Sanctions Checks: Compliance Guide for Screening

Updated 12 Mar 2026Content was accurate at the time of publication

What is a sanctions check?

A sanctions check is the structured process that determines whether a person, company, vessel, aircraft, asset or transaction is subject to government-imposed measures such as asset freezes, trade restrictions, travel bans or financial prohibitions. Sanctions checks commonly cover:

Listed persons and entities on consolidated sanctions lists.
Beneficial owners and subsidiaries via ownership chains.
Vessels and aircraft using IMO and registration numbers.
Financial instruments and accounts linked to listed parties.
Transactions for goods, services or funds that trigger embargoes.

Sanctions checks combine watchlist screening, data verification and documented decisioning. They are a core part of your AML/KYC and export-control ecosystem and must be repeatable, auditable and risk-based.

Why sanctions checks matter for regulated entities

Failing to detect or act on sanctioned activity exposes your organisation to legal, financial and reputational risk:

Legal obligations: comply with the Autonomous Sanctions Act 2011 and its Regulations and follow directions from relevant authorities.
Financial risk: frozen assets, blocked payments or disrupted supply chains.
Reputational harm: enforcement or adverse publicity damages trust with customers and partners.
Regulatory integration: sanctions screening complements your AML/CTF program and risk assessments.

Effective sanctions screening reduces transactional disruption and supports broader compliance activities such as KYC Onboarding and Compliance Risk Assessment.

Key legal framework and authoritative sources

Sanctions compliance sits within a national and international framework:

Autonomous Sanctions Act 2011 and Autonomous Sanctions Regulations 2011 — primary Australian statutory framework
Department of Foreign Affairs and Trade (DFAT) — publishes the DFAT consolidated list and administers permits and licences
AUSTRAC — integrate sanctions screening with AML/CTF obligations
OFAC (US) and SDN list — useful for global coverage
UN Security Council sanctions lists
EU and UK consolidated sanctions lists
Other regulators and guidance (ASIC, ATO)

Regulators expect proactive screening, timely escalation and reasonable steps when a match occurs. DFAT permits may authorise otherwise prohibited activity where appropriate.

Who must perform sanctions screening and when

Typical organisations and touchpoints:

Financial institutions, banks, fintechs and payment processors.
Brokers, insurers, superannuation and pension funds.
Trade and export businesses, freight forwarders and logistics providers.
Corporate treasury and corporate service providers with cross-border exposure.

When to screen:

Onboarding new customers (individuals and entities).
Transaction-level screening for payments, imports/exports and high-value transfers.
Periodic reviews for ongoing customers at a risk-appropriate cadence.
Event-driven screening for adverse media, mergers, sanctions updates or geopolitical developments.

Policies should allocate responsibility across KYC, transaction monitoring and compliance teams and link to your AML/CTF Obligations.

Sources of sanctions data — build multi-source coverage

Relying on a single list is insufficient. Key sources:

DFAT consolidated list (primary domestic source)
UN Security Council lists
OFAC SDN and sanctions program data
EU and UK consolidated lists
National lists of counterparties' jurisdictions
Commercial data providers and watchlists for enhanced coverage and name variants

Ensure vendor or in-house feeds update frequently (daily or more) and record list provenance for audit.

How sanctions screening works — practical workflow

A practical workflow for compliance teams:

Data capture (onboarding/transaction) Collect full legal name, trade or DBA names, date of birth, address history, company registration numbers and beneficial owners. Capture vessel IMO and registration and aircraft registration numbers when relevant.

Data preparation Standardise inputs by removing punctuation, normalising common transliterations and expanding abbreviations. Keep this simple and well-documented.

Matching and review Use exact matching for unique identifiers (company numbers, IMO, passport or ID numbers). Use name-based matching to surface potential matches; apply sensible review rules to separate likely false positives from true matches. Focus on complementary attributes (date of birth, jurisdiction) to disambiguate common names.

Cross-list correlation Check matches across DFAT, UN, OFAC, EU/UK and other relevant lists; multiple list hits increase confidence.

Transaction screening Real-time screening for high-risk payment flows and batch screening for lower-risk activity or reconciliation. Screen sender, recipient and beneficiary details.

Frequency Onboarding is mandatory. Transaction-level screening is real-time for high-risk flows; batch for low-risk. Periodic reviews occur at a risk-based cadence.

Logging and audit Record inputs, list provenance, match details and final disposition.

Keep the process simple, explainable and well-documented for auditors and front-line staff.

Managing matches: triage, verification and escalation

A clear escalation process prevents hesitation and regulatory gaps.

Initial triage: Record list source, entry ID, match fields, any similarity indicators and timestamp. Conduct a prompt manual review focusing on disambiguating attributes.

Verification evidence: Request certified ID, company extracts, beneficial-ownership documents or IMO and airworthiness certificates as needed.

False positive resolution: Document reasoning, update rules if appropriate and close the alert with audit logs.

Probable or true match: Halt the transaction where required, escalate to senior compliance and legal, and follow DFAT permit guidance if the activity may be licensed. Do not provide any prohibited benefit.

Escalation flow (example): Automated alert → first-line analyst review → compliance and legal review → apply for DFAT permit (if applicable) or notify authorities as required → record and retain evidence.

