That is correct. The ATT stipulates there must be a procedure for all exports, but it doesn't say what that procedure has to be. As long as you follow the framework of the treaty, you're free to come to your own arrangements as long as they comply with that framework.
The EU is a very specific example, because you have 28 sovereign states with a single market for a lot of goods. The intra-community transfers directive on arms allows for light-touch transfer. Belgium can transfer arms to Luxembourg without much regulation, but there is still some and, importantly, there is the possibility for government to audit the transfers that have been made and to report on them publicly should they choose to do so.