Crypto sanctions screening means checking a wallet address, and the history of the funds behind it, against government sanctions lists before you credit a deposit, release a withdrawal or settle an OTC trade. In practice that has two layers: an exact lookup of the address against lists such as the Specially Designated Nationals and Blocked Persons List (SDN List) published by the U.S. Treasury’s Office of Foreign Assets Control (OFAC), and an exposure check that traces whether the funds reached the address from sanctioned wallets. This guide sets out a workflow for exchanges, OTC desks and compliance teams. It is operational guidance, not legal advice; your obligations depend on your jurisdiction and should be confirmed with qualified counsel.
What crypto sanctions screening checks
OFAC’s virtual currency FAQs state that sanctions compliance obligations are the same whether a transaction is denominated in digital currency or in fiat. U.S. persons must block the property of listed persons and must not transact with them, and blocking also extends to entities owned 50 percent or more, directly or indirectly, in the aggregate, by blocked persons. OFAC expects businesses in the sector, including exchangers and payment processors, to run a tailored, risk-based compliance program that generally includes sanctions list screening, and notes that no single solution fits every circumstance.
When OFAC designates a party, it may add known digital currency addresses to that party’s SDN entry. Each address sits in its own field labelled “Digital Currency Address” followed by the currency symbol, for example XBT for bitcoin or ETH for ether, and then the full address. Three points from the official FAQs shape any screening process:
- The list is not exhaustive. OFAC says its address listings are “not likely to be exhaustive”. A clean list check does not prove that a counterparty is unconnected to a designated party.
- Address search is exact-match. In the Sanctions List Search tool, addresses go in the ID # field, which, according to FAQ 594, does not use fuzzy logic. One wrong character returns no match.
- Lists change without a fixed schedule. Designations appear on OFAC’s Recent Actions page as they are made, and the lists are also offered as downloadable files for automated screening. Screening data has to be refreshed continuously, not downloaded once.
OFAC is the most searched list, but not the only one. The EU, the UK and other jurisdictions run their own regimes, and their designations do not always match OFAC’s in timing or scope. A recent case shows both points.
| Item | Detail (per Treasury and OFAC) |
|---|---|
| Date | September 9, 2026 (Treasury press release) |
| Designated | Xinbi Guarantee, a Chinese-language online marketplace described as a transnational criminal organization; Cambodia-based Anwen Technology Co., Ltd (XinbiPay/NewPay wallet); Singapore-based SafeW Technology Co., Ltd (SafeW messaging app) |
| Authority | E.O. 13581, as amended by E.O. 13863; in furtherance of E.O. 14390 of March 6, 2026 |
| Reported volume | Equivalent of over $24 billion in digital assets and fiat processed since around 2022 |
| Crypto identifiers | 52 addresses with the TRX (TRON) symbol in the Xinbi Guarantee entry (OFAC Recent Action) |
| Other jurisdictions | The UK sanctioned Xinbi on March 26, 2026, about six months earlier |
From that day, those 52 TRON addresses produce a direct match in any process built on the SDN List, and wallets that received funds from them may carry indirect exposure. Readers dealing with Iran-linked flows should also see our analysis of OFAC sanctions and Iranian crypto wallets.
Direct vs indirect exposure to sanctioned addresses
A list match and an exposure finding are different signals and should lead to different decisions.
| Direct exposure | Indirect exposure | |
|---|---|---|
| Definition | The address is on a sanctions list, or transacted directly with a listed address | Funds reached the address from a listed address through one or more intermediate hops |
| How it is found | Exact list lookup or a single-hop transaction check | Multi-hop tracing of the source of funds |
| Typical significance | Highest risk; for U.S. persons a listed address indicates blocked property | Depends on the share of funds, the number of hops and how recent the flow is |
Indirect exposure is common and does not by itself mean that a wallet belongs to a sanctioned party, because funds pass through exchanges and other intermediaries. Our article on direct vs indirect risk in on-chain analysis explains how hop distance and proportion of funds are weighed.
Screening before you credit a deposit: a practical workflow
For a platform, the point of control is the moment between a deposit being detected on-chain and the balance being credited to the customer. Once the balance is credited and withdrawable, the options narrow. A workable sequence:
- Hold new deposits as pending. Crediting should follow the screening result, not confirmations alone.
