Which Sanctions Lists Apply to Crypto Businesses
Sanctions screening in crypto draws from multiple regulatory bodies, each maintaining its own list:
● OFAC SDN List (US): The Office of Foreign Assets Control's Specially Designated Nationals and Blocked Persons list. Any entity on this list, or any entity owned 50% or more by a listed party (the OFAC 50% Rule), is blocked from US financial services regardless of where the transaction originates.
● EU Consolidated Sanctions List: Maintained by the European Commission; applies to all CASPs operating in or serving EU customers.
● UN Security Council Consolidated List: Applied by most jurisdictions globally as a baseline.
● OFSI (UK): The Office of Financial Sanctions Implementation maintains the UK sanctions regime post-Brexit.
● National lists: Many jurisdictions maintain their own supplementary lists beyond the international ones.
A gateway serving customers across multiple jurisdictions must screen against all applicable lists simultaneously and must do so in real time — screening once at onboarding is insufficient because sanctions lists change frequently, sometimes multiple times per week.
How Crypto Sanctions Screening Differs From Traditional Finance
In traditional banking, sanctions screening primarily targets named individuals and entities in payment metadata — the sender's name, the beneficiary's name, and the bank account numbers involved. Crypto transactions typically include wallet addresses and amounts, but not names. Sanctions screening for crypto therefore requires an additional step: mapping wallet addresses to sanctioned entities.
This mapping is performed by blockchain analytics firms — primarily Chainalysis, Elliptic, and TRM Labs — which maintain continuously updated databases that link wallet addresses to known sanctioned entities, darknet markets, ransomware operators, and other high-risk actors. Gateways integrate these databases through API calls that check each wallet address involved in a transaction before it is processed.
The Tornado Cash OFAC Designation — A Defining Case
In August 2022, OFAC designated Tornado Cash — an Ethereum-based smart contract mixer — as a specially designated national, adding specific smart contract addresses to the SDN list. This was the first time immutable smart contract addresses, rather than companies or individuals, were designated. The designation created compliance uncertainty: could a user be sanctioned simply for having historically interacted with a Tornado Cash contract, even for legitimate privacy purposes?
The case established that blockchain analytics tools must screen not just direct counterparties but also indirect exposure — funds that passed through designated addresses before reaching a payment gateway. Gateways now assess 'indirect exposure' risk: a wallet may not be directly sanctioned but may receive a risk score based on the proportion of its funds that originated from or passed through sanctioned addresses.
What Happens When a Sanctioned Wallet Is Detected
When a gateway's screening system identifies a match — either a direct hit on a sanctions list or a high-risk score from blockchain analytics — the transaction is held and does not proceed to merchant settlement. The compliance team reviews the hit, determines if it is a true positive or a false positive, and takes one of three actions: block the transaction entirely, file a SAR with the relevant financial intelligence unit, or release the transaction if the hit is determined to be a false positive.
Blocking a sanctioned transaction does not necessarily mean the funds are returned to the sender — in many jurisdictions, funds linked to sanctioned parties must be frozen and reported rather than returned, to prevent the gateway from facilitating further movement of the funds.
Secondary Sanctions Risk
Secondary sanctions apply to non-US persons and entities that conduct significant transactions with primary sanctioned parties. A European payment gateway that processes payments connected to Iranian entities, even without a US nexus, may face secondary sanctions exposure if those transactions involve US dollar settlement at any point in the chain. This is a complex compliance area where legal counsel is essential — secondary sanctions exposure requires policy decisions about which jurisdictions and counterparties a gateway will serve.
Compliance Note: This glossary entry is provided for general educational purposes only and does not constitute financial, investment, legal, or tax advice. Industry terminology may vary across jurisdictions and providers; definitions herein may not directly reflect the specific features, terms, or specifications of Finassets' services. For details on Finassets' offerings, please refer to official product documentation or contact our team directly.