A correspondent bank in London receives a payment instruction routed through a Pacific-region respondent. The respondent's client list includes an entity registered in a jurisdiction where both UK and Australian sanctions apply. The compliance team flags the instruction. Does OFSI require the bank to act? Does Australia's autonomous sanctions regime impose a parallel obligation? And if the two regimes point in different directions, which one governs the bank's next move?
Correspondent-banking de-risking (the practice of exiting or restricting a respondent relationship to avoid sanctions exposure) sits at the intersection of two increasingly divergent regimes. Under OFSI, the obligation is grounded in the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations; the test turns on whether a financial sanction is being contravened or a designated person is receiving a financial service. Under Australia's autonomous sanctions regime, administered by DFAT, the prohibitions are asset-freeze and services restrictions under the relevant autonomous sanctions instruments. As of January 2026, neither regime has converged on a single de-risking standard, and the practical gap between them is material for any bank with correspondent exposure in both jurisdictions.
This analysis maps the key divergences across six dimensions: legal basis and governing authority, the ownership-and-control test, licensing routes, reporting and record-keeping obligations, enforcement posture, and the cross-border implications for a bank managing correspondent relationships under both regimes simultaneously.
What is the legal basis for correspondent-banking obligations under each regime?
Under OFSI, the statutory foundation is the Sanctions and Anti-Money Laundering Act ("SAMLA"), which gives effect to the UK's autonomous and UN-derived sanctions programmes through the relevant thematic regulations. A correspondent bank is directly caught where it provides, or risks providing, a financial service to a designated person – whether as the originating institution, the intermediary, or the receiver of funds. OFSI's enforcement guidance makes clear that the obligation is strict: knowledge of the designation is not a precondition for contravention, though it bears on the civil penalty assessment.
Australia's position rests on a different statutory architecture. The relevant autonomous sanctions instruments and the charter-of-the-United-Nations-derived measures operate in parallel, both administered by DFAT. A financial institution with Australian operations – or, in certain cases, a foreign institution processing Australian-dollar transactions – is caught by the asset-freeze and dealings prohibitions. The instrument does not use the term "financial service" in the same framing as SAMLA, and the prohibitions are defined by reference to controlled assets and controlled persons rather than the UK's broader services language.
That structural difference matters immediately. An Australian correspondent bank deciding whether to exit a relationship does so under a dealings prohibition that is, in textual terms, narrower than OFSI's financial-services prohibition. The UK institution on the other side of the same relationship operates under a wider prohibition. In our experience, banks that map their obligations only to their home regime routinely under-assess the exposure the counterpart regime creates for the transaction as a whole.
How do the ownership-and-control tests compare?
Under OFSI, ownership and control (the test for whether a non-listed entity is caught through a listed person) follows the standard that applies across the UK regime: a person is treated as owned or controlled by a designated person where that designated person holds a majority interest, holds the right to appoint or remove a majority of the board, or otherwise exercises significant influence or control. The test is not purely mechanical – the "significant influence or control" limb requires a judgment, and OFSI has published guidance on how it applies that limb to complex ownership structures.
Australia's autonomous sanctions regime applies an associate concept under the relevant instrument, which extends the reach of the prohibitions to entities acting on behalf of, or at the direction of, a controlled person. The practical coverage is broader in one direction – it can capture conduct-based association – and narrower in another, because the specific numerical ownership threshold used in OFSI's guidance does not appear in equivalent form in the Australian rules.
What does this mean for a correspondent bank screening a respondent's client? Under OFSI, a minority-owned subsidiary of a designated person may still be caught if the designated person exercises significant influence or control. Under the Australian regime, the same entity may not be caught unless it is acting at the designated person's direction. A dual-jurisdiction screen that treats both tests as equivalent will mis-classify some counterparties in one direction or the other.
Have you tested your screening logic against both tests separately, or are you applying a single blended standard?
What licensing routes are available under each regime?
Under OFSI, a correspondent bank that identifies a prohibited transaction has access to a licensing route under the relevant thematic regulations. OFSI issues specific licences (case-by-case authorisations for otherwise-prohibited transactions) and, in some programmes, general licences (standing authorisations for defined categories of activity). For financial institutions, the most relevant general licence categories typically cover legacy contracts, wind-down periods, and certain humanitarian or legal payments. OFSI processes licence applications and publishes guidance on the evidence it expects.
Australia's licensing equivalent is a sanctions permit issued by DFAT. The permit system operates on an application-by-application basis for most purposes; there is no standing general-permit architecture of the breadth that OFSI's general-licence programme offers in practice. A bank seeking to complete a payment that the Australian regime would otherwise prohibit must apply to DFAT and obtain a permit before the transaction proceeds.
The divergence in licensing architecture creates a timing problem for a correspondent bank caught under both regimes. Obtaining an OFSI licence does not authorise the Australian leg of the transaction. Obtaining an DFAT permit does not resolve the UK prohibition. A bank must satisfy both regulators, and the two processes run on different evidentiary requirements and different timescales. In our practice, we regularly advise institutions that have obtained one authorisation and are surprised to discover that the other regime remains unsatisfied. The position above covers the standard case. Your specific facts – the goods, the route, the counterparty structure, and the programme in play – change the analysis materially.
