Many hardware companies that sell into defense also build plenty of products that have nothing to do with it: industrial controllers, test equipment, commercial communications gear, consumer accessories. Their procurement teams face the same question on almost every new board: can this one go to an offshore supplier, or does it have to stay with a registered U.S. facility?
We are a PCB and PCBA factory in Shenzhen, so it is worth saying plainly at the start where we stand. XFPCB is not registered with the U.S. Directorate of Defense Trade Controls, and we cannot accept ITAR-controlled boards or technical data. The same applies to designs controlled under the Export Administration Regulations' "600 series" for military items. China is on the ITAR list of countries subject to a policy of denial, and 600-series licensing for China is reviewed consistently with that policy. That is not a gap that paperwork on our side can close.
What we can do is help buyers make the sorting decision cleanly, because we see the consequences when it is made badly: data packages sent before anyone checked, commercial variants that still carry controlled notes, and RFQs that have to be withdrawn. This article is buyer guidance on that sourcing decision. It is not legal advice; jurisdiction and classification determinations belong to your export compliance function and counsel.
The decision starts with the item and its data, not with the supplier
The common mistake is to frame the question as "domestic or offshore?" The real first question is: what is the export control status of this board and of the technical data needed to build it?
Three broad outcomes are possible:
- ITAR-controlled. The board, or the technical data for it, is a defense article on the U.S. Munitions List (22 CFR 121.1) or is specially designed for one in a way the USML controls. Fabrication drawings, Gerber or ODB++ data, stackups, assembly instructions and test procedures for such a board are typically technical data under 22 CFR 120.33.
- Controlled under the EAR. The board or its technology falls under an Export Control Classification Number on the Commerce Control List. This includes the 600-series ECCNs, which cover many parts and components specially designed for military items that were moved off the USML during export control reform, as well as dual-use entries.
- Not specifically controlled. The item is subject to the EAR but not listed (EAR99), or listed but not requiring a license for the destination and end use in question. Most commercial and industrial boards land here.
Only the third group is a straightforward candidate for an offshore supplier like us, and even then subject to end-use and end-user rules discussed below.
How a board ends up on one side of the line
The ITAR's own rules give useful guidance on how classification works, and a few points surprise engineering teams.
Intended use is not the test on its own. The regulations state explicitly (in a note to 22 CFR 120.3) that whether an item is used for military or civilian purposes after export is not by itself a factor in determining whether it is ITAR-controlled. A commercial power supply board installed in a military vehicle does not become a defense article just because of where it is used. Conversely, a simple two-layer board can be controlled if it was specially designed for a defense article and the relevant USML category captures it.
"Specially designed" has a defined meaning. 22 CFR 120.41 sets out when a part or component is specially designed and lists release criteria, for example parts developed as general-purpose items, or developed with knowledge they would be used in both defense and non-defense items, supported by documents from the time of development. Those release criteria are where much of the analysis for PCBs happens, and they depend on development records, not on how the board looks.
There is an order of review. 22 CFR 120.11 describes reviewing the USML first; if an item is not on the USML, it may still be subject to the EAR, and the EAR has its own classification order of review.
When genuinely in doubt, ask the government. A commodity jurisdiction request to DDTC (22 CFR 120.4 and 120.12, using form DS-4076) produces a formal determination of whether an item is on the USML. Registration is not required to submit one.
None of this is something a contract manufacturer can decide on your behalf. A supplier asking you for the jurisdiction and classification of a part number is not being bureaucratic; it is asking for the one fact it needs before it can legally look at your files.
Controlled work stays with appropriately authorized facilities
For ITAR-controlled boards, the practical path for most buyers is a U.S. manufacturer registered with DDTC under 22 CFR Part 122, with access controls that keep technical data with U.S. persons unless a license or other approval permits otherwise. Remember that "export" under 22 CFR 120.50 includes releasing technical data to a foreign person inside the United States, so domestic location alone is not the whole answer; ask suppliers how they control access and whether any subcontracting, offshore CAM support or cloud storage is involved.
For 600-series and other EAR-controlled boards, the analysis depends on the ECCN, destination and end use. For China in particular, 600-series items face review consistent with the arms embargo, and the EAR's military end-use and end-user rules apply on top. In practice, buyers should expect this work to stay out of China.
What can legitimately go offshore
A large share of most companies' board portfolios is ordinary commercial and industrial electronics: classified EAR99 or under an ECCN that does not require a license for the destination. That work can be sourced from an offshore supplier, provided you:
- Have actually classified it, rather than assumed. A classification recorded per part number, with the reasoning, is what lets procurement act quickly.
- Screen the supplier and other parties against U.S. restricted party lists such as the Entity List.
- Confirm there is no prohibited end use or end user involved.
- Make sure the data package you send contains only data for that commercial item.
The last point is where most problems actually occur.
Split sourcing: where the line gets crossed by accident
Companies that buy both controlled and commercial boards often split their sourcing: controlled work to a registered domestic supplier, commercial work to a cost-competitive offshore one. The split is sound. The failure modes are in the data.
Commercial variants of defense designs. A board derived from a controlled design may carry over more than circuitry: fab notes, test specifications, material callouts or design rationale that are themselves technical data for the defense article. Classify the variant on its own, and review its data package line by line before release.
Shared libraries and templates. Fab drawing templates, stackup libraries and assembly instruction templates get reused across programs. A drawing note that references a program, a military specification or a controlled requirement can travel into a commercial package without anyone noticing.
File metadata. Program names in project files, title blocks, file paths, revision histories and embedded comments in CAD exports can reveal more than intended. Export data from a clean project, not a copy of a controlled one.
Shared systems. If controlled and commercial projects live in the same PLM, file-sharing or email threads, a supplier portal or a cloud folder can expose controlled data to offshore users. The ITAR's carve-out for encrypted data in 22 CFR 120.54 has conditions, including not storing data in or sending it to a country listed in 22 CFR 126.1. Segregation is simpler than relying on it.
RFQ bundling. Sending a supplier a single RFQ that covers a mix of boards "to get a better price" is a common way controlled data reaches the wrong recipient. Release each package separately after its own check.
Documentation to prepare
A small amount of discipline makes split sourcing routine rather than risky:
- A jurisdiction and classification record for every board part number: USML category or ECCN or EAR99, the basis, who made the determination and when, and a commodity jurisdiction determination if one exists.
- Data marking. Controlled technical data should carry an export control marking so it is recognizable in any system.
- A release checklist used before any data package goes to an external supplier, confirming classification, scrubbing for program references, and checking the recipient.
- Restricted party screening records for suppliers.
- End-use statements where your compliance program requires them.
- Supplier declarations on subcontracting and data storage locations.
- Records of what was sent, to whom and when.
Your export compliance team or counsel should own the procedure; engineering and procurement are the people who run it day to day.
Where XFPCB fits
Our position is simple. We build commercial and industrial boards. Before files are shared, we ask buyers to state whether a design or its data is export controlled, and if the answer is ITAR or 600-series, the answer from us is no, regardless of volume or schedule. If controlled data ever arrives by mistake, the right response is to stop and tell the buyer so their compliance team can deal with it, rather than quietly deleting it and carrying on. For the commercial work that makes up most portfolios, including the commercial half of a split-sourced program, a classification note with the RFQ and a clean, program-free data package are all we need to quote and build.
If you are weighing domestic and offshore suppliers more generally, our USA vs China PCB guide covers the commercial side of that comparison. For anything controlled, the right next call is to your export compliance counsel and a registered U.S. manufacturer, not to an offshore quote desk.