bmad-plus 0.7.4 → 0.8.0

package/src/bmad-plus/packs/pack-shield/references/itar/compliance-program.md

@@ -1,174 +1,174 @@
-# ITAR Compliance Programme — Penalties, VSD, and TCP
-
-## ITAR Compliance Programme Elements
-
-An effective ITAR compliance programme (recognised by DDTC as a mitigating factor) includes:
-
-### 1. Governance and Leadership
-- Designated **Empowered Official (EO)** (22 CFR § 120.67): A US person with authority to sign licence applications and ensure ITAR compliance; must be in a senior position with ability to override business decisions for compliance reasons
-- Written **ITAR Compliance Policy** signed by senior management
-- Clear escalation path for export control questions
-- Annual management review of compliance programme effectiveness
-
-### 2. Training
-- **Initial training** for all employees with ITAR access within 30 days of hire
-- **Annual refresher training** covering recent regulatory changes, enforcement actions, and company-specific procedures
-- **Role-specific training** for: Empowered Officials, shipping/logistics, engineering/R&D, legal, IT
-- Training records retained 5 years
-
-### 3. Technology Control Plan (TCP)
-
-A TCP controls access to ITAR-controlled technical data, especially by foreign nationals.
-
-**TCP Sections:**
-```
-1. Purpose and Scope
-2. ITAR-controlled items and data inventory
-3. Physical access controls (secure areas, visitor escorts, badging)
-4. IT access controls (network segregation, access lists, encryption)
-5. Foreign national screening procedure
-   - Collect citizenship information at hire/engagement
-   - Screen against denied parties lists
-   - Determine if TAA/licence required before granting access
-6. Visitor and contractor procedures
-7. Annual ITAR training programme
-8. Incident identification, reporting, and response
-9. Records management (5-year retention)
-10. TCP review and update cycle (annual minimum)
-```
-
-### 4. Screening and Due Diligence
-Screen all parties (customers, suppliers, employees, visitors) against:
-- **DDTC Debarred Parties List** (22 CFR § 127.7)
-- **OFAC Specially Designated Nationals (SDN) List**
-- **BIS Denied Persons List, Entity List, Unverified List**
-- **US State Department Watch Lists**
-
-Screening must be documented and re-run at each transaction.
-
-### 5. Jurisdiction and Classification Review
-- Formal **product classification process** for every new item, component, and software
-- Document classification decisions (USML citation or EAR ECCN) with rationale
-- Review classifications when product is modified, use-case changes, or regulations change
-- Consider **Commodity Jurisdiction (CJ)** requests for ambiguous items
-
-### 6. Licence Management
-- Centralised tracking of all active licences, TAAs, MLAs
-- Pre-shipment licence review checklist
-- Licence condition compliance (quantities, end-users, re-export restrictions)
-- Timely licence renewals (track expiry dates with 90-day advance reminders)
-- Post-shipment filing (Automated Export System / Electronic Export Information)
-
-### 7. Audits
-- Annual internal ITAR compliance audit (or third-party audit every 2–3 years)
-- Audit scope: registration currency, licence compliance, TCP effectiveness, training records, screening logs, record retention
-- Findings documented with corrective action plans and owners
-
----
-
-## Penalties — 22 CFR Part 127 and 22 USC § 2778
-
-### Civil Penalties
-- Up to **$1,369,000 per violation** (amount adjusted annually under the Federal Civil Penalties Inflation Adjustment Act)
-- Each unlicensed export, each unlicensed disclosure of technical data, each brokering violation = separate violation
-- DDTC may impose civil penalties via Consent Agreement without criminal referral
-
-### Criminal Penalties
-- Up to **$1,000,000 fine** per violation (22 USC § 2778(c))
-- Up to **20 years imprisonment** per violation
-- Criminal cases referred to Department of Justice; prosecuted by DOJ National Security Division
-
-### Debarment
-- DDTC may debar any person from ITAR privileges (22 CFR § 127.7)
-- Duration: typically 3 years; can be permanent for egregious violations
-- Debarment prevents: registration, licensing, TAA/MLA participation, US government contracting
-- Published on the DDTC Debarred Parties List
-
-### Other Consequences
-- **Seizure and forfeiture** of articles involved in violations (22 USC § 2778(e))
-- **Suspension of export privileges** pending investigation
-- **Congressional notification** requirements for significant violations involving foreign governments
-- **Reputational harm** — consent agreements are publicly disclosed
-
----
-
-## Voluntary Self-Disclosure (VSD) — 22 CFR § 127.12
-
-### Why Disclose
-VSD is the strongest available mitigating factor. DDTC's guidelines recognise that companies with effective compliance programmes that self-discover and promptly disclose violations deserve leniency.
