Space Regulatory Compliance Guide: ITAR, FCC, FAA & More

Why Regulatory Compliance Matters in Space

Space is one of the most heavily regulated industries in the world. Unlike terrestrial businesses that deal with a single regulatory framework, space companies must simultaneously comply with export control laws, communications regulations, launch safety requirements, environmental reviews, remote sensing restrictions, and international treaty obligations. Failure to comply can result in criminal penalties, loss of operating licenses, and irreparable damage to a company's reputation and business relationships.

The regulatory burden is not merely a cost of doing business: it fundamentally shapes corporate strategy. ITAR restrictions determine which international partnerships and customers are feasible. FCC licensing timelines dictate satellite development schedules. FAA launch licensing requirements influence launch site selection and vehicle design. Companies that master the regulatory landscape gain a significant competitive advantage, while those that underestimate it face delays, fines, and lost market opportunities.

The regulatory environment is also evolving rapidly. The FAA's performance-based launch rules (14 CFR Part 450) took effect in 2021 and became the only path for launch licenses in March 2026, and in 2026 the FAA began billing a per-launch user fee. The FCC's five-year post-mission disposal rule for low Earth orbit, adopted in 2022, took effect in September 2024. The Commerce Department's Office of Space Commerce is running its Traffic Coordination System for Space (TraCSS) on fiscal 2026 funds. And international frameworks like the Artemis Accords are establishing norms for lunar and deep-space activities.

Key Regulatory Agencies

Space companies in the United States must navigate multiple federal agencies, each with distinct jurisdiction over different aspects of space activities. Here is a comprehensive overview of the primary regulatory bodies:

In addition to these federal agencies, space companies may need to comply with state-level regulations (particularly for spaceport operations), environmental laws (NEPA, Endangered Species Act), and technical standards (such as NASA-STD-8719.14 for orbital debris and the CCSDS data standards).

ITAR and Export Controls Explained

The International Traffic in Arms Regulations (ITAR) is the most impactful regulatory framework for many space companies. Administered by the State Department's Directorate of Defense Trade Controls (DDTC), ITAR controls the export and temporary import of defense articles and services listed on the United States Munitions List (USML).

What Falls Under ITAR?

USML Category IV covers rockets and space launch vehicles, and Category XV covers "Spacecraft and Related Articles": spacecraft with listed military or intelligence capabilities (such as signals intelligence, remote sensing above set thresholds, or positioning, navigation and timing), certain components, and the related technical data and defense services. Spacecraft not identified in Category XV(a) are subject to the Export Administration Regulations (EAR) instead (22 CFR 121.1).

The revised Category XV that took effect on November 10, 2014 transferred many commercial spacecraft and components from the USML to the Commerce Control List (CCL), making them subject to the EAR rather than ITAR. Launch vehicles, certain propulsion systems, and military satellites remain on the USML.

ITAR Compliance Requirements

• ▸Registration: Anyone in the business of manufacturing or exporting defense articles, or furnishing defense services, must register with DDTC (22 CFR 122.1); brokers register under Part 129. New registrants pay $3,000 a year (Tier 1, 22 CFR 122.3, as of October 2026).
• ▸Licensing: Export licenses are required for permanent and temporary exports of defense articles and technical data to non-US persons.
• ▸Technology Control Plans: Companies handling ITAR data commonly use a written technology control plan with physical and cybersecurity controls to prevent unauthorized access.
• ▸Deemed Exports: Releasing ITAR technical data to a foreign person within the United States is an export (22 CFR 120.50(a)(2)) and needs an authorization unless an exemption applies.

Penalties for ITAR Violations

ITAR violations carry severe penalties. Willful violations can result in fines up to $1 million and imprisonment up to 20 years per violation (22 U.S.C. 2778(c)). Civil penalties can reach the greater of $1,271,078 per violation or twice the transaction value (22 CFR 127.10, adjusted annually for inflation; figure as of October 2026). Aerospace companies have paid multi-million-dollar settlements, such as Hughes Electronics and Boeing Satellite Systems' $32 million civil penalty in 2003. Beyond fines, violations can result in debarment from government contracts, which can be an existential threat for defense- focused space companies.

