Crypto lookbacks: re-screening activity when a new address is designated
A crypto lookback is the review a VASP runs after a new digital currency address is designated, to find past activity and current holdings connected to it. This guide covers OFAC's guidance on lookbacks and re-screening, how past activity differs from assets held now, and what Canadian reporting adds.
What is a crypto lookback?
A crypto lookback is a retrospective review, run after a digital currency address is newly designated, that searches a firm's on-chain and customer records for transfers, customers and holdings connected to that address. It answers two questions: what the firm holds now that may need immediate action, and what past activity reveals about risk.
Our guide to on-chain sanctions screening places the lookback in the wider investigation workflow. Screening is point-in-time: a transfer to an address unlisted when it settled raised no alert. OFAC continues to add addresses to SDN entries, as in its September 9, 2026 action, and lists move in both directions: OFAC removed Tornado Cash from the SDN List on March 21, 2025. See also screening frequency and ongoing monitoring.
What does OFAC say about lookbacks and risk-based re-screening?
OFAC's 2021 Sanctions Compliance Guidance for the Virtual Currency Industry says firms may consider a historic lookback of transactional activity after an address is listed, and recommends ongoing sanctions screening with risk-based re-screening, for example related to a historical lookback. The guidance presents the lookback as a risk-based measure that each firm scopes for itself.
Pages 15 and 16 of the OFAC guidance add two points that shape scope. Analytics tools can continually review historical information, and unlisted addresses that share a wallet with a listed address may pose sanctions risk. OFAC notes that a lookback "could also identify connections to unlisted addresses" that previously transacted with the listed one.
Two FAQs set the floor. OFAC FAQ 560 (2018) confirms that sanctions obligations are the same for digital currency and fiat. OFAC FAQ 562 (2018) says the address listings are not likely to be exhaustive, and expects a firm that identifies an address it believes is owned by or associated with an SDN to block and report, whether or not the address is listed.
Why does the effective designation date matter?
The effective designation date splits a lookback into activity before and after the person or entity became subject to sanctions. Later transfers raise questions of prohibited dealing, while earlier ones inform risk. Take the date from the official action, and check whether the address joined an existing entry, since the original designation date may then be the boundary.
When an address is added to the entry of a person designated earlier, the address listing date may postdate the point at which dealings with that person became restricted, and FAQ 562 already expected firms to act on addresses they believed belonged to an SDN. We recommend recording each transfer's timestamp against both dates, and applying the rules in force at the time. Drawing the legal boundary for a specific program is a matter for counsel.
Regimes also differ. Canada imposes sanctions under its own statutes, which Global Affairs Canada lists as including the United Nations Act, SEMA and JVCFOA, so a Canadian firm works from Canadian listings and dates.
How should past activity be treated differently from assets held now?
Treat assets held now as a potential immediate obligation and past activity as an investigation. Virtual currency the firm holds in which a blocked person has an interest may have to be blocked and reported at once. Transfers that completed and left the firm's control cannot be blocked, but they inform customer risk, due diligence and reporting.
| Lookback finding | Question it raises | US reference point | Canadian reference point |
|---|---|---|---|
| Value held for the listed address or person | Must it be frozen now? | FAQ 562: block and report. FAQ 646: deny access, report within 10 business days and annually. | LPEPR immediately where a disclosure obligation arises; no transaction needed. |
| Transfers with the address after the designation date | Was there a prohibited dealing? | Investigate; block what is still held. | STR where there are reasonable grounds to suspect sanctions evasion. |
| Transfers with the address before the designation date | What does this say about the customer? | Guidance page 14: due diligence on customer history. | FINTRAC indicators, assessed with facts and context. |
| Unlisted addresses that transacted with the listed one | Could they belong to the same actor? | Guidance pages 15 and 16. | Most SEMA and JVCFOA regulations reach indirect dealings (Global Affairs Canada). |
Under OFAC FAQ 646 (2021), blocked virtual currency may be returned to its owner only under an OFAC authorization. For a prohibited transaction with no blockable interest, OFAC FAQ 36, amended on October 26, 2026, calls for rejection. See blocking vs rejecting crypto transactions.
How should a crypto lookback be scoped and run?
Scope a lookback by address set, time window and population. Start with the newly listed addresses, extend only to addresses the evidence ties to the same actor, set the window to cover the actor's known activity, and include closed and dormant accounts. Run it as a documented procedure with reviewer sign-off.
The sequence below is an illustrative, recommended practice. Apply any legal restriction as soon as it is triggered.
- Capture the trigger: list action, entry, addresses, networks, effective dates and list version.
- Snapshot the blockchain data and internal records used.
- Check current holdings first, and route any blockable value to blocking and reporting immediately.
- Search for direct exposure in deposits, withdrawals, saved withdrawal addresses and travel rule records.
