A financial services group with operations in London and Sydney receives two letters in the same week. One arrives from OFSI, the United Kingdom's financial-sanctions enforcement authority. The other arrives from DFAT, the Australian Autonomous Sanctions regulator. Both letters request information about transactions that may involve a designated person. The questions look similar on the surface. The legal obligations behind them are not.
Responding to regulator information requests under OFSI and under the Australian Autonomous Sanctions regime involves distinct legal duties, different timelines, and separate penalty consequences for non-compliance. As of March 2026, both regimes carry mandatory reporting and information-production obligations, but the triggers, the scope of what must be disclosed, and the enforcement posture differ in ways that matter to any cross-border business managing exposure in both jurisdictions.
This analysis sets out how each regime structures its information-request powers, where the two regimes diverge on process and substance, what risk flags practitioners see most often, and when to involve specialist counsel.
What legal authority underlies each regime's information-request powers?
OFSI derives its information-request authority from the Sanctions and Anti-Money Laundering Act, commonly called SAMLA, and from the relevant thematic sanctions regulations made under it. Under that architecture, OFSI may require any person it suspects holds, controls, or has knowledge of funds or economic resources belonging to a designated person to provide information. The obligation is not limited to financial institutions. It applies to any business or individual who has reason to believe they hold or have encountered relevant property. The governing instrument is the applicable thematic sanctions regulation for the particular programme in question – Russia, Iran, Belarus, and so on – rather than a single consolidated statute covering all information requests.
Australia's information-request authority rests on the Autonomous Sanctions Act and the regulations made under it. DFAT administers the regime. Unlike OFSI, where the licensing and enforcement functions sit within a single operational directorate of HM Treasury, DFAT is a foreign-affairs ministry exercising autonomous-sanctions powers alongside its diplomatic functions. That institutional difference is not merely structural. It shapes the tone, pace, and priority of information requests. In our experience, DFAT information requests in the autonomous-sanctions space have historically been less frequent and often less prescriptively worded than their OFSI equivalents, though the underlying statutory power is comparable in breadth.
Both regimes can also interact with law-enforcement referrals. OFSI may refer matters to the Crown Prosecution Service or to the National Crime Agency. DFAT may refer matters to the Australian Federal Police. A request that begins as a civil information-gathering exercise can therefore be a precursor to a criminal investigation. That possibility must inform how a recipient structures its response from day one.
How do the two regimes structure the information-request procedure?
OFSI typically issues a formal information request in writing, specifying the transactions, time period, counterparties, and categories of document sought. The request will also state the statutory basis and the deadline for response. OFSI's enforcement guidance makes clear that it expects full, accurate, and timely responses. Delays, partial responses, or responses that require chasing all feature in OFSI's assessment of the seriousness of a potential breach and, in turn, in its penalty calculation. That connection between responsiveness and penalty outcome is one that in-house teams sometimes underestimate.
The practical mechanics on the OFSI side require the recipient to:
- acknowledge receipt and confirm the legal entity responding;
- identify and preserve all relevant records within the scope stated;
- identify whether legal professional privilege applies to any documents;
- prepare a structured narrative or tabular response covering each item requested;
- submit by the stated deadline, or seek an extension before that deadline expires.
Privilege is a live issue in OFSI matters. Legal advice privilege and litigation privilege apply in the usual way under English law. However, documents produced by the compliance function without the directing involvement of qualified lawyers are unlikely to attract privilege, even if they end up in the lawyers' hands. Businesses that have mixed compliance and legal materials in the same files should audit that material carefully before submission.
On the Australian side, DFAT information requests follow a comparable written format, but the applicable procedural rules track the Autonomous Sanctions Act and regulations rather than a SAMLA-derived template. There is no dedicated enforcement publication from DFAT equivalent in depth to OFSI's enforcement guidance. That means practitioners advising Australian-side recipients must work more closely from the statute and from the practice of the Australian Federal Police and the Department's own administrative guidance. The absence of a detailed published enforcement methodology is itself a risk: a recipient cannot calibrate its response against a stated penalty matrix in the way that is possible with OFSI.
What the two regimes share is that a defective response – one that omits material documents, misstates a fact, or fails to meet the deadline – will be treated as an aggravating factor in any subsequent enforcement proceeding. Neither regulator treats honest error and deliberate omission as equivalent, but in both regimes the starting assumption is that a full, accurate, and timely response is expected as a baseline, not as a mitigating achievement.