For cross-border correspondent-banking matters with a US dollar leg, the position is further complicated by OFAC's jurisdiction over USD-clearing transactions. A payment that satisfies both OFSI and DFAT requirements may still require an OFAC specific licence if it clears through a US correspondent or involves a US person. To assess the full licensing picture for a multi-regime correspondent-banking matter, contact Calder & Vance at info@caldervance.com.
Where do reporting and record-keeping obligations diverge?
OFSI imposes a mandatory reporting obligation on relevant firms that know or have reasonable cause to suspect that a person is a designated person or has committed an offence under the financial-sanctions regulations. The obligation to report is not triggered only by a confirmed contravention; reasonable cause to suspect is the threshold. Failure to report is itself a criminal offence under SAMLA. OFSI's enforcement guidance addresses what "reasonable cause to suspect" means in the context of a correspondent-banking relationship, and the standard is one that practitioners should treat as a low trigger.
Record-keeping under OFSI aligns with the general AML record-keeping standard in UK law: firms are required to retain records that evidence their screening decisions, the basis for any licence application, and any reports made to OFSI. The applicable retention period under the relevant rules is five years.
Australia's reporting obligations for financial institutions sit within the AML/CTF framework administered by AUSTRAC, with a separate DFAT-specific reporting obligation for institutions that deal with controlled assets or controlled persons. The two streams are not co-terminous. An institution that reports a suspicious matter to AUSTRAC has not necessarily discharged its DFAT obligation, and vice versa. In our experience, this bifurcation is one of the most common sources of compliance gaps in Australian financial institutions managing correspondent risk.
The record-keeping obligation under the Australian regime requires documentation of dealings with controlled assets and of permit applications. The specific retention standard differs from the UK's and should be verified against the current DFAT guidance before reliance is placed on any assumed alignment.
How do enforcement postures compare – and what does that mean for de-risking decisions?
OFSI's enforcement posture has sharpened considerably. OFSI has the power to impose civil monetary penalties on a strict-liability basis – a contravention does not require proof of knowledge – and criminal referral to law-enforcement authorities for the most serious cases. OFSI's published enforcement guidance sets out the factors that bear on the penalty assessment, including the quality of the firm's compliance programme, whether the firm self-reported, and the degree of senior management involvement. A voluntary self-disclosure or VSD (a proactive report of an apparent violation to the regulator) is recognised by OFSI as a mitigating factor, though it does not guarantee any specific outcome.
DFAT's enforcement posture for autonomous sanctions breaches operates through a criminal prosecution model. Civil monetary penalties of the OFSI type are not the primary enforcement tool in the Australian regime. Prosecution requires proof of knowledge or recklessness, which sets a materially higher threshold than OFSI's strict-liability civil basis. That difference in the enforcement model has historically influenced how Australian financial institutions calibrate their de-risking decisions: the perceived probability of prosecution has, in some cases, led to a lighter-touch approach than a comparable UK institution would apply under OFSI.
Is that calibration still appropriate? In our view, no. The enforcement-posture gap between the two regimes is narrowing at the policy level, and institutions that have relied on a lower Australian enforcement probability should test that assumption against the current DFAT policy position before the next correspondent relationship review.
For a business already managing a flagged transaction or a correspondent relationship under regulatory scrutiny, an early review preserves options. If a transaction has been flagged or a correspondent review has been initiated, contact Calder & Vance at info@caldervance.com.
The cross-border dimension: secondary-sanctions risk and US dollar clearing
A correspondent bank managing UK and Australian sanctions exposure does not operate in a bilateral environment. The third dimension – OFAC jurisdiction over US-dollar transactions – is the one that most consistently produces enforcement outcomes at the global level. Any payment that clears through a US correspondent bank, involves a US person, or is denominated in US dollars is potentially within OFAC's jurisdiction regardless of where the originating or receiving bank is chartered.
OFAC's extraterritorial reach operates through the dollar-clearing system and through the secondary-sanctions risk attached to designated persons under certain programmes. A bank that relies entirely on OFSI compliance to manage a correspondent relationship is not protected if the same relationship processes dollar payments that OFAC would treat as blocked-property transactions. The analysis for each programme differs; secondary-sanctions risk attaches differently across the major OFAC programmes, and the bank must assess its position under each relevant programme separately.
The interaction between OFSI, DFAT, and OFAC creates a multi-layer problem for correspondent banks. In our cross-border practice, we have acted for banks that correctly identified the OFSI prohibition and obtained an OFSI licence, while missing the OFAC leg entirely. The result was a reportable apparent violation to OFAC that the OFSI licence could not cure. Mapping the three regimes simultaneously at the outset – rather than sequentially under regulatory pressure – is the correct sequence.
