TSA FTSP Compliance for Flight Schools: The Complete Guide to Alien Flight Student Tracking

The Alien Flight Student Program — officially called the Flight Training Security Program (FTSP) — is a TSA mandate that requires all flight schools and training centers in the United States to vet non-US citizens before providing flight training. The program was established after September 11, 2001, and is codified in 49 CFR Part 1552.

Every flight school or training center that provides instruction in an aircraft or simulator is subject to FTSP rules. This includes Part 141 certificated schools, Part 61 training providers, and even individual CFIs operating as independent contractors. If you teach someone to fly and that person is not a US citizen or US national, FTSP applies to you.

The requirement is not optional and it is not waived based on school size. A solo CFI renting a Cessna 172 at a local airport has the same FTSP obligations as a large Part 141 academy with 200 students and 40 aircraft. The TSA does not distinguish between a school that trains one international student per year and one that trains hundreds. The rules are the same.

Failure to comply is a federal violation. The TSA can impose civil penalties ranging from $10,000 to $50,000 per violation, and in severe cases can pursue criminal charges. The TSA has actively audited flight schools and has issued fines to schools that trained non-US citizens without proper FTSP approval. This is not a theoretical risk — it happens, and it happens to schools that assumed FTSP did not apply to them.

FTSP divides flight training candidates into three categories, each with different screening requirements. Understanding which category applies to each student is the first step in compliance.

Category 1: Initial training on aircraft 12,500 pounds or less. This covers the vast majority of flight school students — anyone seeking a private pilot certificate, instrument rating, commercial certificate, or any other training in light aircraft. Category 1 candidates must submit an FTSP application through the TSA's online portal (AFSP.tsa.dhs.gov), pay the TSA processing fee, provide fingerprints, and receive TSA approval before any flight training begins. The TSA conducts a security threat assessment that typically takes 15 to 30 days.

Category 2: Recurrent training on aircraft 12,500 pounds or less. This applies to non-US citizens who have already completed initial training and hold a valid pilot certificate, and who are returning for additional ratings or recurrent training. Category 2 candidates must still register with the TSA and receive approval, but the process is somewhat streamlined because the TSA already has their information on file.

Category 3: Training on aircraft over 12,500 pounds. This applies to type rating courses in large aircraft, turbojets, and airline training programs. Category 3 has the most stringent requirements, including a more extensive background check and additional documentation. Most Part 141 flight schools and Part 61 providers focus on Categories 1 and 2.

There are limited exemptions. US citizens and US nationals are exempt. Certain foreign military personnel training under government-to-government agreements may be exempt. Candidates who hold a current airman certificate issued by a foreign country that is party to the Chicago Convention may qualify for expedited processing under certain conditions. But the default assumption should always be: if the student is not a US citizen, FTSP applies until you confirm otherwise.

The FTSP workflow has a strict sequence that must be followed. Training a non-US citizen before completing this workflow is a violation — even if the student is "almost approved" or "just doing ground school." The TSA defines flight training broadly to include any instruction in an actual aircraft or full-flight simulator.

Step 1: Candidate registration. The prospective student creates an account on the TSA AFSP portal and submits their application, which includes biographical information, passport details, training details, and the flight school's provider code. The student pays the TSA application fee directly.

Step 2: Flight school acknowledgment. The flight school logs into the AFSP portal and acknowledges the student's application, confirming that the school has received a training request from this candidate. This step establishes the school-student relationship in the TSA system.

Step 3: Fingerprinting. The candidate must be fingerprinted at a TSA-approved location. Fingerprints are submitted electronically through the AFSP system. Some flight schools have their own fingerprint collection capabilities; otherwise, candidates use designated third-party collection sites.

Step 4: TSA security threat assessment. The TSA processes the application, conducts background checks, and issues a determination. There are three possible outcomes: approved, denied, or interim approval (which allows training to begin while the full assessment continues). Processing typically takes 15 to 30 days, though it can take longer.

Step 5: Training authorized. Only after the flight school receives notification of approval (or interim approval) in the AFSP portal may training begin. The school must document the approval date and retain this documentation for the student's entire training period and for five years afterward.

Ground school is a gray area. The TSA's official position is that FTSP applies to flight training, which they define as training in aircraft or simulators. Classroom-only ground school instruction is generally not considered flight training under FTSP. However, many schools choose to wait for FTSP approval before beginning any training — including ground school — to avoid any ambiguity. Consult your school's legal counsel if you want to begin ground instruction before FTSP approval.

FTSP compliance generates a significant documentation burden. For each non-US citizen student, the flight school must maintain the following records.

Identity documents. A copy of the student's passport (photo page and visa page), a copy of any US immigration documents (I-20, DS-2019, I-94), and a copy of a government-issued photo ID. These documents must be verified in person before training begins — photocopies sent by email are not sufficient for initial verification, though copies can be retained digitally after in-person verification.

FTSP approval documentation. A printout or digital record of the TSA approval notification from the AFSP portal, including the approval date, the training category, and the specific flight school named in the approval. If interim approval was granted, retain both the interim and final approval notices.

Training records. Complete records of all flight training provided, including dates, duration, aircraft used, and training content. These records serve dual purposes — they satisfy FAA training record requirements and demonstrate to the TSA that training occurred only during the approved period.

Visa status monitoring. The flight school is expected to be aware of the student's immigration status. If a student's visa expires or their immigration status changes during training, the school has obligations to verify continued eligibility. While flight schools are not immigration enforcement agencies, willful ignorance of a student's visa status is not a defense during a TSA audit.

