Sanctions compliance is the one obligation in crypto where the regulator does not care about your intent. OFAC administers a strict-liability regime: if your platform processes a transaction for a sanctioned person, entity, or address, you have a violation, whether or not you knew and whether or not you profited. That is why crypto sanctions screening tools occupy a different place in the stack than the rest of the compliance program — they are the control that has to work in real time, on every transaction, with no analyst in the loop, because by the time a human reads an alert the funds have already moved.
Image: Chainalysis — a counterparty risk panel flagging an exchange address as severe based on indirect sanctions exposure, the trigger condition a screening tool evaluates before funds credit.
This guide covers what screening tools actually check, the four ways firms deploy them, the threshold decisions that separate a defensible program from a checkbox, and what the Tornado Cash episode — designation, litigation, and delisting — taught every compliance team about building for a sanctions list that changes under their feet.
Quick solution
If you need the short version: put a screening API call in the synchronous path of every deposit, withdrawal, and onboarding event, so a verdict comes back before value moves. Configure direct exposure to any SDN-listed address to auto-block, freeze, and route to your sanctions officer for an OFAC blocking report within the regulatory deadline. Set documented thresholds for indirect exposure — most programs open a review case above a stated percentage of value traceable to sanctioned services within a set number of hops — and rescreen your existing customer base every time OFAC updates the SDN list, because designations are retroactive to your book, not just to new activity. If you already run crypto AML compliance software, sanctions screening is usually a module inside it; the work is configuring thresholds and update latency, not buying another product.
A sanctions screening tool for crypto answers one question fast: does this address, or the funds behind it, connect to a sanctioned party? Answering it requires three layers of data working together.
The first layer is the list itself. OFAC began adding digital-currency addresses to SDN entries in 2018, and the set has grown to cover thousands of addresses tied to designated exchanges, mixers, ransomware operators, darknet markets, and state-linked hacking groups. A bare list-lookup tool checks the address you give it against those published identifiers. That is necessary and nowhere near sufficient, because designated actors rotate addresses constantly and OFAC publishes only the addresses it knows.
The second layer is attribution and clustering — the entity data that extends each listed address to the full wallet infrastructure the sanctioned actor controls. When OFAC designates an exchange, analytics vendors map the exchange's cluster: thousands or millions of addresses behaving as one service. A screening verdict built on clustering catches the deposit address the sanctioned exchange generated yesterday, not just the ones printed in the Federal Register. This is the same data layer described in our guide to blockchain analytics for compliance, consumed here at machine speed.
The third layer is exposure computation. Sanctioned actors do not send funds to your platform directly; they route through intermediaries. Exposure math traces incoming value backward and reports what fraction touched sanctioned services and at how many hops, which turns "this address is not on the list" into "this address is two hops and 40 percent of value from one that is."
Image: Chainalysis — an address screening profile alongside the raw API response a platform consumes, returning a severe verdict with risk reason before funds credit.
The four ways firms deploy screening
Deployment shape matters as much as data quality, because the same verdict arriving at different moments produces different legal outcomes. A verdict before credit prevents a violation; a verdict after settlement documents one.
Because no single public comparison lays the deployment approaches side by side, we compiled one from OFAC guidance, vendor documentation, and the architectures we see across exchanges and fintechs:
| Approach | When the check runs | Catches | Misses | Typical use |
|---|---|---|---|---|
| Real-time API (synchronous) | Before deposit credits or withdrawal signs | Direct and indirect exposure pre-settlement | Nothing structural; costs latency budget | Exchanges, custodians, payment processors |
| Batch rescreening | On SDN updates and on a schedule | New designations against the existing book | Nothing between runs if scheduled tightly | Everyone, layered under real-time |
| On-chain oracle | Smart contract queries a sanctions oracle | Sanctioned addresses at the protocol layer | Indirect exposure; oracle staleness | DeFi front ends, protocol teams |
| Manual list lookup | Analyst checks during review | Direct SDN matches only | Clustered addresses, all indirect exposure | Small firms pre-tooling; not defensible alone |
The pattern that passes examinations is the first two together: a synchronous API gate on every value movement, plus batch rescreening of the full customer base within hours of every SDN update. The batch layer is the one firms skip and regret. When OFAC designated Garantex in April 2022, the customers who mattered were the ones who had already deposited from Garantex-linked addresses months earlier — only a rescreen of settled history surfaces them, and only a documented freeze-and-report process turns that surfacing into compliance.