Read our detailed ITAR compliance guide →

FCC Satellite Licensing Process

The Federal Communications Commission licenses U.S. satellites and earth stations, and a satellite licensed by another country needs FCC market access before it can serve the United States (47 CFR 25.137).

The FCC licensing process involves several key steps. First, operators must file an application that includes detailed technical parameters: orbital location (for GEO) or constellation design (for NGSO), frequency bands, transmit power, antenna characteristics, and interference analysis. The FCC conducts a public notice and comment period during which existing operators and other stakeholders can raise concerns about interference or debris risk.

In 2022 the FCC shortened the 25-year benchmark for post-mission disposal in low Earth orbit to five years: satellites ending their mission in, or passing through, LEO below 2,000 km that dispose by uncontrolled reentry must complete disposal as soon as practicable and no later than five years after the end of the mission (47 CFR 25.283(e), effective September 9, 2024). Applicants also file an orbital debris mitigation showing that covers matters such as collision avoidance, reentry casualty risk and passivation.

For non-geostationary (NGSO) constellations, FCC milestones guard against spectrum warehousing: a licensee must launch and operate 50 percent of its authorized satellites within 6 years of the grant and the rest within 9 years, unless the FCC sets a different schedule (47 CFR 25.164(b)).

The FCC also regulates earth stations (ground terminals). The rise of consumer-grade terminals for services like Starlink has created new regulatory considerations around interference, especially in shared frequency bands, and separate Earth Stations in Motion (ESIM) rules cover terminals on aircraft, ships, and vehicles.

FAA Launch and Reentry Licensing

The FAA's Office of Commercial Space Transportation (AST) is responsible for licensing commercial launch and reentry operations in the United States. 14 CFR Part 450, a single performance-based rule, took effect on March 10, 2021, and the previous vehicle-specific rules (Parts 415, 417, 431 and 435) were removed on March 10, 2026 (85 FR 79566).

Part 450 lets operators choose how they demonstrate safety, as long as they meet quantitative risk criteria. The collective risk to the public, measured as expected casualties (E_C), must not exceed 1 × 10^-4 for a launch, excluding people in aircraft and neighboring operations personnel, who have their own limits (14 CFR 450.101(a)). That collective risk counts inert and explosive debris, toxic release and far-field blast overpressure.

A launch license application typically includes vehicle description and performance data, mission profile details, flight safety analysis, ground safety plan, environmental review (NEPA), and financial responsibility (insurance) documentation. The FAA sets each licensee's third-party liability insurance from a maximum probable loss analysis (14 CFR 440.9); by statute the requirement for one launch or reentry is capped at $500 million, or the maximum available on the world market at reasonable cost if that is less (51 U.S.C. 50914).

Since January 1, 2026 every launch or reentry carried out under an FAA license or permit owes a user fee (51 U.S.C. 50924): in 2026, the lesser of $0.25 per pound of payload or $30,000, rising each year to $1.50 per pound or $200,000 in 2033. The FAA works out the fee from the payload weight the operator reports before flight and bills the vehicle operator, who has 30 days to pay (FAA notice, April 22, 2026).

The FAA also licenses launch and reentry sites (spaceports). Its spaceport list (updated September 22, 2026) shows 14 FAA-licensed sites, including the Mid-Atlantic Regional Spaceport in Virginia, the Pacific Spaceport Complex in Alaska and Spaceport America in New Mexico. Federal ranges such as Cape Canaveral and Vandenberg, and private exclusive-use sites such as SpaceX's Starbase in Texas, are listed separately. Site operators are licensed under 14 CFR Part 420.

Spectrum Management and ITU Coordination

Radio spectrum is a finite resource essential to satellite operations. The International Telecommunication Union (ITU), a UN specialized agency, coordinates global spectrum allocation and satellite orbital assignments to prevent harmful interference between systems.

The ITU process for obtaining spectrum rights is lengthy and complex. For geostationary satellites, an operator must file through their national administration (the FCC for US entities) to the ITU's Radiocommunication Bureau. The filing goes through coordination procedures where the operator must negotiate with other administrations whose systems might experience interference. The assignment must be brought into use no later than seven years after the Bureau receives the complete filing, or the Bureau cancels it (Radio Regulations No. 11.44).

