Sanctions Screening for Crypto: OFAC, EU, UN — Architecture & Vendors (2026)

Sanctions screening is the single highest-stakes control inside a regulated CASP's AML programme. The downside of a missed sanctions hit is not a fine — it is loss of correspondent banking, criminal liability for senior managers under several national laws, and (in the US extraterritorial case) blocking from USD-cleared payments globally. Office of Foreign Assets Control enforcement against non-US firms has accelerated since 2022 and the OFAC SDN list now contains specific crypto wallet addresses, putting screening obligations directly into the blockchain-analytics layer.¹^[1]

Every CASP must screen against four overlapping but non-identical lists: the OFAC Specially Designated Nationals list, the EU Consolidated List of restrictive measures, the United Nations Security Council Consolidated List, and (for any CASP serving UK customers) the UK OFSI list. The lists overlap on major designations but diverge materially at the margins — particularly on Russia-related restrictive measures, Iran sanctions, and crypto-specific wallet listings. EU-only screening fails US correspondent diligence; OFAC-only screening fails EBA Guidelines.²^[2]³^[3]⁵^[4]

This guide explains how to architect sanctions screening across the wallet level (Chainalysis, Elliptic, TRM Labs) and the identity level (ComplyAdvantage, Refinitiv World-Check, LexisNexis Bridger, Dow Jones Risk), how the four lists interact, what the supervisor expects to see at authorisation and at inspection, the pricing benchmarks for the typical stack, and the common failure modes that turn a sanctions hit into a regulatory event.

EEA-licensed CASPs face a four-list screening obligation that has hardened materially since 2022. The lists overlap heavily on the largest designations (Russia post-invasion, Iran's IRGC, North Korea's Lazarus Group, terrorist financing entities) but each has unique designations that must be screened independently.

Sanctions screening at a regulated CASP operates at two distinct technical layers: wallet-level (blockchain addresses) and identity-level (natural persons, companies, vessels). Each requires different vendors, different update cadences, and different interpretation logic.

A complete sanctions screening architecture for a CASP combines five layers, each with its own controls and vendor relationships. Missing any one layer creates a documented gap that supervisors flag at first inspection.

• Onboarding identity screen. Every new natural-person and corporate customer screened against OFAC + EU + UN + OFSI at the moment of onboarding. PEP screening overlaid with the same vendor.

• Ongoing identity screen. Every customer re-screened daily (or at least weekly) against updated lists. Match alerts routed to the AML team for rapid triage.

• Wallet screening on inbound deposits. Every inbound crypto deposit address screened against the wallet-level lists via Chainalysis / Elliptic / TRM Labs. Direct sanctions hits trigger automatic freeze plus FIU report.

• Wallet screening on outbound withdrawals. Same screening on withdrawal destination addresses pre-send. Outbound to sanctioned address: blocked, escalated, MLRO-reviewed.

• Indirect exposure / hop tracing. Periodic forensic reviews of customer counterparty chains to identify exposure within 1–3 hops of sanctioned addresses. Risk-based decisions on continued service.

Wallet-level vendors are covered separately (Chainalysis vs Elliptic vs TRM Labs). The identity-level market is dominated by four vendors, with structurally different posture, list coverage, and pricing.

A complete sanctions screening stack — wallet-level analytics + identity-level vendor + ongoing monitoring infrastructure — runs €100,000–€280,000 per year for a mid-sized CASP. The breakdown:

• EU-only screening, OFAC ignored. Most common failure in EEA CASPs. Detected on first US correspondent diligence and is a fatal AML programme weakness.

• Onboarding screening only, no ongoing. List updates daily; a customer onboarded clean three months ago may now be a designated PEP.

• Wallet screening on deposits only, not withdrawals. Outbound withdrawals are when sanctioned-counterparty exposure crystallises into outright sanctions violation.

• Fuzzy matching too strict. Sanctioned individuals frequently use minor name variants (transliteration, middle-name omission). Strict exact-match screening misses 20–40% of true positives.

• No documented disposition for true positives. Discovery of a sanctioned wallet hit must trigger freeze, FIU report, internal escalation — a documented playbook, not improvisation.

