A trading company operating across the Asia-Pacific region signs a new supply agreement. Its procurement team has screened the primary counterparty. Two tiers down, however, a component sub-supplier has a shareholder whose name appears on Australia's autonomous sanctions list. The goods move. The payment clears. The violation, in legal terms, has already occurred.
Supply-chain sanctions mapping under Australia's autonomous sanctions regime – administered by the Department of Foreign Affairs and Trade (DFAT) – requires a structured, multi-tier examination of every material relationship in a supply chain: suppliers, sub-suppliers, intermediaries, logistics providers, and financial counterparties. As of February 2026, Australian sanctions law imposes strict-liability prohibitions on dealings with designated persons and entities, with criminal penalties available for breaches. The mapping process is not a one-time screen; it is an ongoing programme that must respond to DFAT list changes, corporate restructuring, and cross-regime signals from OFAC, OFSI, and the EU.
This page explains how the mapping exercise works, where the Australian regime sits relative to comparable regimes, the risk flags that practitioners encounter most often, and how Calder & Vance assists cross-border businesses that need this work done with rigour.
What does Australia's autonomous sanctions regime require of supply-chain participants?
Australia's autonomous sanctions regime prohibits a person or entity subject to Australian law from making assets available to, or dealing with, a designated person or entity. The governing statute is the Autonomous Sanctions Act and its associated regulations and instrument, administered by DFAT. The prohibitions extend to indirect dealings – meaning a business that routes a payment or a shipment through an intermediary that is itself a designated entity, or that is owned or controlled by one, can still face liability.
The practical consequence is that a supply-chain mapping exercise must look beyond direct contractual counterparties. In our experience, the risk almost never sits at tier one. It accumulates in the ownership structures of tier-two and tier-three suppliers, in the freight-forwarding and cargo-handling network, and in the correspondent banking chain that settles the underlying payments. A business that has screened only its direct suppliers has, in effect, mapped only the most visible part of the problem.
DFAT publishes and maintains the Australian Autonomous Sanctions (Designated Persons and Entities) list. Updates can occur at any time. A mapping programme must therefore include a live-monitoring component, not only a point-in-time check at contract inception. The position above covers the standard case. Your facts – the goods, the route, the counterparties' ownership chains, and the regimes in play – change the analysis materially.
For an assessment of your exposure under the Australian autonomous sanctions regime, contact Calder & Vance at info@caldervance.com.
How does the Australian ownership and control test compare to OFAC and OFSI?
The Australian regime applies an ownership and control test: a non-listed entity can be caught if it is owned or controlled by a designated person or entity, even where the listed person does not hold a majority stake. This places the Australian test closer to the OFSI and EU approach than to OFAC's mechanical ownership rule.
Under OFAC's rules, the relevant threshold is 50 percent or more aggregate ownership by blocked persons, directly or indirectly. The test is arithmetic. If the combined ownership of listed persons reaches or exceeds that figure, the entity is treated as blocked. Intention and effective control are not determinative.
OFSI and the EU apply a broader test. An entity can be caught through control even where the listed person's ownership stake falls below any fixed percentage. Control includes board influence, veto rights, and contractual authority over key decisions. The Australian regime mirrors this broader approach. For a business operating between Australia and counterparties in the United Kingdom or the European Union, this convergence is practically significant: the same ownership structure that escapes OFAC's 50 percent threshold may still be caught under all three other regimes simultaneously.
In our cross-border practice, we regularly advise businesses that have structured their Australian and UK supply-chain reviews as separate workstreams. That approach misses the interaction. A tier-two supplier that passes the OFAC arithmetic may still be designated under the Australian regime, may be caught under OFSI's control test, and may be subject to EU asset-freeze obligations – all at once. The mapping exercise must account for all live regimes, not only the one that governs the primary contract.
What is the step-by-step process for mapping sanctions risk across an Australian supply chain?
Effective supply-chain sanctions mapping under the Australian regime follows a defined sequence. Each stage builds on the last, and the output of the full exercise is a risk-ranked register that an in-house team can act on and maintain.
Stage 1 – Scope the supply chain. Identify every material relationship: direct suppliers, sub-suppliers providing components or services above a defined value threshold, logistics and freight providers, customs agents, port operators, and the financial institutions handling payment settlement. The scope should also capture beneficial ownership of each entity at least to the level where a natural person is identified.
