export compliance best practices...2. continuous risk assessment of the export/import program. 3....

Export Compliance Best PracticesCandace Goforth, Managing Director, Goforth Trade AdvisorsRay Ruthen, Sr. Manager, International Trade Compliance, Pratt & WhitneyJeff Grody, Principal and Executive Director, Orchid Advisors Export PracticeJordan Young, Export Services Manager, Orchid AdvisorsMay 10, 2017

• Twoperspectivesonsiximportanttopicspertainingtoexportcompliancebestpractices

• ITARSection127.1(c):• DDTCRegistranttechnologycontrolprograms• Customer-Intermediary-EndUserDueDiligence• Vendorvetting;enforcementofvendorexportcompliance• ExportcompliancemanagementofTAA,MLAandWDAprograms• Voluntarydisclosures

• WhatareDDTC’sexpectations?• Howdoesanindustryleaderhandlethesechallenges?

2© 2017 Orchid Advisors LLC. All Rights Reserved.

Purpose of this program


PanelistsCast

Candace Goforth (playing the role of DDTC) Candace Goforth is the Managing Director of Goforth Trade Advisors. Candace served over thirteen years in the Directorate of Defense Trade Controls (DDTC) leaving as the Director for Policy. Candace held numerous positions in DDTC to include Licensing Officer, Senior Agreements Officer, Commodity Jurisdiction Analyst, Senior Foreign Affairs Officer and Compliance Specialist. Candace was also the Division Chief for Training, and was charged with the training of all new Licensing and Agreements Officers

Ray Ruthen (playing the role of Industry ITC Leader)Ray is Sr. Manager, International Trade Compliance, for the Pratt & Whitney division of United Technologies Corporation. Ray has been involved in international trade compliance for 16 years as a Business Area Export Representative and business unit export manager for the aerospace manufacturer operations and supply chain. Ray has held positions in Engineering and Operations throughout his 30-year career at UTC. He is responsible for providing leadership and guidance for international trade compliance across the Pratt and Whitney Global Supply Chain. In this role, Ray is responsible for designing a world class ITC strategy supporting Pratt & Whitney’s global growth strategy.


PanelistsSupporting Actors

Jordan Young (playing the role of Export Compliance Consultant), Export Services Manager, Orchid Advisors, helps firearms and ammunition companies with licensing, logistics and registration matters and building and implementing best in class export compliance programs. Jordan brings more than 16 years’ experience as a firearms industry executive to Orchid Advisors, having held management positions at majorU.S. and international firearm manufacturers and importers, including Remington Arms Company, Para-Ordnance and Dasan U.S.A., among others.Jeff Grody (playing the role of Export Compliance Consultant) is Executive Director of the Orchid Advisors Export Services practice. An attorney with more than 30 years’ experience in private practice and as Sr. V. P. and General Counsel for a leading firearm manufacturer, Jeff leads the Orchid Advisors Export Services Practice, which helps companies in the firearms and ammunition industry sell, design and manufacture products in the global marketplace and implement practical and effective export compliance programs.

Sue Gainor (supporting the role of DDTC) was Director of DDTC’s Office of Defense Trade Controls Compliance from November 2013 until August 2016. She has now established a consulting firm, Gainor Global Trade, LLC. Her remarks quoted in this presentation are taken from an interview with Orchid Advisors published on April 14, 2017 and are used with her permission.

Offstage

ITAR Section 127.1(c)

© 2017 Orchid Advisors LLC. All Rights Reserved. 5

Anypersonwhoisgrantedalicenseorotherapprovaloractspursuanttoanexemptionunderthissubchapterisresponsiblefortheactsofemployees,agents,brokers,andallauthorizedpersonstowhompossessionofthedefensearticle,whichincludestechnicaldata,hasbeenentrustedregardingtheoperation,use,possession,transportation,andhandlingofsuchdefensearticleabroad.


ITAR Section 127.1(c)

• HowsignificantisthisITARprovisionstoDDTC?Arealotofvoluntarydisclosuresbasedonthissectionorreferenceit?

• Atahighlevel,whatdoesthismean?WhatactionsdoesthisSectioncompelanexportertotake?

• Whenanexportershipsgunstoacommercialdistributorinanothercountry,whatistheexporter’sobligationtooverseewhatthedistributordoeswiththeguns?Whatifdistributorre-exports?Shouldyoudoavoluntarydisclosure?Shouldyouaudit?

