Skip to content
Back to Compliance Academy

Product context is educational relevance, not a feature-status or compliance claim.

Context: Visitor
Context: Trade
Context: Regulated Access
Export Controls
Controlled Access
Front Desk
Compliance Manager
Admin

What is a U.S. person vs. a foreign national under 22 CFR 120.62?

An export-control status defined at ITAR 22 CFR 120.62 and 120.63. It is one fact used when deciding whether a proposed release of controlled technical data or technology may require authorization.

Last Reviewed: 2026-09-19Plain-English reference · not legal advice

Plain-English Summary

ITAR defines U.S. person and foreign person for its regulatory purposes. A person’s status matters when a proposed release of ITAR technical data or EAR-controlled technology would be an export, but status alone does not decide whether someone may enter a facility or whether a government authorization is required. The analysis also depends on what controlled information is in scope, what access would occur, and which regulation applies.

Why This Matters

Under ITAR, releasing technical data to a foreign person in the United States is an export to the countries specified by the regulation for that person. Under the EAR, release of controlled technology or source code to a foreign person in the United States can be a deemed export. That makes status relevant to access planning where controlled information could actually be released, not a universal visitor-admission rule.

Explanation Depth

Concept Explanation

Being a foreign person does not automatically mean someone cannot enter a facility. It means the export-control team may need to check what controlled technical information the person could see or receive and whether authorization is needed. The decision should be tied to the controlled information and the applicable rule, not simply to nationality.

When You'll See This in SecurePoint

In SecurePoint Visitor, an organization can use the export-control attestation flow to capture U.S.-person or foreign-person status and route the resulting visit through its configured host, security, escort, or area rules. The system records and enforces the customer’s policy; it does not make the export-authorization determination and does not auto-deny solely because the person is foreign.

What You Should Do Next

Use U.S.-person or foreign-person status only where the organization’s export-control process calls for it. Identify the controlled technical data or technology, the areas and systems through which it could be released, and any authorization that applies. Configure visitor restrictions, approvals, or escorts from that documented policy rather than treating foreign-person status as an automatic denial. For employment decisions, also account for the INA anti-discrimination rules and DOJ guidance.

What Can Go Wrong

One error is allowing access that releases controlled technical data without completing the required export-control analysis. The opposite error is turning export-control status into a blanket citizenship or national-origin restriction when the controlled information and authorization facts do not support it. DOJ specifically warns employers against discrimination caused by misunderstandings of export-control requirements.
What is a U.S. person vs. a foreign national under 22 CFR 120.62? | Compliance Academy | SecurePoint USA