What the program is
The Controlled Goods Program is a domestic industrial security programme run by Public Services and Procurement Canada. Its purpose is to prevent certain sensitive military and strategic goods, and the technical data relating to them, from falling into the wrong hands while they are in Canada.
Where export controls deal with items leaving the country, the Controlled Goods Program deals with who can handle those items inside it. Anyone who wants to examine, possess or transfer controlled goods in Canada must generally be registered with the program or be exempt from registration. Registration involves security assessments of key people and a commitment to protect the goods through a security plan.
The program also supports Canada's defence trade relationship with the United States. Canadian companies that receive controlled US defence articles and technical data need to show that those items will be protected, and the Controlled Goods Program is one of the ways Canada provides that assurance.
What counts as a controlled good
Controlled goods are a defined subset of items drawn from the Export Control List. They are mainly military goods and technology, along with certain other strategic items. Technical data such as drawings, specifications, software and manuals relating to those items are included, so a business can handle controlled goods without ever holding a physical part.
Many businesses discover they are dealing with controlled goods through their customers. A machine shop asked to produce a component to a drawing supplied by a defence prime contractor may find that the drawing itself is controlled. An engineering consultancy reviewing a design may be examining controlled technical data. A logistics company storing defence components may be in possession of controlled goods.
The test is the nature of the goods or data, rather than the type of business. If you are unsure, ask your customer for the control status of what they are sending you, and check it against the published list with advice where needed. Customers who supply controlled goods are generally expected to confirm that the recipient is registered or exempt before transferring them.
Who must register
Registration is required for any person or organisation in Canada that examines, possesses or transfers controlled goods, unless an exemption applies. The three activities are interpreted broadly.
- Examine covers consideration of the goods in a way that would reveal their technical characteristics, such as reading a controlled drawing or inspecting a component closely.
- Possess covers physical or other control of the goods, including holding them in storage or on a server.
- Transfer covers disposing of the goods or disclosing their content in any way to another person, including by email or file share.
Typical registrants include defence manufacturers and their suppliers, machine shops, engineering firms, software developers working on military systems, testing laboratories, repair and overhaul businesses, and some logistics providers. Universities and research institutions working on controlled projects may also need to register.
Certain individuals and organisations are exempt in specified circumstances, for example some government employees and some visitors. Exemptions are narrow and conditional, so a business relying on one should confirm that it applies.
The registration process
Registration is applied for through Public Services and Procurement Canada. A business applying for registration typically needs to provide corporate information, details of its owners, officers and directors, and the controlled goods it expects to handle.
A central part of registration is the appointment of a designated official. This is a person within the business who is responsible for its compliance with the program. The designated official conducts security assessments of employees, officers and directors who need access to controlled goods, using criteria and processes set by the program, and decides whether each person may be authorised.
The program itself carries out security assessments of the business's owners, officers and directors and of the designated official. Applicants should allow time for this and make sure the information they provide is complete and consistent, because gaps lead to delays.
Once registered, the business must maintain its registration, report changes in key personnel and ownership, and renew registration when required.
Duties of a registered business
Registration brings ongoing obligations. While the details are set out in the regulations and program guidance, the main duties are well established.
- Security plan. The business must implement a security plan that describes how controlled goods are protected, covering physical security, information technology, visitors and access control.
- Security assessments. Anyone who needs access to controlled goods must be assessed and authorised before access is granted.
- Training. Staff need security briefings on their responsibilities under the program.
- Records. The business must keep records of the controlled goods it receives and transfers, and of the people authorised to access them.
- Breach reporting. Security breaches involving controlled goods must be reported to the program.
- Inspections. The program carries out compliance inspections, and businesses must cooperate and address any findings.
Information technology deserves particular attention. Controlled technical data stored on cloud services, shared through collaboration tools or accessed remotely by staff or contractors can create a transfer to unauthorised people if access is not carefully controlled.
Implications for supply chains
Defence supply chains in Canada depend on the program. A prime contractor can only send controlled drawings or components to suppliers who are registered or exempt, so registration is effectively a condition of doing business in that chain. Suppliers who are not registered may find themselves unable to quote for work, even for simple machining or assembly jobs.
The obligations also run down the chain. A registered supplier that subcontracts part of a job must make sure its own subcontractor is registered before passing on controlled goods or data. Foreign nationals working for a supplier, whether as employees or contractors, require assessment before they can access controlled goods, and some may need specific authorisations depending on their nationality and the goods.
When controlled goods are later exported, export permit requirements apply in addition to the program. A registered business shipping controlled goods abroad needs an export permit where the Export Control List requires one. See our overview of Canadian export controls for that side of the process.
What it means for payments
Payment providers working with Canadian defence businesses often ask about Controlled Goods Program registration as part of onboarding. Registration is useful evidence for several reasons. It shows that the business deals with controlled goods in a regulated way, that its owners and key staff have passed government security assessments, and that it operates under a security plan subject to inspection.
Registration does not authorise exports, brokering or payments in itself, and it does not replace sanctions screening. A provider will still look at each international transaction to confirm that export or brokering permits are in place where needed and that no party or destination is sanctioned or embargoed.
For suppliers paid by prime contractors or foreign customers, the payment provider may ask how the controlled goods involved in a contract were handled, and whether subcontractors receiving payment are themselves registered where required. Keeping registration certificates, lists of authorised personnel and subcontractor registration confirmations in an accessible file makes these questions straightforward to answer.
An onboarding pack for payment partners
A Canadian defence supplier approaching a payment partner can prepare a short pack that addresses the usual questions in one place.
| Document | Purpose |
|---|---|
| Controlled Goods Program registration confirmation | Shows the business is authorised to handle controlled goods |
| Name and contact of the designated official | Identifies who owns program compliance |
| Summary of the security plan | Shows how goods and data are protected |
| List of main customers and suppliers by country | Explains expected payment flows |
| Export and brokering permits currently held | Shows international trade is authorised |
| Export compliance and sanctions screening policy | Shows how parties and destinations are checked |
Avoid sending controlled technical data to a payment provider. The provider needs to understand the business and the transactions, not the specifications of the goods, and sharing controlled data with an unauthorised party would itself raise a program issue.
Common gaps to avoid
Several issues come up repeatedly. Businesses handle controlled drawings before their registration is complete because a customer sent them early. New staff are given system access before their security assessment is finished. Controlled data sits in shared drives that contractors or overseas colleagues can reach. Subcontractors are engaged without checking their registration. Changes in directors or ownership are not reported.
Each of these can be prevented with simple process controls: a check at the point of receiving any customer data, a link between human resources onboarding and access provisioning, regular access reviews and a subcontractor approval step. A designated official with the authority and time to run these controls is the most important safeguard.
Smaller suppliers sometimes give the designated official role to a busy owner or office manager as an extra duty. That can work in a very small business, but the role needs protected time, a deputy who can cover absences and a simple log of decisions: who was assessed, what access was granted, what goods were received and transferred, and what incidents occurred. When an inspection takes place, that log is the first thing inspectors will want to see, and it also gives a payment partner quick confidence that the program obligations are taken seriously.
General information only
This article is general information about the Controlled Goods Program. It is not legal advice. Registration requirements, exemptions and duties depend on your circumstances, and you should refer to Public Services and Procurement Canada guidance and take professional advice.
CCYFX supports international supplier payments and contract receipts for defence businesses that hold the permits their trade requires. See our defence industry page for details.