-
-### VSD Process
-
-**Step 1 — Initial Notification** (~30 days from discovery)
-- Submit brief written notification to DDTC Director of Compliance
-- Include: company name, registration number, general description of the potential violation, estimated number of occurrences
-- Request a tolling agreement to preserve statute of limitations while investigation proceeds
-
-**Step 2 — Internal Investigation** (30–90 days)
-- Investigate all facts: who knew what, when, what was exported/disclosed, to whom
-- Pull all records (licences, shipping docs, emails, TAA files)
-- Identify root cause (process failure, training gap, deliberate act)
-- Preserve all evidence; place litigation hold if appropriate
-
-**Step 3 — Final VSD Report** (within ~60–90 days of initial notification)
-Submit comprehensive written report including:
-- Detailed factual narrative of all violations
-- CFR sections violated for each occurrence
-- Identification of all parties involved
-- Timeline of events
-- Root cause analysis
-- Corrective actions already implemented
-- Proposed additional remediation
-
-**Step 4 — DDTC Review and Resolution**
-- DDTC reviews report; may request additional information
-- Outcomes: no action, warning letter, civil penalty (usually reduced), or referral for criminal review
-- Most cooperative VSDs resolved within 6–18 months
-
-### Mitigating Factors
-- Voluntary self-disclosure
-- Cooperation with DDTC investigation
-- Effective pre-existing compliance programme
-- Prompt remediation
-- No prior ITAR violations
-- Low national security harm
-- Relatively low transaction value
-
-### Aggravating Factors
-- Wilful/deliberate violation
-- Senior management involvement or awareness
-- Harm to national security
-- Pattern of violations
-- Obstruction or lack of cooperation
-- High-risk end-users (state sponsors of terrorism, arms embargoes)
-- Prior violations
-
----
-
-## DDTC Blue Lantern End-Use Monitoring
-
-The **Blue Lantern** programme is DDTC's end-use monitoring initiative. US embassy personnel conduct post-shipment verifications to confirm items reached the stated end-user and are being used as authorised.
-
-**Implications for exporters:**
-- Cooperate fully with Blue Lantern checks (failure to cooperate can trigger licence suspension)
-- Maintain accurate shipping records to facilitate verification
-- Include cooperation obligations in contracts with foreign distributors
-- Report if you discover items have been diverted or misused
-
----
-
-## Checklist — ITAR Compliance Programme Readiness
-
-| Area | ✅ | Key Questions |
-|------|----|--------------|
-| Registration | | Is registration current? Renewal filed on time? |
-| Empowered Official | | Named EO with written authority? |
-| Policy | | IS Policy signed by senior management? |
-| TCP | | Written TCP? Reviewed in last 12 months? |
-| Training | | All ITAR-access employees trained in last 12 months? Records retained? |
-| Classification | | All products/components formally classified? CJ obtained where needed? |
-| Screening | | SDN/debarment screening at every transaction? Documented? |
-| Licence tracking | | All licences logged? Expiry alerts set? Conditions tracked? |
-| Record retention | | 5-year retention in place? Accessible for audit? |
-| Internal audit | | Annual ITAR audit completed? Findings tracked? |
-| Incident response | | VSD procedure documented and communicated? |
+# ITAR Compliance Programme — Penalties, VSD, and TCP
+
+## ITAR Compliance Programme Elements
+
+An effective ITAR compliance programme (recognised by DDTC as a mitigating factor) includes:
+
+### 1. Governance and Leadership
+- Designated **Empowered Official (EO)** (22 CFR § 120.67): A US person with authority to sign licence applications and ensure ITAR compliance; must be in a senior position with ability to override business decisions for compliance reasons
+- Written **ITAR Compliance Policy** signed by senior management
+- Clear escalation path for export control questions
+- Annual management review of compliance programme effectiveness
+
+### 2. Training
+- **Initial training** for all employees with ITAR access within 30 days of hire
+- **Annual refresher training** covering recent regulatory changes, enforcement actions, and company-specific procedures
+- **Role-specific training** for: Empowered Officials, shipping/logistics, engineering/R&D, legal, IT
+- Training records retained 5 years
+
+### 3. Technology Control Plan (TCP)
+
+A TCP controls access to ITAR-controlled technical data, especially by foreign nationals.
