TL;DR
- OFAC issued General Licence GL T (effective 23 January 2026) and GL U (effective 20 March 2026), creating narrow pathways for certain Iran-related transactions — the first substantive relaxation since the 2018 comprehensive restrictions
- DFAT released revised guidance mandating 10-year record retention for all sanctions-related documentation, up from the previous 5-year standard
- AUSTRAC gains limited enforcement powers over sanctions-related financial activity from 31 March 2026, enabling direct monitoring and penalties for supply-chain financing involving Iranian counterparts
- A compliance tension exists between OFAC's permissive licence approach and DFAT's precautionary stance — Australian businesses must navigate both simultaneously
- Fintech firms and payment-service providers face particular regulatory scrutiny under the expanded DFAT and AUSTRAC frameworks
Two New OFAC General Licences Change the Calculus
In March 2026, the US Treasury's Office of Foreign Assets Control (OFAC) issued two new general licences that directly affect any Australian business with a US nexus — meaning USD-denominated accounts, US-based payment processors, or reliance on SWIFT messaging.
GL T (effective 23 Janu
Free Resource A practical, no-jargon security checklist for Australian businesses. Download free — no spam, unsubscribe anytime.Get the Free Cybersecurity Checklist
GL U (effective 20 March 2026) permits the delivery and sale of Iranian petroleum and petrochemical products under tightly defined conditions. This marks the first time since the 2018 comprehensive restrictions that such transactions have been explicitly licenced for commercial purposes. However, both licences carry a critical "no-new-business" clause — Australian firms can only rely on them if they held pre-existing authorisation or if the activity falls within the narrowly defined scope.
For Australian businesses in logistics, energy, mining, or professional services, this means a practical reassessment. If you have any supply chain touchpoint with Iranian parties, you need to determine whether your activities fall within GL T or GL U scope, and whether you need a separate DFAT permit on top.
DFAT's Guidance Overhaul Creates a Compliance Grey Area
The Australian Department of Foreign Affairs and Trade released revised sanctions guidance in March 2026 that introduces several material changes:
10-year record retention. All sanctions-related documentation must now be retained for 10 years. This supersedes the previous 5-year standard and applies to exporters, banks, payment processors, and any entity handling Iran-related transactions. If you are not already archiving sanctions screening logs, transaction records, and due diligence documentation with a 10-year horizon, you are non-compliant.
Expanded entity scope. DFAT has broadened the range of entities subject to sanctions compliance obligations. Fintech firms, payment-service providers, and cryptocurrency businesses are now explicitly included in the guidance.
Stricter red-flag typologies. The revised guidance introduces new red-flag indicators that trigger enhanced due diligence requirements. These are particularly relevant for businesses that process international payments or facilitate cross-border trade.
The tension with OFAC. Here is where it gets complicated. OFAC's GL T and GL U suggest a limited, case-by-case approach to permitted transactions. DFAT's revised guidance adopts a more precautionary posture, warning that any indirect involvement with Iranian entities may trigger penalties. Civil penalties can reach up to USD $1 million per breach. Australian businesses operating across both jurisdictions must reconcile these conflicting standards — and when in doubt, the more restrictive interpretation applies.
ISO 27001 SMB Starter Pack — $97
Everything you need to start your ISO 27001 journey: gap assessment templates, policy frameworks, and implementation roadmap built for Australian SMBs.
Get the Starter Pack →AUSTRAC Enforcement Powers: 31 March 2026
From 31 March 2026, the Australian Transaction Reports and Analysis Centre (AUSTRAC) assumes limited enforcement powers over sanctions-related financial activity. This is a structural change in the Australian sanctions enforcement landscape.
Previously, sanctions compliance enforcement was primarily the domain of DFAT's Australian Sanctions Office (ASO) and the Australian Federal Police. AUSTRAC's new role enables it to directly monitor supply-chain financing that involves Iranian counterparts and to impose penalties for non-compliance.
For Australian fintech firms facilitating cross-border payments — including cryptocurrency transactions — this creates a dual reporting and compliance obligation. Businesses should anticipate AUSTRAC audits and implement automated screening against the OFAC Specially Designated Nationals (SDN) list.
The practical implication: if you process payments that could involve Iranian parties at any point in the chain, you need sanctions screening infrastructure in place before 31 March 2026.
What Australian Businesses Should Do This Week
Assess GL T and GL U applicability. Determine whether any of your Iran-related activities fall within the scope of the new OFAC general licences. If they do, verify that you meet the "no-new-business" clause requirements.
Update record-retention policies. Extend sanctions-related documentation retention to 10 years. This applies to screening logs, transaction records, due diligence files, and compliance certifications.
Review DFAT permit requirements. If your activities exceed the GL T/GL U thresholds, you need a specific DFAT permit. The penalty for proceeding without one can reach USD $1 million per breach.
Implement or upgrade sanctions screening. Automated screening against the OFAC SDN list and DFAT Consolidated List should be in place before AUSTRAC's enforcement powers commence on 31 March.
Brief your board. The regulatory landscape has materially changed. Directors need to understand the dual-jurisdiction compliance obligations and the heightened enforcement environment.
FAQ
Do the new OFAC licences mean Iran sanctions are being relaxed? Not meaningfully. GL T and GL U create narrow exceptions for specific categories of transactions. The comprehensive sanctions regime remains in place, and DFAT has simultaneously tightened compliance expectations. Treat these as limited operational accommodations, not a general relaxation.
Does the 10-year record-retention requirement apply to my business? If you handle any transactions that could involve Iranian parties — directly or indirectly — yes. This includes exporters, banks, payment processors, fintech firms, and any business providing services that touch international trade with sanctioned jurisdictions.
What happens if I am already compliant with DFAT's previous guidance? You likely need to extend your document retention period and review whether your compliance programme accounts for the new red-flag typologies. The expanded entity scope may also bring previously exempt business units into the compliance framework.
Is there a grace period for AUSTRAC enforcement? The enforcement powers commence 31 March 2026. There is no publicly announced grace period. Businesses should have compliance infrastructure in place by that date.
Need a comprehensive sanctions compliance toolkit? The Iran Sanctions and Cyber Risk Guide includes a sanctions compliance checklist, OFAC-DFAT decision framework, supply chain risk assessment templates, and board-level risk briefing — all updated for the March 2026 regulatory changes. $47 AUD with a 30-day money-back guarantee.
Work With Us
Ready to strengthen your security posture?
lilMONSTER assesses your risks, builds the tools, and stays with you after the engagement ends. No clipboard-and-leave consulting.
Book a Free Consultation →