Digital-asset counterparty diligence under Australia: a practical guide

A fintech business in Sydney agrees to acquire a digital-asset portfolio from a counterparty based in a third market. The deal signs. Three days before settlement, a compliance review surfaces a wallet cluster linked to a designated entity under Australia's autonomous sanctions regime. The transaction stops. Unravelling it costs more than the diligence would have. That outcome is avoidable – but only if the counterparty review runs before the contract, not after it.

Digital-asset counterparty diligence under Australia requires checking both the Australian sanctions lists administered by DFAT and the UN Security Council Consolidated List, tracing beneficial ownership through any holding structure, and mapping the wallet addresses involved against known designations. Australia's autonomous sanctions and its UN-implementing obligations apply concurrently; where the two diverge, the stricter prohibition governs. As of January 2026, DFAT's lists and enforcement posture have grown materially, and digital-asset businesses that treat a single name-screen as sufficient diligence are exposed.

This guide walks a representative digital-asset diligence engagement from the first counterparty contact through to a clear-to-proceed decision, noting where the Australian regime interacts with US, UK, and EU obligations that may also bite on the same transaction.

Step 1 – establishing the legal framework before the first screen

Australia's sanctions obligations stem from two concurrent sources: UN Security Council measures, implemented domestically through the autonomous sanctions regime (Australia's own list-based and thematic measures administered by DFAT), and the Charter of the United Nations Act. Both are in force simultaneously, and a transaction may be caught by either or both.

For digital-asset counterparties, the practical starting point is identifying which instruments are relevant to the counterparty's profile. Australia implements all UN Consolidated List designations as a matter of treaty obligation. It also maintains autonomous measures covering a range of designated persons and entities. The two sources are not always in sync on the precise scope of prohibitions: UN measures are globally binding on member states, while Australia's autonomous programme can extend further in defined areas.

What does this mean operationally? It means a compliance team cannot rely solely on a UN-list check and assume it has captured the Australian position. The DFAT consolidated list must be checked directly. In our practice, we regularly see firms treat UN screening as a proxy for all country-level obligations. That shortcut creates a gap that regulators and prosecutors can and do exploit.

Before a single name is run through a screening tool, the diligence team should also confirm whether the counterparty, its holding entities, or the assets themselves have a footprint in the United States, the United Kingdom, or the European Union. A digital-asset wallet does not respect jurisdictional boundaries. If the transaction touches a US person, a US financial institution's correspondent infrastructure, or a stablecoin issued under a US-regulated framework, OFAC's rules apply in parallel with Australia's. Similarly, if the counterparty has EU-based operations or an EU-incorporated holding entity, the relevant EU Council regulations bite. The cross-regime exposure is not hypothetical: it is the baseline position for any cross-border digital-asset deal.

Step 2 – mapping the counterparty's ownership and control structure

The Australian sanctions regime, in common with OFAC and OFSI, looks through nominal holders to the underlying beneficial owner; an entity is caught if it is owned or controlled by a designated person, even if the entity itself is not on any list. Before any name-screening begins, the diligence team must build a complete ownership map.

For digital-asset counterparties, that map is more complex than for a conventional corporate seller. A counterparty may be a natural person operating through a non-custodial wallet, a DAO-adjacent structure with dispersed token-holders, or a centralised exchange incorporated in one jurisdiction and licensed in another. Each structure requires a different set of questions.

The core threshold question for US purposes is whether any single blocked person, or any combination of blocked persons, holds 50 percent or more in aggregate, directly or indirectly. OFAC's 50 percent rule is mechanical: it applies regardless of whether the ultimate controllers exercise day-to-day management. Australia does not publish an identical numerical threshold in the same form, but beneficial-ownership analysis under the Australian regime asks the same functional question. In our experience, the most reliable diligence posture is to apply the OFAC 50 percent test as a floor, then examine whether any lesser degree of ownership or control might nonetheless engage Australian prohibitions on a facts-and-circumstances basis.

UK practice adds a further layer. Ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person) under OFSI's guidance distinguishes between existing, actual influence and a purely theoretical capacity to exert control. UK case law holds that control must be real, not hypothetical. If the transaction has any UK nexus – a UK-incorporated entity, a UK-resident beneficial owner, or a payment route through a UK correspondent bank – OFSI's control analysis applies alongside the Australian beneficial-ownership review.

Build the ownership chain to the natural-person level. Obtain corporate registry documents, shareholder registers, or wallet-attribution reports as appropriate to the counterparty type. Where the counterparty is a VASP (virtual-asset service provider), check its registration status with the relevant domestic regulator and obtain its own AML/CTF disclosure where available. A gap in the ownership chain is itself a red flag that should pause the transaction.

