How to use an early account or settlement scheme under Australia

A multinational with Australian operations receives a notice from DFAT indicating that a transaction may have breached the autonomous sanctions regime. The compliance team knows a voluntary disclosure could help – but no one is certain whether to approach DFAT directly, what to say first, or whether silence might be the safer path. That uncertainty is itself a risk. The window in which proactive engagement does the most good is short, and what a business says in the first days of an inquiry shapes the outcome for months afterwards.

Australia's autonomous sanctions regime, administered by DFAT under the autonomous sanctions legislation, does not operate a codified early account or settlement scheme equivalent to the formal published frameworks seen under OFSI in the United Kingdom or OFAC in the United States. However, voluntary disclosure, co-operation, and early engagement with DFAT are recognised factors in the exercise of prosecutorial and regulatory discretion. Handled correctly, they can make a material difference to whether a matter proceeds to criminal referral, stays at the civil or administrative level, or is resolved without public action.

This guide follows a decision-tree structure: at each branch, the question you need to answer determines the next step. It covers the governing authority and legal basis, how the disclosure and engagement process works in practice, how Australia's approach compares with the UK, EU, and US regimes, and the risk flags that require counsel before you proceed.

What governs sanctions enforcement in Australia – and does a formal scheme exist?

Australia's sanctions enforcement sits principally with DFAT, which administers the autonomous sanctions regime, and with the Australian Federal Police and the Commonwealth Director of Public Prosecutions for criminal matters. The legal basis for autonomous measures is the autonomous sanctions legislation; UN Security Council obligations are implemented through separate regulations. Both carry criminal penalties for breach, and the criminal route is a live risk rather than a theoretical one.

There is no single published document that describes an "early account scheme" or a "settlement scheme" for Australian sanctions enforcement in the way that OFSI's enforcement guidance describes its own early account and settlement mechanisms, or in the way that OFAC's Enforcement Guidelines set out the mitigating-factor analysis for voluntary self-disclosure (VSD – a proactive report to the regulator before it has identified the breach). That absence does not mean co-operation is irrelevant. Australian criminal law and regulatory practice treat co-operation, self-reporting, and early admission as significant factors in charging decisions, penalty submissions, and prosecutorial discretion. What it does mean is that a business cannot rely on a fixed discount or a published procedural pathway.

In our cross-border practice, this structural gap is the first thing clients notice when they move from a matter that also involves OFSI or OFAC to one centred on Australia. The lack of a codified scheme increases the importance of early legal advice: the judgement calls that a published scheme would resolve mechanically must instead be made on the facts, against the regulator's current posture.

As of January 2026, there is no publicly available indication that DFAT has published or intends to publish a formal early account or settlement scheme equivalent to the UK model introduced by OFSI in its February 2026 guidance. Practitioners should verify the current position before any engagement, as the Australian regulatory environment is active.

If there is no formal scheme, does voluntary disclosure still carry weight under Australia?

Yes – and in our experience it can be decisive. Australian prosecutorial guidance and sentencing principles treat genuine co-operation, timely disclosure, and early admission as factors capable of materially affecting the exercise of discretion at the charging stage and the penalty outcome if a matter proceeds. The practical effect of a well-prepared, early disclosure to DFAT is not guaranteed, but it is recognised.

The key distinction is between a disclosure that pre-empts the regulator's own discovery and one that arrives after DFAT or another agency has already identified the apparent breach. A disclosure that arrives first demonstrates genuine corrective intent. One that follows a regulator inquiry is still useful but carries less weight. This mirrors the logic of OFAC's VSD framework, where the timing of disclosure is built into the mitigating-factor analysis, even though the Australian regime does not formalise that distinction in the same way.

What does a useful disclosure to DFAT contain? At minimum: a clear account of what happened, when, and involving which persons or entities; a description of what the business has done to stop the conduct; a candid assessment of the goods, services, or funds involved; and an explanation of the steps taken to prevent recurrence. Incomplete or misleading disclosures can worsen the position significantly. Have you identified the full scope of the conduct before the disclosure letter is sent? That question deserves a genuine answer before any document reaches DFAT.