Stage 2 – Screen against live lists. Run each entity and each identified beneficial owner against the DFAT Consolidated List, the UN Security Council Consolidated List, and – because secondary sanctions risk is real for Australian businesses with US-dollar exposure – the OFAC SDN List and the EU and UK designation lists. Single-list screening is not adequate for a cross-border supply chain.
Stage 3 – Apply the ownership and control test. For any entity where a listed person appears in the ownership or management structure, apply the Australian ownership-and-control analysis. Where ownership is below a clear majority, examine the control indicators: directorship, shareholder agreements, veto rights, and commercial dependency. Document the analysis and the conclusion.
Stage 4 – Classify goods and services. For supply chains involving goods or technology, confirm whether any item is subject to Australian export controls or to dual-use controls under the applicable regime. An item that requires an export permit adds a separate compliance layer on top of the sanctions check.
Stage 5 – Produce a risk-ranked register. Consolidate findings into a register that identifies each relationship, the list or test result, the risk classification, and the recommended action: continue, escalate, restructure, or exit. The register is the audit trail that demonstrates a reasonable-steps defence if a question later arises.
Stage 6 – Build monitoring and trigger protocols. A mapping exercise that ends at Stage 5 decays quickly. Establish automated monitoring for DFAT list changes, define corporate events that trigger a re-screen (ownership changes, new beneficial owners, restructurings), and set a periodic review cycle.
Which supply-chain relationships carry the highest sanctions risk under Australian law?
Certain relationship types carry disproportionate exposure under the Australian regime. Identifying them early determines where to concentrate analytical resource.
Commodity-sector supply chains – extractives, metals, agricultural commodities – frequently pass through intermediary traders, tolling operators, or blenders whose beneficial ownership is opaque. The commodity itself may be legitimate, but the commercial structure conceals the ultimate seller. In our experience, the blending or aggregation step is where the exposure concentrates.
Logistics networks are a persistent risk point. A freight forwarder may be a direct counterparty for the purposes of Australian law, and the carrier, the port operator, and the transshipment hub each represent a further touchpoint. A port that serves as a transshipment point for goods destined for Australia may introduce a sanctioned party as an intermediate handler.
Financial counterparties deserve separate mapping. The correspondent banking chain that settles a US-dollar payment may include an institution that is itself designated, or that has been subject to a de-risking (a financial institution exiting a relationship to avoid sanctions exposure) decision by a US correspondent. Australian businesses with USD payment flows carry secondary-sanctions risk even where the underlying trade is not with a US person.
Joint ventures and long-term framework agreements present a structural risk that spot-screening misses. A joint venture partner whose ownership changes mid-term, or whose controlling shareholder is added to the DFAT list after contract execution, creates an ongoing obligation. The agreement may need to be suspended, restructured, or exited depending on the nature of the dealing.
If a transaction has already been flagged, or a relationship has been identified as potentially problematic, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Does secondary-sanctions risk affect Australian supply chains?
Secondary-sanctions risk – the risk that a non-US entity conducting activity outside the United States becomes ineligible for access to the US financial system or faces designation under a US programme – is a live concern for Australian businesses. It operates independently of whether the Australian business has a US nexus in the primary transaction.
The mechanism is extraterritoriality. OFAC's secondary-sanctions authorities allow the United States to designate, or to limit the US-market access of, non-US persons who engage in specified activity with targets of certain US sanctions programmes. An Australian business that enters into a significant transaction with such a target – even where the goods, the currency, and the parties are entirely outside the United States – can fall within the reach of those authorities.
The practical implication for supply-chain mapping is that the DFAT list is necessary but not sufficient. A counterparty that is not designated under the Australian autonomous sanctions regime may still be a secondary-sanctions target under a US programme. Running OFAC's SDN List and the OFAC non-SDN lists in parallel with the DFAT screen is therefore standard practice for any Australian business with US-dollar accounts, US-person employees, or US-incorporated affiliates.
