Sanctions screening in Australia: how it works
Sanctions screening checks your customers, their beneficial owners and anyone acting for them against DFAT’s Consolidated List, before you provide a service and throughout the relationship. A confirmed match means you freeze their assets and tell the authorities. Dealing with a sanctioned person is a criminal offence, with up to 10 years’ jail.
This guide is for businesses regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC), including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. The facts come from the Department of Foreign Affairs and Trade (DFAT), AUSTRAC and Australia’s sanctions laws, checked on 21 October 2026.
What is sanctions screening?
Sanctions screening checks the people and entities you deal with against official lists of those under sanctions. In Australia the list that matters is the Consolidated List, kept by the Australian Sanctions Office in the Department of Foreign Affairs and Trade (DFAT).
The list holds everyone sanctioned by the United Nations Security Council or by the Foreign Minister under Australia’s autonomous sanctions laws. Each entry gives names and aliases, dates and places of birth, citizenships and addresses.
Screening is one part of customer due diligence. It does not verify identity. It is also separate from checks for politically exposed persons and adverse media screening, which look for different risks.
What does Australian law require?
Two sets of laws apply. United Nations Security Council sanctions take effect under the Charter of the United Nations Act 1945, and Australia’s own sanctions under the Autonomous Sanctions Act 2011. They cover activities in Australia, and Australian citizens and companies overseas.
A targeted financial sanction bans two things. You must not make an asset available to a designated person or entity, directly or indirectly. You must not use or deal with assets they own or control, which is why it is called an asset freeze.
If AUSTRAC regulates your business, the AML/CTF Act adds a screening duty. Before you start to provide a designated service, you must establish on reasonable grounds whether any of these is designated:
- your customer
- any beneficial owner of the customer, with limited exceptions
- anyone acting on the customer’s behalf
- anyone on whose behalf the customer receives the service
Key point
Under Australia’s AML/CTF Act, a reporting entity must establish whether a customer is designated for targeted financial sanctions before providing a designated service.
The duty continues after onboarding. You must check whether any of them becomes designated during the relationship, and monitor customers for possible sanctions breaches. Your anti-money laundering and counter-terrorism financing (AML/CTF) policies must set out how you will avoid dealing with a designated person’s assets.
Which sanctions lists should you screen against?
Four sanctions lists and who keeps them
| List | Kept by | Who is on it |
|---|---|---|
| Consolidated List (Australia) | Australian Sanctions Office, Department of Foreign Affairs and Trade (DFAT) | Individuals, entities and vessels sanctioned by the UN Security Council or by the Foreign Minister under Australia’s autonomous sanctions laws |
| SDN List and other OFAC lists (United States) | Office of Foreign Assets Control (OFAC), US Department of the Treasury | Individuals, entities and groups designated by OFAC, and blocked vessels and aircraft |
| Consolidated list of financial sanctions (European Union) | European Commission (DG FISMA) | Individuals, groups and organisations subject to EU financial sanctions |
| UK Sanctions List (United Kingdom) | Foreign, Commonwealth & Development Office | People, entities and ships designated or specified under UK sanctions regulations. The only UK list since 28 January 2026 |
Sources: DFAT, Consolidated List; US Treasury OFAC, Sanctions List Service; European Commission, Overview of sanctions and related resources; UK Foreign, Commonwealth & Development Office, The UK Sanctions List Reviewed
DFAT’s Consolidated List is the baseline for Australian law. It lists only people and entities sanctioned under Australian laws, including United Nations listings. Names listed only by the US, the UK or the EU are not on it.
AUSTRAC’s guidance points you to DFAT’s list, but foreign laws can still reach some activities. EU sanctions, for example, bind EU nationals and anyone in the EU or doing business there. If another country’s laws might apply, DFAT advises getting legal advice.
In the UK, the UK Sanctions List has been the only list of UK designations since 28 January 2026. See also our guides to the UN sanctions list and the OFAC sanctions list.
How does a sanctions screening check work?
How a sanctions screening check runs
For a business regulated by AUSTRAC, under Australian sanctions laws
- Before the service
Screen every party
The customer, beneficial owners, anyone acting for them and anyone the service is for, against DFAT’s Consolidated List.
- Alert
Potential match
A name matches, allowing for alternative spellings. It is not yet a finding.