Every screening tool ships with configurable risk rules, and the configuration is the program. An examiner's first request is not "show me the tool" but "show me the thresholds and who approved them."
Direct exposure is the easy case: any confirmed transfer to or from an SDN-listed or cluster-attributed sanctioned address should block automatically. There is no risk-based discretion on strict liability.
Indirect exposure is where judgment lives. A program must state, in writing, what it does at each severity: for example, block and review above 10 percent of received value traceable to sanctioned services within two hops; open a case above 1 percent; log below that. The right numbers depend on your business mix — a retail exchange sees far more incidental low-percentage exposure than a custody firm serving institutions — but the wrong answer everywhere is an undocumented default you cannot explain.
Image: Chainalysis — per-category exposure thresholds configured in a screening tool; the documented version of these numbers is what an examiner asks for.
Two configuration details separate mature programs from defaults. First, category granularity: ransomware and sanctioned-mixer exposure warrant tighter thresholds than gambling or high-risk-exchange exposure, and a single global number wastes analyst time on noise while under-weighting the categories that carry OFAC risk. Second, update latency: your vendor's time from OFAC publication to scored data, and your platform's time from scored data to enforced rule, should both be measured and minuted. In the hours after the Tornado Cash designation in August 2022, that latency was the difference between platforms that blocked cleanly and platforms that processed transactions against newly listed contract addresses.
More in Guides
What Tornado Cash taught everyone
The Tornado Cash saga is worth studying because it stress-tested every part of the screening stack in public.
OFAC designated the mixer's smart contract addresses on August 8, 2022 — the first time immutable contracts, rather than a person or a custodial service, went on the SDN list. Screening tools had to propagate dozens of contract addresses within hours, and platforms discovered which of their vendors updated in near real time and which updated on a daily batch. The designation also produced the "dusting" episode, in which pranksters sent small amounts of ETH from the sanctioned contracts to celebrity wallets — instantly teaching every compliance team the difference between exposure a customer chose and exposure inflicted on them, and why blocking rules need a received-versus-sent distinction and a de-minimis review path.
Image: Chainalysis — composition of funds received by Tornado Cash before its designation; the sanctioned-source and stolen-funds shares are what made the mixer an OFAC target.
Then the law moved. In Van Loon v. Department of the Treasury, the Fifth Circuit held on November 26, 2024 that Tornado Cash's immutable smart contracts were not "property" that OFAC could designate under its existing authorities, and OFAC removed the contracts from the SDN list on March 21, 2025. For screening programs the lesson cut both ways: lists shrink as well as grow, delistings must propagate as fast as designations (blocking a delisted counterparty creates its own legal and customer harm), and the underlying risk did not vanish with the listing — funds from the Lazarus Group's Ronin Bridge exploit had moved through Tornado Cash while it was listed, and mixer exposure remains a risk signal your monitoring rules weigh regardless of SDN status.
Image: Chainalysis — the traced path from the Ronin Bridge exploit through Lazarus Group wallets into Tornado Cash, the fund flow that preceded the 2022 designation.
A screening verdict is the start of a workflow, not the end of one, and examiners spend as much time on what happens after the hit as on the hit itself. A defensible escalation path has four stations, each with an owner and a clock.
First comes triage. An analyst confirms the match is real: direct SDN exposure is rarely a false positive, but indirect-exposure alerts need a quick look at the path — how many hops, what fraction of value, whether the intermediary is a major exchange whose commingled flows make percentage math misleading. Most programs give triage a same-business-day deadline for severe alerts because the freeze decision cannot wait for a weekly queue.
Second comes the investigation. For anything that survives triage, an investigator traces the flow in a graph tool, documents the path from the sanctioned source to the customer's deposit, and captures the evidence — screenshots, transaction hashes, cluster attributions — into the case file. On larger teams this is collaborative work: sanctions officers, investigators, and sometimes outside counsel annotating the same case rather than forwarding spreadsheets, because the case file is what gets produced to OFAC or an examiner later.
Image: Chainalysis — investigators annotating a shared trace inside Reactor; the collaborative case file is what a blocking-report decision ultimately rests on.
Third comes the decision: block and report, exit and file a SAR, or clear with a documented rationale. The rationale matters as much as the outcome — "cleared because exposure was one-hop through a regulated exchange's hot wallet" survives review; "cleared" alone does not.
Fourth comes the filing. Blocked property triggers an OFAC blocking report within ten business days and an annual report of blocked property each September. Suspicious activity that does not rise to blocking may still trigger a SAR under BSA rules, which runs on its own thirty-day clock through transaction monitoring workflows rather than the sanctions channel.