+
+**TCP Sections:**
+```
+1. Purpose and Scope
+2. ITAR-controlled items and data inventory
+3. Physical access controls (secure areas, visitor escorts, badging)
+4. IT access controls (network segregation, access lists, encryption)
+5. Foreign national screening procedure
+   - Collect citizenship information at hire/engagement
+   - Screen against denied parties lists
+   - Determine if TAA/licence required before granting access
+6. Visitor and contractor procedures
+7. Annual ITAR training programme
+8. Incident identification, reporting, and response
+9. Records management (5-year retention)
+10. TCP review and update cycle (annual minimum)
+```
+
+### 4. Screening and Due Diligence
+Screen all parties (customers, suppliers, employees, visitors) against:
+- **DDTC Debarred Parties List** (22 CFR § 127.7)
+- **OFAC Specially Designated Nationals (SDN) List**
+- **BIS Denied Persons List, Entity List, Unverified List**
+- **US State Department Watch Lists**
+
+Screening must be documented and re-run at each transaction.
+
+### 5. Jurisdiction and Classification Review
+- Formal **product classification process** for every new item, component, and software
+- Document classification decisions (USML citation or EAR ECCN) with rationale
+- Review classifications when product is modified, use-case changes, or regulations change
+- Consider **Commodity Jurisdiction (CJ)** requests for ambiguous items
+
+### 6. Licence Management
+- Centralised tracking of all active licences, TAAs, MLAs
+- Pre-shipment licence review checklist
+- Licence condition compliance (quantities, end-users, re-export restrictions)
+- Timely licence renewals (track expiry dates with 90-day advance reminders)
+- Post-shipment filing (Automated Export System / Electronic Export Information)
+
+### 7. Audits
+- Annual internal ITAR compliance audit (or third-party audit every 2–3 years)
+- Audit scope: registration currency, licence compliance, TCP effectiveness, training records, screening logs, record retention
+- Findings documented with corrective action plans and owners
+
+---
+
+## Penalties — 22 CFR Part 127 and 22 USC § 2778
+
+### Civil Penalties
+- Up to **$1,369,000 per violation** (amount adjusted annually under the Federal Civil Penalties Inflation Adjustment Act)
+- Each unlicensed export, each unlicensed disclosure of technical data, each brokering violation = separate violation
+- DDTC may impose civil penalties via Consent Agreement without criminal referral
+
+### Criminal Penalties
+- Up to **$1,000,000 fine** per violation (22 USC § 2778(c))
+- Up to **20 years imprisonment** per violation
+- Criminal cases referred to Department of Justice; prosecuted by DOJ National Security Division
+
+### Debarment
+- DDTC may debar any person from ITAR privileges (22 CFR § 127.7)
+- Duration: typically 3 years; can be permanent for egregious violations
+- Debarment prevents: registration, licensing, TAA/MLA participation, US government contracting
+- Published on the DDTC Debarred Parties List
+
+### Other Consequences
+- **Seizure and forfeiture** of articles involved in violations (22 USC § 2778(e))
+- **Suspension of export privileges** pending investigation
+- **Congressional notification** requirements for significant violations involving foreign governments
+- **Reputational harm** — consent agreements are publicly disclosed
+
+---
+
+## Voluntary Self-Disclosure (VSD) — 22 CFR § 127.12
+
+### Why Disclose
+VSD is the strongest available mitigating factor. DDTC's guidelines recognise that companies with effective compliance programmes that self-discover and promptly disclose violations deserve leniency.
