A trading company with operations in the Asia-Pacific region receives a formal letter from the Australian Department of Foreign Affairs and Trade (DFAT, the department responsible for administering Australia's autonomous sanctions regime). The letter requests information about a series of transactions completed over the preceding eighteen months. The compliance team has three business days to decide how to respond. Is this a routine enquiry or the opening of a formal investigation? What must be produced, and what can be withheld? These questions carry real consequence.
Responding to a regulator information request under Australia's autonomous sanctions regime requires a structured, prompt, and legally considered approach. DFAT administers the regime under the relevant autonomous sanctions legislation and associated regulations. As of March 2026, non-compliance with a formal information request can constitute a separate contravention, independent of any underlying sanctions breach – making the response itself a legal risk event that demands early preparation.
This guide walks through the key stages of an effective response: understanding the legal basis for the request, preserving material, assembling the response, managing privilege, assessing cross-regime exposure, and deciding when external counsel adds most value.
Step 1: Understand the legal basis and the authority behind the request
Australia's autonomous sanctions regime is administered by DFAT under the relevant autonomous sanctions legislation and associated regulations. DFAT has statutory authority to request information from persons and entities in connection with suspected contraventions or for monitoring purposes. The first task on receipt of a request is to identify precisely which power is being exercised – monitoring function, investigation trigger, or something more targeted.
The distinction matters for two reasons. First, it shapes what you are legally required to produce. A monitoring request typically covers records relevant to whether particular goods, services, or financial dealings comply with the applicable prohibitions. An investigation-oriented request may be narrower and more pointed. Second, the characterisation of the request affects how you sequence your response and how you frame your covering letter.
In our experience, businesses often treat the opening communication as administrative. That instinct can be costly. A failure to respond within the required period, or a response that is materially incomplete, can itself constitute a civil or criminal contravention under the applicable rules. Identify the request type, confirm the deadline, and assign a response lead within hours of receipt – not days.
Step 2: Implement a document-preservation hold immediately
Before any document is reviewed for production, a preservation hold must lock the relevant records in place. This means suspending all routine document-deletion processes for the categories and periods identified in the request, and extending the hold to electronic communications, transaction records, screening logs, and any internal analysis touching on the relevant counterparties or goods.
Who triggers the hold? The compliance lead or General Counsel should issue written notice to all custodians within the first twenty-four hours. The notice should identify the subject matter, the approximate date range, and the categories of material to be preserved. It should also make clear that alteration, deletion, or transfer of any potentially relevant document carries serious legal risk.
A practical point that is often missed: sanctions transaction records must in many cases be retained for a defined period under the applicable Australian rules. Whether your existing retention programme meets that standard is worth checking now, because a gap in records will itself require explanation. Verify the current position on retention obligations before relying on it, as the applicable period has been subject to regulatory update.
Step 3: Map the scope and conduct a privilege review
Once material is preserved, the next stage is scope mapping: identifying what the request actually covers, what documents fall within that scope, and what protections may apply. Legal professional privilege is the most important protection to assess at this stage. Communications prepared for the dominant purpose of obtaining legal advice, or in anticipation of litigation, may be withheld – but the scope of privilege under Australian law has particular features that differ from the US attorney-client privilege and from the EU's in-house counsel rules.
Several points are worth noting in the Australian context. In-house legal advice can attract privilege, but the circumstances require careful analysis. Dual-purpose documents – those serving both a legal and a business function – are a recurring battleground. And waiver of privilege, even inadvertent waiver through selective disclosure, is difficult to reverse. Build your privilege log at the same time as your review, not after it.
Beyond privilege, assess whether any material is subject to confidentiality obligations to third parties – correspondent banks, foreign government counterparties, or clients operating under contractual non-disclosure terms. These obligations do not override a valid statutory request, but they may require notification to the relevant third party before production and may affect how documents are produced.
What is the cross-regime dimension, and why does it matter here?
