If you accept, send, or process cryptocurrency on behalf of customers, you have a sanctions screening obligation. This guide explains how wallet address screening works in practice, what tools exist, and how to decide which approach fits your business.
Sanctions laws prohibit transactions with designated individuals, entities, and jurisdictions. In crypto, the practical control point is the wallet address — a unique identifier tied to a party on the blockchain.
OFAC, the EU, and the UK all maintain lists of designated wallet addresses. If your business sends funds to or receives funds from a sanctioned address, you may be liable regardless of whether you knew the address was sanctioned. "We didn't check" is not a defense.
The good news: unlike KYC, wallet address screening is deterministic. You either match a list or you don't. It's a tractable technical problem.
There are four lists worth caring about:
OFAC SDN (US). The most comprehensive crypto list. OFAC has been actively designating crypto addresses since 2018 — Tornado Cash, Lazarus Group, ransomware operators, and Iranian exchanges have all had addresses added. As of mid-2026 there are roughly 780 designated crypto addresses.
EU Consolidated List. The EU sanctions list maintained by the European External Action Service. Smaller overlap with OFAC than you might expect — some entities appear on both, others on only one.
UK Financial Sanctions List. Post-Brexit, the UK maintains its own list via the Office of Financial Sanctions Implementation (OFSI). Partially overlaps with both OFAC and EU lists.
Community / threat intelligence lists. Not official sanctions, but useful — known scam addresses, high-risk exchange deposit addresses, mixer addresses. These don't carry legal weight but help identify counterparty risk.
If your business is regulated in the US only, OFAC SDN is your minimum. If you interact with EU or UK regulated entities, you need all three official lists.
OFAC publishes a search tool and the EU and UK publish their lists as downloadable files. You can check an address manually by searching these resources.
This works for occasional one-off checks. It doesn't work if you're processing more than a handful of transactions per day — it's slow, error-prone, and produces no audit trail.
You can download the official XML/CSV feeds, parse them, load them into a database, and query it. OFAC publishes their SDN list at a known URL and updates it regularly.
The engineering work is straightforward. The ongoing maintenance is not. You need to handle:
If you have the engineering bandwidth and want full control, this is a legitimate path. Budget two to four weeks of engineering time to do it properly, plus ongoing maintenance.
A screening API handles the data pipeline, normalization, and audit logging for you. You make a single API call with an address and chain, and get back a risk level and matched sources.
This is the right approach for most crypto businesses — the compliance value comes from the audit trail and multi-jurisdiction coverage, not from building the infrastructure yourself.
A typical request:
curl -X POST https://www.anchorapi.dev/api/v1/screen \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"address": "0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c", "chain": "ethereum"}'A typical response:
{
"address": "0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c",
"chain": "ethereum",
"level": "CRITICAL",
"score": 100,
"matched_sources": ["OFAC_SDN"],
"disclaimer": "Informational screening only..."
}The level field gives you a risk signal: CLEAN_NO_MATCH, LOW, MEDIUM, HIGH, or CRITICAL. A CRITICAL result means the address matched a sanctions list directly. Your compliance workflow should block or escalate any transaction involving a CRITICAL address.
A practical screening workflow for a crypto business:
Wallet address screening is one part of a crypto compliance program — not the whole thing.
KYC. Screening an address tells you whether that address is sanctioned. It doesn't tell you who controls it. KYC (identity verification) is a separate requirement.
Transaction monitoring. Sanctions screening checks the counterparty address. Transaction monitoring looks at the history and flow of funds — whether money came through a mixer, whether the pattern looks like structuring. These are different tools.
Travel Rule compliance. FATF's Travel Rule requires VASPs to share originator and beneficiary information on transfers above a threshold. Separate from screening.
Legal advice. Your compliance program design should involve a lawyer familiar with your jurisdiction and business model. This guide describes how the technology works, not what your specific legal obligations are.
The free OFAC checker lets you screen any address against the OFAC SDN list instantly — no account required. For multi-jurisdiction coverage with a full audit trail, see pricing.