How often to rescreen for sanctions in Australia

No law sets a fixed interval for sanctions rescreening. You must check whether a customer, and the people connected to them, are designated before you start, and keep checking through the relationship. In practice that means rescreening when the DFAT Consolidated List changes or a customer’s details change, and recording every result and the officer’s decision on it, so you can show that a person, not just a system, evaluated each outcome.

TL;DR:

• Screen against DFAT’s Consolidated List, which holds every designation under Australian sanctions laws, United Nations listings included; other countries’ lists, such as the US and EU lists, are not on it, and if those laws might affect your activities DFAT advises getting legal advice.
• If a customer is designated, their assets are frozen: you must not deal with them, or make assets available to the customer, without a sanctions permit, and sanctions law requires you to tell the Australian Sanctions Office and the Australian Federal Police as soon as possible.
• Set default review cadences by customer risk tier, document the rationale, and define who reviews possible matches, clears them, and approves exceptions.
• If you delay initial customer due diligence, screen against the list as early as you can: sanctions laws apply from the first dealing, whatever stage CDD has reached.
• For each review, retain the screening date, searched fields, DFAT source, match outcome, notes on partial matches, and the officer’s reasoning.

Table of Contents

• What do Australian law and official guidance require for sanctions rescreening?
• Which events should force an immediate rescreen?
• How do you turn triggers and risk ratings into a documented schedule?
• What should you record for each rescreen, and for how long?
• How does automation support rescreening without replacing the officer?
• What happens when a rescreen finds a match?
• How AML Guard supports scheduled rescreening
• FAQ
• Sources

What do Australian law and official guidance require for sanctions rescreening?

Neither the AML/CTF Act nor the AML/CTF Rules 2025 sets a rescreening interval. What the law does require is three things. Before you start, establish on reasonable grounds whether the customer, any beneficial owner (with limited exceptions in the Rules), anyone on whose behalf the customer receives the service and anyone acting for the customer is designated for targeted financial sanctions (section 28(2)(e)). Monitor your customers throughout the relationship (section 30), which AUSTRAC says includes monitoring them for potential breaches of sanctions laws. And have AML/CTF policies that make sure you do not make assets available to a designated person or deal with assets they own or control (Rules 5-3).

Sanctions differ from PEP status in one important way: sanctions laws apply whether or not CDD is finished, and breaching them can be a serious criminal offence. AUSTRAC’s guidance notes that sanctions change often, and DFAT’s guidance on dealing with assets of designated persons calls sanctions compliance an ongoing process rather than a one-time assessment, so a clean result at onboarding goes stale. A confirmed match means the person’s assets are frozen: you cannot deal with them, or make assets available to the person, without a sanctions permit.

AUSTRAC’s targeted financial sanctions guidance says you must also check whether the customer or any of those people become designated during the business relationship, and suggests more thorough checks where the risk is higher: international customers, people in countries known as intermediaries for sanctioned countries, and entities with complex structures and foreign beneficial owners.

Which events should force an immediate rescreen?

Rescreen when the DFAT Consolidated List changes or a customer’s details change. Record the result and the decision.

• List changes: rescreen when the DFAT Consolidated List changes. It holds people, entities and vessels, and DFAT’s guide to the list explains that each alias is marked strong or weak, so search the aliases as well as the primary names; AUSTRAC suggests checking alternative spellings and using fuzzy searching.
• Customer detail changes: rescreen when a customer’s details change, such as a new name, a new beneficial owner or a new person acting for them.
• Delayed CDD: if you start the service before finishing initial CDD (section 29), screen as soon as you have the customer’s details. AUSTRAC says it may be appropriate to screen a low-risk customer as part of the delayed CDD, but sanctions laws do not wait for it.

Pro Tip: Sign up for DFAT’s list update notifications and treat each notice as a task with an owner and a due date, so a rescreen is never left to someone remembering to look.

For ongoing monitoring beyond sanctions, see our guide to ongoing AML monitoring.

How do you turn triggers and risk ratings into a documented schedule?

Work through these steps and write each one into your AML/CTF policies:

1. Map risk tiers to a default cadence. Take the ratings from your ML/TF risk assessment (our guide to risk assessment for real estate agencies shows how) and assign a default rescreening frequency to low, standard and high-risk customers. AUSTRAC’s guidance on assigning customer risk ratings says you must continue to monitor each customer for anything that might change their risk, and the Act ties KYC reviews to a frequency appropriate to that risk (section 30(2)(c)). Record why you chose each cadence.
2. Define overrides. List the triggers above that bypass the default cycle and require an immediate recheck.
3. Write escalation and approval rules. State who reviews a possible match, who can clear it, and who approves any exception to the default cadence.
4. Cover delayed CDD. Where you delay initial CDD, specify that screening happens as soon as the customer’s details are known.

What should you record for each rescreen, and for how long?