+
+### VSD Process
+
+**Step 1 — Initial Notification** (~30 days from discovery)
+- Submit brief written notification to DDTC Director of Compliance
+- Include: company name, registration number, general description of the potential violation, estimated number of occurrences
+- Request a tolling agreement to preserve statute of limitations while investigation proceeds
+
+**Step 2 — Internal Investigation** (30–90 days)
+- Investigate all facts: who knew what, when, what was exported/disclosed, to whom
+- Pull all records (licences, shipping docs, emails, TAA files)
+- Identify root cause (process failure, training gap, deliberate act)
+- Preserve all evidence; place litigation hold if appropriate
+
+**Step 3 — Final VSD Report** (within ~60–90 days of initial notification)
+Submit comprehensive written report including:
+- Detailed factual narrative of all violations
+- CFR sections violated for each occurrence
+- Identification of all parties involved
+- Timeline of events
+- Root cause analysis
+- Corrective actions already implemented
+- Proposed additional remediation
+
+**Step 4 — DDTC Review and Resolution**
+- DDTC reviews report; may request additional information
+- Outcomes: no action, warning letter, civil penalty (usually reduced), or referral for criminal review
+- Most cooperative VSDs resolved within 6–18 months
+
+### Mitigating Factors
+- Voluntary self-disclosure
+- Cooperation with DDTC investigation
+- Effective pre-existing compliance programme
+- Prompt remediation
+- No prior ITAR violations
+- Low national security harm
+- Relatively low transaction value
+
+### Aggravating Factors
+- Wilful/deliberate violation
+- Senior management involvement or awareness
+- Harm to national security
+- Pattern of violations
+- Obstruction or lack of cooperation
+- High-risk end-users (state sponsors of terrorism, arms embargoes)
+- Prior violations
+
+---
+
+## DDTC Blue Lantern End-Use Monitoring
+
+The **Blue Lantern** programme is DDTC's end-use monitoring initiative. US embassy personnel conduct post-shipment verifications to confirm items reached the stated end-user and are being used as authorised.
+
+**Implications for exporters:**
+- Cooperate fully with Blue Lantern checks (failure to cooperate can trigger licence suspension)
+- Maintain accurate shipping records to facilitate verification
+- Include cooperation obligations in contracts with foreign distributors
+- Report if you discover items have been diverted or misused
+
+---
+
+## Checklist — ITAR Compliance Programme Readiness
+
+| Area | ✅ | Key Questions |
+|------|----|--------------|
+| Registration | | Is registration current? Renewal filed on time? |
+| Empowered Official | | Named EO with written authority? |
+| Policy | | IS Policy signed by senior management? |
+| TCP | | Written TCP? Reviewed in last 12 months? |
+| Training | | All ITAR-access employees trained in last 12 months? Records retained? |
+| Classification | | All products/components formally classified? CJ obtained where needed? |
+| Screening | | SDN/debarment screening at every transaction? Documented? |
+| Licence tracking | | All licences logged? Expiry alerts set? Conditions tracked? |
+| Record retention | | 5-year retention in place? Accessible for audit? |
+| Internal audit | | Annual ITAR audit completed? Findings tracked? |
+| Incident response | | VSD procedure documented and communicated? |

package/src/bmad-plus/packs/pack-shield/references/itar/licensing-guide.md

@@ -1,146 +1,146 @@
-# ITAR Licensing Guide — 22 CFR Parts 123–125
-
-## License Types at a Glance
-
-| License / Agreement | CFR Reference | Purpose | Typical Use |
-|--------------------|---------------|---------|-------------|
-| DSP-5 | 22 CFR § 123.1 | Permanent export of defense articles | Hardware sale/transfer to foreign end-user |
-| DSP-73 | 22 CFR § 123.5 | Temporary export | Trade shows, testing, repair abroad |
-| DSP-94 | 22 CFR § 123.6 | Temporary import | Foreign defense article entering US temporarily |
-| DSP-61 | 22 CFR § 123.9 | Import license | Permanent import from certain countries |
-| Technical Assistance Agreement (TAA) | 22 CFR § 124.1 | Export of technical data / defense services | Engineering support, training, design assistance |
-| Manufacturing License Agreement (MLA) | 22 CFR § 124.2 | Licensed foreign manufacture | Overseas production of US defense articles |
-| Warehouse/Distribution Agreement | 22 CFR § 124.14 | Stocking items abroad for resale | Distributor model |
-
----
-
-## DSP-5 (Permanent Export License)
-
-### When Required
-Any export of USML hardware not covered by an exemption.