How does Australia's approach compare with OFSI, OFAC, and the EU?

The comparative picture is important for any business with multi-jurisdictional exposure, because the same underlying transaction may trigger obligations under more than one regime simultaneously. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both – and the disclosure obligations do not cancel each other out.

Under OFSI, the UK regulator published revised enforcement and monetary penalty guidance in February 2026. That guidance introduced a formal early account scheme, a settlement scheme with a published discount, and fixed penalties for specified procedural breaches. Firms facing an OFSI matter now have a structured pathway: early account, then co-operation assessment, then settlement offer with a defined percentage reduction. The maximum civil penalty under the UK regime is the greater of £1,000,000 or 50 percent of the breach value, as currently in force – with proposals under review to raise those figures, though that change remains pending and should be verified before reliance. OFSI's monetary penalties can be imposed on a strict-liability basis, meaning that knowledge of the breach is not required for a penalty to attach.

Under OFAC, the Enforcement Guidelines establish a published framework that distinguishes egregious from non-egregious cases and treats voluntary self-disclosure as a significant mitigating factor, with a defined effect on the base penalty calculation. OFAC's civil-penalty authority under IEEPA is strict-liability in character, and records must be kept for five years. OFAC also requires blocked-property and rejected-transaction reports within 10 business days of the relevant event – a hard deadline with no equivalent in the Australian framework.

The EU does not operate a single sanctions-enforcement authority; each member state enforces the directly applicable Council Regulations through its own national mechanisms. An EU directive on the criminalisation of sanctions violations, which required transposition by member states by May 2025, sets minimum penalties for serious offences, with maximum terms of imprisonment of at least five years and corporate fines expressed as a percentage of worldwide turnover. Co-operation and self-reporting are treated as mitigating factors in most member states, but the procedural details differ considerably between jurisdictions.

Australia, by comparison, sits closer to the criminal-law end of the enforcement spectrum: the sanctions legislation creates criminal offences, referral to prosecutors is a genuine route for serious breaches, and the regulatory agency does not itself impose administrative monetary penalties in the way OFSI does. That means the downside of an unmanaged matter in Australia can be qualitatively different from a civil-penalty outcome under the UK or US regimes.

How to handle early account and settlement schemes under Australia: the decision sequence

The absence of a formal scheme does not remove the need for a structured approach. The following sequence reflects how a well-managed engagement with DFAT and related Australian authorities typically proceeds in our experience.

Branch A: The business has identified a potential breach before any regulator contact.

Step 1 – Scope the apparent breach. Before any disclosure, understand what happened. Which sanctions regime applied? Which goods, funds, or services were involved? Which persons or entities? Was the breach a single transaction or a pattern? This scoping exercise needs to be thorough: an incomplete disclosure that requires correction later carries a credibility cost.

Step 2 – Preserve the record. Immediately secure all relevant documents, communications, transaction records, and screening outputs. Do not delete, overwrite, or move anything. In our experience, document preservation failures at this stage have a disproportionate effect on how a regulator reads the subsequent engagement.

Step 3 – Take legal advice before drafting the disclosure. The disclosure letter to DFAT is not an internal compliance memorandum. It is a communication to a regulator that may later be seen by prosecutors. The content, tone, and scope of what is admitted are matters for a sanctions lawyer, not for the compliance function alone.

Step 4 – Make the disclosure promptly. A disclosure that arrives early, is well-prepared, and is candid demonstrates genuine co-operative intent. DFAT's assessment of the business's attitude toward compliance is formed in part by the quality and timing of the initial engagement.

Step 5 – Implement remediation before or alongside the disclosure. Practical steps – enhanced screening, revised counterparty procedures, additional training – signal that the breach was an exception, not a systemic posture. Document what has been done and include a clear remediation account in the disclosure.

Branch B: The business has received an inquiry or notice from DFAT or another Australian authority.