Where do the timelines and deadlines diverge most sharply?
OFSI states its response deadline in the request itself. In practice, the timeframes we see are short – often a matter of weeks rather than months, and occasionally requiring rapid triage of large document sets. Where a recipient needs more time, OFSI will consider a reasoned extension request, but it must be submitted before the original deadline expires. A request submitted after deadline, even by one business day, is treated differently and may be noted in the enforcement record.
Australian autonomous-sanctions information requests are less standardised in their stated deadlines. DFAT may specify a period, or the request may invite a response at the earliest opportunity. The absence of a rigid published deadline framework can create a false sense of latitude. In our cross-border practice, we advise clients in both jurisdictions to treat any stated deadline as a hard commitment and any open-ended request as requiring an internal target of no more than a few weeks.
The mandatory-reporting obligation – distinct from responding to a request – also diverges on timing. Under the applicable UK thematic regulations, a person who knows or suspects they hold funds or economic resources of a designated person must report that to OFSI without delay. The words "without delay" have a well-understood meaning in UK financial-crime law. Waiting to compile a comprehensive picture before reporting, when a reasonable suspicion already exists, is likely to be treated as a failure to comply with the reporting obligation. Australia's mandatory-reporting obligation under the Autonomous Sanctions Act is similarly structured around actual knowledge or reasonable suspicion, but the precise formulation and the enforcement practice around timing differ. Verify the current position under each instrument before relying on any specific timeframe.
The position above covers the standard case. Your facts – the counterparty relationship, the nature of the property involved, whether both UK and Australian entities are in the group – change the analysis materially. For a cross-border assessment of your obligations under both regimes, contact Calder & Vance at info@caldervance.com.
What are the consequences of non-compliance in each regime?
OFSI's civil monetary penalty powers were significantly strengthened by the Economic Crime (Transparency and Enforcement) Act 2022. Under the post-2022 regime, OFSI can impose a civil monetary penalty on a strict-liability basis for a breach of a financial-sanctions prohibition, meaning that intention to breach is not required for civil liability to arise. Penalties can reach the higher of a fixed statutory ceiling or a percentage of the value of the breach. The precise figures in the statutory instrument should be verified before reliance, as they may be updated. What is not in doubt is that the penalty base under the current UK regime is substantially higher than it was before 2022, and that OFSI has published a number of enforcement cases demonstrating its willingness to use those powers.
Failure to comply with an OFSI information request is itself a criminal offence under the applicable thematic regulations. Knowingly providing false information or concealing material facts is treated more seriously than a simple failure to respond. OFSI's enforcement guidance sets out a list of factors it will consider in determining whether to impose a monetary penalty and at what level. Cooperation with the regulator – including the quality and speed of the response to information requests – features explicitly as a mitigating factor. That gives a compliant and timely response direct value in any subsequent penalty assessment.
Australia's enforcement posture under the Autonomous Sanctions Act similarly provides for criminal penalties for breach of the substantive prohibitions, and for false or misleading statements to the regulator. The civil-penalty architecture is less developed in published guidance terms than the OFSI model, and DFAT enforcement actions in the autonomous-sanctions space have been less frequent in the public record. That does not mean the risk is lower; it means the practice of the regime is less predictable from public sources, which is itself a risk-management challenge. Where a group is simultaneously under inquiry in both jurisdictions, the Australian-side exposure should not be treated as secondary simply because the enforcement history is shorter.
If a transaction has already been flagged, or a response deadline is approaching, an early review can preserve options that narrow with time. Write to Calder & Vance at info@caldervance.com.
How does the cross-border interaction between OFSI and Australian obligations complicate matters?
A group entity caught by both regimes faces a genuine coordination challenge. OFSI's information request will be directed to the UK-incorporated or UK-operating entity. DFAT's request will be directed to the Australian entity. The two requests may cover the same underlying transactions but ask different questions and use different categorisations. Responding to one without regard to the other creates a risk of inconsistency – and inconsistency between a group's representations to two different regulators is a serious problem, even where no actual breach of the substantive prohibitions is involved.
There is also the question of document location. In a group with shared systems, the documents relevant to the OFSI request may sit on servers in multiple jurisdictions, some of which are subject to data-protection or blocking legislation that restricts transfer. Australian data-sovereignty considerations can complicate production of Sydney-held records in response to an OFSI request, and the reverse problem arises where DFAT seeks London-held documents. In our experience, this practical obstacle is one of the first things a cross-border team should map when a dual-jurisdiction request lands.
