A financial institution receives a payment instruction from a client whose counterparty has just been flagged on a sanctions screening alert. The instruction involves funds that may be subject to a freezing obligation. Two jurisdictions are potentially in play: the United Kingdom, where OFSI administers the financial-sanctions regime, and Australia, where DFAT oversees the autonomous-sanctions programme. The question is not whether a prohibition applies – both regimes prohibit dealing with designated persons. The question is what the institution must do next, and whether the routes to authorised payment under each regime are materially the same.
They are not. Payment authorisations (case-by-case licences permitting an otherwise prohibited payment involving a designated person or blocked funds) follow different legal bases, different licensing tests, different procedural timelines, and different reporting obligations under OFSI and the Australian autonomous-sanctions regime. A business that assumes equivalence between the two will misapply one of them. As of May 2026, the divergences are substantive enough to require separate legal analysis for each leg of a cross-border payment.
This analysis maps the key points of divergence across the two regimes – governing authority, legal basis, the licensing test, procedure, conditions, reporting, and enforcement posture – and identifies the practical implications for financial institutions and compliance teams managing multi-jurisdictional payment flows.
Governing authority and legal basis: two distinct regimes
In the United Kingdom, OFSI – the Office of Financial Sanctions Implementation, a unit within HM Treasury – administers financial sanctions and holds the authority to issue licences permitting otherwise prohibited transactions. The legal basis for UK financial sanctions is the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA"), under which the relevant thematic regulations are made. OFSI's licensing power derives from those regulations; the grounds for granting a licence are specified in the applicable instrument for each sanctions programme.
In Australia, the autonomous-sanctions programme is administered jointly by DFAT (the Department of Foreign Affairs and Trade) and the Australian Federal Police, which holds enforcement responsibility. The legal basis is the Autonomous Sanctions Act and the Autonomous Sanctions Regulations, supplemented by the relevant autonomous-sanctions instruments for each country-specific or thematic programme. Authorisation to make an otherwise prohibited payment requires either a permit issued by the Minister for Foreign Affairs or a relevant exemption under the applicable instrument.
The structural difference matters immediately. OFSI is a specialist sanctions authority with a dedicated licensing function and published guidance on its licensing process. The Australian authorisation route flows through ministerial discretion, with DFAT as the administering body. These are not equivalent bureaucratic structures, and the practitioner's approach to each must differ accordingly. In our experience, businesses familiar with OFSI's licensing process sometimes underestimate how different the Australian permit route operates in practice, both in its procedural mechanics and its substantive criteria.
What is the licensing test under each regime?
Under OFSI, a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) is available only if the application falls within one of the licensing grounds prescribed in the relevant thematic sanctions regulations. These grounds vary by programme but commonly include: legal expenses, basic needs (humanitarian provision to a designated individual), prior obligations, extraordinary situations, and – for financial institutions – grounds relating to credit institutions and insurance. An application that does not fit a recognised ground will not succeed, regardless of its commercial merits.
The Australian regime does not operate on a closed list of grounds in the same way. The Autonomous Sanctions Regulations provide a broader authorisation power, exercisable where the Minister is satisfied that it is in the national interest or consistent with Australia's international obligations to grant the permit. This is a wider discretion, but it introduces greater uncertainty. There is no published ground-by-ground checklist equivalent to the OFSI licensing-grounds structure. An applicant cannot simply identify the ground and satisfy its criteria; it must build a case for why authorisation is in Australia's interest or consistent with its treaty obligations.
Which test is harder to satisfy? The answer depends on the facts. The OFSI ground-based system gives a well-advised applicant clarity: if you can demonstrate that the transaction falls within a defined ground, the application has a recognised pathway. The Australian discretionary model offers potentially more flexibility but less predictability. For payments with a clear humanitarian or legal-expenses character, OFSI's ground-based approach may produce a faster and more certain outcome. For payments that do not fit neatly into a defined category, Australia's broader discretion may be the more hospitable route – if the national-interest argument can be made out.
How does OFSI's licensing procedure compare to the Australian permit process?
OFSI's licensing process is conducted primarily through its online licensing portal, with supporting documentation submitted according to OFSI's published guidance. OFSI assesses whether the application falls within a licensing ground, whether the designated person is correctly identified, and whether the proposed transaction terms are consistent with the purpose of the ground relied upon. OFSI may request additional information; it has published indicative processing timelines, though these are not statutory deadlines. The applicant corresponds with OFSI directly throughout.