The position is still manageable, but the calculus has changed. A disclosure that arrives after a regulator inquiry is no longer pre-emptive. It is, however, still a form of co-operation – and genuine, substantive co-operation after contact remains a significant factor in how a matter develops. Do not assume that engagement is futile because DFAT has already made contact. The quality of the response to a regulator inquiry can be as important as the fact of it.

In this branch, the same scoping and preservation steps apply, but the timeline is compressed and the legal advice step is urgent. What the business says in response to the initial inquiry – even informally, even in preliminary correspondence – can be used. Engage counsel before responding.

What is the early account and settlement schemes compliance checklist for Australia?

The following checklist reflects the key decisions a compliance counsel or general counsel needs to work through before and during engagement with DFAT. It is not a substitute for legal advice on the specific facts.

• Scope: Have you identified every transaction, every counterparty, and every instrument involved in the apparent breach? Do not disclose until the scope is understood.
• Preservation: Are all relevant records secured and subject to a hold? This includes screening outputs, payment records, shipping documents, internal approvals, and any communications about the transaction.
• Legal advice: Is sanctions counsel engaged before any communication with DFAT? This step is not optional once a potential breach has been identified.
• Multi-regime check: Does the transaction also touch OFAC, OFSI, EU, or another regime? If so, disclosure obligations and timing may differ, and a co-ordinated approach is required. Where two regimes apply, the stricter prohibition governs.
• Disclosure content: Does the disclosure account for what happened, when, by whom, and with what intent? Does it describe the remediation steps already taken?
• Tone: Is the disclosure candid, accurate, and complete? Regulators assess credibility based on the internal consistency of the account and its alignment with the documentary record.
• Criminal risk: Has counsel assessed whether the matter carries criminal exposure and whether the Australian Federal Police or the Commonwealth Director of Public Prosecutions is likely to become involved?
• Ongoing monitoring: After disclosure, is a process in place to report any new developments to DFAT promptly?

What are the risk flags that require immediate escalation to sanctions counsel?

Not every sanctions matter in Australia requires the same level of urgency. But certain features move a matter from a compliance management question to a legal crisis, and they need to be identified early.

The most significant risk flag is criminal exposure. The autonomous sanctions legislation in Australia creates criminal offences. If the apparent breach is intentional, or if there is evidence that individuals within the business took deliberate steps to circumvent controls, the matter is not an administrative one. Criminal referral is a realistic outcome, and the decisions taken in the first days – what is said, to whom, and in what form – can affect that outcome materially. This is not the moment for internal communications that are inconsistent with what will later be disclosed.

A second flag is multi-regime exposure. A business that operates across Australia, the UK, the US, and the EU may face simultaneous reporting and disclosure obligations under regimes that do not operate on the same timeline. OFAC's 10 business day blocked-property reporting requirement, for instance, runs from the date of blocking – not from the date the business decides to engage counsel. Where multi-regime exposure exists, a co-ordinated disclosure strategy is essential.

A third flag is a pattern rather than a single breach. A business that has conducted multiple transactions with the same counterparty over an extended period faces a different analysis than one dealing with a single isolated event. Regulators and prosecutors in all jurisdictions, including Australia, read a pattern as evidence of systemic failure or deliberate disregard – neither of which supports a favourable exercise of discretion.

A fourth flag is reputational proximity to another regulated entity. Banks, payment firms, and other financial institutions that process transactions for exporters or multinationals can face their own sanctions exposure under Australian law, as well as under OFAC's foreign-financial-institution provisions if there is a US nexus. A business that is itself not the primary target of an inquiry may still face significant secondary consequences.

In our experience, the businesses that manage these matters best are those that identify the risk flags early, engage counsel before the situation escalates, and make decisions deliberately rather than reactively. The common thread across Australia, the UK, the US, and the EU is that early, honest, and structured engagement consistently produces better outcomes than delay or silence – and the myth that staying silent is the safer path is exactly that: a myth.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.