All records must be retained for at least five years after the student's last training date. The TSA can request records at any time during this retention period. Schools that rely on paper files in filing cabinets face a significant challenge here — five years of records for dozens or hundreds of international students adds up quickly. Digital record-keeping through a system like Aviatize's compliance module makes retention and retrieval straightforward.

The TSA conducts both scheduled and unscheduled audits of flight schools. Understanding what inspectors look for helps you prepare — and stay prepared year-round.

A TSA inspector will typically request a list of all non-US citizen students who have trained at the school within the past five years. They will then select a sample of student files and review them for completeness. The inspector is checking that every non-US citizen received FTSP approval before training began, that identity documents were properly verified, and that records are complete and accessible.

The most common audit findings are training that began before FTSP approval was received, incomplete or missing identity verification documentation, failure to acknowledge student applications in the AFSP portal, and inadequate record retention. Any of these findings can result in civil penalties.

Inspectors may also interview school staff to assess whether the school has a functioning FTSP compliance process. They want to know: Who is responsible for FTSP compliance? How does the school verify that approval has been received before training starts? Where are records stored? How are new staff trained on FTSP requirements? Schools that can answer these questions confidently — because they have a documented process — make a strong impression.

The TSA may also conduct unannounced visits where an inspector arrives without prior scheduling. These are less common than scheduled audits but they do happen, particularly if the TSA has received a complaint or tip about a school. Schools that maintain audit-ready records and a clear compliance workflow handle unannounced visits without stress. Schools that scramble to assemble files when they know an audit is coming are not prepared for the unannounced variety.

One important note: TSA audits are separate from FAA inspections. A school can pass an FAA inspection and fail a TSA audit, or vice versa. Both agencies have different requirements and different enforcement mechanisms. A comprehensive compliance program addresses both.

After years of FTSP enforcement, clear patterns have emerged in the types of violations that lead to penalties. Avoiding these common mistakes is the fastest path to compliance.

Mistake 1: Starting training before approval. This is the most frequent and most expensive violation. A student arrives, the FTSP application is "in process," and the school decides to start ground school or even flight training while waiting for approval. The justification is usually "it's just ground school" or "approval is coming any day." The TSA does not accept these justifications. Training before approval is a violation, period.

Mistake 2: Not acknowledging applications in the AFSP portal. Some schools accept international students without ever logging into the AFSP portal to acknowledge the training relationship. The student may have submitted their application, but without the school's acknowledgment, the process stalls — and the school has no record of compliance.

Mistake 3: Assuming FTSP doesn't apply. Small schools, individual CFIs, and Part 61 operators sometimes assume that FTSP only applies to large Part 141 academies. It does not. Every provider of flight training is subject to FTSP. The TSA has fined independent CFIs who trained international students without FTSP screening.

Mistake 4: Failing to verify identity in person. The TSA requires in-person verification of identity documents. Accepting emailed passport scans without ever seeing the physical document in person does not satisfy the requirement. This is particularly relevant for schools that begin enrollment processes remotely.

Mistake 5: Poor record retention. Records must be kept for five years after the last training date. Schools that cannot produce records upon TSA request — whether because files were lost, staff turnover disrupted institutional knowledge, or paper records deteriorated — face findings. Digital records with proper backup are essential.

Mistake 6: No designated FTSP compliance person. When FTSP compliance is "everyone's job," it is nobody's job. Schools that do not designate a specific person (and a backup) responsible for FTSP processing inevitably develop gaps. Applications go unacknowledged, approvals are not verified before training starts, and records are not maintained consistently.

Whether you use Aviatize or another system, your FTSP tracking needs to accomplish five things reliably: identify which students require screening, prevent training from starting before approval, maintain complete documentation, track document expiration dates, and produce audit-ready reports on demand.

Identification. Every student intake process should include a citizenship verification step. Before any enrollment is finalized, the school must determine whether the student is a US citizen, US national, lawful permanent resident, or foreign national. This determination drives the entire downstream workflow. In Aviatize, citizenship status is captured during student onboarding and automatically triggers the FTSP workflow for non-US citizens.

Training gate. The system must include a hard block that prevents scheduling or logging flight training for any student who requires FTSP approval but has not yet received it. This is not a warning — it is a block. No override by dispatchers or line staff. Only a designated compliance administrator should be able to override this block, and the override must be logged. Aviatize's compliance module enforces this automatically through the validation engine.

Documentation. All required documents should be stored digitally, linked to the student's record, and accessible for audit. Passport copies, visa documents, FTSP approval notifications, fingerprint confirmations, and training records should all live in one place — not scattered across filing cabinets, email inboxes, and the AFSP portal.

Expiry tracking. Passports expire. Visas expire. FTSP approvals have validity periods. The system must track all expiration dates and alert the compliance officer well before documents expire. A student whose visa expires mid-training creates a compliance issue that must be addressed immediately. Aviatize sends automated alerts 90, 60, and 30 days before any compliance document expires.

Audit reporting. When a TSA inspector requests a list of all international students trained in the past three years, you should be able to produce that list — with complete documentation — in minutes, not days. The report should show each student's FTSP status, approval dates, training dates, and document completeness. Aviatize generates these reports with one click, formatted for TSA review.

Building this system on spreadsheets is possible for a school with fewer than 10 international students. Beyond that scale, the risk of human error, missed expirations, and lost records becomes unacceptable. The cost of a single FTSP violation — $10,000 minimum — dwarfs the cost of a proper compliance management system. The question is not whether you can afford a system. The question is whether you can afford not to have one.