- Identify the address to screen. The deposit address is yours; the counterparty is the sending address, and on account-based networks such as TRON it is usually visible in the transaction. Copy it exactly and confirm the network.
- Run the list check. Match the sending address against current sanctions data. A direct match stops the process and goes to your compliance owner.
- Check exposure and freeze status. Trace where the funds came from over several hops, including sanctioned addresses, mixers, scams and stolen funds, and for USDT check whether the address is frozen by the issuer, which can happen independently of any sanctions designation.
- Apply your written risk policy. Decide in advance which outcomes are credited automatically, which go to manual review and which are rejected or escalated. Thresholds are a business and legal decision, not something a tool should set for you.
- Record the decision. Keep the date, transaction hash, address, network, screening result, the reviewer and the reason for the outcome. A screening report or PDF attached to the case file makes later audits easier.
- Re-screen returning counterparties. Lists change, so an address that was clean last month may not be clean today.
SafeON covers steps 3 and 4 for a single address: it screens wallets on TRON (TRC20) and BNB Smart Chain and returns a 0-100 risk score with the reasons, including exposure to OFAC-sanctioned addresses, USDT freeze and blacklist status (freeze status also on Ethereum) and multi-hop source-of-funds tracing. The AML wallet check page shows how risk and freeze status are reported together. For background on the method, see what crypto wallet screening is.
Screening at scale with an API
Manual checks suit an OTC desk with a few trades a day, not an exchange crediting deposits around the clock. At volume, screening belongs inside the deposit pipeline: the deposit monitor calls a screening API when a transaction is detected, stores the response with the transaction record and routes the deposit to auto-credit, review or hold according to policy. SafeON offers an API for businesses for this purpose. Wallets you deal with repeatedly, such as OTC counterparties or treasury addresses, can also be added to a watchlist with alerts, including via Telegram, so that a change in risk is visible without re-running checks by hand.
What to do when an address is flagged
If the sending address is a direct match on the SDN List, do not credit the funds and escalate immediately. OFAC’s FAQs say that a U.S. person who blocks virtual currency must report it to OFAC within 10 business days and then file annual reports while it remains blocked, under 31 C.F.R. 501.603. The same FAQs note that an institution may tell a customer it has blocked digital currency, and that the customer may apply to OFAC for release. How these rules apply to your business is a question for sanctions counsel.
If the finding is indirect exposure, the response depends on its size, distance and recency: ask the customer about the source of funds, hold or decline the deposit if the explanation is weak, and document the reasoning either way. A screening report supports that decision; it cannot release, unfreeze or recover funds, and SafeON does none of these.
Limits of screening and when to ask a lawyer
Screening reduces risk; it does not remove it. Address lists are incomplete by OFAC’s own statement, exposure scores depend on how well addresses are attributed, and other regimes may designate parties OFAC has not. Nor does screening identify your customer; that is the job of KYC. Speak to a lawyer before you set risk thresholds, when you receive a direct match, when you may be holding blocked property, and whenever you operate across jurisdictions with different sanctions regimes.
Check a wallet’s risk on SafeON
FAQ
How do I check if a crypto wallet is sanctioned?
Search the exact address in the ID # field of OFAC’s Sanctions List Search, which returns only exact matches. Because OFAC’s address listings are not exhaustive, also check the wallet’s exposure to sanctioned addresses through on-chain tracing, which tools such as SafeON’s wallet screening provide.
Should we screen every incoming deposit address?
OFAC expects a risk-based program that generally includes list screening, and there is no single program that fits every business. Some platforms screen every deposit automatically because a missed direct match is costly; how far you go should be set in your written policy with legal input.
Is indirect exposure to a sanctioned address a problem?
Not automatically. Funds move through exchanges and other intermediaries, so small, distant exposure is common. Large, recent or close-range exposure deserves review, a source-of-funds question to the customer and a documented decision.
Does sanctions screening replace legal compliance advice?
No. Screening produces evidence for a decision; it does not tell you what the law requires of your business. Confirm your obligations, thresholds and reporting duties with qualified sanctions counsel.