Crypto wallet AML check: screen any address for sanctions

On 8 August 2022 the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned the mixer Tornado Cash. On 26 November 2024 the Fifth Circuit held that Tornado Cash's immutable smart contracts were not property that could be blocked. On 21 March 2025 OFAC removed Tornado Cash and the 90 Ethereum addresses listed with it, and Treasury told US persons to exercise caution before transactions that could benefit malicious cyber actors or North Korea. A sanctions list check on one of those addresses gave a hit in 2024. Today it does not. Exchanges and payment firms keep each result as a dated record in their AML program for crypto: the address, the lists used, the result and who approved the transfer.

What is an AML check on a crypto wallet address?

An AML check on a crypto wallet tests one address against two kinds of data. OFAC defines a digital currency address as an alphanumeric identifier that represents a potential destination for a digital currency transfer (FAQ 559). The first is sanctions data. Authorities publish some addresses as identifiers of blocked persons. The second is risk intelligence, which records whether the address has received funds from mixers, darknet markets, ransomware operators, scams or exchanges with weak controls.

Risk intelligence separates direct from indirect exposure. Direct exposure means the address itself transacted with the risky source. Indirect exposure means the funds passed through one or more intermediate addresses first, and the closer the link, the more it weighs. The check is one part of know your transaction (KYT). It follows the transfer, where KYC follows the customer file.

Picture a payment firm whose customer asks to withdraw 3,000 USDT to an outside address (an illustrative case). The address has never dealt with a mixer. But the address that funded it received coins from one two hops earlier, so the result shows no direct exposure and some indirect exposure, and the analyst reads it before the withdrawal goes out.

Which wallet addresses are sanctioned, and where are they published?

On 6 May 2022 OFAC designated Blender.io, the first virtual currency mixer it sanctioned. In the same action it identified four more addresses that North Korea's Lazarus Group used to launder the rest of the proceeds from the Axie Infinity heist.

OFAC may add digital currency addresses to the SDN List entry of a blocked person as identifiers, and it warns that its address listings are not likely to be exhaustive. Each listed address names its currency (XBT for Bitcoin, ETH for Ethereum) and then an identifier of up to 256 characters. Exchanges are designated too. OFAC listed Garantex on 5 April 2022 and, on 14 August 2025, designated it again with its successor, Grinex.

OFAC's Sanctions List Search takes an address in its ID # field, and that field does not use fuzzy logic, so only an exact match comes back (FAQ 594). Firms can also screen against the downloadable SDN List files. In the UK, OFSI's financial sanctions guidance for ransomware, updated on 28 January 2026, says an asset freeze bars making funds or economic resources, cryptoassets included, available to a designated person.

What are the steps of a crypto wallet AML check?

The steps take one address at a time, as an analyst reviews a single deposit or withdrawal.

1. Copy the address from the transaction record. A retyped address can differ by one character, and an exact match search then returns nothing.
2. Note the network and the asset. Every address on the SDN List names its currency, so the record should say which chain and token the transfer used.
3. Run the check. complead, formerly Sanction Scanner, offers a free crypto wallet risk check: paste the address, and the page checks it against OFAC, UN and EU sanctions lists and ransomware threat intelligence with no account needed. It shows a risk verdict and sends the full report as a PDF by email.
4. Read the categories before the number. Note which category raised the result and whether the exposure is direct or indirect.
5. Screen the name behind the address. FATF guidance expects the sending and the receiving institution to screen the other party's name when they carry out a transfer (Updated Guidance, October 2021, para 193), so run the counterparty through a free sanctions check as well.
6. File the report with its date. The PDF, the decision and the analyst's name go into the case record.

If OFAC lists the address next month, the dated report from step 6 shows what the check returned on the day the transfer went out and who approved it.

What does a wallet risk score tell you, and what does it leave out?

The tool page lists four things behind its score: addresses published by OFAC and other authorities; exposure to darknet markets, mixers, ransomware and scam operations; links to exchanges with weak or absent KYC controls; and transaction behavior such as peeling chains and rapid layering. Its FAQ adds that direct and indirect exposure are weighted by how close the links are. Take an exchange exposure result. It describes where the funds came from, a platform with weak checks, and says nothing about what the customer did.

