Check every new client against DFAT’s Consolidated List before you start work, keep a record of what you searched and which version of the list you used, and check your existing clients again whenever the list changes. For a Tranche 2 firm that has been a legal requirement since 1 July 2026, under section 28 of the AML/CTF Act. The sanctions laws underneath it apply to every business in Australia and have for years.
Sanctions screening, like the politically exposed person check that sits beside it in the same paragraph of the Act, doesn’t shrink with risk. You can keep identity checks light for a low-risk local client. Whether that client is a designated person still has to be answered, every time.
The sanctions laws and the AML/CTF Act
The prohibitions sit in the Autonomous Sanctions Act 2011 and the Charter of the United Nations Act 1945, with regulations under each. In plain terms, you must not make an asset available to a designated person, and you must not use or deal with an asset they own or control. DFAT’s Australian Sanctions Office keeps the list and grants permits. The AFP investigates breaches.
The AML/CTF Act adds the screening duty on top. Section 28(2)(e) requires a reporting entity to establish, before it starts providing a designated service, whether the customer or certain connected people are designated for targeted financial sanctions. Rule 5-3 of the AML/CTF Rules then requires your AML/CTF policies to deal with how you avoid both kinds of prohibited dealing. AUSTRAC supervises that part.
The penalties come from the sanctions law, and they are heavy. Under section 16 of the Autonomous Sanctions Act, an individual faces up to 10 years in prison and a fine of up to 3 times the value of the transaction or 2,500 penalty units, whichever is greater, which is $910,000 at the current $364. For a company the fine reaches 10,000 penalty units, $3.64 million, or 3 times the transaction value if that is higher.
The company offence is strict liability. The prosecution doesn’t have to prove the company knew anything. The only way out is the defence in section 16(7): the company proves it took reasonable precautions and exercised due diligence to avoid the contravention. That is why I treat the screening record as the most important page in a client file. If a firm ever has to show it took reasonable precautions, a dated screen against a named version of the list is the evidence.
Where assets show up in an accounting practice
The Act defines an asset as property of any kind, tangible or intangible, plus any document evidencing title to it. In an accounting practice that means money held in your trust account for a client, the shares in a company you register for them, a shelf company you sell, and a refund you pass on. Each of those is a point where you could make an asset available or deal with one.
The Rules reflect this. Even where you are allowed to start work before finishing initial CDD, rule 6-12(4) bars you from transferring money or property for the customer, or otherwise making it available to them, until CDD is complete.
Who you have to screen
Section 28(2)(e) names 4 groups:
- the customer
- every beneficial ownerof the customer
- anyone on whose behalf the customer is receiving the service
- anyone acting on behalf of the customer, such as the director who instructs you or an attorney
There are narrow exceptions for beneficial owners. Where the customer is a listed public company subject to disclosure rules, a government body, or an entity controlled by one of them, rule 6-7(2) treats the beneficial owner screen as done. Rule 6-18(2) does the same for certain customers under simplified CDD, such as entities overseen by a prudential regulator. The customer itself still gets screened. Our guide to customer due diligence under Tranche 2 covers the rest of the initial CDD matters.
When to screen
Before you start providing the designated service. Section 29 and rule 6-12 do allow you to begin before initial CDD is finished, but only where starting is essential to avoid interrupting the ordinary course of business, the extra risk is low, and you complete the outstanding steps within 20 business days. In my view a sanctions screen takes minutes, and it is the last step I would ever defer.
After that, the obligation keeps running. AUSTRAC’s guidance on targeted financial sanctions expects you to check whether any of the people above become designated during the business relationship, and always to use the most recent version of the list.
How to run the check
Start from the source. DFAT publishes the Consolidated List as a spreadsheet and shows the date it was last updated. When we checked on 3 November 2026, that date was 23 July 2026, a reminder that the list changes on DFAT’s timetable and not yours. Subscribe to DFAT’s mailing list so you hear about updates.
Then search the full name and every known alias, using fuzzy matching. Exact matching misses too much. Most of our clients have Chinese names, and romanisation is where manual checks fail: the same surname can be Chen in Pinyin and Chan in Cantonese, and the family name can come first on a passport and last on a bank form. AUSTRAC’s guidance makes the same point about alternative spellings of names transliterated into English.
A name hit on its own proves nothing. The list carries dates and places of birth, citizenship and addresses, and those decide whether a near match is your client.
Result | What to do |
No match | Record the date, the list version, the names searched and who ran the check. Proceed. |
Near match cleared | Record which list entry you compared and the identifiers that differ, such as date or place of birth. Proceed. |
Possible match not cleared | Stop. Don’t move or release any money or property. Escalate to your compliance officer and get legal advice. |
Confirmed match | Freeze any asset you hold for them, contact the Australian Sanctions Office and the AFP, and consider a suspicious matter report. |
Every outcome gets a written record, including the clean ones.
From my desk A new company client’s director once came back as a near match against an individual on the list. Same romanised name, same surname order. The listed entry had a date of birth 19 years earlier and a different place of birth, which cleared it in about 10 minutes. The file note records which entry we compared, what differed and the list version we used. If anyone ever asks why we went ahead, that note is the answer.
If you get a real match
Stop work and don’t move anything. Under the sanctions regulations, an asset owned or controlled by a designated person has to be frozen, and you can’t return it to the client or release it to anyone without a sanctions permit from DFAT.
DFAT asks asset holders to email the Australian Sanctions Office at asset.freezing@dfat.gov.au and to notify the AFP as soon as possible. Regulation 24 of the Autonomous Sanctions Regulations 2011 requires you to tell the AFP, as soon as practicable, what the asset is, what you know about its owner or controller, and why you formed your view. The Charter of the United Nations (Dealing with Assets) Regulations 2008 has a matching duty in regulation 42.
