At the Briefing FFL Compliance Summit last week in Dallas, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) walked industry professionals through a new way to answer crime-gun traces. The program is called FFL Direct. ATF billed it as a no-cost way to cut the burden on Federal Firearms Licensees (FFL) and to get serial-number hits back to the National Tracing Center (NTC) without a clerk, a fax machine, or a voicemail. The slides compared it with the older NTC Connect program and then showed, in working JSON, exactly what a request and a reply look like.
The pitch is operational. The architecture is more interesting than the pitch.
FFL Direct is an opt-in system. It is not a new statute. A shop does not have to turn it on. ATF issues production credentials only after the licensee signs a Terms of Service (ToS) Agreement. If a software vendor or other service provider sits in the middle, that vendor also has to sign the Rules of Behavior. Test accounts come first. The FFL works with ATF’s project team to build, test, and validate the connection. Only then do the two sides set a go-live date. That is the opposite of a midnight rule. It is also how infrastructure gets normalized: one cooperative agreement at a time, until the holdouts are the ones still answering traces by hand.
ATF’s own comparison slide is the cleanest summary of what changed. NTC Connect was limited to manufacturers, importers, and wholesalers. Those participants had to upload Acquisition and Disposition data and keep that upload current. FFL Direct is open to all FFL types. There is no copy and no upload of the bound book. ATF’s phrase on the slide is “set it and forget it.” It is a real-time solution. The records stay on the dealer’s side of a dotted line that ATF drew on the architecture chart and labeled “FFL Partner Data.”
That last point is the agency’s answer to the registry charge. The answer is technically true and politically incomplete.
How the API Works
The operations slide is a four-box diagram. On the left is the FFL Direct API Service inside ATF. It sends a request through a Request API. The request lands at the FFL partner, the dealer or the dealer’s recordkeeping vendor, which ATF describes as handling “Asynchronous Response Control, Query Handling, & Security.” That partner box talks to the dealer’s own data store. A Response API sends the answer back.
The protocol is ordinary web plumbing. ATF transmits a trace request as a JSON file over HTTP with TLS. The FFL or its vendor writes a control layer that consumes that file and runs it against the electronic A&D book. If the serial matches, the system packages the matching disposition as a JSON response and returns it to the NTC. If it does not hit, the system sends a negative response: no record found.
Two connection types sit under that flow. A direct connection is one-to-one. The endpoint maps to a single FFL. A proxy or service-provider connection is one-to-many. One endpoint can answer traces for multiple affiliated licenses. Those requests carry an fflIdentifier field. By default, that field is the FFL’s RDS key. It can also be set to an internal identifier the vendor already uses. That is how a platform such as FastBound can sit in front of hundreds of shops without ATF opening a separate socket to every counter.
To receive traffic, the partner has to expose a valid endpoint, complete an authentication grant, and return HTTP 200 on success. The sample request on the screen was not abstract. It carried a requestId, a traceId, a tracePriority, the serial number, manufacturer, firearm type, caliber, model, country of origin, importer, the FFL number and shipper name, an invoice number, a ship date, and the FFL Identifier.
In other words, the packet is not “give me everything you have on John Smith.” It is “here is this serial, from this prior FFL, on this invoice. Do you have the next disposition?”
The reply slides show both flavors of hit.
When the gun moved to another licensee, the JSON returns the manufacturer, serial, type, caliber, country, the disposition FFL number, the date, the business name, city, state, and the number of firearms in that sale. When the gun moved to an unlicensed buyer, the payload is the purchaser file: last name, middle name, first name, date of birth, address lines, city, state, county, ZIP, height, weight, and sex. The companion screen on that slide was a form view of the same fields, the individual information ATF would otherwise pull off a 4473 or a bound-book line.
A separate record type lets the FFL attach a file. The example on the screen was a Form 4473 sent as a PDF, base64-encoded, with a document type of “4473.” ATF described that attachment as optional supplementary documentation the licensee chooses to provide. Optional is the right word today. It also reminds us that once a pipe can carry a 4473 image, the only thing keeping that image off the wire is policy and the contract.
Several electronic bound-book vendors already have the hook. FastBound is the name most people in the room knew. Lipsey’s and other large accounts have been in beta. Dealers can configure the system not to answer instantly. Industry people who have seen live shops say many never touch that setting. The default is speed, which is the program’s entire point.
What the Trace Statute Already Says
None of this invents ATF’s tracing power. The Gun Control Act of 1968 authorized the National Tracing Center. 18 U.S.C. § 923(g) requires every licensee to keep acquisition and disposition records. Section 923(g)(7) requires the licensee to answer a trace request within 24 hours. If you miss that clock, ATF treats it as a willful violation that can cost the FFL their license. Traces are supposed to serve a law-enforcement agency in a bona fide criminal investigation. That limit appears in the statute, on ATF Form 3312.1, and in the eTrace agreements departments sign before they get a login.
