## What Is Crypto Sanctions Screening?
Crypto sanctions screening is the process of identifying and blocking transactions involving wallets, entities, or addresses designated under international sanctions programs such as OFAC’s SDN list. Virtual asset service providers (VASPs) — including crypto exchanges, DeFi platforms, digital wallet providers, and payment processors — are legally required to screen all counterparties against global sanctions lists before processing transactions. Failure to do so exposes firms to civil penalties reaching $1 million per violation and criminal prosecution under the International Emergency Economic Powers Act (IEEPA). As of 2025, OFAC has designated over 15,000 digital asset addresses linked to sanctioned individuals, terrorist financing networks, and state-sponsored hacking groups.
Unlike traditional financial sanctions screening, crypto sanctions present unique challenges: pseudonymous addresses, cross-chain activity, mixing protocols, and indirect exposure through tainted transaction graphs all require specialized blockchain analytics — not simple name matching.
---
## How Does the OFAC SDN List Apply to Cryptocurrency?
The Office of Foreign Assets Control (OFAC), a division of the U.S. Department of the Treasury, maintains the Specially Designated Nationals and Blocked Persons (SDN) list — the primary sanctions reference for U.S. persons and entities globally. Since 2018, OFAC has dramatically expanded its inclusion of cryptocurrency identifiers directly within SDN entries, listing specific wallet addresses alongside traditional identifiers like names and passport numbers.
The legal framework is clear: under 31 CFR Parts 500–598, any U.S. person — or foreign entity touching the U.S. financial system — is prohibited from engaging in transactions with SDN-listed parties. Critically, OFAC’s guidance published in October 2020 clarified that this obligation extends fully to the virtual asset ecosystem. VASPs must screen not only the direct counterparty wallet but also trace the origin and destination of funds across multiple transaction hops. OFAC applies a strict liability standard for most civil sanctions violations, meaning intent is irrelevant — if a prohibited transaction occurs, the penalty applies. The agency’s 2021 framework further emphasized that sanctions compliance programs must be risk-based, ongoing, and proportionate to the firm’s exposure, customer base, and geographic footprint.
---
## What Are the Key Sanctioned Crypto Entities in 2025?
Several high-profile enforcement actions have defined the boundaries of crypto sanctions compliance. Understanding these cases is essential for any compliance team building a screening program.
**Tornado Cash** was designated by OFAC on August 8, 2022, marking the first time a decentralized protocol’s smart contract addresses were added to the SDN list. OFAC identified that Tornado Cash had been used to launder over $7 billion in cryptocurrency since 2019, including funds stolen by North Korea’s Lazarus Group. More than 100 Ethereum smart contract addresses were designated. The designation sparked significant legal debate, with a Fifth Circuit ruling in November 2024 holding that immutable smart contracts cannot be “property” of a foreign national — though OFAC’s authority over the associated persons and mutable contracts was upheld. Compliance teams must continue screening Tornado Cash-linked addresses regardless of ongoing litigation.
**Lazarus Group** (APT38), the North Korean state-sponsored cybercrime syndicate responsible for the 2022 Ronin Bridge hack ($625 million), the 2022 Harmony Horizon Bridge hack ($100 million), and numerous other thefts, has had hundreds of associated wallet addresses designated across multiple OFAC actions. The UN Panel of Experts estimated North Korea stole approximately $3 billion in cryptocurrency between 2017 and 2023 to fund its weapons programs.
**Garantex**, a Russia-based crypto exchange, was designated in April 2022 following OFAC findings that it had processed over $100 million in transactions linked to darknet markets and ransomware. Garantex continued operating until March 2025 when international law enforcement, including Europol and the U.S. DOJ, seized its infrastructure.