-
-### Application Requirements
-Submit via DDTC's D-Trade portal:
-- **Block 1**: Applicant (DDTC registration number)
-- **Block 2**: Country of ultimate destination
-- **Block 3**: Foreign end-user name and address
-- **Block 4**: Description of articles (USML category, quantity, value)
-- **Block 5**: End-use statement (intended use, no re-export without US government approval)
-- **Supporting docs**: Purchase order, end-user certificate, import certificate if required by destination country
-
-### Processing Times
-- Standard: 30–60 days
-- Significant Military Equipment (SME): may require Congressional notification (22 USC § 2776) for sales ≥$14M
-
-### License Conditions (common)
-- Items may not be re-exported without prior DDTC authorisation
-- End-user restrictions apply
-- US government access rights for audits
-- 4-year validity; extendable
-
----
-
-## DSP-73 (Temporary Export)
-
-### When Required
-Hardware leaving the US temporarily (not for resale/transfer to foreign ownership).
-
-### Key Requirements
-- Describe items precisely; document serial numbers
-- State duration and purpose (e.g., "air show display," "field test," "repair and return")
-- Items must return to the US by the license expiry date
-- License conditions prohibit use in combat, operational deployment
-
----
-
-## Technical Assistance Agreement (TAA)
-
-### Purpose
-Authorises the export of **technical data** and/or **defense services** to specific foreign persons/entities. Required even for oral disclosure of ITAR-controlled technical data to a foreign national.
-
-### Required TAA Clauses (22 CFR § 124.9)
-1. **Scope of agreement**: Precise description of technical data / defense services
-2. **Parties**: US licensor + all foreign licensees, authorised sub-licensees
-3. **Retransfer prohibition**: No further disclosure/transfer without prior written DDTC approval
-4. **US government rights**: US government may review all records; terminate agreement
-5. **Record-keeping**: 5-year retention
-6. **Audit rights**: US licensor right to audit foreign licensee compliance
-7. **Term**: Normally 5 years; must renew before expiry
-8. **Security classification handling** (if applicable)
-
-### Amendment Requirements
-Any change to scope, parties, or authorised countries requires a formal amendment approved by DDTC.
-
-### Common TAA Uses
-- Sharing engineering drawings with foreign manufacturer
-- Providing maintenance training to foreign military
-- Technical support under FMS (Foreign Military Sales) cases
-- Joint development programmes with foreign partners
-
----
-
-## Manufacturing License Agreement (MLA)
-
-### Purpose
-Allows a foreign person to manufacture a defense article under US licence — typically for local production under an FMS programme or commercial arrangement.
-
-### Key Differences from TAA
-| Feature | TAA | MLA |
-|---------|-----|-----|
-| What is transferred | Technical data / services | Manufacturing rights + technical data |
-| Foreign party produces? | No | Yes |
-| Sub-licensing allowed? | Conditional | Usually yes, with restrictions |
-| Offset programs | Not typical | Common |
-
-### Required MLA Clauses
-- Licence to manufacture (specific quantities, articles, versions)
-- Quality assurance provisions
-- US government rights (inspection, audit, terminate)
-- Retransfer and re-export controls
-- Royalty / fee structure
-- End-of-programme disposition of tooling and data
-
----
-
-## ITAR Exemptions (Selected)
-
-Certain transfers do not require a licence if all conditions are met. **Exemptions are NOT blanket authorisations — verify conditions every time.**
-
-### Key Exemptions (22 CFR Part 123–126)
-
-| Exemption | CFR Reference | Conditions |
-|-----------|--------------|-----------|
-| US government | § 126.4 | Export by/for US Dept of Defense, State, etc. with government orders |
-| Canada exemption | § 126.5 | Certain unclassified hardware to Canada only; does not apply to all categories |
-| Australian/UK exemption | § 126.7 | Limited scope for certain Gov-to-Gov and industry-to-industry transfers; requires eligibility verification |
-| Intra-company | § 125.4(b)(9) | Technical data to wholly owned US subsidiary abroad; limited scope |
-| Beta test software | § 125.4(b)(10) | Unclassified software for beta testing by foreign person; narrow conditions |
-| Beta hardware | § 123.16 | Temporary export of unclassified hardware for demonstration; strict limits |
-
-**Australia, UK, Canada Defence Trade Cooperation Treaties**: Provide streamlined licensing for covered defence articles between treaty partners; not a blanket exemption.
