FIPS 140-2 does not explicitly forbid key export; what it says is that the module shall prevent unauthorized disclosure; it furthermore states that when a private key is exported from a module, it shall be done with encryption. The important word is "unauthorized": simply encrypting with an AES key is not enough; that key must also be such that it is known only to "authorized" systems or people, and this depends on a lot of other parts of FIPS 140-2. Basically, you cannot export a private key "generically" simply by virtue of having employed encryption; it must be part of some documented procedure that itself complies with the roles and constraints defined in FIPS 140-2, and has been evaluated as part of the process that allowed the module to be "certified FIPS 140-2 level 3".
To make the story short:
- Some modules will never allow a private key to be exported, regardless of encryption.
- Some modules will allow a private key to be exported only if, at key generation time, it was tagged as "extractable" (see the PKCS#11 "CKA_EXTRACTABLE" attribute).
- Some modules will allow a private key to be exported but only as part of a fully-specified procedure that is covered by FIPS 140-2 level 3; in practice, this happens only for moving keys between two equally 140-2 compliant hardware modules.
It is very improbable that a certified FIPS 140-2 level 3 module allows unbounded private key export, only protected with an externally provided AES key, and is still FIPS 140-2 level 3.