ITAR, Security Clearances, and Regulatory Moats in A&D

Introduction

The regulatory environment in aerospace and defense creates competitive barriers that are qualitatively different from anything else in industrials. In most industrial sub-sectors, competitive moats come from scale, customer relationships, or proprietary technology. In A&D, they also come from the government itself: ITAR export controls, security clearances at both the facility and personnel level, and classified program access requirements create layers of regulatory protection that insulate incumbent contractors and fundamentally limit who can participate in the market, both as competitors and as acquirers.

For A&D investment bankers, these regulatory moats are not background context; they are central to deal execution. They determine which buyers can be approached in a sell-side process, how long the deal will take to close, what structural protections may be required, and whether CFIUS review will be triggered. Understanding the regulatory landscape is a prerequisite for effective A&D coverage.

ITAR is the primary regulatory framework governing the export of defense articles, services, and technical data from the United States. Administered by the State Department's Directorate of Defense Trade Controls (DDTC), ITAR requires any US company that manufactures, exports, or brokers defense articles listed on the US Munitions List (USML) to register with the DDTC and comply with strict export controls.

International Traffic in Arms Regulations (ITAR)

A set of US government regulations that control the export and temporary import of defense articles and defense services covered by the United States Munitions List (USML). ITAR applies to any US person or entity that manufactures, exports, or provides technical data related to defense articles. The regulations restrict sharing of controlled technical data with foreign persons (including foreign employees of US companies, known as "deemed exports"), require State Department licensing for defense exports, and impose severe penalties for violations (up to $1 million per violation in civil penalties and criminal prosecution for willful violations).

The practical impact of ITAR on A&D companies is pervasive. Manufacturing facilities that handle ITAR-controlled items must maintain strict physical security, information security, and personnel screening protocols. Technical data (engineering drawings, test results, manufacturing processes) for ITAR-controlled items cannot be shared with foreign persons without a license, which affects hiring practices, supplier relationships, and international collaboration.

The USML scope is actively expanding. The DDTC's 2025 regulatory agenda included 14 planned rulemaking actions, and the September 2025 final rule added new controls for advanced aircraft parts and large unmanned underwater vehicles. This expansion signals a shift from the prior decade's Export Control Reform initiative, which had been narrowing the USML. For bankers, an expanding USML means that more companies and products fall under ITAR's regulatory umbrella, broadening the competitive moat for compliant incumbents.

The AUKUS alliance framework, finalized in 2024, created new ITAR exemptions for defense trade between the US, Australia, and the UK, removing licensing requirements for over 70-80% of commercial defense trade among the three countries. While this is a significant liberalization for AUKUS partners, it does not extend to other foreign buyers, maintaining ITAR's role as a barrier for most international acquirers.

Beyond ITAR, the security clearance system creates additional layers of competitive protection. Both individuals and facilities must hold appropriate clearances to work on classified defense programs.

Personnel clearances (Confidential, Secret, Top Secret, TS/SCI) require extensive background investigations that take 6-18 months to complete and are granted only to US citizens. A company's ability to staff classified programs depends on its base of cleared personnel, which cannot be rapidly expanded. Recruiting and retaining cleared workers is one of the primary competitive challenges in A&D, and the cleared labor pool is a key valuation driver for government IT and services companies.

Facility clearances (FCL) require that a company's physical locations meet specific security requirements for handling and storing classified information. Obtaining an FCL involves demonstrating foreign ownership, control, or influence (FOCI) mitigation measures if any foreign ownership exists, and passing security inspections by the Defense Counterintelligence and Security Agency (DCSA). A foreign-owned company seeking an FCL typically must establish a proxy board or Special Security Agreement that insulates the foreign owner from access to classified operations.

The regulatory framework shapes A&D deal execution in several specific ways that bankers must manage.

Buyer universe construction. On a sell-side process for an ITAR-registered company with classified programs, the buyer universe is effectively limited to US-based strategic acquirers, US-based PE sponsors with existing cleared platforms, and (in limited cases) AUKUS-allied buyers. This can reduce the buyer universe from dozens of potential acquirers to a handful. However, the reduced competition is partially offset by the high strategic value that qualified buyers place on the asset, often resulting in premium valuations despite the smaller pool.

Deal timeline management. ITAR compliance review, security clearance transitions, and potential CFIUS review add months to deal timelines. A straightforward industrial M&A transaction that might close in 3-4 months could take 9-12 months when classified programs are involved. Bankers must set realistic timeline expectations with clients and factor the extended timeline into deal structuring (including ticking fees and interim operating covenants).