How to evaluate a crypto screening result: an eight-question checklist

What is a crypto screening result?

A crypto screening result is the output a blockchain analytics or wallet screening tool returns for an address or transfer: a match to a listed address, an entity label, a risk category or an exposure measurement. It is evidence for a compliance decision. It is not the decision itself, and it carries assumptions the reviewer has to test.

Most results mix three layers: observed activity (addresses, timestamps and value on the blockchain), attribution and exposure (links drawn between addresses and actors), and the compliance disposition. Our guide to on-chain sanctions screening explains each. A sound practice is to record them separately, so that "possibly associated with Entity X" never hardens into "the customer is Entity X".

The inferences have known limits. NYDFS's April 2022 guidance on blockchain analytics notes that wallet addresses are typically pseudonymous and that the tools may not identify underlying owners without off-chain verification using customer data. Fröwis and co-authors, in a 2020 paper on forensic cryptocurrency evidence, warn that wrong clustering results can lead to missed or even false convictions.

What are the eight questions in the checklist?

The eight questions are scope, attribution, clustering, exposure type, measurement, intermediaries, coverage and disposition. Together they separate what the blockchain shows from what was inferred and from what the firm decided. The checklist is our recommended practice, not a regulator-prescribed test, and a reviewer should be able to answer each question from the case file.

The first seven questions test the evidence and the eighth tests the decision, so its answer should name the law or policy relied on.

How should a reviewer test attribution and clustering evidence?

Test attribution and clustering as two separate confidence questions. First, why is the original address associated with the actor? Second, why was that association extended to the other addresses in the cluster? A strong answer to the first does not support the second, and a result can fail on the extension even when the original label is sound.

On the first question, the strongest evidence is documentary, such as an address OFAC lists as an identifier on an SDN entry, as in its September 9, 2026 action. Other labels are only as reliable as their source: Fröwis and co-authors note that a "ransomware" tag may not say whether an address belongs to the attacker, a victim or something merely related.

On the second, ask for the heuristic. Fröwis and co-authors show that naive Bitcoin multi-input clustering (often called common-input clustering) is significantly biased by CoinJoin transactions, and Friedhelm Victor's 2020 paper on Ethereum clustering finds that no existing heuristic applies directly to Ethereum's account model. See wallet attribution and address clustering.

How should exposure percentages and hop counts be read?

Read an exposure percentage as the output of a stated tracing method applied to a stated denominator. It describes how value was allocated through a transaction graph. It is not a probability that the customer is sanctioned, not an amount to block, and not an ownership threshold. Hop counts describe distance in the graph, not legal proximity.

Tracing methods disagree by design. A 2019 preprint by Tironsakkul and co-authors describes poison, which taints every output of a transaction if any input is tainted, and haircut, which gives each output a proportional share. The same transaction can yield a partial figure under one rule and a fully flagged output under the other, as our haircut vs poison example shows.

Direct and indirect exposure are analytical conventions. FINTRAC's 2021 virtual currency indicators treat direct and indirect exposure to known suspicious sources as an indicator to assess with facts and context. See direct vs indirect crypto exposure.

What should a reviewer check about intermediaries and coverage?

Check whether an intermediary breaks the link to the flagged source, and what the analysis left out. Exchanges and custodians often hold customer funds in their own wallets, so a path through them does not by itself identify the underlying customer. Unanalyzed chains, assets or periods leave gaps, and unresolved activity should be recorded as unresolved.

NYDFS makes the intermediary point directly: attributing an address to an institution does not by itself identify the institution's underlying customer or beneficial owner. Tironsakkul and co-authors likewise note that exchanges often store users' bitcoins in their own wallet system.

On coverage, OFAC FAQ 562 (2018) says OFAC's address listings are not likely to be exhaustive, and expects a firm that believes an address is owned by or associated with an SDN to block and report whether or not it is listed. We recommend wording such as "no identified concern within the analysis performed", followed by the networks, assets, period and list versions covered. See the limits of crypto address screening.

What should the case record for a crypto screening result contain?

The case record should let another reviewer reproduce the result and follow the reasoning. It needs the transaction identifiers, a dated snapshot of the blockchain data used, the label sources and their dates, the tracing method and tool version, the assumptions made, the reasoning that links evidence to disposition, and the approving reviewer.

Fröwis and co-authors treat provenance and reproducibility as conditions for blockchain evidence to carry weight, discussing chain of custody, reliability and verifiability. Labels change and tools are revised, so a file that stores only the vendor's current output may not be reproducible a year later.

Where the disposition is a legal action, name the obligation. For US persons, OFAC FAQ 646 (2021) requires blocked virtual currency to be reported within 10 business days and annually thereafter. In Canada, FINTRAC's sanctions evasion guidance requires reporting, since August 19, 2024, of completed and attempted transactions where there are reasonable grounds to suspect sanctions evasion. Whether an obligation applies is a question for counsel.

How can the checklist support QA and vendor due diligence?

Use the checklist in two places. In internal quality assurance, sample closed alerts and score whether the file answers each of the eight questions. In vendor due diligence, give a blockchain analytics provider a sample alert and ask it to answer all eight, with sources, methods and stated limits, before the firm relies on its results.

For QA, we recommend sampling cleared alerts as heavily as escalated ones, because a weak clearance rarely surfaces any other way. For a VASP selecting or renewing a provider, the questions become due diligence requests:

1. Where do your labels come from, and how often is each source re-verified?
2. Which clustering heuristics apply on each network, and how are CoinJoin and account-based chains handled?
3. Which tracing method is the default, and what denominator does a percentage use?
4. Which chains and assets fall outside your coverage?
5. Can a past result be reproduced with the method version and data that produced it?

The same questions apply to crypto lookbacks after a new designation.

Sources

• NYDFS, Guidance on Use of Blockchain Analytics (2022)
• OFAC FAQ 560 (2018)
• OFAC FAQ 562 (2018)
• OFAC FAQ 646 (2021)
• OFAC, Recent Actions (September 9, 2026)
• FINTRAC, ML/TF indicators: virtual currency transactions (2021)
• FINTRAC, Report suspected sanctions evasion
• Fröwis et al., Safeguarding the evidential value of forensic cryptocurrency investigations (2020)
• Victor, Address clustering heuristics for Ethereum (2020)
• Tironsakkul et al., Methods for Taint Analysis (preprint, 2019)

FAQ