• Indirect-exposure tracing absent. A customer transacting with a counterparty 1 hop from Tornado Cash is a sanctions-risk signal even if the customer's direct wallet is clean.

• No annual independent audit of screening rules. EBA Guidelines require independent review; absence is a clean inspection finding.

OFAC enforces sanctions extraterritorially through three mechanisms. Each one alone has stopped non-US fintechs from operating; together they make OFAC compliance functionally non-optional for any CASP with USD exposure.

• Secondary sanctions. A non-US firm transacting with primary-sanctioned counterparties can be itself listed, blocking it from USD-cleared payments globally.

• Correspondent-banking pressure. US correspondent banks of EEA institutions require the EEA bank to enforce OFAC compliance on its own customers — a non-US CASP that fails OFAC screening loses its EU bank's USD line.

• Civil monetary penalties. OFAC has imposed multi-million-dollar penalties on non-US firms for crypto sanctions violations involving sanctioned addresses (BitGo, BitPay, Bittrex, Kraken settlements 2022–2024).

Yes if you have any USD exposure, US correspondent banking, US-resident customers, or US-cleared payments — which describes almost every operationally serious CASP. EEA NCAs do not formally require OFAC screening, but US correspondent banks do, and your Travel Rule counterparty network includes US-licensed CASPs that screen incoming transfers against OFAC. Practical answer: yes, screen against OFAC.

OFAC SDN typically updates within hours of designation announcements. EU Consolidated List updates within 24–48 hours of EU Council decisions. UN Consolidated List updates within 48–96 hours of Security Council resolutions. UK OFSI updates within 24–72 hours. Vendor consumption layers (ComplyAdvantage, Refinitiv) propagate updates within 1–6 hours of source publication for premium tiers.

Document the disposition. Standard practice: AML analyst reviews the alert with corroborating identity data (full DOB, ID number, country of residence), determines true vs false positive, dispositions the alert with a written rationale, and escalates true positives to the MLRO. Supervisors examine false-positive disposition documentation as carefully as true-positive handling — sloppy false-positive workflow is itself an AML programme weakness.

Yes, generally — and you must on a confirmed hit. EU restrictive measures and OFAC blocking regulations require immediate freezing of assets belonging to designated persons. The freeze is mandatory, not discretionary. Communication with the customer is restricted by tipping-off rules under 6AMLD national transpositions; standard practice is to freeze, file the FIU report, and consult counsel before any communication beyond a generic 'review in progress' message.

Direct exposure (a wallet that has interacted with Tornado Cash addresses) is a clear high-risk hit and most CASPs decline service. Indirect exposure (a counterparty 1–3 hops from a mixer) requires risk-based decisions. The Tornado Cash designation in 2022 set the benchmark: most regulated CASPs treat 1-hop exposure as automatic EDD, 2-hop as risk-based EDD, 3-hop as monitored. Document the policy.

AMLR codifies harmonised sanctions screening obligations across the EU including specific timelines for re-screening, EDD triggers, and FIU reporting. AMLA's direct supervision of significant CASPs from 2028 will likely set common methodology standards across vendors. Practical impact: identity-level screening cadence will tighten (likely toward daily refresh as the standard rather than weekly), and wallet-level screening will move from optional to mandatory at the regulation level rather than the EBA Guideline level.

• Chainalysis vs Elliptic vs TRM Labs: Choosing blockchain analytics in 2026

• AML Compliance for Crypto Firms: What the 6AMLD requires from CASPs and VASPs

• MLRO Hiring Guide for CASPs: What to look for, what to pay

• USD Treasury for Non-US Fintechs: BCB, Wise, JP Morgan, Cross-River — provider selection by volume tier

Sanctions screening is the AML control with the highest asymmetric downside in a regulated CASP — modest cost to do well, catastrophic cost to do badly. The architecture is now well-understood: layered screening across wallet-level and identity-level, four lists screened in parallel, ongoing monitoring with documented disposition workflow, and an annual independent audit. Implement the full stack before launch, document every layer in the AML programme, and run table-top exercises annually on suspected-hit handling. The cost is modest. The cost of a missed sanctions hit is the business.