A private machine shop on Long Island should not need an SEC compliance function, and it should not pay rising federal fees for services it never receives. LIFT's regulatory relief agenda has two fronts: eliminating SEC reporting flow-downs onto private small businesses, and fixing the ITAR registration system so that small manufacturers pay less — and get something real in return.
Securities disclosure rules are written for publicly traded corporations — companies that chose to raise money from public markets in exchange for transparency obligations. But those obligations do not stop at the public company's door. A public prime contractor must file a disclosure with the SEC; to do so, it must collect information from its suppliers — who must in turn collect it from their suppliers. Each tier passes the requirement down as a condition of doing business. By the time it reaches a small machine shop on Long Island, an SEC rule has become a stack of mandatory questionnaires, certifications, and audit requests — unpaid work, backed by the implicit threat of losing the contract. The small supplier gets all of the burden and none of the benefit of public-market access.
Under Section 1502 of the Dodd-Frank Act, public companies must investigate and report annually (on Form SD) whether their products contain tin, tantalum, tungsten, or gold from the Democratic Republic of the Congo region. The rule remains in force, and every spring the questionnaires cascade down the aerospace supply chain. A small supplier of machined parts or electronic assemblies must chase certifications from its own vendors for materials it buys in quantities that could not conceivably influence conditions in central Africa.
The costs are not speculative. The SEC's own economic analysis estimated compliance at roughly $4 billion in the first year and about $200 million every year thereafter — spread across tens of thousands of supply-chain companies. As Forbes observed, the paperwork costs alone exceed all annual U.S. aid to the DR Congo — while the on-the-ground improvements in the region have come from initiatives that predate the rule. An idea originally estimated to cost about a penny per cell phone became, through regulatory design, one of the most expensive disclosure mandates ever imposed. A decade of experience has produced enormous costs and little evidence of humanitarian benefit — in 2024 the GAO officially concluded the rule has not improved peace or security in the DRC.
Read the full case study » — the SEC's own compliance flowchart, the supply-chain pinch point, the compliance mini-industry, the smuggling routes defeating the paperwork, and the brief LIFT presented to New York congressional offices in 2015.
Climate disclosure frameworks — including the SEC's 2024 climate-related disclosure rules and the "science-based" emissions-target regimes that large corporations adopt alongside them — require public companies to quantify greenhouse-gas emissions, including, in many frameworks, the emissions of their entire supply chain. That sends energy-use surveys and emissions questionnaires down to private small manufacturers who must measure, calculate, and attest to data they have no infrastructure to produce. Notably, the SEC itself has now proposed rescinding its climate disclosure rules — an acknowledgment that the burden was misjudged — yet the flow-down machinery of supplier ESG questionnaires persists through corporate procurement policies and other jurisdictions' rules.
Any company that manufactures defense articles must register with the State Department's Directorate of Defense Trade Controls (DDTC) — even if it never exports a thing. In January 2025, after fifteen years of flat fees, DDTC raised registration costs across the board: the entry tier rose from $2,250 to $3,000 per year, the standard tier from $2,750 to $4,000, and the per-license surcharge for active exporters jumped from $250 to $1,100 per favorable determination — more than a four-fold increase that effectively penalizes small companies for successfully winning export business. The small-business accommodations that accompanied the increase are modest, petition-based, and paperwork-heavy.
Here is what a registered small manufacturer receives for its annual payment: the right to apply for licenses. No services. No directory listing. No compliance tools. Registration is a tax on being in the defense business, and it funds no instrument the registrant can actually use.
The gap is most obvious when a supplier tries to answer the most basic question in the controlled-data supply chain: "Can I send Company X this technical data or CUI — or not?" There is no way to find out. DDTC treats registration status as confidential and publishes no list of registered companies, so the only "verification" available is asking a partner for a copy of its registration letter and taking it on faith. On the CUI side it is worse: a supplier's NIST 800-171 assessment score sits in a government database (SPRS) visible to DoD but not to the peer companies who actually have to decide whether to share data, and CMMC certification status is not publicly searchable either. Every day, small manufacturers make controlled-information sharing decisions with no authoritative information at all.
On SEC flow-downs: disclosure obligations should stop with the registrant that owes them. Public companies should satisfy their obligations without conscripting private small suppliers as unpaid data collectors, and small businesses below a reasonable size threshold should be exempt by rule from supply-chain tracing and emissions-reporting demands. Where a disclosure regime is not delivering its intended benefits — as a decade of conflict minerals experience shows — it should be repealed, not merely trimmed.
On ITAR: roll back the per-determination surcharge for small businesses and create a true small-manufacturer fee tier — DDTC has committed to reviewing its fee structure every two years, so the vehicle exists. And make whatever fee remains actually purchase something: fund a government-maintained verification registry for controlled information — think SAM.gov for the defense data supply chain — where any company can confirm that a partner is ITAR-registered and current on its CMMC / NIST 800-171 standing before sharing technical data. That single tool would reduce risk, speed up teaming, and give registrants a return on the fees they already pay.
Our position in one sentence: a private small manufacturer should never bear disclosure burdens it does not owe or pay fees for services it does not receive — and every supplier deserves a simple, authoritative way to answer "can I send Company X this data?"
Sources: SEC conflict minerals disclosure guide · Forbes on Section 1502 · Federal Register: ITAR registration fees final rule · Federal Register: proposed rescission of SEC climate disclosure rules