relationship before those entities receive technical data or begin participating in production
- Allowing technical discussions outside approved parameters is the most operationally common MLA violation — it reflects a gap between the compliance program's understanding of the agreement's scope and the technical team's day-to-day collaboration practices, which structured pre-meeting compliance briefings and clear written guidance on covered topics directly address
- Misunderstanding that an MLA covers all export needs is a recurring pitfall that can leave companies exposed in areas the MLA was never intended to address — a manufacturing license covers the specific production activities and technical data described in its scope, but additional licenses or authorizations may still be required for other aspects of the defense program, making comprehensive authorization mapping an essential part of MLA program management
- Managing foreign partners' ongoing adherence to ITAR requirements is resource-intensive but non-delegable — the U.S. company's compliance obligations under an MLA extend to ensuring that foreign manufacturing partners are implementing the controls the agreement requires, making partner compliance monitoring a sustained program element rather than a one-time onboarding step