• Whatifit’sagovernmentalcustomer?Howcanyoumonitorwhatthegovernmentdoeswiththeproductsyousend?

• Ifyougivetechdatatoadomesticvendorandthevendorsendsitoutofthecountrytogetatoolmade,whatisyourresponsibilityunderthissection?ShouldyoudoaVDifthevendordoesn’t?Whatifthevendordoesfileone– shouldyoudoyourown?

• Ifyou’reamanufacturerordealerandyousellproducttoacustomerintheU.S.knowingthatthecustomer’sintentistoexporttoaforeignenduser,whatisyourresponsibilityunderSection127.1(c)?Isthisadomesticsaleoranexportsale?


ITAR Section 127.1(c) -- DDTC

• DescribehowPratt&WhitneyfulfillsitsSection127.1(c)obligations.

• WhenPratt&WhitneyislookingatEAR-controlleditemsandtechnology,doesitviewitsobligationsinthisrespectdifferently?Ifso,how?


ITAR Section 127.1(c) -- UTC



This document does not contain any export regulated technical data.



Supplier Engagement

Due Diligence

Awareness Training

Terms & Conditions

Health Assessment

QuestionNumberCategory Sub-Category Gold?

41 ProcessManagement ITC Yes Category: ProcessManagement41 ProcessManagement ITC Yes Sub-Category: ITC41 ProcessManagement ITC Yes GoldQuestion: Yes

41 ProcessManagement ITC YesQuestion#: 41 Doyouhaveaprocessinplacetofullycomplywithallapplicableexportor

importcontrollawsandregulations?

41 ProcessManagement ITC Yes

Clarification: Companycomplianceprocessshouldinclude:1.ManagementCommitment:Seniormanagementmustestablishwrittenexport/importcompliancestandardsfortheorganization,commitsufficientresourcesfortheexportcomplianceprogram,andensureappropriateseniororganizationalofficial(s)aredesignatedwiththeoverallresponsibilityfortheexport/importcomplianceprogramtoensureadherencetoexport/importcontrollawsandregulations.2.Continuousriskassessmentoftheexport/importprogram.3.Formalwrittenexport/importmanagementandcomplianceprogram:effectiveimplementationandadherencetowrittenpoliciesandoperationalprocedures.4.Ongoingcompliancetrainingandawareness.5.Pre/Postexport/importcompliancesecurityandscreening:screeningofemployees,contractors,customers,products,andtransactionsandimplementationofcompliancesafeguardsthroughouttheexportlifecycleincludingproductdevelopment,jurisdiction,classification,valuation,countryoforigin,sales,licensedecisions,supplychain,servicingchannels,andpost-shipmentactivity.6.Licenseapplicationsandexemption/exceptiondeterminations,includingallsupportingdocumentation,aretimelysubmittedandobtainedconsistentwithregulatoryrequirements.7.Adherencetorecordkeepingregulatoryrequirements.8.Internalandexternalcompliancemonitoringandperiodicaudits.9.Maintainingaprogramforhandlingcomplianceproblems,includingreportingexport/importviolations.10.Completingappropriatecorrectiveactionsinresponsetoexport/importviolations.

41 ProcessManagement ITC Yes Answers: 0 [] No41 ProcessManagement ITC Yes 141 ProcessManagement ITC Yes 241 ProcessManagement ITC Yes 341 ProcessManagement ITC Yes 441 ProcessManagement ITC Yes GoldLevel 5 [] Yes41 ProcessManagement ITC Yes

SupplierHealthAssessment2.0

UTC is ultimately responsible for export authorizations regardless of the party who violates it under ITAR § 127.1(c).

This document does not contain any export regulated technical data.

Technology Control Programs


ControllingagainstunauthorizedreleasesoftechnicaldataanddefenseservicestoforeignpersonsintheUnitedStatesisachallengingpartofexportcompliance.ItisdifficulttocontrolwhatthirdpartiesintheU.S.dowithtechnicaldataanddefenseservicestheyreceiveandhowtheyprotectit.


Technology control programs

SueGainor• DDTCexpectsregistrantstocomplywiththeregulations.DDTCcommunicatesthisexpectationandexpressestheimportanceofhavingwell-functioningcomplianceprogramsinmanyways.