Secondary-sanctions considerations add a further layer. Where the underlying transactions involve US-designated persons or US-dollar clearing, the group may also face exposure under OFAC's information and reporting requirements, even if neither OFSI nor DFAT has yet raised that dimension. A complete response strategy must therefore consider whether the US dimension has been triggered, and whether a voluntary self-disclosure to OFAC is warranted before a request arrives from that direction.
Consider also the position of group employees who are simultaneously subject to interview requests or compelled statements in both jurisdictions. Privilege and self-incrimination protections differ between the UK and Australia, and between civil and criminal proceedings in each. What a senior compliance officer says in a DFAT interview may be relevant to OFSI's assessment, and vice versa. Coordinating the narrative across jurisdictions, without creating false impressions in either, is a task that requires experienced cross-border counsel from the outset.
What risk flags should a compliance team look for when a request arrives?
The single most common failure we see is treating an information request as a document-production exercise rather than as an enforcement trigger. A request is a signal that the regulator has already identified a transaction or counterparty of concern. The question is not simply whether the documents produced are accurate and complete; it is also what those documents will reveal and whether the business has properly assessed its own exposure before handing anything over.
Specific risk flags to assess before responding include:
- Whether the transactions covered by the request include any that were not previously identified in the business's own sanctions screening;
- Whether any designated person's identity was not immediately apparent from the counterparty's own records – for example, where beneficial ownership was obscured or the counterparty used a nominee structure;
- Whether any funds or economic resources were made available, even inadvertently, to a designated person or to an entity owned or controlled by one;
- Whether any employee who handled the transaction has left the business or is otherwise difficult to reach for interview;
- Whether the request covers a time period for which records are incomplete, either through routine data-retention practices or because of a system migration.
In a recent matter, a trading-group compliance function received an OFSI information request covering a multi-year period of transactions with a counterparty whose beneficial ownership had changed during that period. The request arrived before the group had conducted its own internal review. We were instructed to scope the apparent violations, advise on voluntary self-disclosure, and prepare the response. The structured internal review produced a clearer and more defensible picture than an uncoordinated document dump would have done, and the response was submitted on time. Outcomes in any individual matter depend on the facts, but early instruction of counsel consistently produces a more controlled process.
A final risk flag: the myth that a request addressed to one group entity does not concern the others. OFSI's reach under SAMLA and the applicable thematic regulations extends to UK persons and to conduct within the United Kingdom, but where a group's UK entity has facilitated a transaction involving another group member, OFSI may in practice request information about the group structure and the roles of entities in other jurisdictions. Assuming that the request is contained to the named addressee alone, without reviewing whether other entities are implicated, is a significant oversight.
A common myth about information requests: "we are only required to provide what was explicitly asked for"
A widely held misconception among in-house teams is that the obligation on receipt of an information request is narrow – that the business need only answer the specific questions posed and produce only the documents listed. That is incorrect under both regimes, and acting on that assumption carries material risk.
Under the applicable UK thematic regulations, the obligation to report knowledge or suspicion that funds or economic resources are held is a free-standing, proactive duty. It exists independently of whether a formal request has been made. If, in the course of preparing a response to an OFSI information request, the compliance team identifies a transaction that was not part of the original request but that gives rise to a suspicion of a breach, the mandatory-reporting obligation is likely triggered at that point. Sitting on that information until it is asked for is not a tenable position.
The Australian position is broadly comparable. The Autonomous Sanctions Act creates reporting obligations that run independently of the information-request power. A response that is technically responsive to every question asked, but that withholds material information about a parallel breach, will not protect the business from liability for failure to comply with the reporting obligation.
In practice, this means that the preparation of a response to an information request is also a review exercise. The compliance team – ideally supported by counsel – should use the process to identify whether the transactions in scope reveal broader issues that require separate reporting. That is a more demanding obligation than most in-house teams anticipate, and it is one of the primary reasons why early instruction of sanctions lawyer counsel (a qualified specialist in the applicable regime) is important rather than optional.
Related practices
- Apparent violation assessment – EU – assessing apparent breaches, scoping exposure, and advising on disclosure under the EU sanctions regime.
- Voluntary self-disclosure: EU and SECO compared – analysing when and how to disclose potential breaches to EU and Swiss regulators.
- Voluntary self-disclosure: OFAC and Canada compared – comparing the US and Canadian frameworks for self-reporting apparent sanctions violations.