🛡️ ITAR
ITAR-Registered Powder Coating for Defense Hardware
When a coated part is a defense article on the US Munitions List, the question is no longer whether the finish looks right but whether every person, drawing, and facility that touched it was authorized under US export-control law. ITAR registration with the State Department's Directorate of Defense Trade Controls is what lets a powder coater legally receive controlled technical data and apply a finish to USML hardware. The combination is real but narrower than people expect, because much defense coating is specified as CARC rather than powder, so buyers use app.mfgbase.com to find ITAR-registered coaters whose capabilities actually match the drawing callout.
ITARISO 9001AS9100
What ITAR Registration Means and What It Does Not
ITAR is not a quality standard and it is not an audited certification in the way ISO 9001 or Nadcap are. It is a legal regime: the International Traffic in Arms Regulations (22 CFR 120 through 130), administered by DDTC. A coater that handles defense articles or the associated technical data must register with DDTC under Part 122, which produces a registration code and an annual renewal, not a certificate of conformance. Registration is essentially a notification and eligibility status; it does not by itself attest that the shop coats well, only that it is legally permitted to handle USML-controlled work.
The substance of compliance is access control over technical data. A powder coater receiving a controlled drawing, a CAD model, or a process specification for a USML part must ensure that data is only seen by US persons (as defined in 22 CFR 120.62) absent a license, must store it securely, and must prevent any export, including the deemed export that occurs when a foreign-national employee on the shop floor views a controlled drawing. For a coater, the drawing and the finish spec are usually the controlled items, since the geometry and finishing requirements can themselves be technical data.
This is why ITAR work clusters at shops with mature compliance programs: a documented technology control plan, US-person verification, visitor and access controls, and segregated handling of controlled prints. The coating itself may be ordinary; the surrounding controls are what carry the legal weight.
CARC, MIL Specs, and the Powder Reality on Defense Parts
Be clear-eyed about the finish. A great deal of defense ground and aviation hardware is specified with Chemical Agent Resistant Coating (CARC) systems under MIL-DTL-53039 or MIL-DTL-64159 over an epoxy primer per MIL-DTL-53022, because CARC is engineered to resist chemical-warfare agents and decontamination and to meet specific infrared signature requirements. Standard powder coating is generally not a CARC substitute and will be rejected if a drawing calls out a CARC system.
That said, powder coating is genuinely used on plenty of ITAR-controlled hardware where CARC is not required: enclosures, racks, brackets, ground-support equipment, weapon-system subassemblies, and components where durable corrosion protection and a controlled color are the requirement. Some defense programs also use powder over phosphate or over a qualified primer where the spec permits. The key is that the part is ITAR-controlled because of what it is and the technical data behind it, not because the finish is powder. Read the drawing: if it invokes a MIL CARC spec, you need that capability; if it specifies a powder finish to a TT or commercial standard, an ITAR-registered powder shop is the right match.
Verifying ITAR Status and Avoiding the Common Traps
Unlike OASIS for AS9100, there is no public registry where a buyer can independently confirm a coater's DDTC registration, because registration data is not published. Verification is contractual: you obtain a copy of the registrant's current DDTC registration letter (which shows the registration code and validity period) and incorporate ITAR compliance representations into the purchase order or supplier agreement. Many buyers also require the supplier to attest in writing to a technology control plan and US-person handling of controlled data.
The traps are mostly about scope and currency. ITAR registration lapses annually if not renewed, so confirm the current period, not a years-old letter. Registration covers the legal entity, so verify the actual coating facility is part of that entity and not an uncovered subcontractor or a separate LLC. The most dangerous trap is technical-data leakage: a registered prime that emails a controlled drawing to a non-registered outsource coater, or a shop with foreign-national staff who can view controlled prints, has created an export violation regardless of paperwork. Flow ITAR requirements down explicitly and confirm where the data and the parts physically go.
Frequently Asked Questions
No, and treating it as one is a serious mistake. ITAR registration with the Directorate of Defense Trade Controls is a legal eligibility status under 22 CFR 122 that permits a company to handle defense articles and the associated technical data; it says nothing about whether the company can powder coat to a tight specification. There is no quality audit, no process checklist, and no certificate of conformance involved in registration itself. For finish quality you still need a quality system standard such as ISO 9001 or AS9100, and for many defense coating processes you may need Nadcap or compliance with a specific MIL specification. The right way to think about it is that ITAR registration answers the question can this shop legally touch my controlled part and its drawings, while ISO 9001, AS9100, and the applicable MIL or process specs answer the question can this shop produce a conforming finish. A defense coating order typically requires both: legal eligibility under ITAR plus a demonstrated quality system and the correct process capability for the finish the drawing calls out.
Both are used, and the drawing decides. Chemical Agent Resistant Coating systems under MIL-DTL-53039 or MIL-DTL-64159 over an epoxy primer per MIL-DTL-53022 are required wherever the part must resist chemical-warfare agents and decontamination or meet specific infrared signature and reflectance requirements, which covers a large share of tactical ground vehicles and exterior combat hardware. Standard powder coating is not a CARC substitute and will be rejected against a CARC callout. However, powder coating is widely and legitimately used on ITAR-controlled hardware that does not require CARC: electronics enclosures, equipment racks, brackets, ground-support equipment, and many weapon-system subassemblies where durable corrosion protection and a controlled color meet the requirement. The part is ITAR-controlled because of what it is and the technical data behind it, not because of the finish chemistry. Read the finish callout carefully: if it invokes a MIL CARC specification you need a CARC-capable applicator, and if it specifies a powder finish to a commercial or federal standard, an ITAR-registered powder coater is the correct supplier. Never assume powder and CARC are interchangeable.
There is no public lookup equivalent to the AS9100 OASIS database, because DDTC registration information is not published, so verification is contractual and document-based rather than registry-based. Ask the coater for a copy of their current DDTC registration letter, which shows the registration code and the validity period, and confirm it is in the current annual period rather than an expired one, since registration lapses if not renewed each year. Confirm that the specific facility doing your coating is part of the registered legal entity and not a separate company or an uncovered subcontractor. Beyond the registration itself, require evidence of a technology control plan, written confirmation that controlled technical data is handled only by US persons as defined in 22 CFR 120.62, and physical and IT access controls that prevent deemed exports to foreign-national employees on the floor. Incorporate ITAR compliance representations and flowdown language into your purchase order, and verify where your controlled drawings and parts actually travel, because the most common real-world violation is a registered prime emailing controlled data to an unregistered outsource coater. Documentation plus knowing the physical and data path is your verification.
They are separate but increasingly intertwined requirements that often land on the same defense coater. ITAR governs the export-control handling of defense articles and technical data under State Department regulations, while CMMC, the Cybersecurity Maturity Model Certification flowed down through the Department of Defense, governs how a contractor protects controlled unclassified information on its IT systems, built on NIST SP 800-171 controls. A coater that receives controlled drawings electronically is handling both ITAR technical data and, very often, CUI, so the same prints can trigger both regimes at once. In practice that means the shop needs ITAR-compliant access control and a technology control plan for the export side, and the appropriate CMMC level with NIST 800-171 safeguards for the cybersecurity side, including secure email, access logging, and incident response. For lower-tier coating suppliers the CMMC level required depends on whether they actually store or process CUI; some arrange to handle prints in a controlled way that limits their CUI footprint. When you flow defense work to a coater, confirm both the ITAR posture and the CMMC status that your prime contract requires, because satisfying one does not satisfy the other.
Last updated: July 2026
Find ITAR-Certified Powder Coating Suppliers
Search verified powder coating shops that hold ITAR.
No logins. No email gates. Just results.