• Theregulatorygoalisforregistrantstodevelopcomplianceprogramsthatsuittheirbusinessmodelnotforthegovernmenttodictatewhattheseprogramsshouldlooklike.

• DDTCdoesn’tseektotelltheregulatedindustryhow tocomplyjustthat itmustcomply.


Technology control programs -- DDTC

• WhenaU.S.manufacturergivestechnicaldatatoasupplierintheU.S.,doesITAR§127.1(c)apply?(Note:thisrelatestotheword“abroad”attheendofthefirstsentencein§127.1(c))

• WhenshouldanITARregistrantobtainalicensepriortogivingaplanttourtoforeignvisitors?

• Howimportantisittohaveaproductclassificationmatrixthatidentifiescontrolledgoodsandtechnicaldatainyourcompany?

• DDTCencourages,butdoesnotmandate,complianceprograms?Why?Whattypesoftechnologycontrolviolationsareparticularlyserious?


Technology control programs -- DDTC

• HowdoesUTCaddresstechnologycontrol?• AreanyoftheseissueshandleddifferentlywhenUTCisdealingwithEARtechnologyratherthanITARtechnicaldataanddefenseservices?

• Whatisthedecision-making/sign-offprocedurefordeterminingtheapplicabilityofITARexemptionsandEARexceptionsintechnologycontrolprograms?


Technology control programs -- UTC

Customer-Intermediary-End User Due Diligence


U.S.ExportRegulationsrestonafoundationofvoluntarycompliance.Howmuchdoesanexporterneedtoknowabouttheconsigneesandendusersitdoesbusinesswith?HowmuchduediligencedoesDDTCexpectexporterstodo?


Customer-Side Due Diligence

SueGainor• Regulatorsencourageexporterstodevelopsufficientrelationshipswiththeirdistributors,intermediateconsignees,andend-userstobeconfidentthosepartiesareableandwillingtocomplywiththeITAR.

• GiventhattheyareresponsibleunderSection127.1(c)oftheITAR,authorizedexporterswouldbewisetominimizetheirexposurebyensuringtheyaredealingwithreputableandcompliantdistributors,intermediaries,andend-users.

• DDTCencouragesexporterstoconductdeniedpartyscreeningasanelementofitscomplianceprogram,butsuchscreeningshouldn’tbethesumtotalofexporters’duediligence.

• Periodicpost-salechecksareaprudentwaytoensurerecipientsaremeetingtheirobligations.Exporterswouldbewisetoretainrecordsofallduediligenceefforts,asDDTCwillrequestthoserecordsshoulditlearnofaviolation.


Customer-Side Due Diligence -- DDTC

• Whenisadeniedpartyscreenenoughduediligenceonaforeignenduser?• WhatmorethanadeniedpartyscreendoesDDTCthinkanexportershouldknowaboutanoverseas(i)commercialdistributor,(ii)retailpurchaserofgunpartsorguns,(iii)governmentalcustomer,(iv)aU.S.customerthatwantsyoutoshiptoaforeignenduser?

• AlicensedfirearmsretailerinBelgiumwantstobuy25firearms.WhatdoesDDTCwantyoutoknowaboutthatdistributor?Whatrecordsofyourduediligenceshouldyouhave?Whatpost-salecheckingshouldyoudo?

• CanU.S.embassieshelpinthedestinationcountries?Ifso,how?Whodoyoucontact?Ifyouwanttoconfirmwhetheragovernmentaltenderexists,whocantellyou?

• IsanintermediaryabrokerundertheITARif,insteadofactingasacommissionedagent,hebuysproductunderhisownPO,simultaneouslysellsittotheenduserunderaseparatePO?


Customer-Side Due Diligence -- DDTC

• ResponsestoDDTCquestions?• DescribehowPratt&Whitneyfulfills“knowyourcustomer”obligations.



Customer-Side Due Diligence -- UTC

Vendor Vetting; Enforcement Of Vendor Export Compliance


WhatareaDDTCregistrant’sobligationsregardingtheselectionandmonitoringofitsvendorstoprotectagainstexportcontrolviolationsarisingfromweaknessesintheirexportcomplianceprograms?


Vendor Export Compliance

SueGainor• DDTCencouragesregistrantstohelptheirsuppliers(anddistributors,intermediaries,end-users)complywiththeregulations.

