FFL Direct: ATF's Trace API and the Registry Fight

Two stories crossed the wire within about 24 hours of each other last week, and they point at the same part of your business. On Sept. 30, AmmoLand reported that ATF used the FFL Compliance Summit in Dallas to pitch FFL Direct, an opt-in API that lets a dealer's recordkeeping system receive and answer crime-gun trace requests automatically. On Sept. 29, Rep. Michael Cloud (TX-27) sent a letter to President Trump and Vice President Vance asking them to dismantle an ATF records database that he says holds 1.41 billion out-of-business dealer records.

One story is a product walkthrough. The other is a fight over whether the federal government is running a gun registry. Dealers do not get to settle that fight. You do own the decision sitting between the two, though: who holds your records, on what terms, and what your staff says when a customer asks about it at the counter.

What FFL Direct Actually Is

Strip out the politics and FFL Direct is plumbing. It is not a statute and not a new rule. It is an API program from ATF's National Tracing Center. A licensee opts in, signs a Terms of Service agreement, and ATF issues production credentials. If a software vendor or other service provider sits in the middle of the connection, that vendor also signs a Rules of Behavior agreement. Test accounts come first, then a joint go-live date.

The protocol is ordinary web infrastructure. ATF sends a trace request as JSON over HTTPS/TLS to the FFL partner, meaning the dealer or the dealer's recordkeeping vendor. The partner's system searches the dealer's own acquisition-and-disposition data for the serial number, and a response goes back to the Tracing Center. No clerk, no fax machine, no voicemail tag.

The comparison with the older NTC Connect program is the part worth reading twice. NTC Connect was limited to manufacturers, importers and wholesalers, and participants had to upload acquisition-and-disposition data and keep that upload current. A copy of the bound book effectively lived on the government's side. FFL Direct is open to all FFL types, and ATF's own comparison slide describes it as "set it and forget it": no copy, no upload. Per the architecture ATF presented in Dallas, the records stay on the dealer's side of a line the agency labels "FFL Partner Data."

That design is why the program is being pitched as burden reduction rather than a records program. To see how many licensees sit in the state where it was pitched, start with the Texas directory at fflsearch.net/ffl/tx; the same pattern holds in every high-volume market.

Why the Registry Fight Landed Here Anyway

The 1986 Firearm Owners' Protection Act prohibits a federal system of registration of firearms, firearm owners or firearm transactions. Appropriations riders go further, barring the centralizing of dealer records and barring searches of them by name. FFL Direct does not repeal any of that, and it does not copy your bound book. The argument Congress is making is about what ATF already holds, and about where automated access leads over time.

Cloud's letter says ATF holds 1.41 billion out-of-business dealer records at its Martinsburg, West Virginia facility, including buyers' names, addresses and firearm details, up roughly 500 million from the approximately 920 million records reported in 2021. The letter asks for an independent investigation of the database, destruction of any records held in violation of the 1986 Act, and a requirement that any future retention rule comply with the same prohibitions. Sen. Jim Risch separately asked the Department of Justice to investigate. For the dealers whose closed paperwork makes up that total, the West Virginia directory at fflsearch.net/ffl/wv is a reminder that the records center and the state are the same story.

ATF answered this ground in a June 10 response letter to Cloud: out-of-business records are stored as static, non-searchable images indexed mainly by dealer license number, not by purchaser name, and they solve crimes. The agency's example is the rifle used in the July 2024 assassination attempt, traced in 30 minutes through records from a dealer that had closed 11 years earlier. Gun Owners of America, which has pressed the issue since a 2022 report, counters that the database is searchable by make and model.

Retention policy is a separate fight with the same stakes. ATF's May 2026 proposal on firearm records retention periods, tracked as RIN 1140-AA95, drew an Aug. 5 letter from Rep. Andrew Clyde (GA-09) and roughly 30 House colleagues urging a 20-year cap and the immediate destruction of digitized transaction records already in agency hands. Clyde's district sits in north Georgia, where licensee density is high; the dealers listed in the Georgia directory at fflsearch.net/ffl/ga are the population those retention rules bind.

None of that is a dealer's lawsuit to file. But two things in it are yours to act on: what your recordkeeping vendor is actually selling you, and what your staff tells customers.

The Business Case for Automation, and Its Cost

Trace handling is unpaid labor. Every trace request interrupts whoever is working the counter, and the lookup is manual: find the serial number in the bound book, pull the disposition, answer. Dealer-facing documentation for the automated trace programs describes a 24-hour response expectation, which is exactly the kind of deadline that slips on a Saturday.

The vendor layer is already moving. FastBound launched TraceDesk in January 2026 to receive and respond to FFL Direct requests and to log manual trace correspondence in one place, and APB360 lists an FFL Direct integration in active development. ATF's own process starts with an integration guide and a cooperative agreement; the program inbox is [email protected].

What to price before you say yes: staff minutes per trace, your error rate on manual lookups, the quality of the audit trail the tool produces, and whether records and credentials are separated per license if you run more than one location or more than one FFL.

The cost is custody. Opting in creates a standing credential path between ATF's tracing service and the system that holds your acquisition-and-disposition records. That turns a recordkeeping software purchase into a data-custody decision. Put four answers in writing before you sign: who signs the Terms of Service and the Rules of Behavior, you or the vendor; who holds and can revoke the credentials; what happens to the connection if you change vendors; and can you export a complete, usable copy of your A&D on demand. Add a fifth question most dealers skip: your records have to survive for decades, so what happens to them, and to your access, if your vendor is acquired or shuts down? The tracing center that now holds 1.41 billion out-of-business records is the long-run answer to what happens when a shop stops keeping its own books.

The Counter Script You Need This Week

Customers are going to hear the 1.4-billion-records story and ask the person at your counter whether their paperwork is going into a registry. Have one accurate answer ready, short enough to say while bagging a rifle:

• The Form 4473 and the entry in the bound book stay at this shop.
• ATF can request those records for a criminal trace, and if a shop closes, its records transfer to ATF as federal law requires.
• Whether this shop connects to automated tracing does not change what the law already requires us to keep. It changes how fast we answer.

Do not argue politics across the counter, and do not improvise. Write the three sentences into your compliance manual, date it, and walk every employee through it. Customers arrive with the version of this story they heard on television, and the shop that answers crisply and consistently keeps the transfer customer the news cycle just sent through the door.

Five Things to Do This Week

1. Read the FFL Direct Terms of Service and the Rules of Behavior before anyone signs anything, and ask ATF for test credentials first.
2. If your vendor will hold the connection, get credential ownership, per-license separation and audit-trail terms in writing.
3. Confirm your A&D export rights, and test the export yourself rather than accepting a feature page.
4. If you opt out, nothing changes about your obligations, but document the decision, the date and the reasoning in your compliance file.
5. Watch two dates: ATF's promised written guidance on records, and where the retention proposal (RIN 1140-AA95) lands.

FFL Direct is opt-in today, and the cooperative-agreement process is precisely how a program becomes ordinary infrastructure, one dealer at a time. The shops that decide on the record, with the terms in writing, will be the ones whose paperwork position is defensible a year from now, whichever way the registry fight goes.

— Fred Thompson, [email protected]