Sanctions compliance for accountants means two jobs. You screen your own clients and suppliers, and you report what you find where the law makes you a reporting firm. In the UK, accountancy firms are "relevant firms" with their own duty to report to the Office of Financial Sanctions Implementation (OFSI). In the US and Australia the rules differ, but the screening work looks much the same.
This guide covers the firm's own obligations, then what to do when you spot a sanctioned name in a client's Xero or QuickBooks file. If you are new to the topic, start with what a sanctions list is.
Who counts as a relevant firm under UK sanctions rules?
UK financial sanctions apply to everyone in the UK and to UK persons anywhere. Some sectors also carry a reporting duty. OFSI calls them relevant firms.
OFSI's general guidance lists the relevant firms. The ones that matter for the accountancy profession are:
| Relevant firm | Listed |
|---|---|
| A firm or sole practitioner that is a statutory auditor or local auditor | Before May 2025 |
| A firm or sole practitioner that provides, by way of business, accountancy services | Before May 2025 |
| A firm or sole practitioner that provides, by way of business, advice about tax affairs | Before May 2025 |
| A firm or sole practitioner that provides certain trust or company services | Before May 2025 |
| A firm or individual who acts as an insolvency practitioner | 14 May 2025 |
The legal definitions sit in the "Information and records" part of each sanctions regime. For Russia, that is regulation 71 of the Russia (Sanctions) (EU Exit) Regulations 2019.
OFSI says the duty applies to relevant firms in the UK or under UK jurisdiction, "including individuals working for them". A junior bookkeeper who spots a match is inside the firm's duty.
What do accountants have to report to OFSI, and when?
The rule for Russia is in regulation 70. The other UK regimes carry an equivalent. OFSI's guidance summarises it:
Reporting obligations apply to relevant firms (as defined in the UK regulations under the Sanctions Act ("UK regulations") and referred to below), who are required to inform OFSI as soon as practicable if they know or reasonably suspect a person is a designated person or has breached a prohibition or failed to comply with an obligation under specified provisions of the UK regulations, where that information is received in the course of carrying on their business.
The report must include the information your knowledge or suspicion is based on and any information you hold that identifies the person. If the person is your client, you must also state the nature and amount of any funds or economic resources you hold for them. Reports go through OFSI's online reporting forms. OFSI asks you to quote the person's UK Sanctions List "Unique ID".
The rule says "a person", not only your customer. A sanctioned supplier you see while doing a client's books is likely to be information received in the course of your business.
What happens if a firm does not report?
OFSI's guidance says a relevant firm that fails to comply with its reporting obligations "will be committing an offence, which may result in a criminal prosecution or a monetary penalty".
Under the Russia Regulations, the failure to report is an offence under regulation 70(6). Regulation 80(4) sets the maximum on summary conviction at 6 months' imprisonment or a fine, or both, in each part of the UK. OFSI's guidance adds that since 15 November 2023 it can also impose civil monetary penalties for reporting and information offences.
Breaching the sanctions themselves is treated more harshly. OFSI's civil penalty can reach £1 million or 50% of the breach value, whichever is greater. For breaches on or after 15 June 2022, OFSI's enforcement guidance says it no longer has to show the person knew or suspected a breach before imposing a penalty.
Has OFSI published guidance for accountants specifically?
Not as of October 2026. OFSI's sector threat assessments cover financial services, legal services, property, cryptoassets, and art and high value goods. The February 2025 financial services assessment does say relevant firms include "providers of related professional services, such as accountancy service providers or auditors".
How do sanctions checks fit with the Money Laundering Regulations?
They are two separate regimes that ask for much of the same information.
The Money Laundering Regulations 2017 apply to "auditors, insolvency practitioners, external accountants and tax advisers" under regulation 8. An external accountant is "a firm or sole practitioner who by way of business provides accountancy services to other persons". Regulation 28 requires you to identify and verify the client, understand the ownership and control of a company client, and identify its beneficial owners. Regulation 40 requires you to keep those records for five years after the relationship ends.
Your AML supervisor is your professional body if it is listed in Schedule 1, such as ICAEW, ACCA or the Institute of Certified Bookkeepers. HMRC supervises accountants and tax advisers who are not supervised by one of those bodies. The Office for Professional Body Anti-Money Laundering Supervision (OPBAS), housed in the FCA, supervises the 25 professional body supervisors.
