How crypto sanctions screening works

Who publishes crypto addresses

OFAC, the UK Sanctions List and the EU publish addresses; other regimes mostly designate persons. OFAC itself says its list is not exhaustive.

OFAC (United States) adds digital-currency addresses to SDN entries as identifiers on Ethereum, Bitcoin, Tron, Solana and others, and its own FAQ states the list is not exhaustive: a designated person can control addresses that were never published. The UK Sanctions List (FCDO, which replaced the OFSI consolidated list on 28 January 2026) includes crypto addresses for some designations. The EU consolidated listpublishes them for a smaller set. Other regimes (UN, national lists) mostly designate persons, not addresses. KYTGate re-syncs OFAC, UK and EU at least every 6 hours, records the address count and a content hash of each snapshot, and keeps every snapshot so you can show which version applied to a decision.

Exact match versus risk score

A listed address drives BLOCK_PENDING_MLRO by itself. Matching must be chain-aware, and "no match" is reported as NO_KNOWN_MATCH rather than clean.

An address that equals a listed address is a match. There is no probability to discuss. That certainty is why an exact match drives a BLOCK_PENDING_MLRO decision in KYTGate's baseline policy instead of feeding into a score. Two consequences follow. First, the match must be case-normalised and chain-aware (an EVM address is the same on Ethereum, BSC, Base and Arbitrum, but a Tron address is not). Second, "no match" is reported as NO_KNOWN_MATCH and never as "clean", because the publisher itself says the list is incomplete.

KYTGate does report a 0–100 figure alongside the decision, so it is worth being precise about what that figure is. It is a sum over the signals that fired, using published weights. Every point is attributed to a named finding, and the figure can be recomputed from the receipt. An exact listing is kept out of that sum. It sets the figure to 100 and says so, because a fact shown as 94 invites somebody to set a threshold at 95. The figure also decides nothing, since the policy engine cannot read it. Unlike a vendor score, you can check it, and it cannot act on its own.

What "indirect exposure" adds

Vendor exposure percentages are useful inference with parameters you cannot verify. The coverage matrix keeps them apart from exact match.

Commercial analytics providers trace funds a few hops back and report that a deposit is "12% exposed to a sanctioned entity". That is useful for source-of-funds review and for catching money that moved through a mixer after a designation. It is also an inference with parameters (hops, thresholds, attribution quality) that you cannot verify and that changes between vendors. KYTGate's coverage matrix keeps the two apart: sanctions is the exact-match dimension, sourceOfFundsExposure is the inference dimension, and a decision records which of them ran. You can add a commercial provider later without pretending it was there before.

KYTGate does one thing in between. It screens the wallet’s direct counterparties against the same official snapshots. A statement such as “three of the ten addresses this wallet transacted with most are themselves on the OFAC list” is a fact. It needs no attribution and no hop parameters, and the snapshot it came from can be cited. It is still not an exposure percentage. It covers one hop, and only the counterparties that appeared in the history the explorer returned. The coverage of that read is printed next to the answer, because “none of them is listed” after a capped read says much less than after a full one. The result is information for the reviewer. The engine still holds a deposit for a listed subject, not for a listed neighbour.

Re-screening past counterparties

Designations happen after onboarding. Every address seen is re-screened against each fresh snapshot, and a new match opens a case.

Designations happen after onboarding. A counterparty that was clean in March may be listed in August, and the regulator's question will be "when did you find out?". KYTGate re-screens every address it has seen against each fresh snapshot every morning. A new match opens a case automatically and fires a webhook. The evidence pack shows the snapshot that first matched and the one that did not, which is the timeline a supervisor wants to see.

Stablecoin freezes

Tether and Circle freeze addresses on-chain, often before any list changes. A frozen address is treated like a sanctions match.

Tether and Circle can and do freeze addresses at the contract level, often at law-enforcement request and often before any list is updated. KYTGate reads isBlackListed / isBlacklisted live from the official contracts on six networks. A frozen address is the other hard signal, and KYTGate treats it like a sanctions match: the deposit is blocked and a person decides. More on this in stablecoin compliance.

What you will be asked to prove

Which list version, at what time, against which address, with what result, and who decided, all on a signed receipt.

The question goes beyond "did you screen?". You will be asked which list version you used, at what time, against which address, with what result, and who decided what next. Every KYTGate screening answers those five with a signed Decision Receipt that carries the snapshot hashes, the policy version and the human actions. Anyone can verify the signature in a browser without trusting us.

Try it

The free checker shows the list versions it used and can re-check an address daily.

The free wallet sanctions check runs the exact-match and issuer-freeze checks on any address and shows the list versions it used. Leave an e-mail and we re-check the address daily against the latest lists and tell you only when its status changes.