diff --git a/TODO.md b/TODO.md
index a28072c..775bfab 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,7 +1,6 @@
 # TODO
 
 * access lists:
-  * disallow any activity until access list is loaded / load it at startup
   * test functionality
   * rename Allow to Require?
   * serde-rename AccessListTypes to lowercase
diff --git a/aquatic_udp/src/lib/lib.rs b/aquatic_udp/src/lib/lib.rs
index b44bb33..f7bc466 100644
--- a/aquatic_udp/src/lib/lib.rs
+++ b/aquatic_udp/src/lib/lib.rs
@@ -6,6 +6,7 @@ use std::thread::Builder;
 use std::time::Duration;
 
 use anyhow::Context;
+use aquatic_common::AccessListType;
 use crossbeam_channel::unbounded;
 use privdrop::PrivDrop;
 
@@ -23,6 +24,13 @@ pub const APP_NAME: &str = "aquatic_udp: UDP BitTorrent tracker";
 pub fn run(config: Config) -> ::anyhow::Result<()> {
     let state = State::default();
 
+    match config.access_list.list_type {
+        AccessListType::Allow | AccessListType::Deny => {
+            state.access_list.lock().update_from_path(&config.access_list.path)?;
+        },
+        AccessListType::Ignore => {},
+    }
+
     let num_bound_sockets = start_workers(config.clone(), state.clone())?;
 
     if config.privileges.drop_privileges {