• Thewaysregistrantshelptheirsupplierscanincludeformalorinformalinformation-sharingprocesses,cooperativediscussionsaboutorreviewsofsuppliercomplianceprograms,andregistrant-conductedsuppliertraining.

• Someregistrantsarereluctanttohelpsuppliers,fearingsuchhelpmakesthemmoreliableforsupplierviolations.

• Astheregulatorysystem’scompliancegoalisprotectingforeignpolicyandnationalsecurity,DDTChopesregistrantswouldcontributetotheefforttoensuretheirsupplierscomply.


Vendor Export Compliance -- DDTC

• DDTCreceivesVDsonviolationsbyvendors.Whatarearegistrant’sobligationsinthisregard?

• WhattypesofviolationsgetDDTCupsetinthisarea?• DofirearmsmanufacturershaveanobligationtopolicewhethervendorswhomanufacturedefensearticlesareDDTCregistered?

• IfafirearmmanufacturerhasaproceduretomakesureitsvendorsareDDTC-registeredwhenrequiredtobe,isthatenoughduediligenceinDDTC’seyes?

• ShouldmanufacturerseducatetheirvendorsintheITARandEAR?


Vendor Export Compliance -- DDTC

• DescribehowPratt&Whitneyfulfills“knowyourcustomer”obligations.



Vendor Export Compliance -- UTC



P&W SUPPLIER ENGAGEMENT

WhatWeExpect• Completeduediligenceassessment– NewSuppliers• Completebasicawarenesstraining- Onboarding• AdheretoITCterms&conditions- Contractual• ActivelyparticipateinSupplierGoldProgram-Continuoussustainment

•This document does NOT contain technical data



DUE DILIGENCE PROCESS

ThisdocumentdoesNOTcontaintechnicaldata

•TRACE ASSESSMENT SCOPE

Ø Prior to supplier approval.



DUE DILIGENCE PROCESS

• Responsetoself-assessmentquestionnaire• Reputationalscreenofcompany,ownersanddirectors• ITCQuestionnaire• Mediasearchwitha5yearlook-backperiod• Businessreferencecheck• Ethicsoverview

ThisdocumentdoesNOTcontaintechnicaldata


Vendor Export Compliance -- UTC•ITC TERMS & CONDITIONS

Long and Short Form T&Cs updated and posted for use

http://www.utc.com/Suppliers/Pages/Terms-and-Conditions.aspx

•Contractual RequirementsØ Required for every purchase order.



Vendor Export Compliance -- UTCTRADE COMPLIANCE TRAINING

•P&W offers all suppliers 10 freesession of on-line compliancetraining.•Please email Catherine at:•[email protected]

•Onboarding New SuppliersØ Basic training covering EAR and ITAR



Vendor Export Compliance -- UTC•WHAT IS SUPPLIER GOLD & WHO PARTICIPATES?

•UTC Supplier Gold Criteria

•0 100% ≥6 ≥80% Escapes (Quality Rejections) for the Last 12 Months

On-Time Delivery for the Last 12 Months

Customer Satisfaction Score (out of 7

Score on Supplier Health Assessment in All CategoriesPlus Zero Gold Question Gaps

•Existing Supply Base Sustainment

Ø Embedded in Quality Health AssessmentKey Programs

This document does NOT contain technical data


Vendor Export Compliance -- UTC•SUPPLIER GOLD ITC QUESTION

“Do you have an Export Management Compliance Program (EMCP), which is suitable for your business?”

http://www.bis.doc.gov/index.php/compliance-a-training/export-management-a-compliance/compliance

Dep’t of Commerce Guidelines• Integrate existing BIS guidelines




When answering this question, consider the following elements of an effective EMCP. Each item below is a fundamental pillar of compliance regardless of whether your product or service is subject to the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR). More information concerning how to establish or enhance your company’s EMCP may be found at the following Bureau of Industry and Security website: http://www.bis.doc.gov.

1. Management Commitment: Senior management must establish written export compliance standards for the organization, commit sufficient resources for the export compliance program, and ensure appropriate senior organizational official(s) are designated with the overall responsibility for the export compliance program to ensure adherence to export control laws and regulations.

