The free OFAC checker on our homepage lets you paste any crypto address and get an instant sanctions result — no account, no API key, no credit card. If you're a compliance officer who needs to run a one-off check, a developer evaluating the API, or someone who just read about Tornado Cash and wants to understand what a "sanctioned address" actually looks like in practice, this tool is for you.
This article explains how the checker works, what the results mean, and how to know when you've outgrown it.
OFAC — the Office of Foreign Assets Control — is the U.S. Treasury bureau that enforces economic sanctions. Its primary tool is the Specially Designated Nationals (SDN) list: a list of individuals, entities, and, increasingly, cryptocurrency addresses that U.S. persons and U.S.-connected businesses are prohibited from transacting with.
Crypto enforcement ramped up significantly after OFAC's 2022 action against Tornado Cash, the Ethereum mixing protocol, which was the first time OFAC designated a smart contract address rather than a named individual. That action was upheld (with some modifications) on appeal in 2025, and it sent a clear message: crypto businesses have real sanctions exposure, and OFAC is willing to use novel legal theories to enforce it.
Today, OFAC publishes over 780 sanctioned crypto addresses across 14 blockchains — Bitcoin, Ethereum, Tron, and others. The list changes regularly. Garantex, the Russia-based exchange, had addresses added in 2022. New mixer addresses appear periodically. The SDN list is a living document, not a static blocklist.
If your business touches crypto — exchange, OTC desk, DeFi protocol, payment processor, payroll system — and has any U.S. nexus, you're expected to check.
Go to the homepage and you'll see the checker in the hero section. You paste an address, select the blockchain, and click Check. Results appear in under a second.
Under the hood, the checker queries our database, which we refresh directly from the official OFAC sanctions XML feed every two hours. Each ingestion run validates the data before promoting it to live — we won't silently serve stale data if a download fails.
The checker supports nine chains: Ethereum, Bitcoin, Tron, Polygon, Arbitrum, Base, Optimism, BNB Chain, and Solana.
CLEAN — No Match: The address is not in the OFAC SDN list. This is the result you want. Note what it doesn't mean: it doesn't mean the address has a clean history, it doesn't cover EU/UK sanctions lists, and it's only valid as of the moment you checked.
LOW / MEDIUM: These risk levels are used in the paid API tier for non-sanctions risk signals (community threat intelligence, high-risk entity labels). The free checker is OFAC-only, so you won't see these.
HIGH / CRITICAL: The address matched an SDN entry. CRITICAL means the address is directly listed as a sanctioned crypto address. HIGH means it's associated with a high-risk entity through our scoring system. If you see CRITICAL on a real transaction, stop. Don't process it. Escalate to your compliance team.
A CRITICAL result on the free checker shows you the program name (e.g., "IRAN", "CYBER2") and the label ("sanctions"). That's enough to know you have a problem. The paid API returns the full entity name, when the address was added, and which specific SDN entry it came from.
If you want to verify the checker is working, use the Tornado Cash router address: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c on Ethereum. This was designated by OFAC in August 2022. It should return CRITICAL every time.
A clean ETH address to contrast: 0x742d35Cc6634C0532925a3b8D4C9E2e0E8B21f3. This has no SDN listing and should return CLEAN.
Be honest about what this tool can and can't do.
OFAC SDN only. The free checker doesn't check the EU Consolidated List, UK FCDO list, or other jurisdictions' sanctions lists. If your business is regulated in Europe, or if you interact with UK-regulated entities, the SDN list alone isn't sufficient. OFAC SDN covers U.S. sanctions; EU and UK lists cover those jurisdictions' designations, and there's meaningful divergence — Garantex appears on OFAC, EU, and UK lists, but other entities appear on only one.
10 checks per day per IP. This is a rate limit, not a quota. It resets daily. If you're doing more than 10 manual checks a day, you need the API.
No audit log. The free checker doesn't record your queries, which means you can't prove you checked. For compliance purposes, you need a record: who checked what address, when, and what the result was. The paid API logs every request to your usage dashboard.
No batch screening. You can't paste 500 addresses and get a CSV back. That requires the API's batch endpoint, which accepts up to 100 addresses per request.
Not suitable for automated workflows. If you're checking addresses programmatically — at user onboarding, before processing a withdrawal, in a nightly re-screening job — you need an API key, not a browser tool.
Not legal advice. This tool checks government-published sanctions lists. It does not tell you whether a specific transaction is legal in your jurisdiction, does not account for the "50% rule" (where entities majority-owned by SDN-listed parties are also blocked even if not explicitly listed), and does not substitute for a compliance program.
Manual one-off checks are legitimate in a few scenarios:
If you're doing more than a few checks a week, or if your checks are part of any operational process, you need the API.
These use cases require the paid API:
Exchange onboarding. You need to check every deposit address at account creation and every time a user adds a new withdrawal address. This is dozens to thousands of checks per day, needs an audit trail, and can't depend on a human manually running a browser tool.
Withdrawal processing. Before releasing funds to an external address, you screen it. At scale, this is a real-time API call in your transaction processing pipeline. A 400ms latency is acceptable; a human-in-the-loop process isn't.
DeFi front-end screening. You want to check wallet addresses before allowing interaction with your protocol. This is a server-side API call, not a browser widget.
Periodic re-screening. You have existing customers whose deposit addresses you need to re-check against updated lists. This is a batch job that runs nightly or weekly.
Multi-jurisdiction compliance. If you need EU and UK lists in addition to OFAC, you need the paid tier.
Once you have an API key from the dashboard, screening an address is straightforward:
from chainscreen import Client
client = Client(api_key="sk_live_your_key_here")
result = client.screen("0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c", chain="ethereum")
if not result.is_clean:
raise ValueError(f"Address is sanctioned: {result.risk_level}")Or in Node.js:
import { Client } from '@chainscreen/sdk'
const client = new Client({ apiKey: 'sk_live_your_key_here' })
const result = await client.screen('0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c', 'ethereum')
if (!result.isClean) {
throw new Error(`Address is sanctioned: ${result.riskLevel}`)
}Or directly via curl:
curl -X POST https://anchorapi.dev/api/v1/screen \
-H "Authorization: Bearer sk_live_your_key_here" \
-H "Content-Type: application/json" \
-d '{"address":"0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c","chain":"ethereum"}'The response includes risk_level, risk_score (0–100), labels (what kind of risk), and _disclaimer reminding you this is informational only.
The free checker is on the homepage. Paste your address, select the chain, and you'll have a result in under a second.
If you need more than what the free tool offers — API access, multi-jurisdiction screening, audit logs, batch screening — see the pricing page. Starter is $99/month for 10,000 requests. There's no setup fee and no annual commitment required.
Results from this tool are informational only and do not constitute legal advice. You remain responsible for your own compliance obligations. This tool checks the OFAC SDN list only; it does not check EU, UK, or other sanctions lists.