-
----
-
-## Foreign Military Sales (FMS) vs Direct Commercial Sales (DCS)
-
-| Aspect | FMS | DCS |
-|--------|-----|-----|
-| Contract party | US Government (DSCA) | US company directly |
-| ITAR licence | Not required (US Gov exemption) | DSP-5 / TAA required |
-| End-use assurance | US Government provides | US company responsible |
-| Price | Government + administrative fees | Market rate |
-| Delivery risk | US Government manages | US company manages |
-
----
-
-## Record-Keeping Requirements (22 CFR § 122.5)
-
-All ITAR registrants must maintain for **5 years**:
-- All export/import licences and shipping documents
-- All TAA/MLA agreements and associated records
-- End-user certificates and purchase orders
-- Records of all disclosures of technical data
-- Commodity Jurisdiction requests and determinations
-- Voluntary disclosure records
-
-Records must be available for inspection by DDTC, US Customs, DoD, or other US government agencies.
+# ITAR Licensing Guide — 22 CFR Parts 123–125
+
+## License Types at a Glance
+
+| License / Agreement | CFR Reference | Purpose | Typical Use |
+|--------------------|---------------|---------|-------------|
+| DSP-5 | 22 CFR § 123.1 | Permanent export of defense articles | Hardware sale/transfer to foreign end-user |
+| DSP-73 | 22 CFR § 123.5 | Temporary export | Trade shows, testing, repair abroad |
+| DSP-94 | 22 CFR § 123.6 | Temporary import | Foreign defense article entering US temporarily |
+| DSP-61 | 22 CFR § 123.9 | Import license | Permanent import from certain countries |
+| Technical Assistance Agreement (TAA) | 22 CFR § 124.1 | Export of technical data / defense services | Engineering support, training, design assistance |
+| Manufacturing License Agreement (MLA) | 22 CFR § 124.2 | Licensed foreign manufacture | Overseas production of US defense articles |
+| Warehouse/Distribution Agreement | 22 CFR § 124.14 | Stocking items abroad for resale | Distributor model |
+
+---
+
+## DSP-5 (Permanent Export License)
+
+### When Required
+Any export of USML hardware not covered by an exemption.
+
+### Application Requirements
+Submit via DDTC's D-Trade portal:
+- **Block 1**: Applicant (DDTC registration number)
+- **Block 2**: Country of ultimate destination
+- **Block 3**: Foreign end-user name and address
+- **Block 4**: Description of articles (USML category, quantity, value)
+- **Block 5**: End-use statement (intended use, no re-export without US government approval)
+- **Supporting docs**: Purchase order, end-user certificate, import certificate if required by destination country
+
+### Processing Times
+- Standard: 30–60 days
+- Significant Military Equipment (SME): may require Congressional notification (22 USC § 2776) for sales ≥$14M
+
+### License Conditions (common)
+- Items may not be re-exported without prior DDTC authorisation
+- End-user restrictions apply
+- US government access rights for audits
+- 4-year validity; extendable
+
+---
+
+## DSP-73 (Temporary Export)
+
+### When Required
+Hardware leaving the US temporarily (not for resale/transfer to foreign ownership).
+
+### Key Requirements
+- Describe items precisely; document serial numbers
+- State duration and purpose (e.g., "air show display," "field test," "repair and return")
+- Items must return to the US by the license expiry date
+- License conditions prohibit use in combat, operational deployment
+
+---
+
+## Technical Assistance Agreement (TAA)
+
+### Purpose
+Authorises the export of **technical data** and/or **defense services** to specific foreign persons/entities. Required even for oral disclosure of ITAR-controlled technical data to a foreign national.