- Review
Compare the other details
Date of birth, place of birth and citizenship on the list entry. Then decide:
False positive: record why, and carry on orTrue match: stop, and get legal advice -
True match: freeze and report
Freeze the asset, tell the Australian Sanctions Office and notify the Australian Federal Police. Lodge a suspicious matter report where required.
Sources: AUSTRAC, Persons designated for targeted financial sanctions; DFAT, Consolidated List Reviewed
A check compares the details you collected at onboarding with each list entry. Names are the hard part. AUSTRAC notes that spellings vary, especially for non-English names, so you may need to check alternative spellings and use fuzzy searching.
A name match is a potential match, not a finding. Compare the other details on the entry, such as date of birth, place of birth and citizenship. Keep a note of what you compared and why you decided, so a reviewer can follow it.
AUSTRAC suggests more thorough checks where the risk is higher: international customers, people in countries known as intermediaries for sanctioned countries, and entities with complex structures or foreign beneficial owners.
What must you do if you find a match?
If you confirm a match, DFAT advises getting legal advice before any dealing. Without a sanctions permit, you must not deal with the person’s assets or make assets available to them.
If you hold, or think you hold, an asset owned or controlled by a designated person, DFAT says you must:
- hold, or freeze, the asset
- tell the Australian Sanctions Office, by email to asset.freezing@dfat.gov.au
- notify the Australian Federal Police through its Report a crime form, as soon as possible
Key point
Under Australian sanctions laws, an asset holder must freeze any asset owned or controlled by a designated person and notify the Australian Federal Police.
If you suspect on reasonable grounds that you have information relevant to a sanctions breach, you must also lodge a suspicious matter report with AUSTRAC. You must not return frozen assets to the customer without a permit.
What are the penalties for breaching sanctions?
Breaching an Australian sanctions law is a serious criminal offence. The maximums are the same under section 16 of the Autonomous Sanctions Act 2011 and sections 20 and 21 of the Charter of the United Nations Act 1945:
- Individual: up to 10 years’ jail, a fine, or both. The fine is up to 2,500 penalty units (A$910,000) or 3 times the value of the transaction, whichever is greater.
- Company: a fine of up to 10,000 penalty units (A$3.64 million) or 3 times the value of the transaction, whichever is greater.
The dollar figures use A$364 a penalty unit, the rate from 1 July 2026. For a company the offence is one of strict liability, so no intent needs to be proved.
A company has a defence if it proves it took reasonable precautions and exercised due diligence. Records of each check are how you show that. The AML/CTF Act’s own duties carry separate penalties: see AML non-compliance penalties.
How do you keep screening up to date?
The list changes often. AUSTRAC says to always check the most recently published version, and DFAT runs a mailing list that announces changes to it.
A new designation can catch an existing customer, so re-screen when the list changes, not only at onboarding. Ongoing monitoring re-runs the screen; see also ongoing customer due diligence.
The laws are changing as well. DFAT consulted on an exposure draft of the Autonomous Sanctions Bill 2026 from 7 September to 16 October 2026. Its guide to the reforms says the penalties for sanctions offences stay the same.
Frequently asked questions
Is sanctions screening the same as PEP screening?
No. Sanctions screening looks for people and entities you must not deal with. Politically exposed person (PEP) screening finds people with prominent public roles, who need extra checks but are not banned.
Do I have to screen against the OFAC list in Australia?
AUSTRAC points you to DFAT’s Consolidated List. US, UK or EU laws may still apply to some activities, so DFAT advises legal advice if they might.
Can I screen a low-risk customer after onboarding?
Sometimes. AUSTRAC says it may be appropriate to screen low-risk customers against the Consolidated List as part of delayed initial customer due diligence. Otherwise you screen before you provide the service.
When will the new sanctions laws start?
No date is set. DFAT’s guide says that, if Parliament passes it, the new framework needs to start on or before 1 October 2027, when the current Autonomous Sanctions Regulations expire.
Next steps
Check that your AML/CTF policies say who screens, against which list, who decides a potential match and when existing clients are re-screened. Our customer due diligence checklist covers the checks around screening.
StackGo’s IdentityCheck screens every party against PEP, sanctions and adverse media inside the customer relationship management (CRM) or practice software your team already uses. It records a High, Medium or Low risk rating against the client. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.
Sources
The facts on this page come from these sources, checked on 21 October 2026.