Sanctions compliance checklist, Iran-linked cyber threat profiles, supply chain risk assessment, and board-level risk briefing templates for Australian businesses.
Comprehensive sanctions and cyber risk toolkit for Australian businesses.
Step-by-step checklist to verify your business complies with Australian and international Iran sanctions requirements.
Detailed profiles of Iran-linked threat actors targeting Australian businesses. Know what to look for.
Templates to assess your supply chain for Iran-linked exposure. Third-party risk evaluation made practical.
What to do if you detect a state-sponsored intrusion. Step-by-step playbook aligned to Australian requirements.
Ready-to-present risk briefing template. Communicate geopolitical cyber risk to non-technical leadership.
Written for Australian businesses. References DFAT sanctions list, ASD advisories, and local reporting requirements.
Needing to understand and communicate geopolitical cyber risk to stakeholders.
Responsible for sanctions compliance and third-party risk management.
Needing threat intelligence on state-sponsored actors targeting Australian infrastructure.
Any organisation with international suppliers, partners, or customers in sensitive regions.
This is not a static risk. In March 2026, OFAC issued General Licences GL T and GL U — the first substantive relaxation of Iran sanctions since 2018 — while DFAT simultaneously tightened compliance expectations with mandatory 10-year record retention and expanded red-flag typologies. From 31 March 2026, AUSTRAC gains enforcement powers over sanctions-related financial activity. The AFP prosecution of a remittance-company director for transferring $649,000 to sanctioned Iranian banks demonstrates that Australian authorities are actively pursuing criminal charges. Meanwhile, Iran-linked APT groups continue accelerating exploitation of new CVEs with supply-chain compromise campaigns. The regulatory landscape is shifting fast, enforcement is intensifying, and businesses that treat this as a checkbox exercise are exposed. This guide gives you the practical tools to assess your exposure, navigate the OFAC-DFAT compliance tension, and brief your board — all in Australian context with current intelligence.
OFAC issued two new general licences that directly affect Australian businesses with US nexus. GL T (effective 23 January 2026) authorises limited safety- and environmental-related transactions involving blocked persons or vessels. GL U (effective 20 March 2026) permits the delivery and sale of Iranian petroleum products under tightly defined conditions, marking the first substantive relaxation since the 2018 comprehensive restrictions. Australian firms that maintain USD-denominated accounts, use US-based payment processors, or rely on SWIFT must assess whether their Iran-related activities fall within these narrow licence scopes. Both licences carry a "no-new-business" clause requiring pre-existing authorisation.
DFAT released revised sanctions guidance introducing stricter red-flag typologies, expanding the scope of entities subject to compliance (including fintech firms and payment-service providers), and mandating a 10-year record-retention obligation for all sanctions-related documentation. This supersedes the previous 5-year standard and applies to exporters, banks, and payment processors. Critically, DFAT's precautionary posture creates a compliance grey area: while OFAC's licences permit limited transactions, DFAT still requires specific permits for activity exceeding licence thresholds, with civil penalties of up to USD $1 million per breach.
From 31 March 2026, AUSTRAC assumes limited enforcement powers over sanctions-related financial activity. This enables direct monitoring and penalties for supply-chain financing involving Iranian counterparts. Australian fintech firms facilitating cross-border payments — including cryptocurrency transactions — face heightened regulatory scrutiny under both AUSTRAC and DFAT frameworks. Businesses should anticipate audits and implement automated screening against the OFAC SDN list.
Iran-linked APT groups are accelerating exploitation of newly disclosed CVEs, with campaigns observed using PowerShell-based execution vectors and supply-chain compromise techniques targeting software-update pipelines. These groups continue to target critical infrastructure, financial services, and government-adjacent organisations in allied nations including Australia. The guide includes updated threat actor profiles, known TTPs, and indicators of compromise.
A divergence has emerged between OFAC and DFAT interpretations. OFAC's GL T and GL U suggest a limited, case-by-case approach to permitted transactions, while DFAT adopts a more precautionary posture warning that any indirect involvement with Iranian entities may trigger penalties. Multinational corporations operating across both jurisdictions must reconcile these conflicting standards. The guide maps the overlap and provides a decision framework for dual-jurisdiction compliance.
One-time purchase. Instant download. Start implementing today.
Get the Guide — $47 AUD →