**Hydra Market**, the world’s largest darknet marketplace until its takedown in April 2022, had processed over $5.2 billion in cryptocurrency transactions. OFAC designated Hydra and 100 associated cryptocurrency addresses simultaneously with German law enforcement’s seizure of its servers.
| Sanctioned Entity | Designation Date | Estimated Illicit Volume | Primary Jurisdiction |
|---|---|---|---|
| Tornado Cash (Protocol) | August 8, 2022 | $7B+ laundered | OFAC (U.S.) |
| Lazarus Group / APT38 | Multiple (2019–2024) | $3B+ stolen | OFAC (U.S.), UN |
| Garantex Exchange | April 5, 2022 | $100M+ processed | OFAC (U.S.), EU |
| Hydra Market | April 5, 2022 | $5.2B+ transacted | OFAC (U.S.), BaFin (DE) |
| Chatex Exchange | November 18, 2021 | $157M+ processed | OFAC (U.S.) |
| Suex OTC | September 21, 2021 | $160M+ in ransomware | OFAC (U.S.) |
---
## How Does Crypto Sanctions Screening Work Technically?
Effective crypto sanctions screening goes far beyond maintaining a static list of wallet addresses. Modern compliance infrastructure requires a multi-layered technical approach that combines real-time address matching, graph-based chain analysis, and risk-scored indirect exposure detection.
**Direct Address Matching** is the baseline layer. Every wallet address involved in a transaction — sender, receiver, and any intermediate addresses — is compared against the full universe of designated addresses from OFAC, the EU Consolidated List, HMT Financial Sanctions (UK), and UNSC Consolidated List. This comparison must occur in real-time, before transaction settlement or fund release. For exchange operators processing millions of transactions per day, this requires indexed database lookups with sub-100ms latency.
**Transaction Graph Analysis** extends screening beyond one-hop relationships. OFAC’s guidance specifies that funds retaining a sufficient nexus to a sanctioned party remain tainted even after passing through intermediary wallets. Leading blockchain analytics platforms trace funds across 10–15 hops, flagging transactions where sanctioned entity exposure exceeds a defined percentage threshold (typically 10% direct, 50% indirect). This graph traversal analyzes UTXO chains on Bitcoin and account-based state transitions on Ethereum and EVM-compatible chains.
**Cluster Attribution** uses heuristics such as common-input-ownership analysis (for Bitcoin), contract interaction patterns, and behavioral clustering to associate unknown wallets with known entities. When a wallet cluster is attributed to a sanctioned entity, all addresses within that cluster become subject to blocking — even if not individually listed.
**Smart Contract Interaction Screening** has become essential post-Tornado Cash. Platforms must screen not only who a user transacts with, but whether their wallet history shows interaction with designated protocols. Defy’s screening engine flags wallets that have sent funds to or received funds from sanctioned smart contract addresses, enabling preemptive blocking before onboarding.
---
## What Is the Difference Between Direct and Indirect Sanctions Exposure?
One of the most consequential distinctions in crypto sanctions compliance is between direct and indirect exposure — a nuance that traditional financial compliance programs rarely needed to address at this granularity.
**Direct sanctions exposure** occurs when a transaction counterparty is itself listed on the SDN list or equivalent. A user attempting to withdraw funds to a Lazarus Group-attributed address, or an exchange receiving deposits from a designated Garantex wallet, represents clear direct exposure. In these cases, the obligation is absolute: freeze funds, file a blocked property report with OFAC within 10 business days, and do not release funds without a specific OFAC license.
**Indirect sanctions exposure** — sometimes called “taint” — arises when funds passing through a transaction have a traceable history involving a sanctioned party, even if the immediate counterparty is not designated. OFAC has not established a bright-line percentage threshold for indirect exposure, but industry practice informed by OFAC guidance typically treats any wallet with greater than 10% exposure to a sanctioned source as high-risk, requiring enhanced due diligence, transaction blocking, or suspicious activity reporting. Wallets with 25–50%+ indirect exposure are generally treated equivalently to direct exposure by leading compliance platforms.
| Exposure Type | Definition | Regulatory Obligation | Risk Level |
|---|---|---|---|
| Direct (1-hop) | Counterparty is SDN-listed | Block, freeze, report to OFAC | Critical |
| Indirect (2–5 hops) | Funds traceable to SDN address | EDD, possible blocking, SAR filing | High |
| Indirect (6–10 hops) | Distant taint, low percentage | Risk-based assessment, monitoring | Medium |
| Protocol Interaction | Wallet used designated mixer/contract | Enhanced screening, possible offboarding | High |
The practical implication for VASPs is that sanctions screening cannot rely solely on OFAC’s published address list, which contained approximately 15,000 cryptocurrency addresses as of early 2025. The true screening universe — including attributed clusters and indirect taint — encompasses tens of millions of addresses.