Common mistakes that turn into violations
- Screening deposits but not withdrawals. Sending value to a sanctioned address is a violation on the same strict-liability terms as receiving it. Withdrawal destinations need the same synchronous gate, and address-book entries saved before a designation need rescreening.
- No rescreen on SDN updates. A customer who was clean at onboarding and is designated on Tuesday is a blocked person on Tuesday. Programs without an automated rescreen-and-freeze loop find the relationship in next quarter's lookback, which is a self-disclosure conversation instead of a blocking report.
- Treating the alert queue as the control. If a severe-exposure deposit credits first and alerts second, the tool is documenting violations, not preventing them. The screening verdict has to gate settlement, which is an engineering commitment, not a compliance memo.
- Ignoring counterparty VASP screening. Your travel rule counterparties are themselves screenable entities. A travel rule compliance solution exchanging originator data with a sanctioned or unlicensed exchange is exposure your sanctions program owns, not just a messaging problem.
"We are a US exchange with an existing analytics contract" — this team turns on its vendor's screening module rather than buying separately, wires the synchronous check into deposit and withdrawal flows with a latency budget the trading team signs off on, and spends its real effort on the rescreen loop: SDN update detected, book rescreened, hits frozen, blocking reports filed within ten business days, all logged end to end.
"We are a DeFi front end with no custody" — this team screens at the interface layer, blocking SDN-listed and severely exposed addresses from connecting, and evaluates an on-chain oracle for the protocol layer while documenting honestly what an oracle cannot see: indirect exposure and same-block designation lag. Post-Van Loon, counsel reviews which addresses belong on the front-end blocklist at all, because over-blocking has its own legal posture now.
"We are a fintech offering crypto through a partner" — this team gets the partner's screening thresholds, update latency, and freeze procedure in writing, tests them with a benign known-exposure address at onboarding, and keeps independent read access to screening verdicts for its own customers, because OFAC liability does not outsource even when operations do.
Frequently asked questions
What happens when a screening tool flags a deposit as sanctioned?
The platform freezes the funds rather than returning them — rejecting a blocked transaction back to a sanctioned party is itself prohibited — files a blocking report with OFAC within ten business days, and holds the property in a blocked, interest-bearing account. The customer relationship then goes through review: dusting victims and incidental indirect exposure get released paths; genuine sanctioned-nexus accounts get exited and reported.
Do sanctions screening tools work for DeFi and self-hosted wallets?
They screen the address, not the account holder, so they work anywhere an address is known: DeFi front ends screen connecting wallets, protocols can query on-chain oracles, and platforms screen self-hosted withdrawal destinations. What changes is remediation — with no custodian there may be nothing to freeze, so the control becomes refusing the interaction rather than blocking the property.
How fast do new OFAC designations show up in screening verdicts?
Leading vendors propagate SDN updates to scored data within minutes to hours, including cluster expansion beyond the literal listed addresses. Your obligation runs from the designation's effective time, not from your vendor's refresh, so the propagation SLA belongs in your vendor contract and your update latency belongs in your compliance metrics.
Is indirect exposure to a sanctioned entity actually a violation?
Not automatically. The violation is transacting with a blocked person or property; receiving funds that passed through a sanctioned service several hops upstream is a risk signal, not a per-se breach. OFAC's 2021 guidance for the virtual currency industry expects a risk-based program that detects and evaluates that exposure — which is why documented indirect thresholds, rather than block-everything or ignore-everything, are the defensible middle.
Do we still need mixer screening now that Tornado Cash is off the SDN list?
Yes. The delisting removed the strict-liability trigger for those specific contract addresses; it did not make mixed funds clean. Mixer exposure remains a core money-laundering risk signal under BSA monitoring obligations, and other mixers — including custodial services like Blender and Sinbad — were designated as entities and remain listed. Screening categories and monitoring rules treat mixer proximity as high-risk regardless of any single service's SDN status.
Sources
- U.S. Department of the Treasury, OFAC — "Sanctions Compliance Guidance for the Virtual Currency Industry," published October 15, 2021.
- U.S. Department of the Treasury, OFAC — designation of Tornado Cash, announced August 8, 2022; removal from the SDN list announced March 21, 2025.
- U.S. Court of Appeals for the Fifth Circuit — Van Loon v. Department of the Treasury, decided November 26, 2024.