An information request from DFAT rarely exists in isolation. If the underlying transactions have a US dollar clearing leg, involve a US person, or touch goods with a US-origin classification, the same conduct may simultaneously attract attention from OFAC (the US Office of Foreign Assets Control) or BIS (the Bureau of Industry and Security). Similarly, if the counterparty appears on an EU sanctions list or an OFSI (UK Office of Financial Sanctions Implementation) designation, parallel obligations may exist in those jurisdictions.
The cross-regime dimension creates two specific risks for the responding party. First, voluntary disclosures or admissions made in a DFAT response could be discoverable or otherwise relevant in a separate US, UK, or EU enquiry. The legal protection attaching to a voluntary self-disclosure (VSD – a proactive disclosure to a regulator intended to demonstrate cooperation and potentially attract mitigation) differs significantly between regimes. OFAC's VSD programme, for instance, operates under a specific framework with defined mitigation credit that has no direct equivalent under the Australian rules. Getting the sequencing wrong – disclosing more than necessary in one regime while a parallel enquiry is live in another – can prejudice the global position.
Second, Australian individuals and entities operating internationally may be subject to secondary-sanctions risk. A transaction that is lawful under the Australian regime may still expose a firm to OFAC secondary-sanctions consequences if a foreign financial institution or a US-person nexus is involved. We regularly advise clients on how to map these cross-border exposures before submitting a response, precisely because what you say to DFAT is read through more than one regulatory lens.
For businesses that have received a comparable request from BIS under the EAR, our guide to responding to BIS information requests under the EAR sets out the parallel procedure and the key differences in scope and timing.
The position above covers the standard cross-regime case. Your facts – the counterparty, the goods, the route, the financial flows, and the specific regimes in play – will change the analysis materially.
For a confidential review of your cross-regime exposure following a DFAT information request, contact Calder & Vance at info@caldervance.com.
Step 4: Assemble the response and draft the covering letter
The substantive response has three components: the document production, a narrative explanation (if appropriate), and a covering letter that frames both.
Document production should be organised by the categories specified in the request. Present documents in a clear, numbered format with an index. Do not produce more than the request requires – over-production of documents outside the request's scope can inadvertently waive privilege and can create issues in parallel proceedings. But equally, do not produce less than is required by selective interpretation of the scope; a narrow reading that later appears deliberate compounds the risk.
A narrative explanation is worth considering where the factual picture is complex or where the documents require context to be properly understood. DFAT examiners reviewing a transaction file will apply the regime's prohibitions to what they see. If the documents tell an incomplete story without context – for instance, because internal approvals followed a separate oral decision-making process, or because a screening result was later overridden with documented reasons – a brief, accurate, and professionally drafted narrative can prevent an incorrect inference from hardening into a finding.
The covering letter is a legal document, not a courtesy. It should identify the basis on which you are responding, confirm the date of receipt and the deadline, list what is being produced, identify anything withheld and the basis for withholding it, and confirm that the response is complete to the best of the respondent's knowledge and belief. This last statement carries significant weight; it is, in effect, an attestation. Do not sign it without verifying the completeness of the production.
Risk flags: when does a DFAT request signal something more serious?
Not every DFAT information request is the prelude to enforcement action. Many are routine monitoring enquiries. But certain features of a request should heighten your alert level and alter your response strategy. Ask yourself: does the request name a specific designated person or entity? Does it focus on a particular transaction or series of transactions rather than a category of business? Has DFAT referred the matter to the Australian Federal Police or the Department of Home Affairs? Have you received simultaneous enquiries from another jurisdiction?
Each of these signals shifts the probability that the enquiry has moved beyond monitoring. In those circumstances, the response strategy changes: a more conservative privilege analysis, closer attention to the narrative, and earlier involvement of external counsel are all warranted.
There is a further risk category that we see regularly in practice: the apparent violation that the firm did not know about before the request arrived. DFAT's request may be the first indication that a transaction had a sanctioned nexus. If you discover during your review that your production will disclose a potential contravention, the question of whether to make a VSD – and how to sequence it relative to the compelled response – becomes urgent. Do not allow the compelled response to run ahead of that decision.
