OFAC Crypto Address Checker
Check if a cryptocurrency wallet address is on OFAC's Specially Designated Nationals (SDN) List. This tool simulates OFAC's wallet screening process to help you understand compliance requirements.
Understanding OFAC Compliance
OFAC requires screening all transactions against the SDN List. If a wallet address is blocked, you must immediately freeze the funds and report to OFAC within 10 business days. Even a single transaction involving a sanctioned address can result in penalties up to $750,000.
When you run a cryptocurrency exchange, wallet service, or even a DeFi platform, you might think your users’ transactions are private, decentralized, and beyond the reach of governments. That’s not true. OFAC cryptocurrency sanctions apply to every digital asset transaction involving U.S. persons, U.S.-based companies, or any activity that touches the U.S. financial system. And if you’re not prepared, you could be hit with a $750,000 fine - like ShapeShift was in September 2025 - for letting users in sanctioned countries trade crypto worth over $12 million over two years.
What Is OFAC and Why Does It Matter for Crypto?
The Office of Foreign Assets Control (OFAC), part of the U.S. Treasury, has been enforcing economic sanctions since 1950. But it didn’t start targeting digital assets until 2018, when it first blocked Bitcoin and Ethereum addresses linked to North Korea and ransomware gangs. Since then, OFAC has made it crystal clear: blockchain doesn’t exempt you from U.S. law.
In October 2021, OFAC released its Sanctions Compliance Guidance for the Virtual Currency Industry. This wasn’t just a reminder - it was a rulebook. It said: if you’re a U.S. company, or if your service is used by someone in the U.S., you’re legally required to screen every transaction against the Specially Designated Nationals (SDN) List. That list now includes over 1,200 cryptocurrency wallet addresses tied to sanctioned entities like terrorist groups, drug cartels, and Russian cybercriminal networks.
And here’s the kicker: OFAC operates under strict liability. That means you don’t have to know you’re breaking the rules to get punished. If a user from Iran sends you 0.5 ETH, and your system doesn’t block it - even if you didn’t realize they were in Iran - you’re in violation. No intent required. No excuses accepted.
The SDN List: Your Crypto Compliance Lifeline
OFAC’s SDN List is the single most important tool in your compliance toolkit. It’s not just names and countries anymore. It’s wallet addresses. Ethereum public keys. Bitcoin UTXOs. Every single one of these can be frozen.
As of October 2025, the SDN List had 27,538 total entries - and 1,247 of them were digital currency addresses. These aren’t random. They’re linked to specific bad actors. Garantex, for example, was designated in 2022 for helping Russian financial actors. By August 2025, OFAC went further - it blocked not just Garantex, but six of its successor companies and even executives tied to the operation. That’s called “network sanctions.” And it’s becoming the new norm.
If your platform processes a transaction to or from one of these addresses, you’re legally required to block it. You can’t just ignore it. You can’t “let it pass once.” You have to freeze the funds and report them to OFAC. And you don’t have to convert them to dollars. You can keep them as crypto - locked in a designated “Blocked SDN Digital Currency” wallet. But they can’t move. Ever.
How to Build a Real Compliance Program
OFAC doesn’t expect you to be perfect. But it does expect you to have a system. A proper Sanctions Compliance Program (SCP) has five core parts:
- Management Commitment - Your board or CEO must sign off. This isn’t just the job of your compliance officer. It’s a company-wide responsibility.
- Risk Assessment - You need to document your exposure: Where do your users come from? What coins do you support? Do you offer privacy coins like Monero or Zcash? Update this every quarter.
- Internal Controls - This is where tech comes in. You need blockchain analytics tools like Chainalysis, Elliptic, or Crystal Intelligence to screen wallets in real time. These tools connect to OFAC’s SDN List and flag matches before a transaction confirms.
- Testing and Auditing - Hire an outside firm to test your system at least once a year. Internal checks aren’t enough. Regulators want proof.
- Training - Every employee who touches transactions needs training. ACAMS found compliance officers need 147 hours of crypto-specific training just to get started.
Setting this up takes time. A 2025 Steptoe & Johnson study found it takes 22 to 36 weeks to go from zero to fully compliant. That’s half a year. And it costs between $150,000 and $2 million a year, depending on your volume.
Tools That Actually Work
You can’t screen wallets with Excel. You need specialized software. The top three tools used by exchanges in 2025 are:
- Chainalysis Reactor - Used by Coinbase and Kraken. Known for accurate matching and low false positives. Kraken cut its false alerts from 18% to 4.3% after implementation - but it cost $450,000.