Congress also tried to stop the next step. The Firearms Owners’ Protection Act amended 18 U.S.C. § 926(a). After 1986, ATF may not require FFL records, or any part of them, to be recorded at or transferred to a federal facility. It may not establish a system for registering firearms, firearms owners, or firearms transactions. The Tiahrt appropriations riders, renewed for two decades, further restrict how trace data can be released, used in civil cases, or treated as a public research file. Separate Brady Act and NICS rules require destruction of identifying information on allowed transfers and bar use of NICS as a registry of people who are not prohibited.
The distinction is real. It is also thinner in an API world than it was in a filing-cabinet world.
A registry is a list the government keeps. A query network is a list the government can reach. If the major vendors ship the endpoint as a default feature, ATF does not need the whole book in West Virginia to get book-like results. It needs a roster of live endpoints and a serial number. Out-of-business records in OBRIS are static images. FFL Direct talks to a book that is still being written. Every successful JSON response is also a government record of a disposition, name, address, date, serial, assembled on ATF’s side of the call even if the source file never moves.
The individual-purchaser example on the Dallas screen is the part that should end the word game. The system does not return “a dealer’s abstract inventory code.” It returns the person. Height, weight, sex, and street address are not required to prove that a serial existed. They are required to identify who took possession. That is the function of a trace. It is also the raw material of a list.
This ATF Is Not the Problem
It would be lazy to treat the Dallas briefing as a secret plot. The current operational case is not fake. After-hours traces punish small shops. A clerk squinting at a carbon copy produces worse data than a serial match against a clean electronic book. Priority traces that now take a day can, in theory, come back before the investigator hangs up. Director-level statements this year have repeated the same line: traces exist for criminal investigations, and ATF does not maintain a searchable registry of lawful owners.
Take that as good faith. Good faith is not a control.
An anti-gun administration does not have to seize every bound book on day one. It has to inherit a network that already knows how to ask and already knows how to answer. Three quiet shifts would do the rest.
First, “opt-in” becomes “expected.” Demand letters already exist for shops that miss the 24-hour window. Trace response is already on the list of revocation-class violations. A guidance memo that says failure to implement available electronic response may be evidence of willfulness would not need a new statute. Inspectors do not have to order the API. They only have to treat the holdouts as the problem.
Second, the query widens. Today the packet is a trace ID, a priority code, and a serial tied to a prior FFL and an invoice. Tomorrow the same endpoint can be asked to accept a different payload if “investigation” gets a sloppy reading, if a later rule redefines the trigger, or if a service provider is already standing in front of a thousand licenses and the political appetite for “just one more field” arrives.
Third, the answers accumulate. Even if ATF never hosts the book, it hosts the replies. Index those replies by purchaser name instead of by trace number and the FOPA line about “no system of registration” becomes a dispute about file structure, not about function. The optional 4473 attachment on the slide is the same story in miniature. Optional documentation can become the complete file when the next administration decides the incomplete file is non-cooperative.
Software vendors will not rip out an API that ATF, Lipsey’s, and the bound-book platforms already run. Dealers who signed the Terms of Service will not enjoy being the last fax machine in the county. Political appointees turn over. Endpoints do not.
Friction is a civil-liberties feature. A process that takes a person twenty minutes forces someone to decide whether the request is worth the call. A process that returns a name, a date of birth, and a street address before the agent finishes a sentence invites the next use case. Databases sold as narrow and later used as broad are not a hypothetical. They are the standard biography of federal information systems.
What the Contract Should Say Before Anyone Signs
Opt-in only matters if the paper is written like a limited warrant.
The Terms of Service should lock the use case to statutory traces under § 923(g)(7) for bona fide criminal investigations. It should forbid bulk queries, name searches, and any request that is not tied to a recovered serial. There should be a requirement for a dealer-side log of every inbound call: time, trace number, serial number, and whether a hit was returned. It should let the FFL disable instant response without being scored as uncooperative. Also, it should say how long ATF keeps the JSON, who can see it, and whether the response file is indexed by purchaser. If a vendor is in the proxy seat, the Rules of Behavior should say the same things in writing, not in a slide deck stamped “FOR OFFICIAL USE ONLY.”
Vendors should make the dark setting the standard. “Built into most electronic bound books” is convenient for ATF. It is a default setting that a small shop will never audit. A dealer who wants the old 24-hour manual process should be able to leave the API off without breaking the rest of the software.
Congress already wrote the policy. FOPA said the records stay with the licensee. Tiahrt said trace data is not a public research file. The Brady framework said NICS is not a list of lawful buyers. FFL Direct does not repeal those lines. It builds a machine that can honor them or ignore them depending on who holds the keys.
Speed is a legitimate law-enforcement interest. So is the reason those statutes exist. A federal roster of who bought what is a political weapon. The current ATF can call FFL Direct an efficiency project and mean it. The next ATF that wants a registry will not need to invent one. It will only need to keep asking a question the industry already taught the servers to answer.
Signs Suggest Walmart to Turn Over Customer 4473 Gun Records to ATF
About John Crump
Mr. Crump is an NRA instructor and constitutional activist with more than 26 years of experience in networking and cybersecurity for major Fortune 100 companies. John has written about firearms, the Constitution, and cybersecurity, and has interviewed people from all walks of life. John lives in Northern Virginia with his wife and sons. Follow him on X at @right2bear, or at www.crumpy.com.