For clients managing an apparent violation across the EU regime as well as Australia, our EU apparent-violation assessment service addresses the parallel procedural path in that regime and the strategic questions that arise when both regimes are live simultaneously.
If a transaction has already been flagged, or if the information request has surfaced a potential breach, an early review can preserve options that narrow considerably with time. Contact us at info@caldervance.com for a confidential initial discussion.
How does Australia's regime compare to OFAC, OFSI, and Canada on information requests?
Australia's information-request mechanism shares broad features with those of other major regimes – there is a designated competent authority, a statutory power to compel production, and consequences for non-compliance – but the detail differs in ways that matter operationally.
Under the OFAC regime, formal information requests from OFAC's enforcement staff typically arise as part of a subpoena or civil investigative process, and the VSD programme provides a structured mitigation pathway with defined credit that is not replicated in Australian practice. The US regime also has a broader secondary-sanctions reach and more expansive extraterritorial jurisdiction than Australia's, meaning that the same conduct is more likely to attract a US response.
OFSI in the UK operates under SAMLA (the Sanctions and Anti-Money Laundering Act) and the relevant thematic UK sanctions regulations. OFSI has a statutory power to require information from persons it suspects of having knowledge relevant to a sanctions matter, and the failure to comply or the provision of false information is itself a criminal offence. OFSI's enforcement posture has hardened in recent years, and its guidance on information requests makes clear that it expects responses to be comprehensive, timely, and accurate.
Canada's Global Affairs Canada (GAC) administers the autonomous sanctions regime under SEMA (the Special Economic Measures Act). The Canadian regime shares with Australia a focus on designated individuals and entities in a defined set of country or thematic programmes. However, the procedural mechanics around information requests – timelines, required content, enforcement consequences – differ from the Australian model and require separate analysis. Our guide to responding to GAC information requests under the Canadian sanctions regime sets out those differences in full.
The practical divergence that matters most for a business operating across multiple jurisdictions is sequencing and privilege. Producing documents to DFAT on a given timeline may not leave adequate time to conduct a full privilege review to the standard required in a parallel US or EU proceeding. Building that overlap into the response plan from day one is not optional – it is a prerequisite for managing the global position.
When should you involve external sanctions counsel?
This is the question most businesses ask too late. The honest answer is: earlier than feels necessary. There is a category of DFAT information request – routine, narrow, well-understood – where an experienced in-house compliance team can manage the response without external assistance. But several conditions tend to make external counsel not merely useful but essential.
First, any request that touches conduct with a potential cross-border dimension. As described above, parallel OFAC, OFSI, EU, or Canadian exposure changes the strategy fundamentally, and the privilege analysis becomes significantly more complex when the audience for the documents includes regulators in multiple jurisdictions.
Second, any request that arrives alongside, or shortly after, a separate enforcement development – a transaction block, a payment refusal, a counterparty notification, or an inquiry from a correspondent bank. These are indicators that the matter has already passed through at least one screening system and been flagged. The information request may not be the only process in motion.
Third, any request where the internal review surfaces documents that were not known to exist, or that reveal a decision made without adequate legal sign-off. These are the situations in which the difference between a managed disclosure and an unmanaged one is most pronounced.
Fourth, the VSD question. If the review uncovers a potential apparent violation, the decision about whether and how to disclose it proactively – separate from and in addition to the compelled response – is one of the most consequential judgments in an enforcement matter. It involves weighing the mitigation benefit of cooperation against the risk of broader disclosure in a rapidly evolving factual picture. Our practice covers that analysis across the major regimes.
We have acted for businesses across the financial services, manufacturing, energy, and logistics sectors in managing information requests under the Australian regime and in coordinating the response with parallel proceedings under OFAC, OFSI, and the EU Council regulations.
Related practices
- EU apparent-violation assessment – assessing and managing apparent violations under the EU sanctions regime
- BIS / EAR information request guide – responding to BIS information requests under the EAR
- Canada sanctions information request guide – responding to GAC requests under the Canadian autonomous sanctions regime