On a high score, the tool page says the address has exposure worth investigating and that "the score is an input to a decision, not the decision itself." Its header reads "any wallet, any chain", while its FAQ says the check covers "the major chains, including Bitcoin and Ethereum along with widely used tokens." FATF notes that not all virtual assets are covered by all analytics vendors (para 234). On a little used chain, a low score can mean thin data.

What does one check not tell you?

First, who owns the address. FATF says the ledger may let authorities trace a transaction to an address without readily linking that address to a person (para 162).

Nor does one result cover the future. OFAC suggests a historic lookback once it lists a new address, and rescreening as lists change (virtual currency guidance, pages 15 and 16). For the customer file, that rescreening is the job of ongoing monitoring. Last comes the sender's identity, because travel rule data moves between firms separately from the transfer.

How do you act on a high risk wallet result?

Table 1. Exposure categories and the first action for each (illustrative: each firm sets its own thresholds and routes)

A match to a listed address is a sanctions question. A US person who holds virtual currency that must be blocked denies all parties access to it and reports it to OFAC within 10 business days, then once a year while it stays blocked. The institution may tell the customer about the block, and the customer may apply for its release (FAQ 647).

A risk result without a listing is an AML question. Hold the transfer first. Then ask the customer for the source of funds behind the coins and decide with the answer on file. If suspicion remains, a US money services business files a suspicious activity report when the transaction involves at least $2,000, no later than 30 calendar days after it first detects the facts (31 CFR 1022.320). The report, and anything that would reveal it, stays confidential, and FATF asks countries to apply the same tipping off ban to VASPs (para 213).

Why did an exchange hold my deposit after a wallet check?

Picture someone who buys 0.2 bitcoin from a peer to peer seller and sends it to an exchange account (an illustrative case). The exchange screens the sending address and finds that the coins passed through a mixer before the seller owned them. That is indirect exposure. It can justify a hold even when the buyer did nothing wrong.

Expect questions about the purchase record, the seller and the wallets used. A crypto exchange KYC form shows what an exchange may ask: the addresses you send from or receive to, whether each is self hosted, and how you came to hold the coins. The exchange will not tell you whether it filed a report. Tipping off rules forbid that.

You can check your own address first, since the free check takes any address and needs no account. A clean result from your own check does not bind the exchange, which runs its own screening.

Which rules require crypto wallet screening?

FATF Recommendation 15 requires that virtual asset service providers be regulated for AML and CFT purposes and licensed or registered. The 2021 guidance asks a VASP to screen its customers' and counterparties' wallet addresses, as part of ongoing monitoring, against the blacklisted addresses that other VASPs make available (para 273). The FATF's seventh targeted update, published on 16 July 2026, lists unhosted wallets among the risks that authorities and the private sector should address.

In the EU, Regulation (EU) 2023/1113 has applied since 30 December 2024. A crypto asset service provider sends the originator's distributed ledger address with each transfer. For a transfer of more than EUR 1,000 to a self hosted address, it also assesses whether the originator owns or controls that address (Article 14(5)). MiCA authorization adds conduct rules on top.

In the US, OFAC's obligations are the same whether a transaction is in digital currency or fiat (FAQ 560), and FinCEN's guidance of 9 May 2019 applies the money services business rules, an AML program and SAR filing among them, to business models that transmit convertible virtual currency. The GENIUS Act, signed on 18 July 2025, treats a permitted payment stablecoin issuer as a financial institution under the Bank Secrecy Act once it takes effect, on 18 January 2027 at the latest (Section 20), with the technical capabilities to block, freeze and reject impermissible transactions (Section 4(a)(5)).

Before the end of this week:

1. Run the last ten withdrawal addresses your team approved through the check, and compare each result with the decision on file.
2. Add the network, the asset and the date to every wallet check record.
3. Name who decides on an indirect exposure result, and by when.