Crypto sanctions screening connects wallet data to a legal and operational review. An address match is a signal rather than a complete decision, so the process must connect the address, asset, network, customer and transaction to the rules that apply to the business.

For US persons and firms subject to US jurisdiction, the Office of Foreign Assets Control says sanctions obligations apply to virtual currency just as they apply to fiat currency. OFAC also says there is no single compliance program suitable for every business. The process should be risk-based and tailored to the activity.

Start with jurisdiction and obligation

Before choosing a screening tool, identify:

  • where the business and customer are located;
  • which legal entities process the transaction;
  • which sanctions programs apply;
  • whether the business holds customer assets;
  • whether it can stop, block or reject a transaction;
  • who makes escalation and reporting decisions.

This article explains OFAC’s published virtual-currency guidance. It does not determine the obligations of a particular business or replace legal advice.

OFAC FAQ 560 says US persons and persons otherwise subject to OFAC jurisdiction must avoid unauthorized transactions with blocked persons or property. It recommends a tailored, risk-based program that generally includes sanctions-list screening and other appropriate measures.

Screen more than the customer name

A wallet transaction can contain several identifiers:

  • customer or beneficial-owner names;
  • counterparty names when known;
  • wallet addresses;
  • transaction hashes;
  • asset and network;
  • exchange, custodian or payment processor;
  • IP or location information lawfully collected by the business;
  • linked accounts and payment instructions.

OFAC can include digital-currency addresses as identifiers on the SDN List. The same FAQ collection warns that listed addresses are unlikely to be exhaustive. An exact address check can find a published identifier, but a non-match does not prove that the transaction is free of sanctions risk.

Screening should therefore combine list checks with the business’s customer due diligence, transaction context and risk rules.

Normalize the network and address

An address string is meaningful only with its network and asset context. Store the original value and a normalized form that follows the relevant network’s rules.

A screening record should include:

  • the full address;
  • network;
  • asset;
  • transaction hash;
  • direction;
  • timestamp;
  • screening-list version or retrieval time;
  • vendor or internal rule version;
  • match score and reason;
  • analyst decision;
  • evidence used;
  • final action.

Do not shorten an address in the evidence record. Two addresses can share the same first and last characters.

OFAC FAQ 563 explains that digital-currency addresses on the SDN List appear as identifiers tied to a currency symbol. FAQ 594 says the Sanctions List Search tool can query a digital-currency address through the ID field and uses exact, rather than fuzzy, matching for that field.

Understand what the tool actually checks

A vendor may provide several different signals:

  1. exact list match;
  2. address attributed to an entity;
  3. direct transaction exposure;
  4. indirect exposure through one or more hops;
  5. behavioral or typology alert;
  6. geographic or service-category risk.

These are not interchangeable. The business needs written thresholds and escalation rules for each type.

An “indirect exposure” label is not the same as an OFAC listing. A distance of two blockchain hops does not by itself establish ownership, control or a prohibited transaction. Conversely, an unlisted address can still be linked to a blocked person through other evidence.

Ask the vendor which lists, networks and address types it supports, how quickly updates are applied and how attribution changes are documented.

Screen at the right moments

A useful program can screen:

  • at onboarding;
  • when an address is first added;
  • before a withdrawal or payout;
  • when a deposit is detected;
  • before releasing goods or credit;
  • when a list update affects recent activity;
  • during periodic customer review.

The correct moment depends on whether the business can stop the transaction. A blockchain transfer may be irreversible after broadcast, so pre-transaction controls matter for outbound payments.

For inbound transfers, the business needs a documented process for restricting access, escalating and reporting when required. Do not improvise by returning funds to a sending address: that can create another prohibited transaction or send assets to the wrong controller.

Build an escalation record

An alert should move to a person with clear authority and a repeatable checklist.

The reviewer should ask:

  • Is the match exact or inferred?
  • Is the network correct?
  • Is the address currently listed?
  • Which person or entity is associated with it?
  • Does the 50 Percent Rule or another ownership rule matter?
  • What jurisdiction and sanctions program apply?
  • Is the transaction pending, completed or still reversible?
  • Must property be blocked or a transaction rejected?
  • Is a report or licence request required?
  • Who approved the decision?

OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry recommends controls that reflect a company’s risk profile. It discusses management commitment, risk assessment, internal controls, testing and auditing, and training.

Avoid two common failures

Treating a non-match as approval

A list is not a complete map of ownership and control. Address attribution changes, and OFAC says published digital-currency addresses are not likely to be exhaustive.

Treating every proximity alert as a violation

Blockchain analytics can identify flows and clusters, but legal decisions depend on the facts and applicable rules. A tool score should route a case; it should not silently replace the decision process.

Keep the vendor evidence and the analyst’s reasoning separate.

Preserve evidence and list versions

Sanctions lists and attribution data change. An audit record should show what the business knew when it made the decision.

Preserve:

  • the source list or version;
  • the tool response;
  • the address and network;
  • transaction data;
  • customer records relied on;
  • analyst notes;
  • approvals;
  • reports or licence correspondence where applicable;
  • later changes to the decision.

Access to this material should be limited because it can contain sensitive customer and investigation data.

Coordinate with Travel Rule data

For regulated virtual-asset transfers, information collected under Travel Rule requirements may help identify originators and beneficiaries. It does not replace sanctions screening.

Our explainer on the Travel Rule covers the information that can travel with a crypto transfer. Keep Travel Rule compliance, customer due diligence, fraud controls and sanctions decisions connected but distinct.