OFAC Sanctioned Crypto Addresses: How the SDN List Works

OFAC adds some crypto addresses to the SDN List as identifiers of sanctioned people and entities. You can look an address up in OFAC's Sanctions List Search, but only an exact match counts, and OFAC says its address lists are not likely to be exhaustive. That is why AML checkers look beyond the list and flag addresses that sent or received funds from a sanctioned wallet.

What OFAC lists, and since when

OFAC is the US Treasury office that runs economic sanctions. Its main list is the SDN List: people and entities whose property is blocked. US persons generally may not deal with them, directly or indirectly.^[1]

In November 2018, Treasury designated two Iran-based men who helped turn SamSam ransomware bitcoin into Iranian rial. Treasury said this was the first time OFAC publicly tied digital currency addresses to designated individuals.^[2]

OFAC says it adds addresses to alert the public to identifiers linked to a blocked person.^[3] The address is not the sanctioned party. The person or entity behind it is.

How an address appears on the SDN List

OFAC FAQ 563 sets a fixed format. Each address gets its own field. The field starts with "Digital Currency Address", then a dash, then the currency's symbol, for example "Digital Currency Address - XBT" for Bitcoin or "Digital Currency Address - ETH" for Ethereum. The address itself follows, up to 256 characters.^[4]

So one SDN entry can carry many addresses, across several networks. Screening one address on one network does not cover the rest of that person's wallets.

How to search the list

OFAC's Sanctions List Service gives access to the SDN List and the Consolidated (non-SDN) List, file downloads, and the Sanctions List Search tool.^[5]

To check an address:^[6]

1. Open Sanctions List Search.
2. Paste the full address into the ID # field, not the name field.
3. Click Search.

The ID # field does not use fuzzy logic. Only an exact match is returned. A typo, a missing character or a different address format gives "no result", not "clean". For bulk screening, OFAC points to its list files and downloads instead.^[6]

What the rules say about blocking

OFAC FAQ 560 says sanctions obligations are the same for digital and fiat currency. US persons must block property of SDN-listed persons and of entities owned 50 percent or more by blocked persons. OFAC suggests a risk-based compliance program that usually includes list screening.^[7]

FAQ 562 goes further. If you hold crypto in a wallet you believe belongs to, or is linked to, an SDN, you should block it and report to OFAC with what you know about who owns it. The address does not have to be listed.^[3]

FAQ 646 explains what blocking means for crypto:^[8]

• Deny all parties access to the blocked virtual currency.
• Report it to OFAC within 10 business days, then once a year while it stays blocked.
• There is no duty to convert it to dollars or hold it in an interest-bearing account.
• A company may block each wallet or pool blocked funds, if controls allow release only under an OFAC authorization or once the legal prohibition ends.

The 2021 guidance and indirect exposure

In October 2021, OFAC published "Sanctions Compliance Guidance for the Virtual Currency Industry".^[1] It is aimed at exchanges, wallet providers, miners and other firms. Several points explain how AML tools behave:^[1]

• Strict liability. OFAC may impose civil penalties even where a firm did not know it was dealing with a sanctioned party.
• Unlisted addresses. An unlisted address that shares a wallet with a listed one may pose sanctions risk.
• Lookbacks. After OFAC lists an address, firms may review past activity to find connections to it, including unlisted addresses that transacted with it.
• Tools. OFAC says firms may consider blockchain analytics tools to find these risks.
• Location. It recommends geolocation and IP blocking, since users from sanctioned regions are a risk too.

The last point is not theory. In October 2022, OFAC settled with the exchange Bittrex for $24,280,829.20 over 116,421 apparent violations. Its vendor screened against the SDN List, but users from sanctioned jurisdictions got through. Bittrex had IP and address data that showed where those users were and did not screen it.^[9]

Why your AML checker flags more than the list

An AML checker reads the same signals. It usually reports two kinds of risk:

• Direct exposure: the address is on the SDN List, or sent funds straight to or from a listed address.
• Indirect exposure: funds reached the address through one or more hops from a listed address or entity.

Indirect exposure is not a legal finding. It is a risk signal that a compliance team weighs. Exchanges have their own policies on how many hops and what share of funds they accept. Our guide to AML risk scores explains how scores are built, and the sanctions risk category page covers how checkers label it.

Listings also change. When Tornado Cash addresses were removed from the SDN List, checkers had to update their data; see our post on the Tornado Cash delisting.

What to do

1. Search the exact address in Sanctions List Search using the ID # field. Copy it, do not retype it.
2. Treat "no result" carefully. OFAC's list is not exhaustive, so a missing address is not proof of a clean source.
3. Run an AML check before you accept a large payment, to catch indirect exposure. See our list of free and paid checkers.
4. Do not send funds back on your own if a check shows sanctions exposure. Talk to your exchange or a lawyer first; blocking rules may apply.
5. Keep records of the checks you ran and when.

This article explains OFAC's public guidance. It is not legal advice.