No hit is not a clearance: the limits of crypto address screening
Crypto address screening checks wallet addresses against sanctions lists and analytics labels, and a clean result covers only what was actually checked. This guide explains where lists, attribution and custodial structures leave gaps, and how to word a no-hit result and its coverage statement so the case file stays accurate.
What does a no-hit result from crypto address screening mean?
A no-hit result means the screened address did not match the lists, labels and exposure rules applied at the time of the check. It does not establish who controls the address, or that the funds have no connection to a designated party. It is a statement about the analysis performed, and nothing more.
Wallet screening combines two checks with different failure modes: matching against addresses that authorities publish, and blockchain analytics that infer who controls an address and what it has transacted with. Our guide to on-chain sanctions screening sets out how both feed a decision. OFAC's FAQ 559 (2021) defines an address as an identifier for a potential transfer destination, and a wallet as the mechanism holding a user's addresses, keys and balance. One clean address can sit in a wallet that also holds a listed one.
| Limit | Source | Effect on a no-hit result |
|---|---|---|
| Address lists are not exhaustive | OFAC FAQ 562 | Unlisted does not mean unconnected |
| Addresses are pseudonymous | NYDFS (2022) | Owner may be unknown without off-chain data |
| Clustering can be wrong | Fröwis et al. (2020) | Related addresses may be missed or merged |
| Bitcoin heuristics do not fit Ethereum | Victor (2020) | Attribution depth differs by network |
| Labels can be ambiguous or false | Fröwis et al. (2020) | A label is a claim to verify |
| Designations change after the check | OFAC guidance (2021) | Results age and need re-screening |
Why are sanctions address lists not enough on their own?
OFAC states that its digital currency address listings are not likely to be exhaustive. Designated persons can create new addresses at will, and OFAC expects a firm that identifies an address it believes is owned by or associated with an SDN to block the relevant digital currency and report it, whether or not the address is listed.
That expectation comes from OFAC FAQ 562 (2018). OFAC still adds addresses as identifiers on SDN entries, as in its September 9, 2026 action, and lists also shrink: Tornado Cash was removed from the SDN List on March 21, 2025. A list-only control therefore needs the current list and a record of the version used. For how entries are structured, see sanctions lists explained.
Why can't blockchain analytics always identify who controls an address?
Blockchain addresses are pseudonymous. NYDFS's 2022 guidance on blockchain analytics notes that tools may not identify underlying owners, including ultimate beneficial owners, without off-chain verification using customer data. Analytics infers control through clustering heuristics and attribution tags, both of which can be wrong, so an unlabeled address is simply unattributed.
The NYDFS industry letter of April 28, 2022 describes analytics for KYC, on-chain monitoring and on-chain sanctions screening, and is direct about these limits. The research supports it. Fröwis and colleagues (2020) note that wrong clustering results can lead to missed or even false convictions, and that naive multi-input clustering is significantly biased by CoinJoin transactions. On Ethereum, Victor (2020) found that no existing heuristics apply directly to the account balance model. Our article on wallet attribution covers these methods in depth.
How do exchanges and custodial wallets limit address screening?
When funds move through an exchange or other custodial service, the on-chain trail usually ends at the institution's own addresses. NYDFS notes that attributing an address to an institution does not by itself identify that institution's underlying customer or beneficial owner, so a result naming an exchange still leaves the counterparty customer unidentified.
A 2019 preprint by Tironsakkul and colleagues notes that exchanges often store users' bitcoins in their own wallet system. Two consequences follow. Exposure to an exchange that once received illicit funds does not show that your customer dealt with the illicit party. And a clean exchange label says nothing about the person on the other side. A sound practice is to screen the originator and beneficiary names in travel rule data alongside the address; see our guide to FINTRAC travel rule requirements.
What can go wrong with crypto address labels?
Labels are claims made by a data provider, and they can be ambiguous, outdated or wrong. Fröwis and colleagues (2020) show that a ransomware tag may not say whether an address belongs to the attacker, a victim or a related party, and that false or deliberately misplaced tags can associate unrelated actors.
We recommend asking two separate questions of any label. Why is the original address associated with this actor, and when was that last verified? And why was the association extended to other addresses through clustering? A strong label on one address can travel through a weak cluster to dozens of others, so label confidence and cluster confidence belong in the case record as separate findings.
