Direct vs indirect crypto exposure: why hop count is not a legal test
Direct vs indirect crypto exposure separates a customer address that transacted with a flagged address in one transfer from one connected through intermediaries. This guide explains what each result shows, how OFAC, FINTRAC and Global Affairs Canada frame the question, and why the number of hops never settles a sanctions outcome on its own.
What is direct and indirect crypto exposure?
Direct crypto exposure means a customer's address sent funds to, or received funds from, a flagged address in a single on-chain transfer. Indirect exposure means at least one intermediate address sits between them. Both are analytical conventions that blockchain analytics and wallet screening tools use to describe a transaction path; neither is a legal definition.
This article is part of our series on on-chain sanctions screening, which recommends recording observed activity, attribution and the compliance disposition as separate layers. The number of transfers between two addresses is the hop count: one hop is direct, two or more is indirect. Some tools also report a percentage, which depends on the allocation method; see haircut vs poison tracing.
What are the four types of crypto screening result?
Crypto sanctions screening produces four distinct result types: an exact match to an address in an official list entry, an attribution linking an unlisted address to a blocked person, direct exposure through a single transfer, and indirect exposure through one or more intermediaries. Each answers a different question and needs different evidence before a disposition.
In the table, S is a flagged source, P an intermediary and C the customer's address.
| Result type | What it shows | What the analyst still has to establish |
|---|---|---|
| Exact listed-address match | C is an identifier in an official list entry. | Network, asset, exact address, current entry, program and circumstances. |
| Same-entity attribution | C is unlisted, but evidence associates it with a blocked person. | The source and quality of the attribution. Absence from the list is not a clearance. |
| Direct exposure | S transferred to C, or C to S, in one transaction. | Direction, value, timing, counterparties and purpose. |
| Indirect exposure | S transferred to P, and P later transferred to C. | What connects the transfers and the role of P. Do not assume S, P and C share an owner. |
The first two rows are identity findings; the last two are flow findings. A sound practice is to record the result type before any risk score, so a path is never read as an identity finding. Our guide to wallet attribution and address clustering covers how attributions are built.
Why is hop count not a legal test?
Hop count is not a legal test because sanctions prohibitions are framed around dealings with designated persons and their property, and distance in a transaction graph measures neither. OFAC applies the same obligations to digital currency as to fiat, and most Canadian regulations under SEMA and JVCFOA reach dealings conducted even indirectly, through a third party.
OFAC FAQ 560 (2018) states that obligations are the same whether a transaction is denominated in digital currency or fiat. OFAC FAQ 562 (2018) adds that its address listings are not likely to be exhaustive, and that a firm identifying an address it believes is owned by or associated with an SDN should block the relevant digital currency and report it. The operative questions are ownership, association and property interest, which a path can prompt but cannot answer.
The one numerical test nearby is OFAC's 50 Percent Rule, described in FAQ 560: entities owned in the aggregate, directly or indirectly, 50 percent or more by blocked persons are themselves blocked. It concerns corporate ownership and should never be read against a hop count or a tracing percentage.
Canada imposes sanctions under its own statutes, including the Special Economic Measures Act (SEMA) and the Justice for Victims of Corrupt Foreign Officials Act (JVCFOA), according to Global Affairs Canada. Its humanitarian sector guidance explains that under most SEMA and JVCFOA regulations it is prohibited to enter into or facilitate a transaction related to a dealing with a listed person even indirectly, such as through a third party. Whether a specific path is a prohibited dealing is a legal question for counsel on the facts.
How does FINTRAC treat direct and indirect exposure?
FINTRAC lists funds added to or withdrawn from a virtual currency address with "direct and indirect exposure links to known suspicious sources" as a money laundering and terrorist financing indicator. An indicator prompts assessment. FINTRAC expects facts, context and other indicators to be weighed together before a reporting entity decides whether reasonable grounds to suspect exist.
FINTRAC's virtual currency indicators (2021) name darknet marketplaces, mixers, questionable gambling sites, ransomware and theft reports as suspicious sources, add a separate indicator for addresses on watch lists such as OFAC's, and set no distance.
Since August 19, 2024, reporting entities must also report to FINTRAC completed and attempted transactions where there are reasonable grounds to suspect sanctions evasion, covering any overlapping money laundering or terrorist financing suspicion in the same report. Suspicious transaction reports are due as soon as practicable.
Why do exchanges and other intermediaries change the meaning of a path?
An intermediary address can belong to anyone: the sender, the recipient, an associate, or a custodial service holding many customers' funds in one wallet system. When the intermediary is an exchange, a path from a listed address to your customer may only show that both used the same platform, which on its own establishes no relationship between them.