---
## What Are the Sanctions Compliance Obligations for VASPs Under US, EU, and UK Regimes?
VASPs operating across multiple jurisdictions face a complex, overlapping web of sanctions obligations. While the underlying prohibited conduct is similar — engaging with designated persons or blocked property — the specific legal frameworks, enforcement authorities, and procedural requirements differ materially.
**United States (OFAC):** U.S. persons and entities (including foreign branches of U.S. firms) must comply with OFAC regulations under IEEPA and the Trading with the Enemy Act (TWEA). VASPs are required to implement a risk-based sanctions compliance program, screen all customers and transactions against the SDN list, block prohibited transactions, and report blocked property within 10 business days. Civil penalties can reach the greater of $356,579 or twice the value of the transaction per violation (2024 inflation-adjusted figures). Criminal penalties include up to 20 years imprisonment and $1 million in fines per violation. OFAC has signaled through its 2021 Virtual Currency Compliance framework that it will consider the adequacy of a firm’s compliance program as a mitigating factor in enforcement actions.
**European Union (EU Sanctions):** The EU Consolidated List, maintained by the European External Action Service (EEAS), covers persons and entities designated under Common Foreign and Security Policy (CFSP) decisions. EU-regulated crypto asset service providers (CASPs) under MiCA (Markets in Crypto-Assets Regulation, effective December 2024) must screen against the EU list and are subject to national competent authority enforcement. Penalties vary by member state but can include license revocation, substantial fines, and criminal referrals. The EU Russia sanctions packages — particularly Regulations 833/2014 and 269/2014 as amended — contain specific provisions applicable to crypto asset transactions.
**United Kingdom (OFSI):** The Office of Financial Sanctions Implementation (OFSI) enforces the UK Sanctions and Anti-Money Laundering Act 2018 (SAMLA) and the associated sanctions regulations. Post-Brexit, the UK maintains its own consolidated list, which largely parallels but is not identical to OFAC and EU lists. VASPs registered with the FCA under the Money Laundering Regulations 2017 must screen against OFSI’s list. Civil monetary penalties can reach the greater of £1 million or 50% of the breach value, with criminal penalties of up to 7 years imprisonment under the Policing and Crime Act 2017.
| Jurisdiction | Primary Authority | Legal Framework | Max Civil Penalty | Crypto-Specific Guidance |
|---|---|---|---|---|
| United States | OFAC / Treasury | IEEPA, TWEA | $356,579+ per violation | October 2020, September 2021 framework |
| European Union | EEAS / National CAs | CFSP, MiCA | Varies by member state | MiCA Title VI (2024) |
| United Kingdom | OFSI / FCA | SAMLA 2018, MLR 2017 | £1M or 50% of breach | OFSI crypto guidance (2023) |
| United Nations | UNSC Committees | UNSC Resolutions | N/A (member state enforcement) | DPRK, Iran, Russia regimes |
---
## How Does Defy’s Real-Time Screening Catch Sanctioned Wallet Interactions?
Defy’s compliance infrastructure is purpose-built to address the full complexity of crypto sanctions screening — not merely list-matching against the published OFAC SDN address inventory. The platform’s Live AML module performs continuous, real-time screening at multiple layers simultaneously, enabling VASPs to intercept prohibited transactions before settlement.
At the core of Defy’s screening engine is a continuously updated dataset that aggregates sanctioned addresses from OFAC, the EU Consolidated List, OFSI, UNSC, and Interpol notices, normalized into a single queryable index. This index is updated within minutes of any OFAC SDN amendment — a critical capability given that OFAC sometimes designates addresses with immediate effect, leaving platforms with zero grace period for compliance. Address updates are pushed to Defy’s screening API in real time, ensuring that no transaction processed after a designation goes undetected.
Beyond direct address matching, Defy’s blockchain risk scoring engine analyzes transaction graphs across Bitcoin, Ethereum, Tron, BNB Chain, Solana, and 20+ additional networks. When a wallet initiates a transaction, the engine traces the origin of funds across historical transaction paths, computing a weighted exposure score based on the percentage of funds traceable to each risk category — including OFAC-designated sources, darknet markets, ransomware wallets, and high-risk exchanges. Wallets with sanctions exposure above configurable thresholds are automatically flagged for blocking or manual review, with a full audit trail generated for regulatory reporting.