Each rescreen should leave a record an auditor can follow without asking you to explain it:

• The screening date and the fields searched
• The list searched, and the date of the version you used
• The outcome: match or no match
• Notes on any fuzzy or partial match
• The officer’s decision and the reasoning behind it

Record each screening result and decision in your audit trail. The Act requires records of your customer due diligence, including any analysis, risk assessment or decision, to be kept for 7 years after the business relationship ends or the occasional transaction is completed (section 111). AML Guard’s audit trail holds records for 8 years, above the Act’s seven-year minimum. Our guide to AML record keeping explains the rest.

The officer’s decision matters as much as the automated result. A list of unreviewed system outputs shows that software ran. A recorded decision shows that a person evaluated the result.

How does automation support rescreening without replacing the officer?

Two kinds of check do different jobs. Scheduled checks catch customers whose risk cadence has come due; event-driven checks catch the list change that lands between schedules. You need both, because a scheduled cycle alone can leave a newly designated customer undetected for weeks.

Automation should feed a workflow, not close it. Every alert needs an officer to review it and record a decision. AUSTRAC’s guidance on how to monitor your customers expects monitoring to alert you in a timely way, to be more intensive for higher-risk customers, and to escalate unusual activity for review, and gives a match against a sanctions list as an example of an alert to investigate.

When you configure a system:

• Set out when to rescreen, including when the DFAT Consolidated List changes or a customer’s details change.
• Define how screening results and decisions will be recorded.
• Use CRM status flags that show compliance status only, so CDD data stays out of the CRM.
• Confirm that results and decisions land in the audit trail.

Pro Tip: Test your setup by feeding it a known alias variation, then confirm the alert reaches an officer and the decision is recorded.

What happens when a rescreen finds a match?

If a rescreen returns a possible match, an officer compares the listed entry’s details, such as dates and places of birth, citizenship and addresses, with what you hold before deciding. You do not wait for that decision to act: if you are, or think you may be, holding an asset owned or controlled by a designated person, freeze it and report it while you confirm the match. AUSTRAC’s guidance and DFAT’s set out what follows:

• Freeze: do not deal with the person’s assets, or make assets available to them, without a sanctions permit, and do not return assets you hold to them.
• Tell the Australian Sanctions Office and the Australian Federal Police as soon as possible: DFAT’s guidance makes this a legal requirement, and AUSTRAC expects it as soon as practicable.
• Submit a suspicious matter report if you suspect, on reasonable grounds, that you hold information relevant to a breach of sanctions laws, within 3 business days of forming the suspicion, or 24 hours if it relates to terrorism financing (section 41).
• Consider whether to continue the business relationship, and seek legal advice before any further dealing, as DFAT advises.

DFAT’s guidance allows you to tell a designated person that their asset has been frozen in compliance with Australian sanctions laws; disclosing a suspicious matter report is a different question, governed by the tipping off offence (section 123).

How AML Guard supports scheduled rescreening

AML Guard runs scheduled automatic rescreening, with every result and officer decision recorded in its 8-year tamper-evident audit trail. Compliance status can go to REX CRM without any CDD detail.

Firms start with a demo. Book a demo to see scheduled rescreening and the audit trail, or review our pricing.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Does the AML/CTF Act set a fixed sanctions rescreening interval?

No. The Act and the AML/CTF Rules set no fixed interval, but you must check before you start and keep checking during the relationship. Screen at onboarding, rescreen when the DFAT Consolidated List changes or a customer’s details change, and record each result and decision. Our guide to how often to rescreen PEPs covers that separate question.

What should I do when a customer matches the DFAT Consolidated List?

Treat the person’s assets as frozen: do not deal with them, or make assets available to the person, without a sanctions permit, and do the same while you confirm a possible match. Tell the Australian Sanctions Office and the Australian Federal Police as soon as possible, submit a suspicious matter report if you suspect a breach of sanctions laws on reasonable grounds, and record the match and your officer’s decision.

Do US or EU sanctions lists carry legal effect in Australia?

Not as Australian law. DFAT’s Consolidated List holds the designations made under Australian sanctions laws, United Nations listings included, so that is the list to screen against. It does not include other countries’ lists, or people and organisations listed under other Australian laws (the terrorist organisations listed under the Criminal Code, for example). If another country’s laws, or other Australian laws, may affect your activities, DFAT advises seeking legal advice.

How long must I keep rescreening records?

Seven years after the business relationship ends or the occasional transaction is completed. Section 111 of the Act covers the records of your customer due diligence, including the analysis and decisions behind it, which takes in each screening result and the officer’s decision on it.

Sources

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Anti-Money Laundering and Counter-Terrorism Financing Rules 2025
• Persons designated for targeted financial sanctions (TFS) | AUSTRAC
• Assigning customer risk ratings | AUSTRAC
• How to monitor your customers | AUSTRAC
• Consolidated List | Department of Foreign Affairs and Trade
• Guidance Note: Dealing with assets owned or controlled by designated persons and entities | Department of Foreign Affairs and Trade

Recommended

• Tranche 2 customer due diligence in Australia
• Tranche 2 AML Australia: your compliance obligations explained
• Suspicious matter reports for Tranche 2 firms
• Tranche 2 AML/CTF for Australian law firms