On-chain sanctions screening explained: from blockchain evidence to a defensible decision
On-chain sanctions screening checks crypto addresses and transaction histories for links to sanctioned persons, and its result is evidence for a decision made under sanctions law. This guide explains how to keep observed activity, attribution and the disposition apart, and how to reach an outcome you can defend in the US and Canada.
What is on-chain sanctions screening?
On-chain sanctions screening is the review of crypto addresses and their transaction histories for links to sanctioned persons or entities. It combines official address listings with blockchain analytics that attribute addresses to actors and measure exposure. Its output is evidence for a compliance decision about a customer, transfer or holding; the decision itself still rests on sanctions law.
OFAC's FAQ 560 (2018) states that sanctions obligations are the same whether a transaction is in digital currency or fiat. The evidence differs: a VASP screens pseudonymous identifiers whose ownership often has to be inferred. NYDFS's 2022 guidance on blockchain analytics describes these tools as supporting KYC, on-chain transaction monitoring and on-chain sanctions screening. OFAC still lists digital currency addresses on SDN entries, as in its September 9, 2026 action, so exact matching remains the starting point. For the wider program, see what sanctions screening is and AML screening for crypto exchanges.
Why record observed activity, attribution and disposition separately?
Observed activity, attribution and disposition belong in separate records because each carries a different level of certainty. The ledger shows transfers. Attribution and exposure are inferences built on labels, clustering and tracing rules. The disposition is a legal or policy conclusion. Keeping them apart stops "possibly associated with Entity X" from hardening into "the customer is Entity X".
| Layer | What it contains | What it cannot establish alone |
|---|---|---|
| Observed activity | Addresses, transaction identifiers, timestamps and value | Who controls an address or owns it beneficially |
| Attribution and exposure | Listings, labels, clusters, tracing results, hop counts | Certainty: labels and clusters can be wrong |
| Compliance disposition | Clear, restrict, block, reject, report | A sound outcome, if the layers beneath were not tested |
NYDFS notes that analytics tools may not identify underlying owners without off-chain verification using customer data. Fröwis and co-authors (2020) show that labels and clusters can be mistaken, and that wrong clustering can lead to missed or even false convictions.
How do screening tools attribute a crypto address to a sanctioned party?
Attribution links an address, or a cluster of addresses, to identifying information about an actor. It rests on three kinds of evidence: documentary association, such as an address published in an official designation; clustering heuristics that infer common control; and off-chain corroboration from customer records. Each fails in different ways, so each needs its own confidence assessment.
OFAC's FAQ 559 (2021) defines an address as an identifier for a potential transfer destination, and a wallet as a mechanism that holds a user's addresses, private keys and balance. An address is not a person, and a wallet is rarely one address.
- Clustering. Fröwis and co-authors show that naive multi-input (common-input) clustering on Bitcoin is significantly biased by CoinJoin transactions.
- Account-based chains. Victor (2020) finds that no existing heuristics apply directly to Ethereum's account balance model.
- Labels. A "ransomware" tag may not say whether the address belongs to a victim or the attacker (Fröwis).
- Institutions. Attributing an address to an exchange does not identify that exchange's underlying customer (NYDFS).
We recommend testing two questions separately: why is the original address linked to the entity, and why was that link extended to other addresses? See wallet attribution and address clustering.
What is the difference between direct and indirect exposure?
Direct exposure means a screened address sent funds to, or received funds from, a flagged address in a single transfer. Indirect exposure means value reached it through one or more intermediate addresses. Both are analytical conventions used by screening tools, and hop count alone does not decide whether a sanctions prohibition applies to the activity.
| Result type | What it means | What to establish |
|---|---|---|
| Exact listed-address match | The address appears in an official designation | Asset, network, current entry, program, circumstances |
| Same-entity attribution | Unlisted, but evidence links it to a designated party | The quality of the attribution |
| Direct exposure | One transfer to or from a flagged address | Direction, value, timing, purpose |
| Indirect exposure | Value passed through intermediaries | Who controls each intermediary |
FINTRAC's 2021 virtual currency indicators include direct and indirect exposure links to known suspicious sources, to be assessed with facts and context. Distance does not take activity out of scope: Global Affairs Canada states that most SEMA and JVCFOA regulations prohibit facilitating a transaction related to a dealing with a listed person even indirectly, such as through a third party. See direct vs indirect crypto exposure.
Percentages depend on method: one illustrative transaction scores 20% under haircut tracing and 100% under poison tracing (see haircut vs poison tracing). OFAC's FAQ 562 (2018) adds that its address listings are not likely to be exhaustive: a firm that identifies an address it believes is owned by or associated with an SDN should block and report, listed or not. See the limits of crypto address screening.
What does a sanctions nexus require in the US and Canada?
In the US, virtual currency that must be blocked is frozen, with access denied to all parties, and reported to OFAC; a prohibited transaction with no blockable interest is rejected instead. In Canada, the applicable Canadian statute decides the outcome, and FINTRAC reporting can apply separately. An OFAC result does not settle the Canadian position automatically.