That structure is due to change. In October 2025 the government decided that the FCA will take over AML supervision of legal, accountancy and trust and company service providers. Until that happens, your professional body remains your supervisor.
The sanctions duty sits outside this structure. Your MLR supervisor checks your AML controls, but reports of designated persons go to OFSI. Run the sanctions check at onboarding alongside identity checks, because both use the same names, owners and controllers.
Can a UK accountant work for a client connected with Russia?
Usually not. Regulation 54C of the Russia Regulations bans providing accounting services, directly or indirectly, to "a person connected with Russia". Auditing, business and management consulting, and several other professional services are banned too. The accounting ban started on 21 July 2022.
The Department for Business and Trade's guidance on professional and business services says a person connected with Russia includes a company incorporated or constituted under Russian law, or domiciled in Russia. That covers a Russian subsidiary of a UK company. It also includes individuals who are ordinarily resident or located in Russia.
The main exception for accountants is in regulation 60DA(1). The ban is not breached where the services relate to "the discharge of or compliance with UK statutory or regulatory obligations, such obligations not arising under contract". DBT says that if you use an exception, you must notify the Office of Trade Sanctions Implementation (OTSI). Otherwise you need a licence.
Regulation 54C gives a defence if you "did not know and had no reasonable cause to suspect" the client was connected with Russia. Recording the client's country of incorporation and residence at onboarding is how you show that.
What do OFAC rules mean for US CPA firms?
A CPA firm is bound by OFAC rules because it is a US person. OFAC's FAQ 11 says all US persons must comply, including US citizens and permanent residents wherever they are, everyone in the US, and US-incorporated entities and their foreign branches. OFAC's sanctions lists apply to the firm's own clients, staff and suppliers like any other business.
The Russia accounting services ban
On 8 May 2022 OFAC issued a determination under Executive Order 14071. It prohibits:
the exportation, reexportation, sale, or supply, directly or indirectly, from the United States, or by a United States person, wherever located, of accounting, trust and corporate formation, or management consulting services to any person located in the Russian Federation.
It took effect on 7 June 2022. It excludes services to an entity in Russia owned or controlled by a US person, and services for the wind down or divestiture of an entity in Russia not owned or controlled by a Russian person. OFAC's FAQ 1068 confirms that accounting services include tax preparation and filing. OFAC has also published a general license authorising certain accounting services to US individuals located in Russia.
FAQ 1059 draws the line on subsidiaries. Tax work for the US subsidiary of a Russian company is not prohibited, provided the subsidiary has its own US operations and the services are not passed on to the Russian parent.
Reporting and records in the US
OFAC's reporting rule follows the property. Under 31 CFR 501.603, any US person holding blocked property must report it within 10 business days. Primary responsibility rests with "the actual holder", although "an attorney, agent, or other person" may file on their behalf. A CPA who never holds the client's funds is usually not the holder. A firm that runs bill pay or a client trust account might be.
31 CFR 501.601 requires records of transactions subject to OFAC rules to be kept for at least 10 years.
What changed for Australian accountants in 2026?
Australia's anti-money laundering reforms, often called tranche 2, now cover accountants. AUSTRAC's reforms page says businesses providing the new designated services "will be regulated by us from 1 July 2026". That date has passed. The obligations are in force.
Regulation depends on the service, so not every accountant is caught. AUSTRAC's list of professional designated services includes:
- assisting with a transaction to buy, sell or transfer real estate, a company or a legal arrangement
- receiving, holding or managing a person's property to help with a transaction
- equity or debt financing for a company or legal arrangement
- creating or restructuring a company or legal arrangement, or selling a shelf company
- acting as, or arranging, a director, secretary or nominee shareholder
- providing a registered office or principal place of business address
A firm providing any of these must enrol with AUSTRAC. AUSTRAC's targeted financial sanctions guidance says that before providing a designated service you must establish on reasonable grounds whether the customer, its beneficial owners, and anyone acting for or on behalf of the customer is designated. You must also check whether any of them become designated during the relationship.
The sanctions offences themselves sit with the Department of Foreign Affairs and Trade (DFAT). Its Guidance Note on Sanctions Compliance for Accountants, updated 28 July 2026, sets the penalties:
- Individuals: up to 10 years in prison and a fine of up to AUD 910,000 or three times the transaction value, whichever is greater.
- Bodies corporate: up to AUD 3.64 million or three times the transaction value, whichever is greater.