+
+### Required TAA Clauses (22 CFR § 124.9)
+1. **Scope of agreement**: Precise description of technical data / defense services
+2. **Parties**: US licensor + all foreign licensees, authorised sub-licensees
+3. **Retransfer prohibition**: No further disclosure/transfer without prior written DDTC approval
+4. **US government rights**: US government may review all records; terminate agreement
+5. **Record-keeping**: 5-year retention
+6. **Audit rights**: US licensor right to audit foreign licensee compliance
+7. **Term**: Normally 5 years; must renew before expiry
+8. **Security classification handling** (if applicable)
+
+### Amendment Requirements
+Any change to scope, parties, or authorised countries requires a formal amendment approved by DDTC.
+
+### Common TAA Uses
+- Sharing engineering drawings with foreign manufacturer
+- Providing maintenance training to foreign military
+- Technical support under FMS (Foreign Military Sales) cases
+- Joint development programmes with foreign partners
+
+---
+
+## Manufacturing License Agreement (MLA)
+
+### Purpose
+Allows a foreign person to manufacture a defense article under US licence — typically for local production under an FMS programme or commercial arrangement.
+
+### Key Differences from TAA
+| Feature | TAA | MLA |
+|---------|-----|-----|
+| What is transferred | Technical data / services | Manufacturing rights + technical data |
+| Foreign party produces? | No | Yes |
+| Sub-licensing allowed? | Conditional | Usually yes, with restrictions |
+| Offset programs | Not typical | Common |
+
+### Required MLA Clauses
+- Licence to manufacture (specific quantities, articles, versions)
+- Quality assurance provisions
+- US government rights (inspection, audit, terminate)
+- Retransfer and re-export controls
+- Royalty / fee structure
+- End-of-programme disposition of tooling and data
+
+---
+
+## ITAR Exemptions (Selected)
+
+Certain transfers do not require a licence if all conditions are met. **Exemptions are NOT blanket authorisations — verify conditions every time.**
+
+### Key Exemptions (22 CFR Part 123–126)
+
+| Exemption | CFR Reference | Conditions |
+|-----------|--------------|-----------|
+| US government | § 126.4 | Export by/for US Dept of Defense, State, etc. with government orders |
+| Canada exemption | § 126.5 | Certain unclassified hardware to Canada only; does not apply to all categories |
+| Australian/UK exemption | § 126.7 | Limited scope for certain Gov-to-Gov and industry-to-industry transfers; requires eligibility verification |
+| Intra-company | § 125.4(b)(9) | Technical data to wholly owned US subsidiary abroad; limited scope |
+| Beta test software | § 125.4(b)(10) | Unclassified software for beta testing by foreign person; narrow conditions |
+| Beta hardware | § 123.16 | Temporary export of unclassified hardware for demonstration; strict limits |
+
+**Australia, UK, Canada Defence Trade Cooperation Treaties**: Provide streamlined licensing for covered defence articles between treaty partners; not a blanket exemption.
+
+---
+
+## Foreign Military Sales (FMS) vs Direct Commercial Sales (DCS)
+
+| Aspect | FMS | DCS |
+|--------|-----|-----|
+| Contract party | US Government (DSCA) | US company directly |
+| ITAR licence | Not required (US Gov exemption) | DSP-5 / TAA required |
+| End-use assurance | US Government provides | US company responsible |
+| Price | Government + administrative fees | Market rate |
+| Delivery risk | US Government manages | US company manages |
+
+---
+
+## Record-Keeping Requirements (22 CFR § 122.5)
+
+All ITAR registrants must maintain for **5 years**:
+- All export/import licences and shipping documents
+- All TAA/MLA agreements and associated records
+- End-user certificates and purchase orders
+- Records of all disclosures of technical data
+- Commodity Jurisdiction requests and determinations
+- Voluntary disclosure records
+
+Records must be available for inspection by DDTC, US Customs, DoD, or other US government agencies.