If you suspect on reasonable grounds that you hold information relevant to a sanctions breach, AUSTRAC also expects a suspicious matter report, and the tipping off rules apply from that point. DFAT’s own advice is to get legal advice before dealing with a listed person or their assets at all.
Keeping it current
The part most small firms will struggle with is the ongoing check. Screening 300 clients once at onboarding is manageable. Re-screening all 300 by hand every time DFAT changes the list isn’t, and that is the step that catches a client who becomes designated halfway through a relationship.
Our HP-KYC workspace runs the DFAT screen with fuzzy matching, stamps every result with the list version it used, and re-screens existing clients every week, so your compliance officer hears about a new hit without anyone having to remember to look.
Your sanctions screening checklist
- Write your sanctions approach into your AML/CTF policies, as rule 5-3 requires.
- Screen the customer, beneficial owners, anyone the customer acts for and anyone acting for the customer before you start work.
- Use the latest Consolidated List and record its date.
- Search aliases and spelling variants, and use identifiers to clear near matches.
- Keep a written record of every screen, clean or not.
- Re-screen your existing clients whenever the list changes.
- On a real match, freeze, contact the ASO and the AFP, consider an SMR, and get legal advice.
Frequently asked questions
Do accountants have to check the DFAT sanctions list?
Yes, if they provide designated services under Tranche 2. Since 1 July 2026, section 28(2)(e) of the AML/CTF Act requires them to establish, before starting work, whether the client and connected people are designated for targeted financial sanctions. The sanctions laws themselves apply to every accountant, enrolled or not.
How often should I rescreen existing clients for sanctions?
Whenever DFAT updates the Consolidated List, because AUSTRAC expects you to pick up a client who becomes designated during the relationship and to use the latest list. The Act sets no fixed interval, and in my view re-screening after every update, or on a short cycle such as weekly, is the defensible way to meet that.
What do I do if a client matches the sanctions list?
First rule out a false positive using date of birth, place of birth and citizenship. If the match stands, stop work, freeze any asset you hold for them, email the Australian Sanctions Office, notify the AFP and consider a suspicious matter report to AUSTRAC. Get legal advice before doing anything else.
Is sanctions screening risk-based under the AML/CTF Act?
The check itself applies to every customer, whatever their risk rating. What can scale with risk is how deep you go: AUSTRAC suggests more thorough checks for international customers, complex structures and foreign beneficial owners.
Do I have to screen a client’s beneficial owners for sanctions?
Yes, along with anyone the client acts for and anyone acting for the client. The Rules treat the beneficial owner screen as done for listed public companies, government bodies and entities they control, and for some customers under simplified CDD. The customer itself still has to be screened.
What is the penalty for dealing with a sanctioned person in Australia?
For an individual, up to 10 years in prison and a fine of up to 2,500 penalty units ($910,000) or 3 times the transaction value, whichever is greater. A company faces up to 10,000 penalty units ($3.64 million) or 3 times the value, and the offence is strict liability, with a defence only if it took reasonable precautions and exercised due diligence.
Technical details
Current as at November 2026.
AML/CTF Act 2006 (Compilation No. 62, 1 July 2026). s 28(1) and (2)(e)(ii): before commencing a designated service, a reporting entity must establish on reasonable grounds whether the customer, any beneficial owner, any person on whose behalf the customer receives the service, or any person acting on behalf of the customer is a person designated for targeted financial sanctions. s 5: a person designated for targeted financial sanctions is a designated person or entity under regulations made under the Charter of the United Nations Act 1945 or the Autonomous Sanctions Act 2011. s 26F(3)(e): AML/CTF policies must deal with matters specified in the Rules. s 29: exemption from initial CDD timing where Rules circumstances apply. s 30: ongoing CDD.
AML/CTF Rules 2025 (F2025L01026, Compilation No. 1, 31 March 2026). Rule 5-3: policies must deal with not making assets available to, or for the benefit of, a person designated for targeted financial sanctions, and not using or dealing with assets owned or controlled by such a person, in contravention of either Act. Rule 6-7(2): beneficial owner TFS screen taken to be established where rule 6-7(1), (1A), (1B) or (1C) applies (listed public companies, government bodies and entities they control or partly own). Rule 6-18(2): same for beneficial owners under simplified CDD. Rule 6-12: delayed initial CDD for services provided in Australia; 20 business day completion period (r 6-12(5)); no transfer of, or making available, money, property or virtual assets before s 28(1) is complied with (r 6-12(4)).
Autonomous Sanctions Act 2011 (Compilation No. 5, 30 October 2026). s 16(1) to (4): individual offence, up to 10 years imprisonment and a fine of the greater of 3 times the transaction value or 2,500 penalty units. s 16(5) to (9): body corporate offence of strict liability, fine of the greater of 3 times the transaction value or 10,000 penalty units; defence of reasonable precautions and due diligence, legal burden on the body corporate (s 16(7)). Commonwealth penalty unit $364 from 1 July 2026.
Autonomous Sanctions Regulations 2011. reg 14: prohibition on making assets available to designated persons or entities. reg 15: prohibition on using or dealing with controlled assets. reg 24: notify the AFP as soon as practicable of an opinion that an asset is a controlled asset. Charter of the United Nations (Dealing with Assets) Regulations 2008 reg 42: equivalent AFP notification.
DFAT Consolidated List: XLSX, last updated 23 July 2026 as shown on 3 November 2026. Freezing notifications to asset.freezing@dfat.gov.au.
Sources
- Persons designated for targeted financial sanctions (Reform), AUSTRAC
- Consolidated List, Department of Foreign Affairs and Trade
- Autonomous Sanctions Act 2011, Federal Register of Legislation
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, Federal Register of Legislation
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006, Federal Register of Legislation