- Crystal Explorer - Popular among smaller firms. Offers customizable risk rules and supports privacy coin analysis.
- TRM Labs - Strong API integration, but users report weaker documentation. Rated 3.2/5 on G2.
These tools don’t just check addresses. They track transaction patterns. If someone sends crypto through 12 different wallets in 10 minutes to avoid detection, the software flags it as “chain-hopping” - a known evasion tactic.
But even the best tools struggle with privacy coins. Monero and Zcash are designed to hide sender, receiver, and amount. OFAC says you still need “reasonable measures” to block them. That means you might have to restrict trading on those coins entirely - which is what Binance did in 2024 after their internal audit found 12% of Monero transactions involved sanctioned addresses.
What Happens When You Fail?
ShapeShift’s $750,000 penalty wasn’t the biggest fine ever - but it was the most telling. Why? Because they didn’t use geolocation. Their system didn’t check where users were logging in from. They allowed users in Cuba, Iran, Sudan, and Syria to trade crypto for nearly two years. Over 500 different IP addresses. No block. No warning. Just $12.5 million in transactions flowing through.
OFAC didn’t care that ShapeShift claimed they didn’t know. They didn’t care that the users were using VPNs. The law doesn’t care about technical excuses. If your system doesn’t prevent access from sanctioned countries, you’re liable.
Compare that to Binance. In 2025, they reported a 99.98% screening accuracy rate across 1.2 million daily transactions. How? They spent $2 million on their compliance system. They integrated real-time geolocation. They updated their SDN list daily. They trained 200 staff members. They didn’t cut corners.
How OFAC Compares to the Rest of the World
The U.S. is the toughest on crypto sanctions. OFAC has issued 17 enforcement actions since 2018, totaling $48.7 million in penalties. The UK’s OFSI? Three actions. Singapore? Five. And most of those were for money laundering - not direct sanctions violations.
Why the difference? OFAC uses strict liability. The EU’s 6AMLD directive allows companies to defend themselves if they can prove they took “reasonable measures.” OFAC doesn’t. Even if you did everything right - if one wallet slipped through - you’re still fined.
Also, OFAC goes after networks. When Garantex was hit, so were its executives, its successor companies, and even its cloud hosting provider. That’s a warning: if you work with a sanctioned entity, even indirectly, you’re at risk.
Biggest Challenges Right Now
Here’s what crypto compliance teams are struggling with in 2025:
- DeFi protocols - If you’re lending on Aave or swapping on Uniswap, who’s the counterparty? No KYC. No identity. OFAC says you still need “reasonable measures.” But how? Most firms just block all DeFi access.
- Privacy coins - Monero, Zcash, Dash. You can’t screen them. So you either ban them or risk non-compliance.
- False positives - Even the best tools flag innocent wallets. Coinbase’s team gets 12-15% false alerts daily. That means 1 in 8 flagged transactions is a mistake. Someone’s money gets frozen. They complain. You waste hours investigating.
- Constant updates - OFAC added 37 new crypto addresses in Q2 2025 alone. Your system has to update daily. Manual checks won’t cut it.
What’s Coming in 2026 and Beyond
OFAC isn’t slowing down. In September 2025, they launched a new Digital Asset Sanctions Task Force with 35 specialists. The Treasury’s 2026 budget requests $28 million for crypto enforcement - up 40% from last year.
And there’s a quiet revolution happening: Ethereum is testing EIP-7594, a proposal to build sanction compliance directly into the blockchain. Imagine a wallet that refuses to send funds to a blocked address - automatically. But the Ethereum community is pushing back hard. Over 1,200 comments on the AllCoreDevs forum called it “centralized censorship.”
Meanwhile, Gartner predicts the crypto compliance market will hit $1.8 billion by 2026. That’s not just exchanges. It’s banks, payment processors, even NFT marketplaces. If you’re handling crypto and you’re connected to the U.S. financial system, you’re in scope.
Where Do You Start?
If you’re reading this and you’re running a crypto business - here’s your action plan:
- Check your SDN List coverage. Are you screening wallets? Or just names?
- Verify your geolocation. Can you block users from Iran, Syria, North Korea?
- Review your privacy coin policies. Are you trading Monero? If yes, you’re at high risk.
- Test your system. Run a mock transaction to a known blocked address. Does your tool catch it?
- Train your team. One person can’t handle this alone. You need at least two trained staff.
Compliance isn’t optional. It’s the cost of doing business in crypto today. The technology exists. The rules are clear. The penalties are real. The question isn’t whether you can afford to comply - it’s whether you can afford not to.