- US blocking. Under OFAC's FAQ 646 (2021), blocked virtual currency is reported within 10 business days and annually thereafter, and may be returned to its owner only under an OFAC authorization, so sending it back on your own initiative is not an option.
- US rejection. OFAC's FAQ 36, amended October 26, 2026, says a prohibited transaction with no blockable interest is rejected and returned to the originator, never processed forward, and reported within 10 business days.
- Canadian law. Canada applies its own statutes, including the United Nations Act, SEMA and JVCFOA.
- FINTRAC STR. Since August 19, 2024, completed and attempted transactions with reasonable grounds to suspect sanctions evasion must be reported as soon as practicable.
- FINTRAC LPEPR. The Listed Person or Entity Property Report is due immediately when a disclosure obligation arises; no transaction has to occur.
Which outcome applies is a legal question on the facts. See blocking vs rejecting crypto transactions.
What is a defensible workflow for a crypto sanctions alert?
A defensible workflow validates the alert, reconstructs and corroborates the evidence, determines which obligations apply, records the disposition, and revisits it when facts change. The six steps below are our recommended practice rather than a regulator-prescribed sequence, and any legal restriction applies the moment it is triggered, even if later steps are still open.
- Validate the alert: network, asset, address, timestamp, list entry, effective designation date, and whether the hit is an official match or an analytical label.
- Reconstruct the evidence: transfers, direction, value, path and tracing method.
- Corroborate the relationship: attribution, clustering, customer records, travel rule data and the role of intermediaries.
- Determine the obligations: jurisdiction, program, property interests, authorizations and reporting duties, under the rules in force at the time of the activity.
- Record the disposition: clear, restrict, block or reject, and any report, with the reasoning and the reviewer named.
- Reassess when facts change: new designations, revised labels or new customer information reopen the case.
Test steps 2 and 3 with the crypto screening result checklist.
When should past crypto activity be re-screened?
Past activity should be re-screened when a new address is designated, when an attribution changes, and when a customer's risk profile shifts. OFAC's 2021 virtual currency guidance describes historical lookbacks after an address is listed and recommends ongoing screening with risk-based re-screening, because a lookback can reveal unlisted addresses that transacted with the listed one.
The OFAC guidance (pages 15 and 16) also notes that unlisted addresses sharing a wallet with a listed address may pose sanctions risk. Separate past activity from assets held now; see crypto lookbacks after new designations.
Sources
- OFAC FAQ 559 (2021)
- OFAC FAQ 560 (2018)
- OFAC FAQ 562 (2018)
- OFAC FAQ 646 (2021)
- OFAC FAQ 36 (amended 2026)
- OFAC virtual currency guidance (2021)
- OFAC action, September 9, 2026
- NYDFS: Guidance on Use of Blockchain Analytics (2022)
- FINTRAC: virtual currency ML/TF indicators (2021)
- FINTRAC: Report suspected sanctions evasion
- FINTRAC: Listed Person or Entity Property Report
- Global Affairs Canada: sanctions legislation
- Global Affairs Canada: indirect dealings guidance
- Fröwis et al., forensic cryptocurrency investigations (2020)
- Victor, Address clustering heuristics for Ethereum (2020)
FAQ
What is on-chain sanctions screening?
On-chain sanctions screening is the review of crypto addresses and transaction histories for links to sanctioned persons or entities. It starts with exact matches against addresses that authorities such as OFAC publish, and extends through blockchain analytics to addresses attributed to designated parties and to funds that passed through intermediaries. The result is evidence for a decision about a customer, transfer or holding, and it should be recorded separately from the disposition that sanctions law requires.
Does indirect exposure to a sanctioned address mean a transfer must be blocked?
Not automatically. Indirect exposure means value reached an address through intermediaries, and an intermediary may be an exchange holding funds for many unrelated customers. The legal question is whether a prohibition applies on the facts, such as whether a designated party has an interest in the funds or the dealing is caught by a rule on indirect dealings. Hop counts and percentages inform that assessment but do not decide it.
Do Canadian crypto businesses report sanctions concerns to FINTRAC?
Yes, through two separate reports. Since August 19, 2024, reporting entities must file a suspicious transaction report for completed or attempted transactions where there are reasonable grounds to suspect sanctions evasion. Separately, a Listed Person or Entity Property Report is due immediately when a disclosure obligation arises under the Criminal Code, UN Act regulations, SEMA regulations or JVCFOA. The property report does not require any transaction to have occurred.
What should a crypto screening case record contain?
A case record should let a reviewer who was not involved reproduce the decision. It should hold the transaction identifiers, a snapshot of the blockchain data analyzed, each label with its source and collection date, the clustering and tracing methods and their versions, the assumptions made, and the reasoning that links the evidence to the disposition. Research by Fröwis and co-authors (2020) stresses provenance and reproducibility for this reason.
Turn on-chain evidence into decisions you can explain.
Book a demo and talk to our team about how your program records screening evidence and the reasoning behind each decision.
Book a demo