DFAT says the offences are strict liability for a body corporate. A company has a defence if it "took reasonable precautions, and exercised due diligence". If you hold an asset you believe is controlled by a designated person, DFAT says you must tell the Australian Federal Police and should report it to the Australian Sanctions Office. Reporting entities should also consider a suspicious matter report to AUSTRAC. Our guide to Australia's Consolidated List covers how to search it.
Obligations by country at a glance
| UK | US | Australia | |
|---|---|---|---|
| Who sets the rules | OFSI (HM Treasury) and FCDO lists | OFAC (US Treasury) | DFAT's Australian Sanctions Office; AUSTRAC for AML |
| Is an accounting firm a reporting firm? | Yes, a relevant firm | No accountant-specific category | Yes, if it provides designated services (from 1 July 2026) |
| Reporting trigger | Knowledge or reasonable suspicion, learned in the course of business | Holding blocked property | Holding a controlled asset; suspicious matters |
| Deadline | As soon as practicable | 10 business days | As soon as practicable to the AFP, per AUSTRAC |
| Russia accounting ban | Regulation 54C, since 21 July 2022 | EO 14071 determination, since 7 June 2022 | Check the relevant DFAT framework |
| Record period | MLR: 5 years after the relationship ends | 10 years | Check AUSTRAC record-keeping rules |
How should an accounting firm screen its clients and suppliers?
Give sanctions screening one owner in the firm, usually your MLRO or compliance partner.
Which lists to screen
- UK firms: the UK Sanctions List. The FCDO says it "is now the only source for all UK sanctions designations", since the OFSI Consolidated List closed on 28 January 2026.
- US firms, or UK firms with US clients: OFAC's SDN list and its other lists.
- Australian firms: DFAT's Consolidated List.
What to screen at onboarding
- The client's legal name and any trading names.
- For a company: directors, people with significant control and other beneficial owners.
- For a trust: trustees, settlors and beneficiaries. DFAT's accountants note names trust beneficiaries specifically.
- Anyone acting for the client, such as an agent or signatory.
- Country of incorporation and residence, for the Russia service bans.
Remember ownership. OFSI says an asset freeze can reach entities owned or controlled by a designated person even when they are not on the list.
When to rescreen
Lists change without a schedule. Rescreen the whole client book when a list you rely on changes. Rescreen a client before any engagement that moves money or changes ownership. Also rescreen when the client's directors or owners change.
Screening your own suppliers
The firm also pays software vendors, contractors and landlords. Those payments carry the same asset-freeze risk as any business's. Our guide to sanctions compliance for small businesses covers this side.
What should you do when a client's vendor matches a sanctions list?
To check a client's contacts, follow our guides for Xero contacts and QuickBooks vendors. Most hits are false positives. Compare the full list entry against the address, date of birth, registration number and nationality you hold before calling anything a match.
If the match holds up, the work divides like this.
| Step | The client | The accounting firm |
|---|---|---|
| Stop the payment | Must not pay or deal with the designated person | Must not process the payment if it runs bill pay or a client account |
| Decide what to do with the relationship | The client's decision | Advise, but do not make the decision for the client |
| Report (UK) | Should report a suspected breach to OFSI if a payment has already gone out | Must report to OFSI as a relevant firm, as soon as practicable |
| Report (US) | Reports blocked property within 10 business days if it holds it | Reports only if the firm itself holds the blocked property, or files as the client's agent |
| Report (Australia) | Tells the AFP if it holds a controlled asset | If AUSTRAC-regulated: suspicious matter report; tells the AFP if it holds a controlled asset |
| Records | Keeps its own records of the decision | Records the check, the evidence and the report on the client file |
How should you document sanctions checks for each client?
Keep one record per client file. For each check, record:
- the date and time
- the names you searched, including owners and controllers
- the lists searched and the date each list was last updated
- the results, including the false positives and why you cleared them
- who reviewed the result
- any report made, with its date and reference
Keep the records for the longest period that applies to you. That means at least five years after the relationship ends under the UK Money Laundering Regulations, and at least 10 years for transactions under OFAC rules.
Doing this by hand across dozens of client files is slow. Sanctions Clear, opening to QuickBooks Online and Xero users, will screen vendors and customers against eight sources, including OFAC, UK, EU, UN and Australia's list, note each result on the contact and log who cleared each possible match. An accountant plan priced per client file, with one dashboard across all clients, is planned but not live yet.
This guide is general information and not legal advice. If you find a likely match or are unsure whether a service is caught, speak to a sanctions lawyer or your professional body.