Tipping-off: Avoid disclosing suspicion to the subject where that could prejudice an investigation. Seek legal advice if in doubt.

Maintain a checklist: watchlist snapshot, screenshots, documents obtained, reviewer notes and timestamps.

Enhanced due diligence and risk-based screening

When to apply enhanced due diligence (EDD):

High-risk jurisdictions, complex ownership, large cross-border transactions, PEPs or adverse media.

Practical EDD steps:

Map beneficial ownership using corporate registries.
Run adverse-media, litigation and sanctions-history checks.
Verify source of funds and payment chains.
Consider third-party attestations or site visits for critical supply chains.

Embed EDD triggers into your AML/KYC risk framework and document approvals for audit purposes.

Recordkeeping, audit trails and reporting

Regulators expect complete, auditable records:

Capture onboarding inputs and transaction details.
Store watchlist snapshots and source URLs or IDs for each match.
Log match scores (where used), analyst notes and final disposition.
Preserve communications, permit applications and outcomes.
Retention: follow legislative requirements and regulator expectations; keep logs long enough to support investigations and audits.

Use tamper-evident logs, segregated storage for sensitive documents and periodic tests of your audit trail.

Common mistakes and how to avoid them

Frequent pitfalls and fixes:

Over-reliance on a single data source — adopt DFAT plus international lists and commercial feeds.
Poor data capture — ensure forms collect dates of birth, company numbers, IMO and registration numbers.
Inadequate tuning — balance sensitivity to avoid excessive false positives while catching true matches; measure and adjust over time.
Stale data — automate updates; schedule daily reconciliations at minimum.
Ignoring non-name identifiers — leverage company registration, IMO, passport or ID and account numbers.
Missing an escalation playbook — document roles, templates and SLAs.

Implement standardised intake forms, multi-source feeds and documented escalation paths.

Technology and vendor considerations

Key selection criteria for screening tools:

Watchlist coverage: DFAT, UN, OFAC, EU/UK and reputable commercial sources.
Update cadence: daily minimum; more frequent for high-volume flows.
Matching support: robust exact matching, clear review workflows and multi-script handling.
Identifier support: company numbers, IMO and ship IDs, aircraft registration numbers, IBAN and account numbers.
API access and batch processing for operational flexibility.
Audit logs and evidence export: immutable logs and provenance metadata.
SLAs and support: responsiveness for urgent escalations and assistance with DFAT-related questions.

In-house offerings provide control but require higher maintenance. Vendors typically provide faster deployment and broader list coverage — verify data provenance, contract terms and exit planning.

Confirm any vendor explicitly supports DFAT consolidated list updates and supplies clear provenance for matches.

Checklist: Sanctions screening controls for compliance teams

Actionable controls your team can implement:

Onboarding: Standardised intake capturing full name, date of birth, addresses, company numbers, beneficial owners and IMO or registration where applicable. Automated screening against DFAT and international lists before activation.

Transaction screening: Real-time checks for payment flows; batch screening for lower-risk activity. Screen sender, recipient and beneficiary fields.

Periodic reviews: Risk-based refreshes (annual for low-risk; quarterly or more for high-risk).

Escalation: Documented flow, contact points and template communications.

Evidence and records: Store watchlist snapshots, match details and disposition notes.

Enhanced due diligence: Trigger rules for ownership mapping, adverse media checks and source-of-funds validation.

Technology: Daily feed updates, robust matching and API integration.

Training and testing: Regular analyst training on DFAT lists, tipping-off and permit processes; quarterly testing of screening logic.

Case studies and examples

False positive handled correctly: A common-name match on DFAT was resolved by requesting date of birth and certified ID; date of birth did not match and the alert was closed with documented reasoning.

True match and permit path: A supplier payment matched a DFAT entry by company number. Compliance halted settlement, escalated, applied for a DFAT permit for humanitarian supplies and proceeded only after licence conditions were met. All steps were logged.

Enforcement example: Enforcement actions focus on whether reasonable screening, escalation and permit-seeking steps were taken after designation.

FAQ

How often should I screen customers?

At onboarding, for qualifying transactions and on a periodic schedule based on risk (commonly annual for low-risk; quarterly or monthly for high-risk).

Do PEPs appear on sanctions lists?

Not all PEPs are sanctioned. PEP screening is complementary; some PEPs may be designated and appear on sanctions lists. See PEP Screening.

How do I deal with subsidiaries or shell companies?

Map beneficial ownership, request company extracts and screen related legal entities and significant shareholders. Enhanced due diligence is often required.

What non-name identifiers should I include?

Company registration numbers, IMO (vessels), aircraft registration numbers, passport or ID numbers and IBAN or account numbers increase match confidence.

When should I notify DFAT vs AUSTRAC vs law enforcement?

DFAT manages permits and the consolidated list. AUSTRAC is the AML/CTF regulator. Consult legal counsel for enforcement notifications; in urgent criminal matters notify law enforcement as appropriate and always document decisions.

Key takeaways

Sanctions screening is a mandatory compliance control for regulated entities in Australia. Effective screening combines multi-source watchlist data, rigorous matching processes and clear escalation procedures to detect and manage sanctioned activity. Maintain auditable records, update your data sources daily and integrate sanctions checks into your broader AML/KYC framework. Legal counsel and DFAT guidance are essential for permit applications and enforcement decisions.