Step 3 – running the name and wallet screens

With the ownership map in hand, the screening step covers three distinct dimensions: named persons and entities, wallet addresses, and the assets being transferred.

Named-person screening requires checking the DFAT consolidated list, the UN Consolidated List, and – given the high probability of cross-regime exposure – the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons), OFSI's designated-persons list, and the EU consolidated financial-sanctions list. Running all five is standard practice for any cross-border digital-asset transaction. A screening tool that covers only one regime's output is not adequate for this class of counterparty.

Wallet-address screening is a separate and non-substitutable step. Regulators including OFAC publish wallet addresses associated with designated persons, and a designation can extend to addresses associated with that person's activity. Blockchain analytics (the use of on-chain data to trace transaction histories and cluster addresses by probable ownership) is the principal method for this step. The analytical output should be reviewed by someone who can distinguish a high-confidence cluster from a speculative attribution – the risk of false positives in blockchain analytics is real, and acting on a false positive can itself damage a legitimate transaction.

What about the assets themselves? For a digital-asset portfolio acquisition, the specific tokens or coins being transferred must be checked against known designations. Some assets have been specifically identified in enforcement actions and, in some cases, in regulatory guidance as associated with designated entities. The asset-level check is not standard practice at many firms; it should be.

Document every screen: which tool was used, which lists were checked, the date and time, the version of the list, and the disposition of every alert. If a hit is generated, it must be escalated and resolved before the transaction proceeds. A record showing that a plausible match was noted and then silently cleared without a documented rationale is evidence of a control failure, not of a functioning programme.

Step 4 – resolving alerts and assessing residual risk

An alert does not automatically mean a match, and a match does not automatically mean the transaction is blocked. The resolution step requires structured analysis: is the identified person the same individual or entity as the counterparty? Does any ownership-chain holding reach the threshold that triggers a prohibition? Is there a licensing route available under the applicable regime?

Australia operates a licensing regime for sanctions matters administered by DFAT. Specific licences are available for defined purposes, including humanitarian activity and certain financial transactions. Licence timelines are not fixed by statute in the same way as some other regimes and should be treated as variable; build the realistic timeline into the deal schedule before relying on a licence as the clearance path.

For US-nexus transactions, OFAC administers both specific licences (case-by-case authorisations to conduct an otherwise prohibited transaction) and general licences (standing authorisations for defined categories). Where a transaction has both an Australian and a US dimension, the licensing analysis must run in both jurisdictions. Obtaining an Australian licence does not give clearance under OFAC, and vice versa.

The position above covers the standard case. Your facts – the counterparty, the wallet history, the route, the regimes in play – change the analysis. If an alert raises genuine uncertainty, take specialist advice before deciding to proceed. In our cross-border practice, we regularly advise on exactly this type of mid-transaction alert, and the cost of a few hours of legal review is materially less than the cost of proceeding on a mistaken clearance. For an assessment of your exposure under the Australian regime, contact Calder & Vance at info@caldervance.com.

Where the alert cannot be resolved and no licence is available, the transaction cannot proceed. The firm must then consider its reporting obligations. There is a legal obligation on relevant firms to report knowledge or suspicion of designated persons to the relevant authority. Under the Australian regime, an obligation to report may arise even where the transaction does not complete. The UK has an equivalent obligation for relevant firms to report to OFSI. If the transaction has US nexus, blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the blocking or rejection. Understand which reporting obligations are engaged before deciding how to handle an unresolved match.

Step 5 – the myth that representations replace diligence

A persistent misunderstanding in digital-asset transactions is that a seller's representations and warranties about sanctions compliance remove the buyer's sanctions risk. They do not. Representations are a contractual remedy between the parties. Sanctions law is a regulatory obligation owed to the state. A buyer that proceeds on the strength of a seller's reps alone, without independent diligence, has not discharged its legal obligation and may face enforcement regardless of what the contract says.

This matters particularly in digital-asset deals because the assets themselves may carry a tainted history that pre-dates the current seller's involvement. On-chain transaction history is permanent and publicly visible. Regulators can and do look at the provenance of an asset, not merely its current holder. A buyer that acquires a wallet containing assets previously associated with a designated entity may find that the taint analysis follows the asset, irrespective of the contractual protections it extracted from the seller.