For non-geostationary constellations, the 2019 World Radiocommunication Conference (WRC-19) added deployment milestones: after the bringing-into-use period ends, operators must deploy 10% of the constellation within 2 years, 50% within 5 years and all of it within 7 years (ITU).

Key spectrum bands for satellite services include Ku-band (12-18 GHz) for direct-to-home broadcasting and broadband, Ka-band (27-40 GHz) for high-throughput satellites, V-band (40-75 GHz) for next-generation systems, and L-band (1-2 GHz) and S-band (2-4 GHz) for mobile satellite services and direct-to-device (band edges as NASA lists them). The growing demand for spectrum, particularly from mega-constellations, is creating significant coordination challenges and regulatory innovation.

Track spectrum allocations and auction results on SpaceNexus →

International Frameworks

Space activities are governed by a series of international treaties and agreements that establish the legal framework for activities in outer space. Understanding these frameworks is critical for companies with international operations or customers.

The Outer Space Treaty (1967)

The foundational treaty of space law: 118 states had ratified or acceded to it as of 1 January 2026, according to the UN Office for Outer Space Affairs treaty status page (116 as at 1 January 2025, plus the accessions of Latvia and Malaysia in 2025). Key principles include: space is free for exploration and use by all states, no national sovereignty claims in space, states bear international responsibility for their national space activities (including commercial operators), and the duty to avoid harmful contamination of space and celestial bodies. This treaty is why governments must authorize and supervise private space activities.

The Artemis Accords (2020)

A common set of principles for civil exploration of the Moon, Mars, and beyond, established in 2020 by NASA, the State Department and seven other founding signatories. As of September 2026, 76 nations have signed. The principles cover peaceful purposes, transparency, interoperability, emergency assistance, registration of space objects, release of scientific data, preserving outer space heritage, space resources, deconfliction of space activities, and orbital debris. The Accords are particularly relevant for companies involved in lunar exploration and cislunar activities.

UN COPUOS Guidelines

The United Nations Committee on the Peaceful Uses of Outer Space (COPUOS) adopted 21 voluntary Guidelines for the Long-term Sustainability of Outer Space Activities in June 2019. They cover the policy and regulatory framework for space activities, the safety of space operations, international cooperation, and scientific and technical research. While not legally binding, these guidelines influence national regulations and industry best practices worldwide.

Track treaty obligations and regulatory changes on SpaceNexus →

CMMC and Cybersecurity Requirements for Defense Space

The Cybersecurity Maturity Model Certification (CMMC) is transforming cybersecurity requirements for the defense industrial base, including space companies. The program rule (32 CFR Part 170) took effect on December 16, 2024, and the DFARS rule that puts CMMC requirements into contracts took effect on November 10, 2025.

CMMC has three levels (32 CFR 170.14). Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21 for Federal Contract Information and is self-assessed. Level 2 is identical to the 110 security requirements of NIST SP 800-171 Rev. 2 for Controlled Unclassified Information, assessed by the contractor or by a certified third party depending on the contract. Level 3 adds 24 selected requirements from NIST SP 800-172 and is assessed by the government (DCMA's DIBCAC).

For space companies, CMMC compliance is particularly challenging due to the distributed nature of satellite operations. Ground station networks, mission operations centers, telemetry data flows, and supply chain data sharing all create potential attack surfaces that must be secured.

Companies seeking defense space contracts should begin CMMC preparation well in advance: gap assessment, a system security plan, policies, and implementation of technical controls all take time before a Certified Third-Party Assessment Organization (C3PAO) can assess.

How SpaceNexus Helps with Compliance Tracking

SpaceNexus brings public regulatory information for the space industry into one place. It is a research aid, not legal advice:

1. 1Regulatory Filings: Browse public FCC, FAA and ITU filings and Federal Register entries in our Compliance Hub.
2. 2Spectrum Coordination: Monitor spectrum assignments, ITU filings, and interference environments via our Spectrum Management tool.
3. 3Orbital Slot Tracking: Track orbital position assignments and coordination status via our Orbital Slots tracker.
4. 4Space Law: Read the treaties, national laws and Artemis Accords references in the Compliance Hub's Space Law section.
5. 5Regulatory Radar: See upcoming rulemakings, comment deadlines and meetings on the Regulatory Radar.

Frequently Asked Questions