GUIDE · SANCTIONS DATA

How to use the OFAC crypto address list

Published 2026-09-30 · Updated 2026-09-30

OFAC publishes crypto addresses inside its SDN list rather than as a separate file. This guide shows how to find them, what the labels mean, and what an exact match does and does not tell you.

Since November 2018 the US Treasury's Office of Foreign Assets Control has included digital-currency addresses in some of its designations. There is no separate OFAC crypto address list. The addresses sit inside the Specially Designated Nationals (SDN) list, as identifiers attached to a designated person or entity, alongside passport numbers and company registrations. This guide explains how to extract them, how to read them and what a broker should do with them.

If you only need the data, KYTGate publishes every address it extracts from the OFAC, UK and EU lists as a CSV or JSON download, refreshed with each sync, with the licences attached.

Start free sandbox Talk to us50 screenings a month free, no card.

On this page

Where the addresses are in the SDN list

As "Digital Currency Address" identifiers on a designated entry, labelled with a currency code.

Each address appears as an identifier of the form Digital Currency Address - XBT followed by the address, on the entry of the person or entity it belongs to. The same entry may carry several addresses across several currencies. The first were published on 28 November 2018, attached to two individuals linked to the SamSam ransomware. Since then OFAC has added addresses for darknet markets, mixers, exchanges that served sanctioned parties, ransomware operators and state-linked groups.

The addresses are only part of a designation. The legal effect comes from the designation of the person or entity: US persons must block property in which that party has an interest and must not deal with them, whether or not a particular wallet is on the list. OFAC has stated that the addresses it lists are not necessarily all the addresses a designated party controls.

Reading the currency labels

The label names a currency, not always a chain. USDT on Tron and USDT on Ethereum can carry the same label.

The code after Digital Currency Address - is a currency ticker chosen by OFAC: XBT for bitcoin, ETH, TRX, USDT, USDC, XMR, LTC and others. It is not always a network. An address labelled USDT can be a Tron address (starting with T) or an Ethereum address (starting with 0x), and an Ethereum-format address is valid on every EVM chain at once: Ethereum, BNB Smart Chain, Arbitrum, Base and the rest.

What this means for screening

Screen an address against the list by its format, not by the network the deposit arrived on. A 0x address listed under ETH is the same controller on BSC or Base, and a match there is a match.

For this reason the KYTGate download keeps OFAC's label in its own column and does not convert it into a chain. The label is what the publisher stated. Mapping it to networks is a screening decision, and you should be able to see it.

Exact matching and its limits

Match the exact address, normalised the way the chain defines it. A miss means "not on the list", not "clean".

EVM addresses are case-insensitive: compare them lowercased. Bitcoin legacy addresses and Tron addresses are case-sensitive base58 and must be compared exactly. Bech32 bitcoin addresses (bc1...) are lowercase by definition. A screening tool that uppercases or trims the wrong way will miss real matches without any error.

An exact match is strong evidence: the funds come from, or are going to, a wallet a government has named. A miss is weak evidence. It says the address is not on the list today. It says nothing about wallets the designated party controls but OFAC has not published, or about funds that passed through a listed address one hop earlier. That second question is exposure analysis, which needs an attribution provider. KYTGate records exposure as a separate coverage dimension and does not suggest that a list check answers it.

Screen the deposit address and, for transfers, the address that actually sent the funds, not the fee payer or a contract.
Re-screen on every list change: an address that was clean when the deposit landed can be designated the next week.
Keep the list version you screened against with the decision, so you can show later which list you were bound by.

Delistings count too

Addresses are removed as well as added. Screening against a stale copy blocks people you no longer have to block.

OFAC removes entries as well as adding them. The best-known case is Tornado Cash: its smart-contract addresses were designated in August 2022 and removed in March 2025, after a US appeals court ruled that immutable smart contracts could not be designated as property. A tool still screening against a 2024 copy would keep blocking those addresses with no legal basis.

So freshness matters in both directions, and a screening record should say which snapshot it used. KYTGate syncs the lists every six hours, keeps a content hash for every snapshot, and puts that hash in each signed decision receipt. The sanctions data page shows when each list last changed.

OFAC is not the only list

UK and EU lists publish addresses too, and bind different firms.

The UK Sanctions List and the EU consolidated financial sanctions list also carry digital-currency addresses, fewer than OFAC but not a subset of it. Which lists bind you depends on where you are established and where you do business, not on which list is largest. A broker licensed in the EU and serving UK clients may need all three.

See who must screen crypto payments for how the obligations divide, and the free wallet sanctions check to test a single address against all three lists at once.

Questions

Is there an official OFAC list of crypto addresses?

Not as a separate file. OFAC publishes digital-currency addresses as identifiers inside the SDN list, attached to the designated person or entity. Extracted versions, such as the KYTGate download on /sanctions-data, pull those identifiers out into a table.

Does an address not being on the OFAC list mean it is safe?

No. It means that address is not listed today. OFAC says its published addresses are not necessarily exhaustive, and a wallet can receive funds from a listed address without being listed itself. A list check answers one question, and exposure analysis answers another.

What does XBT mean on the SDN list?

It is the currency code OFAC uses for bitcoin. Other codes include ETH, TRX, USDT, USDC, XMR and LTC. The code names a currency, and an Ethereum-format address listed under ETH is the same address on every EVM network.

Is Tornado Cash still on the OFAC list?

No. Its smart-contract addresses were designated in August 2022 and removed from the SDN list in March 2025, following a US appeals court ruling. Screening against an outdated copy of the list would still flag them.

How often does the OFAC list change?

Irregularly, sometimes several times a week. That is why the list should be re-synced often and each screening should record which version it used. KYTGate syncs every six hours and records the snapshot hash in every signed receipt.

Start free sandbox Talk to us