How should a no-hit result be worded in the case file?
Word it as a bounded finding: no identified concern within the analysis performed, followed by what that analysis was. The phrasing avoids implying clearance, stays accurate if a later designation or new attribution changes the picture, and shows a reviewer which checks support the decision to proceed.
| Avoid | Use instead (recommended) |
|---|---|
| "Address cleared" | "No identified concern within the analysis performed on [date]" |
| "Not sanctioned" | "No match against [lists and versions] on [date]" |
| "Low risk" | "Unresolved: counterparty not attributed" where that is the fact |
| "No exposure" | "No exposure identified above [threshold] under [method and depth]" |
An unresolved result is not a low-risk result. FINTRAC's virtual currency indicators (2021) say facts, context and indicators need to be assessed together, so a clean screen does not cancel other indicators on the file.
What should a crypto screening coverage statement include?
A coverage statement records the scope behind a result: the networks and assets checked, the lists and their versions, the analytics data and its date, the exposure method, direction and depth, and anything not analyzed. It turns a bare no-hit into a finding that a reviewer, auditor or examiner can test and reproduce.
- Network, asset and addresses screened, with transaction hashes.
- Lists checked, with versions and the time of the check.
- Analytics provider, data snapshot date and label sources.
- Exposure method, direction, hop depth and threshold.
- What was not analyzed, such as unsupported networks or unattributed counterparties.
Fröwis and colleagues stress provenance and reproducibility for the same reason. A dated statement also shows when a result needs revisiting: OFAC's 2021 guidance for the virtual currency industry recommends ongoing sanctions screening and risk-based re-screening, for example related to a historical lookback. See our articles on crypto lookbacks and the screening result checklist.
Sources
These are the primary regulatory and research documents this guide relies on, each checked against the published text in November 2026. The Tironsakkul paper is a preprint and has not been peer-reviewed. Confirm the current version of each regulatory document before relying on it in a policy or case decision.
- OFAC FAQ 559 (2021)
- OFAC FAQ 562 (2018)
- OFAC: Sanctions Compliance Guidance for the Virtual Currency Industry (2021)
- OFAC recent action (September 9, 2026) and Tornado Cash delisting (March 21, 2025)
- NYDFS: Guidance on Use of Blockchain Analytics (2022)
- Fröwis et al., forensic cryptocurrency investigations (2020)
- Victor, address clustering heuristics for Ethereum (2020)
- Tironsakkul et al., taint analysis methods (preprint, 2019)
- FINTRAC: virtual currency indicators (2021)
FAQ
Does a clean crypto address screening result mean the address is safe?
No. A clean crypto address screening result means the address did not match the lists, labels and exposure rules applied at the time. OFAC says its address listings are not likely to be exhaustive, NYDFS notes that analytics may not identify underlying owners without off-chain information, and labels and clusters can be wrong. The defensible wording is "no identified concern within the analysis performed", recorded with a statement of what was analyzed.
Are OFAC's sanctioned crypto address lists complete?
Not by OFAC's own account. OFAC's FAQ 562 states that its digital currency address listings are not likely to be exhaustive. A firm that identifies a wallet or address it believes is owned by or associated with an SDN is expected to block the relevant digital currency and report it to OFAC, whether or not that address appears on the list. Lists also change in both directions, so screening should use the current version and record which one was used.
Can blockchain analytics identify the customer behind an exchange address?
Usually not on its own. NYDFS's 2022 guidance notes that analytics tools can typically identify addresses associated with an institution, but that attribution does not by itself identify the institution's underlying customer or beneficial owner. Exchanges often hold users' funds in their own wallet system, so the on-chain trail ends at the exchange. Identifying the customer needs off-chain information, such as travel rule data from the counterparty service.
Do address clustering heuristics work the same on Ethereum as on Bitcoin?
Not directly. The common-input heuristic used for Bitcoin relies on transactions with multiple inputs, and Friedhelm Victor's 2020 research found that no existing heuristics apply directly to Ethereum's account balance model. Victor proposed Ethereum-specific heuristics, such as deposit address reuse, airdrop multi-participation and self-authorization. In practice, attribution depth can differ by network, so a coverage statement should name the networks analyzed and the methods used for each.
Put coverage on the record for every wallet screen.
Book a demo to discuss how your team screens wallet addresses and documents what each result covers.
Book a demo