- Extend to indirect exposure and candidate same-actor addresses, recording the heuristic and confidence for each.
- Decide per customer: clear, enhanced due diligence, restriction, exit, legal block and reports.
- Add confirmed addresses to ongoing screening.
Step 5 is where lookbacks overreach. A cluster is an inference, and Friedhelm Victor's 2020 paper shows that Bitcoin clustering heuristics do not apply directly to Ethereum's account model. Treating a cluster as a listing without evidence can freeze the wrong customer. See wallet attribution and address clustering.
What do Canadian reporting obligations add to a lookback?
In Canada, a lookback can trigger two separate FINTRAC reports. A suspicious transaction report covers completed or attempted transactions where there are reasonable grounds to suspect sanctions evasion. A Listed Person or Entity Property Report is due immediately when a disclosure obligation arises over property, even if no transaction occurred.
FINTRAC's sanctions evasion guidance applies the STR obligation from August 19, 2024. Where money laundering or terrorist financing is suspected alongside sanctions evasion, one report covers all suspected offences, and STRs are due as soon as practicable.
The LPEPR guidance ties the report to disclosure obligations under section 83.1 of the Criminal Code and regulations under the United Nations Act, SEMA and JVCFOA. The trigger is the existence of the property, so a lookback that finds a listed person's assets in custody can require one with no new transaction. Where a transaction occurred, FINTRAC also expects an assessment of whether an STR is warranted. For historical transfers, FINTRAC's 2021 virtual currency indicators include addresses matching recognized watch lists such as OFAC's.
What records should a crypto lookback produce?
A lookback should produce a record showing what triggered it, what was searched, what was found and what was decided: the list action and version, effective dates, address set, time window, data snapshot, methods and tool versions, each finding and its disposition, reports filed with dates, and the approving reviewer.
Reproducibility is the test. Fröwis and co-authors, in a 2020 paper on forensic cryptocurrency evidence, treat provenance and verifiability as conditions for blockchain evidence to carry weight, and labels change after the fact. Deadlines belong in the record too: 10 business days for OFAC blocked and rejected transaction reports, as soon as practicable for an STR, and immediately for an LPEPR.
A lookback that finds nothing still needs a file. We recommend a coverage statement such as "no identified concern within the analysis performed", with the networks, period and list version covered. See the limits of crypto address screening and our eight-question checklist.
Sources
- OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (2021)
- OFAC FAQ 560 (2018)
- OFAC FAQ 562 (2018)
- OFAC FAQ 646 (2021)
- OFAC FAQ 36 (amended 2026)
- OFAC, Recent Actions (September 9, 2026)
- OFAC, Recent Actions (March 21, 2025)
- FINTRAC, Report suspected sanctions evasion
- FINTRAC, Suspicious transaction report guidance
- FINTRAC, Listed Person or Entity Property Report guidance
- FINTRAC, ML/TF indicators: virtual currency transactions (2021)
- Global Affairs Canada, Canadian sanctions legislation
- Global Affairs Canada, humanitarian sector guidance
- Fröwis et al., Safeguarding the evidential value of forensic cryptocurrency investigations (2020)
- Victor, Address clustering heuristics for Ethereum (2020)
FAQ
When should a VASP run a crypto lookback?
A VASP should consider a crypto lookback whenever a designation adds digital currency addresses that could connect to its business. OFAC's 2021 virtual currency guidance presents the historic lookback as a measure firms may consider after an address is listed. A sound practice is to set the triggers, window and approval route in procedures in advance, so each lookback starts when the designation is published.
Does OFAC require a lookback when a crypto address is designated?
OFAC's 2021 guidance says firms may consider a historic lookback and recommends risk-based re-screening. Separately, OFAC FAQ 562 expects a firm that identifies an address it believes is owned by or associated with an SDN to block the relevant digital currency and report it, whether or not the address is listed. A firm holding such assets has that obligation however it finds them. Counsel should confirm the position in a specific case.
What happens if a lookback finds crypto we still hold for a designated person?
For US persons, OFAC FAQ 646 requires the firm to deny all parties access to the blocked virtual currency, report it to OFAC within 10 business days and annually thereafter, and hold it until an OFAC authorization permits release. In Canada, where a disclosure obligation arises, a Listed Person or Entity Property Report is due to FINTRAC immediately, and no transaction needs to have occurred for that report to be required.
Do transfers made before an address was designated have to be reported?
Not by default. A transfer that settled before the listing could not have matched it, but the designation changes what the firm knows. Check whether the person was designated earlier under another identifier, review the customer's history as OFAC's guidance suggests, and in Canada consider whether the facts give reasonable grounds to suspect money laundering, terrorist financing or sanctions evasion, which would require a suspicious transaction report to FINTRAC.
Be ready for the next designation.
Book a demo to discuss how your team re-screens customers and activity when sanctions lists change.
Book a demo