Does OFAC only target U.S.-based crypto companies?
No. OFAC applies to anyone doing business with U.S. persons, using U.S. financial systems, or operating within U.S. jurisdiction - even if they’re based overseas. If a user in Germany uses your exchange and connects via a U.S. server, or if your payment processor is based in the U.S., you’re in scope. OFAC’s jurisdiction is based on activity, not location.
Can I avoid OFAC sanctions by using a decentralized exchange (DEX)?
No. OFAC has made it clear that DeFi protocols are not exempt. If your DEX allows users from sanctioned countries to trade, and you’re a U.S. person or entity, you’re liable. OFAC’s October 2025 update to FAQ 646 requires “reasonable measures” to prevent transactions involving blocked persons - even if you can’t identify the counterparty. Many DEXs now block access from sanctioned jurisdictions or disable certain tokens to comply.
What happens if I accidentally process a transaction with a sanctioned address?
You must immediately freeze the assets and report the transaction to OFAC within 10 business days. You’re required to file a “Blocked Property Report” (Form OFAC-100). Even if it was an honest mistake, failure to report or block the funds can result in penalties. OFAC does consider voluntary self-disclosure as a mitigating factor - but only if you act fast and fully cooperate.
Do I need to screen every single wallet address, even for small transactions?
Yes. Unlike the FATF Travel Rule, which only applies to transactions over $1,000, OFAC requires screening for all transactions - no matter the size. A $5 transfer to a sanctioned address is still a violation. Your compliance system must screen every incoming and outgoing transaction in real time.
How often does OFAC update its SDN List with new crypto addresses?
OFAC updates the SDN List daily. In Q2 2025 alone, they added 37 new cryptocurrency addresses. Your screening tool must sync with OFAC’s official API (available via Treasury’s GitHub repository) at least once every 24 hours. Manual checks are too slow. Automated updates are mandatory.
Can I use free blockchain explorers like Etherscan to check for sanctions?
No. Free explorers like Etherscan or Blockchain.com don’t flag sanctioned addresses. They show transaction history, but they don’t cross-reference OFAC’s SDN List. Relying on them is like using Google to check if someone has a criminal record. You need a licensed blockchain analytics tool with direct OFAC integration - and even those require regular tuning to reduce false positives.
Are NFTs subject to OFAC sanctions too?
Yes. Any digital asset - including NFTs - is subject to OFAC rules if it’s traded by a U.S. person or through a U.S.-based platform. In 2024, OFAC blocked an NFT collection linked to a sanctioned Russian oligarch. If you operate an NFT marketplace, you must screen wallet addresses involved in sales, bids, and transfers - just like you would for cryptocurrency.
What if my users use a VPN to hide their location?
Using a VPN doesn’t protect you. OFAC expects you to implement layered controls - including IP geolocation, device fingerprinting, and behavioral analysis. If a user logs in from 12 different countries in one day, or uses a known Tor exit node, your system should flag them for review. Relying solely on IP checks is insufficient. You need to detect patterns, not just locations.
Kelly McSwiggan
November 15, 2025 AT 03:53Vanshika Bahiya
November 16, 2025 AT 20:28Drew Monrad
November 17, 2025 AT 16:42Byron Kelleher
November 17, 2025 AT 19:01Cherbey Gift
November 18, 2025 AT 07:25Anthony Forsythe
November 19, 2025 AT 21:30Kandice Dondona
November 21, 2025 AT 00:05Becky Shea Cafouros
November 21, 2025 AT 08:24Cody Leach
November 23, 2025 AT 06:00sandeep honey
November 23, 2025 AT 06:39Mandy Hunt
November 24, 2025 AT 03:14anthony silva
November 25, 2025 AT 13:01David Cameron
November 25, 2025 AT 22:18Sara Lindsey
November 27, 2025 AT 04:12alex piner
November 27, 2025 AT 07:28Gavin Jones
November 29, 2025 AT 00:17Mauricio Picirillo
November 30, 2025 AT 11:40Liz Watson
December 1, 2025 AT 00:30Rachel Anderson
December 2, 2025 AT 22:50Hamish Britton
December 3, 2025 AT 13:14Robert Astel
December 4, 2025 AT 11:57Andrew Parker
December 5, 2025 AT 05:21Kevin Hayes
December 6, 2025 AT 09:27Katherine Wagner
December 8, 2025 AT 06:56ratheesh chandran
December 8, 2025 AT 14:10Hannah Kleyn
December 8, 2025 AT 21:10gary buena
December 9, 2025 AT 03:44Albert Melkonian
December 9, 2025 AT 06:02