The Australian permit process is administered through DFAT's sanctions team, with applications made in writing. There is no equivalent online portal of the type OFSI operates. DFAT conducts an internal assessment, which may involve consultation with other agencies, and the decision is formally taken at ministerial level. Processing times are not published in the same structured way as OFSI's guidance, and in our practice we advise clients to build in materially longer lead times for Australian permit applications than for OFSI licences.
Both regimes require the applicant to provide details of the parties to the transaction, the nature and amount of the payment, the reason the transaction is otherwise prohibited, and the basis on which authorisation is sought. The documentary burden is broadly comparable at the application stage. The difference lies in what happens next: OFSI's ground-based review has a clearer internal structure, while the Australian ministerial-discretion route involves a less transparent decision-making pathway.
The position above covers the standard case. Your facts – the counterparty, the jurisdiction of the paying institution, the nature of the payment, and the sanctions programme involved – change the analysis materially. For a preliminary assessment of which authorisation route applies to your payment, contact Calder & Vance at info@caldervance.com.
Conditions, reporting obligations, and record-keeping: where the regimes diverge further
An OFSI licence is typically granted subject to conditions. These may include requirements to report on the use of the licence, to maintain records of transactions conducted under it, and to notify OFSI if the circumstances change. The record-keeping obligation under the UK regime extends to records of the licence itself, the transactions conducted, and the due diligence carried out. OFSI's enforcement guidance makes clear that failure to comply with licence conditions is itself a breach of financial sanctions.
Under the Australian regime, a permit will also be issued subject to conditions specified by the Minister, and the Autonomous Sanctions Act imposes reporting obligations on persons who are aware they hold or control assets owned by a designated person. The reporting obligation in Australia runs to DFAT and, in some cases, to the Australian Federal Police. The trigger for the reporting obligation is awareness, not just a formal screening hit, which means that compliance programmes must be calibrated to capture qualitative intelligence as well as list-based alerts.
A critical divergence on record-keeping is the time horizon. Under OFSI's guidance, firms are expected to retain records relevant to their financial-sanctions compliance. The Australian regime similarly imposes record-keeping obligations, but the two regimes do not align on every detail of what must be retained and for how long. Where a payment involves both a UK and an Australian nexus, a financial institution will need to satisfy the stricter of the two sets of obligations simultaneously. In our cross-border practice, the rule of thumb is simple: where two regimes apply to the same transaction, the stricter prohibition and the more demanding compliance standard govern.
How does the 50 percent rule apply in each regime, and why does it affect payment authorisations?
The ownership question is not merely a screening question – it determines whether a payment authorisation is needed at all. Under OFSI, the UK regime adopts an ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person): a company that is owned or controlled by a designated person is itself subject to the asset-freeze, even if not separately listed. Control in the UK sense extends beyond 50 percent ownership and captures de facto control through less formal means.
Australia's autonomous-sanctions regime uses a broadly comparable test for entities that are "owned or controlled" by a designated person, but the precise articulation differs from the OFSI formulation. Practitioners should not assume that a determination made under one regime as to whether a company is caught by a designated person's ownership will be accepted as determinative under the other. Both assessments must be conducted under the applicable national rules.
This matters for payment authorisations because the threshold question – is this payment prohibited in the first place? – precedes the authorisation question. If the counterparty is caught under one regime but not the other, only one authorisation is required. If it is caught under both, authorisations must be sought in parallel. Getting the ownership analysis wrong in either direction – treating a non-caught entity as prohibited, or treating a caught entity as free – generates either unnecessary delay or unlicensed exposure. Both are costly outcomes.
Enforcement posture and risk: what happens if a payment is made without authorisation?
OFSI has a civil enforcement power and can impose monetary penalties for breaches of financial sanctions. OFSI's published enforcement guidance describes a two-stage civil process. Penalties are calculated with reference to the value of the breach and can be substantial. OFSI also holds a criminal referral route for the most serious cases, with prosecutions conducted through the Crown Prosecution Service. The UK regime is widely regarded as active in enforcement, and OFSI publishes information about its enforcement actions, which provides the market with signal about its priorities.