2. Continuous Risk Assessment of the Export Program. 3. Formal Written Export Management and Compliance Program: Effective implementation and adherence to written policies and operational procedures. 4. Ongoing Compliance Training and Awareness. 5. Pre/Post Export Compliance Security and Screening: Screening of employees, contractors, customers, products, and transactions and implementation of compliance safeguards throughout the export life cycle including product development, jurisdiction, classification, sales, license decisions, supply chain, servicing channels, and post-shipment activity. 6. Adherence to Recordkeeping Regulatory Requirements. 7. Internal and External Compliance Monitoring and Periodic Audits.

8. Maintaining a Program for Handling Compliance Problems, including Reporting Export Violations. 9. Completing Appropriate Corrective Actions in Response to Export Violations.


“Do you have an Export Management Compliance Program (EMCP) that is suitable for your business?”

Export Compliance Management of TAA, MLA and WDA Programs


ITAR“Agreements”arecomplexlicensesinvolvingcontinuingexchangesoftechnicaldata,defenseservicesand,usually,defensearticlesbymanypeopleoveralongperiodoftime.HowshouldU.S.licensorsfulfilltheirITAR§127.1(c)obligationsinconnectionwithAgreements?


Management of Agreements

• HowmuchshouldaU.S.licensorknowaboutwhatthelicenseeandsublicenseesaredoingwithtechdata,defenseservicesanddefensearticlesexportedunderanAgreement?

• HowmuchshouldtheU.S.licensorknowaboutthepartiestheforeignlicenseeissellingproducttointheapprovedsalesterritory?

• IsaU.S.licensorexpectedtoconductITARtrainingfortheforeignlicensee?

• WhatareDDTCexpectationsregardingmonitoringforeignpersonemployeesfromunapprovedcountriesonanongoingbasisatforeignlicenseesandsublicensees?

• DoesDDTCworryaboutU.S.licensorcontrolofAgreementprogramswhentheforeignlicenseeistheparentcompany?

• HowshouldalicensorkeeptrackofdefenseservicesandtechnicaldataexportedunderanAgreement?Whatrecordsshoulditbekeeping?

• Whatarecommonviolations/VDsthatDDTCseesunderAgreements?


Management of Agreements -- DDTC

• ResponsestoDDTCquestions?• Whenaforeigndesign,procurementormanufacturingprogramisoccurringunderanEARlicenseratherthananITARAgreement,ismanagementoftheforeignendoftherelationshiphandleddifferentlythanitwouldbeunderanITARAgreement?


Management of Agreements -- UTC

Voluntary Disclosures


ITAR§127.12(c)encouragesthesubmissionofvoluntarydisclosureswhenviolationsoccuroraresuspected.


Voluntary Disclosures

• Aretherereasons,otherthanmitigatingriskofpenalties,thataregistrantshouldsubmitaVD?

• WhatarethedifferentlevelsofresponsethatDDTCtakestoVDsandwhatarethetriggersforhigherlevelresponses?

• HowdoesDDTCtrackVDsfromregistrants?Forinstance,ifyousubmitfiveayear,issomeonemonitoringyourbehavior?Ifso,whatshouldyoubeconcernedaboutasaregistrantifyouaresubmittinglotsofVDs?

• IsthereaconnectionbetweentheDDTCcomplianceandlicensingdivisionssuchthatcertaintypesofVDsortheamountofVDscanimpactaregistrant’sabilitytoobtainlicenses?

• HowmanyVDsistoomanyforoneregistranttosubmitbeforeDDTCgetsconcernedaboutthenumberofviolationsfromthatregistrant?


Voluntary Disclosures -- DDTC

• WhatisUTC’spolicyforsubmittingVDsandVSDs?• HowdoesUTChandlerootcauseanalysis?• HowdoesUTChandledesignandimplementationofcorrectiveaction?

• ITAR§127.12(c)encouragesseniormanagementinvolvementinVDsituations.HowdoesUTCaddressthat.

• ITAR§127.12(c)askspartiesfilingdisclosurestoidentifyallpartiesinvolvedintheviolation.DoesUTCidentifyindividualemployees?

• WhatinternaldisciplinedoesUTCtakeagainstemployeeswhocauseviolations?


Voluntary Disclosures -- UTC

Questions?


export compliance best practices...2. continuous risk assessment of the export/import program. 3....

Documents