A 2019 preprint on taint analysis by Tironsakkul, Maarek, Eross and Just notes that exchanges often store their users' bitcoins in their own wallet system. NYDFS's 2022 guidance on blockchain analytics adds that attribution to an institution does not by itself identify its underlying customer or beneficial owner.
| Illustrative scenario | Path | What P turns out to be | What the path supports |
|---|---|---|---|
| A | S to P to C (two hops) | An omnibus wallet of a custodial exchange | S and C used the same platform; no relationship is shown without the exchange's records. |
| B | S to P to C (two hops) | An unhosted address that received only from S and paid only C within hours | A pass-through pattern that warrants attribution work on P and questions to the customer. |
Through a custodial service, the useful questions move off-chain, to the customer and the counterparty VASP; see AML screening for crypto exchanges.
Can an unlisted address create sanctions exposure?
Yes. OFAC says its digital currency address listings are not likely to be exhaustive, and expects a firm that identifies an address it believes is owned by or associated with an SDN to block the relevant digital currency and report it, whether or not the address appears on the list. Exposure analysis is one way such addresses come to light.
OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021) notes on pages 15 and 16 that unlisted addresses sharing a wallet with a listed address may pose sanctions risk, and that "A lookback could also identify connections to unlisted addresses that have previously transacted with the listed address." If the analysis concludes that funds must be blocked or a transfer rejected, the mechanics differ by jurisdiction; see blocking vs rejecting crypto transactions.
How should a compliance team document an exposure finding?
A defensible exposure finding records the result type, the path, the direction and value of each transfer, the role of every intermediary, the measurement method and the reasoning that links those facts to a disposition. We recommend writing it so a reviewer can tell what was observed on-chain, what was inferred, and what remains unknown.
- State the result type from the four above.
- Describe the path: network, asset, addresses, transaction identifiers, timestamps, direction and value.
- Classify each intermediary as custodial, unhosted or unknown, with the evidence.
- Name the measurement method and hop convention behind any percentage.
- Record off-chain inquiries and what remains open.
- Record the disposition and its basis: no action, policy restriction, block, rejection or report.
Compare "Customer has indirect sanctions exposure (two hops)" with "C received funds from P two days after P received funds from listed address S; P is attributed to a custodial exchange, and the exchange has been asked to confirm the originator."
Sources
- OFAC FAQ 560 (2018)
- OFAC FAQ 562 (2018)
- OFAC: Sanctions Compliance Guidance for the Virtual Currency Industry (2021)
- FINTRAC: ML/TF indicators, virtual currency transactions (2021)
- FINTRAC: Report suspected sanctions evasion
- FINTRAC: Suspicious transaction reporting guidance
- Global Affairs Canada: Canadian sanctions legislation
- Global Affairs Canada: Sanctions and the humanitarian sector
- NYDFS: Guidance on Use of Blockchain Analytics (2022)
- Tironsakkul et al.: Probing the Mystery of Cryptocurrency Theft (preprint, 2019)
FAQ
What is the difference between direct and indirect crypto exposure?
Direct exposure means a customer's address transacted with a flagged address in a single on-chain transfer, in either direction. Indirect exposure means one or more intermediate addresses sit between them. Both are conventions blockchain analytics tools use to describe a transaction path. They show where to investigate, but neither establishes who controls the addresses, whether the funds belong to a sanctioned person, or whether a transaction is prohibited under the applicable regime.
How many hops is too many for crypto sanctions screening?
No hop count makes sanctions risk disappear. OFAC applies the same obligations to digital currency as to fiat and expects firms to block funds where they believe an address is owned by or associated with a designated person, listed or not. Most Canadian regulations under SEMA and JVCFOA also prohibit dealings conducted indirectly. A program may set a hop range for automated alerts as a matter of risk appetite, provided the policy records why and analysts can escalate beyond it.
Does indirect exposure to a sanctioned address mean the funds must be blocked?
Not automatically. An indirect path shows value moved from a sanctioned source through intermediaries before reaching the customer. Blocking depends on whether the investigation establishes that the funds or address are owned by or associated with a designated person, or that the transaction is otherwise prohibited. The finding should be investigated, documented and, where it supports a suspicion of sanctions evasion in Canada, reported to FINTRAC.
Is direct exposure to a darknet market reportable to FINTRAC?
Direct or indirect exposure to darknet marketplaces, mixers, ransomware and similar sources is one of FINTRAC's published indicators for virtual currency transactions. FINTRAC states that a single indicator may not appear suspicious on its own and that facts, context and other indicators must be assessed together. A suspicious transaction report is required when that assessment produces reasonable grounds to suspect, and it is due as soon as practicable.
Turn exposure results into decisions you can explain.
Book a demo to discuss how your team screens counterparties and records the reasoning behind each sanctions decision.
Book a demo