In Australia, enforcement responsibility sits with the Australian Federal Police, and prosecutions are conducted through the Commonwealth Director of Public Prosecutions. The Autonomous Sanctions Act provides for criminal penalties for persons who contravene the sanctions laws, including penalties for natural persons and corporations. The enforcement posture differs from OFSI's civil-first model: Australia does not have a published civil monetary-penalty regime for autonomous-sanctions breaches that is equivalent to OFSI's. This means the primary enforcement tool is criminal prosecution, which has a higher evidential threshold but correspondingly higher consequences if pursued.
The practical implication is that the risk profile of an unauthorised payment differs between the two jurisdictions. Under OFSI, the risk is primarily of a civil monetary penalty, with criminal prosecution reserved for the most serious or deliberate cases. Under the Australian regime, the civil-penalty safety valve is more limited. A financial institution operating in both jurisdictions must calibrate its escalation protocols accordingly: a screening alert with an Australian nexus may warrant a lower threshold for payment suspension and permit application than the firm's OFSI procedures alone would suggest.
If a transaction has already been flagged, or a payment has been suspended pending a sanctions review, an early assessment can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss your position.
Secondary-sanctions risk and the US nexus
Neither OFSI nor Australia's autonomous-sanctions regime carries secondary-sanctions provisions in the manner of US OFAC programmes. However, a payment that involves a UK financial institution, an Australian financial institution, or a correspondent bank with a US nexus will also engage OFAC's jurisdiction if the payment touches a US person or clears through the US financial system. OFAC's secondary-sanctions programmes operate independently of whether OFSI or Australia has authorised the payment: an OFSI licence does not protect against OFAC exposure, and an Australian permit does not either.
This is a point on which cross-border compliance teams frequently need to apply a layered analysis. An OFSI-licensed payment that routes through a US correspondent bank to a counterparty in a jurisdiction covered by a US secondary-sanctions programme requires its own OFAC assessment. In our practice, we see the US nexus materialise most commonly through USD-denominated payments, US correspondent banking relationships, and the involvement of US-incorporated entities in the transaction chain. The question to ask before any payment is not only "do we have the authorisation we need under OFSI and Australian law?" but also "does this payment touch the US system in a way that brings OFAC into the analysis?"
The EU dimension is also worth noting for businesses with European operations. An EU-regulated entity cannot rely on an OFSI licence for a transaction that the relevant EU Council Regulation also prohibits: the EU authorisation must be sought separately, from the competent authority of the relevant member state. Multi-jurisdictional payments may therefore require concurrent authorisations from OFSI, the applicable EU competent authority, and DFAT, each assessed under its own rules and each subject to its own conditions.
Practical risk flags and when to involve counsel
For a financial institution or compliance team managing payment authorisation questions across the OFSI and Australian regimes, the following risk flags consistently appear in our practice as indicators that specialist advice should be sought before proceeding.
- The counterparty is not itself designated but has a shareholder, director, or controller who appears on one or more lists: the ownership and control analysis under both regimes must be completed before the payment decision is taken.
- The payment has a USD component or routes through a US correspondent: the OFAC layer must be assessed independently.
- The transaction involves both a UK-regulated entity and an Australian-regulated entity: concurrent authorisations may be required, and the timing must be coordinated.
- The proposed payment ground under OFSI does not have a clear equivalent in the Australian permit criteria: separate legal strategies are required for each leg.
- The sanctioned programme in question is a thematic programme (counter-terrorism, non-proliferation) rather than a country-specific programme: the licensing grounds under OFSI and the Australian instruments differ more markedly for thematic programmes.
- A prior payment has been made without authorisation, and the institution is now aware of the defect: the reporting obligation, the voluntary disclosure question, and the penalty-mitigation analysis must all be addressed promptly.
A common myth in this area is that obtaining an OFSI licence for a payment provides a firm with adequate protection for all jurisdictions in which its group entities operate. It does not. The OFSI licence authorises the conduct of the transaction under UK law only. Group entities in Australia, the EU, or the United States remain separately subject to their own applicable regimes. The licence issued by one authority has no extraterritorial legal effect under another regime's rules. Compliance programmes that treat an OFSI licence as a group-wide clearance for a cross-border payment create a significant residual exposure.
Related practices
- Frozen account management under BIS/EAR – advising on release of blocked funds under US export-control and sanctions rules
- OFSI vs Australia: Payment authorisations – further analysis – extended comparison of procedural and substantive divergences
- Release of blocked funds: EU vs SECO – analysis of the EU and Swiss routes for authorising payments involving designated persons