Defy also screens smart contract interactions. When a user’s wallet shows historical interaction with Tornado Cash contracts, Sinbad.io, or other designated mixing services, the platform generates a high-severity alert and routes the customer to enhanced due diligence review. This indirect exposure detection capability is particularly important for DeFi platforms and DEX operators, where traditional transaction counterparty screening is insufficient due to the protocol-mediated nature of transactions.
For VASP customers operating in real-time payment environments, Defy’s API delivers screening decisions in under 200ms at scale — enabling transaction blocking without introducing unacceptable latency into the user experience. Each screening decision is logged with the full rationale, matched list sources, exposure percentages, and timestamp, creating the complete compliance record required for OFAC blocked property reports and regulatory examinations.
---
## What Are the Penalties for Sanctions Violations in Crypto?
The consequences of failing to implement adequate crypto sanctions screening are severe, and enforcement actions against VASPs have accelerated significantly since 2021. Understanding the penalty landscape is essential for calibrating the business case for compliance investment.
**Civil penalties** under OFAC’s enforcement framework are assessed on a strict liability basis. In the crypto sector, notable enforcement actions include: BitPay’s $507,375 settlement in 2021 for processing transactions involving users in sanctioned jurisdictions; Poloniex’s $10.39 million settlement in 2021 for similar geographic screening failures; Bittrex’s $29 million settlement in 2022 (combined OFAC and FinCEN) for apparent sanctions violations and BSA non-compliance; and Kraken’s $362,158.70 settlement in 2022 for transactions with users in Iran. The pattern is clear — OFAC treats the crypto sector as subject to the same rigorous standards as traditional financial institutions.
**Criminal penalties** represent an existential risk. The 2023 prosecution of Bitzlato founder Anatoly Legkodymov resulted in a guilty plea for unlicensed money transmission involving sanctioned parties. The 2024 guilty pleas by Binance and its CEO Changpeng Zhao — resulting in a $4.3 billion settlement and a $150 million personal fine — included sanctions violations as a key component of the DOJ and Treasury enforcement action. Criminal liability extends to individual compliance officers who knowingly facilitate prohibited transactions.
**Reputational and operational consequences** often exceed the direct financial penalties. Banking relationships are severed, licenses are revoked, and user trust evaporates following a public sanctions enforcement action. For many VASPs, the operational disruption of a Treasury enforcement action is more damaging than the fine itself.
| Enforcement Action | Year | Penalty | Primary Violation |
|---|---|---|---|
| BitPay | 2021 | $507,375 | Geographic screening failure |
| Poloniex | 2021 | $10.39M | Sanctioned jurisdiction transactions |
| Bittrex | 2022 | $29M (OFAC + FinCEN) | Sanctions + BSA violations |
| Kraken | 2022 | $362,158 | Iran transactions |
| Binance / CZ | 2024 | $4.3B + $150M personal | AML, sanctions, licensing |
---
## Conclusion: Building a Sanctions-Resilient Crypto Compliance Program
Crypto sanctions screening in 2025 is not a checkbox exercise — it is a technically complex, continuously evolving compliance obligation that requires real-time data, blockchain analytics, and a risk-based framework calibrated to the specific risks of virtual asset businesses. The regulatory expectations set by OFAC, the EU under MiCA, and OFSI in the UK are unambiguous: VASPs must screen all counterparties and transaction paths, not just direct wallet addresses against a static list.
The enforcement record demonstrates that inadequate screening — whether through outdated address lists, missing indirect exposure analysis, or delayed designation updates — results in material penalties and reputational damage. Conversely, firms that invest in robust, real-time screening infrastructure benefit from OFAC’s documented willingness to treat a strong compliance program as a significant mitigating factor in penalty calculations.
Defy’s platform is designed specifically to meet these obligations for crypto-native businesses, providing real-time multi-jurisdictional sanctions screening, transaction graph analysis, smart contract interaction detection, and full audit trail generation — enabling VASPs to operate with confidence in the most complex sanctions environment in the history of financial regulation.
---
*Sources: OFAC SDN List (ofac.treas.gov), OFAC Virtual Currency Guidance October 2020, OFAC Sanctions Compliance Framework September 2021, FinCEN BSA Guidance FIN-2019-G001, EU MiCA Regulation 2023/1114, OFSI Cryptoassets Guidance 2023, UN Panel of Experts DPRK Report 2024, Chainalysis Crypto Crime Report 2024, OFAC Civil Penalties and Enforcement Actions Archive.*