The EU sanctions dimension adds a further layer for institutions with euro-denominated flows or EU-based counterparties. The relevant Council regulations apply to transactions processed within the EU and to EU persons acting anywhere. A bank with operations in an EU member state is subject to the EU prohibitions independently of its OFSI and DFAT obligations.
What common errors drive de-risking decisions that create, rather than reduce, risk?
The most consequential error is broad-based de-risking without a documented legal rationale. A bank that exits a correspondent relationship because of a generalised concern about a counterparty's jurisdiction is not managing sanctions risk; it is replacing a legal analysis with a geography-based proxy. That approach creates three problems simultaneously: it may breach contractual obligations to the respondent; it may constitute discriminatory conduct under banking-access rules in the respondent's jurisdiction; and – most directly – it leaves the bank unable to demonstrate, in any subsequent regulatory review, that the exit was based on a specific sanctions prohibition rather than a blanket policy.
OFSI's guidance expressly addresses the tension between de-risking and financial inclusion. The guidance does not prohibit de-risking, but it expects that a firm's decision to exit a relationship is grounded in a specific assessed exposure – not a categorical avoidance of a geography or sector.
A second common error is treating the ownership-and-control test as binary. A firm that screens only the named respondent institution, without mapping the respondent's clients and their ownership chains, is not performing a compliant OFSI screen. The extension of OFSI's prohibition to entities owned or controlled by designated persons means that the relevant universe of counterparties is larger than the respondent's own designation status.
A third error – less visible but equally consequential – is failing to document the decision not to exit. A bank that reviews a correspondent relationship, finds no prohibition, and continues the relationship without a record of that review has created an evidential problem for itself. If OFSI subsequently investigates a payment in that relationship, the absence of a documented review will be treated as an absence of a compliance programme, even if the substantive analysis was sound.
Related practices
- OFAC correspondent-banking de-risking – screening, ownership mapping, and transaction structuring under the US sanctions regime.
- OFSI vs Australia de-risking: follow-on analysis – further regime comparison covering permit timing and dual-jurisdiction documentation.
Addressing a common misconception: is the stricter regime always the safer choice?
A widely held view among compliance teams is that always applying the stricter of two applicable regimes is the safest course. In the OFSI-versus-Australia context, that often means treating the OFSI ownership-and-control test as the universal standard and applying it across both jurisdictions. The logic is appealing. The practical consequences, in some cases, are adverse.
Applying the OFSI standard to the Australian leg of a transaction can produce over-compliance that is operationally costly and, in some cases, contractually or legally impermissible in the Australian context. Where Australian law does not prohibit a transaction that OFSI would require a licence for, a bank that voluntarily refuses the Australian transaction without a legal basis for doing so may be exposed to claims under Australian banking law or contractual obligations. The principle that the stricter prohibition governs applies within a single regime; it is not a general rule that automatically imports one regime's standard into another jurisdiction's legal analysis.
The correct approach is to apply each regime's test to the leg of the transaction that falls within that regime's jurisdiction, and to identify the specific points of divergence that require separate authorisation or separate documentation. Where a transaction falls within both regimes, both analyses are required – and both results must be documented.
In a recent matter, a financial institution with correspondent relationships in both the UK and the Pacific region was applying a single de-risking policy derived from its OFSI obligations. We reviewed the policy against the Australian regime and identified a category of transactions that were prohibited under OFSI but permissible under the Australian regime without a permit – transactions that the bank was refusing on OFSI grounds without mapping whether the Australian prohibition was engaged at all. Restructuring the analysis by regime and by transaction leg removed a significant volume of unnecessary exits and produced a more defensible documented position for both regulators.
When should a correspondent bank involve external counsel?
Four situations consistently call for external sanctions counsel before the de-risking decision is made. First, where the respondent's ownership structure includes a potential designated-person connection at a non-majority level – the significant-influence-or-control question under OFSI, or the direction-or-behalf question under the Australian regime, neither of which is resolved by a standard screening tool.
Second, where the correspondent relationship processes transactions in multiple currencies and through multiple clearing systems, creating concurrent OFSI, DFAT, and OFAC exposure that must be mapped together.
Third, where the bank has received a voluntary disclosure enquiry, an information request from OFSI, or a query from DFAT, and must assess what the apparent violation is, whether to self-report, and what the penalty defence looks like under each regime's enforcement guidance.
Fourth, where the bank is considering a transaction for which a licence or permit is required, and must decide whether to apply to OFSI, to DFAT, or – in a multi-regime matter – to both, in which order, and on what timetable.
We regularly advise correspondent banks on each of these situations. The analysis is regime-specific, transaction-specific, and time-sensitive. Acting without external counsel at the point of first identification of a potential prohibition is, in our experience, the most consistent source of avoidable enforcement exposure in this space.
To discuss a correspondent-banking de-risking matter under OFSI, the Australian regime, or both, contact Calder & Vance at info@caldervance.com. For matters with a BIS or export-control dimension, see also our analysis of divesting a sanctioned interest under the BIS EAR versus EU rules.