The interaction between OFAC's extraterritorial reach and Australian law also means that a licence issued by DFAT for an otherwise-prohibited dealing does not authorise conduct that OFAC prohibits. Where a transaction requires authorisation under both regimes, both applications must be filed and both grants must be in hand before the dealing proceeds. We regularly advise on the sequencing of parallel licence applications across Australian and US channels.
What common errors should businesses avoid in Australian supply-chain mapping?
Several avoidable errors recur in supply-chain mapping exercises we review for clients who have conducted their initial assessment without specialist input.
The first is single-list screening. A screen that runs only the DFAT Consolidated List will miss entities designated solely under OFAC, OFSI, or EU programmes – all of which are relevant to an Australian business with cross-border exposure. The correct minimum is screening against the DFAT list, the UN Consolidated List, and the major autonomous-sanctions lists of the jurisdictions with which the supply chain interacts.
The second is static screening. A one-time check at the point of contract execution creates the impression of compliance while leaving the business exposed to every subsequent list change. DFAT updates its list without advance notice. A business that screened a supplier six months ago and has not monitored since cannot rely on that earlier check.
The third error is shallow ownership analysis. Identifying the direct legal owner of a counterparty without tracing the chain to the ultimate beneficial owner level is the most common gap our team finds. Beneficial-ownership registers in many jurisdictions are incomplete or delayed. Proprietary databases, corporate registry filings, and in some cases direct enquiry to the counterparty are required to close that gap.
A fourth error – one we encounter in regulated-sector compliance programmes – is the myth that a large counterparty with its own compliance programme need not be screened independently. Counterparty reliance is not a defence under Australian sanctions law. A business that deals with a sanctioned entity cannot point to its counterparty's compliance certification as a mitigant. The obligation to verify is its own.
Finally, documentation gaps undermine an otherwise-sound programme. Where a question later arises from DFAT or from a correspondent bank, the quality of the contemporaneous record – the screening result, the ownership analysis, the risk assessment, and the escalation decision – determines whether the business can demonstrate a reasonable-steps defence.
How does Calder & Vance approach supply-chain mapping engagements?
Our engagement model for Australian supply-chain sanctions mapping is structured around a defined scope, a documented methodology, and a deliverable that the client's team can use, maintain, and update.
We begin by scoping the supply chain with the client's procurement and legal teams. That exercise identifies the tier structure, the key commodity or service flows, the payment channels, and the jurisdictions in play. We then apply multi-list screening across the DFAT, UN, OFAC, OFSI, and EU lists, supplemented by open-source intelligence and proprietary corporate-registry searches where the counterparty's beneficial ownership is not immediately apparent.
For relationships where a listed person appears at any level of the chain, we conduct the full Australian ownership-and-control analysis, and – where the supply chain has US, UK, or EU exposure – the parallel analysis under the relevant regime. The output distinguishes between relationships that are clear (listed or unlisted), relationships that require further information before a view can be expressed, and relationships that carry a residual risk that the client must decide to accept or to mitigate.
In a recent matter, a manufacturing business with an Asia-Pacific supply chain identified a tier-two component supplier whose ultimate beneficial owner had been added to the DFAT list following a mid-year update. We conducted the ownership-and-control analysis, assessed the concurrent OFAC and EU positions, and supported the client in restructuring its procurement arrangements to remove the exposure. The engagement was completed within a defined timeframe agreed at the outset.
We also assess eligibility, prepare and submit licence applications, and manage the regulator's queries where a specific authorisation from DFAT is required to continue an otherwise-affected relationship. For businesses that have identified a potential breach, we scope the apparent violation, advise on voluntary self-disclosure to the relevant authority, and prepare the response to any enforcement inquiry.
Trust signals matter in this work. Our team covers Australian, US, UK, and EU sanctions from a single engagement structure. Clients do not need to co-ordinate separate counsel for the secondary-sanctions analysis. Response time and fee transparency – including fixed-fee entry points for defined-scope engagements – are built into our service model.
Related practices
- Correspondent banking and de-risking under OFAC – managing US dollar correspondent access and de-risking exposure for cross-border financial flows
- Supply-chain mapping under BIS / EAR – export-control classification, licence requirements, and end-use controls for US-regulated goods and technology
- Supply-chain mapping: advanced BIS / EAR analysis – dual-use classification and Commerce Control List screening for complex multi-tier supply chains