In our experience, representations are a complement to diligence, not a substitute. The diligence record – the ownership map, the screen outputs, the alert dispositions, the counsel opinion where one was obtained – is the evidence that demonstrates the buyer's independent, good-faith compliance effort. That record matters not only for regulatory purposes but also in any subsequent dispute with the seller over the representations.

A related misconception is that a brief counterparty questionnaire sent to the seller constitutes adequate diligence. Questionnaires elicit self-reported information. They are useful inputs into the diligence process, but they are not a substitute for independent verification. A counterparty that is itself subject to a designation, or that has a designated beneficial owner, is unlikely to self-identify that fact accurately. Independent verification against the authoritative lists is the only defensible basis for a clearance decision.

Step 6 – documentation, record-keeping, and ongoing monitoring

Diligence does not end at closing. Sanctions lists change; a counterparty that was clean at the time of the transaction may be designated subsequently. For ongoing business relationships with digital-asset counterparties, periodic re-screening is a minimum standard. The frequency should be risk-calibrated: a counterparty in a higher-risk sector or jurisdiction warrants more frequent review than a well-established, domestically-regulated exchange with a clean history.

Records of the diligence process must be retained. Under OFAC's rules, sanctions records must be kept for five years. The Australian regime has its own record-keeping expectations. Where a transaction has multi-regime exposure, the most demanding record-keeping requirement governs the retention schedule for the whole file.

The documentation should be structured so that a regulator or an enforcement team can reconstruct the decision: what was screened, when, against which lists, by whom, and on what basis the transaction was cleared or blocked. A well-documented file demonstrates that the business applied a genuine compliance programme. Inadequate records are a separate enforcement risk, independent of whether the underlying transaction was itself compliant.

For businesses that process a high volume of digital-asset transactions, building the diligence workflow into the transaction system – rather than treating it as a manual, ad hoc step – is both more reliable and more defensible. Automated tools can manage the list-screening steps and generate the documentation trail; human review is still required for alert resolution and for the ownership-chain analysis that no screening tool can replace.

If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. To discuss an ongoing matter or to stress-test your screening programme, write to Calder & Vance at info@caldervance.com.

How the Australian regime compares with other major regimes

Australia's autonomous sanctions and UN-implementing obligations place it within the mainstream of allied-country sanctions practice, but several features of the regime are worth understanding for a business that also operates under OFAC, OFSI, or EU rules.

On list coverage, Australia's autonomous lists are narrower in volume than the OFAC SDN List, which is the largest single-jurisdiction sanctions list in the world by number of entries. A counterparty that passes an Australian-only screen may nonetheless appear on the SDN List. For any transaction with a US nexus – and in digital assets, the US nexus question arises regularly given the dominance of US-dollar stablecoins and US-based exchange infrastructure – the OFAC screen is non-optional.

On the beneficial-ownership test, Australia, the UK, and the EU all apply a functional ownership-and-control analysis. OFAC's 50 percent rule is the most widely known formulation, but it is not the only one. The EU's ownership criterion uses a threshold of more than 50 percent for asset-freeze purposes; OFSI's control test can engage at lower levels of ownership where actual control is established. In practice, a cross-border diligence file should address all of these formulations where the transaction has multi-regime exposure.

On enforcement posture, DFAT's enforcement of Australia's autonomous sanctions has become progressively more active, and the Australian government has signalled that digital-asset transactions are an area of particular regulatory attention. The UK introduced strict-liability civil penalties for financial-sanctions breaches, meaning that knowledge or intent need not be proved. The EU is transposing a directive that establishes criminal penalties for serious sanctions violations. The US maintains the longest-running enforcement programme of all major regimes and has an extended statute of limitations for civil and criminal violations. A business that operates across these jurisdictions faces an enforcement environment in which every regime is capable of independent action on the same underlying facts.

Switzerland and Canada both implement UN measures and maintain autonomous programmes broadly aligned with EU and UK positions respectively. Singapore implements UN measures through regulations. For a digital-asset counterparty with any footprint in these jurisdictions, the diligence file should note the applicable country regime and assess whether any additional check is warranted.

The practical implication of this multi-regime environment is that a diligence programme calibrated solely to Australian obligations will be insufficient for most cross-border digital-asset transactions. Build the multi-regime check into the standard workflow, not as an exceptional step but as the baseline.

Related practices

• AIS anomaly indicators – EU service – sanctions risk identification through vessel-tracking anomalies for EU-nexus transactions
• Digital-asset counterparty diligence – BIS / EAR guide – US export-control analysis for digital-asset transactions with US technology content
• Digital-asset counterparty diligence – cross-border guide – multi-regime diligence framework for digital-asset transactions spanning two or more jurisdictions

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.