OFAC SDN List and Crypto: How It Works and How to Screen Wallet Addresses

If you operate a crypto-asset business in Europe or the United States, one name appears in almost every AML policy you will ever read: OFAC. The Office of Foreign Assets Control publishes the most comprehensive crypto sanctions database in the world, and failing to screen against it is one of the fastest ways to attract regulatory attention.

This guide explains exactly how OFAC sanctions work in the context of cryptocurrency, what the SDN list contains, and how to run an effective screening process.

What Is OFAC?

OFAC — the Office of Foreign Assets Control — is a financial intelligence and enforcement agency of the US Department of the Treasury. It administers and enforces economic and trade sanctions based on US foreign policy and national security goals.

OFAC operates under presidential emergency powers and statutory authority from laws including the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act. Its sanctions programs cover countries, governments, terrorist organizations, narcotics traffickers, and — increasingly since 2018 — cryptocurrency addresses.

Why OFAC Matters for European CASPs

A common misconception is that OFAC only applies to US businesses. In practice, the reach is much broader.

OFAC applies to any transaction that touches the US financial system. Because most stablecoin issuers, major exchanges, and blockchain infrastructure providers are incorporated in the US or process transactions through US correspondent banks, virtually any crypto transaction has some US nexus. OFAC has pursued enforcement actions against non-US entities that facilitated transactions involving sanctioned parties.

Under MiCA, European CASPs are also required to maintain robust AML/CFT frameworks. The EBA and national regulators increasingly expect CASPs to screen against OFAC as part of a comprehensive sanctions compliance program — not just the EU Consolidated List and UK OFSI, which contain far fewer crypto-specific entries.

The SDN List: What It Contains

The Specially Designated Nationals and Blocked Persons List (SDN List) is OFAC's primary sanctions database. It is a publicly available document listing individuals, entities, vessels, and aircraft whose assets are blocked and with whom US persons are generally prohibited from dealing.

As of mid-2026, the SDN list contains over 780 cryptocurrency wallet addresses across more than a dozen blockchains:

The addresses are embedded in SDN list entries as digital currency address identifiers, tagged with the currency type. OFAC began publishing crypto addresses in 2018 when it first designated two Bitcoin addresses associated with Iranian nationals.

Major Crypto-Related Sanction Programs

CYBER2 — North Korea / Lazarus Group

The CYBER2 program is the most active source of new crypto address designations. It covers North Korean state-sponsored hacking operations, most prominently Lazarus Group — responsible for some of the largest crypto thefts in history, including the $625 million Ronin Bridge hack and the $100 million Horizon Bridge attack.

Lazarus Group addresses appear across Ethereum, Bitcoin, and Tron. Many of these addresses are connected to complex multi-hop laundering schemes involving mixers, cross-chain bridges, and OTC desks.

Russia-related Programs (RUSSIA32, UKRAINE-EO13685)

Following the 2022 invasion of Ukraine, OFAC designated several crypto-related Russian entities. The most significant for CASPs is Garantex, a Russian crypto exchange that processed billions in transactions for criminal actors. OFAC, the EU, and the UK all designated Garantex simultaneously in 2022, making it one of the few entities appearing across all three major sanctions lists with associated crypto addresses.

SDGT — Global Terrorism

The Specially Designated Global Terrorists program has been used to sanction cryptocurrency addresses linked to Hamas, Hezbollah, and ISIS financing networks. These designations often involve addresses that received relatively small amounts but represent high-profile enforcement priorities.

IRAN, CUBA, SYRIA

Iran-related designations include individuals and entities that used cryptocurrency to circumvent traditional financial sanctions. Cuba and Syria programs similarly include crypto-related entries, though with fewer wallet addresses than the CYBER2 and Russia programs.

How OFAC Updates the SDN List

OFAC updates the SDN list on a rolling basis — there is no fixed schedule. New designations are published as they occur, which can be multiple times per week during active enforcement periods or following major geopolitical events.

For crypto compliance purposes, this means that a wallet address that was clean yesterday may appear on the list today. The practical implication is that screening should happen at transaction time, not just at onboarding.

OFAC publishes the list in multiple formats:

• XML (sdn_advanced.xml) — machine-readable, contains all digital currency address identifiers
• CSV — flat file, less structured
• PDF — human-readable, impractical for automated screening

For compliance infrastructure, the XML feed is the authoritative source. AML Radar syncs against this feed every 6 hours and extracts all crypto address entries along with their program tags, entity names, and designation dates.

The "Strict Liability" Problem

OFAC sanctions operate on a strict liability basis for civil penalties. This means that a violation can occur even if you had no knowledge that the counterparty was sanctioned. The violation is the transaction itself, not the intent.

This is why "we didn't know" is not a defense. OFAC considers factors such as the existence of a sanctions compliance program, the sophistication of the entity, and whether the violation was voluntarily self-disclosed when determining the penalty — but the violation still occurred.

Civil penalties for sanctions violations can reach up to $1,368,457 per transaction (the figure is adjusted annually for inflation) or twice the value of the transaction, whichever is greater. Criminal penalties can include imprisonment.

How to Screen Crypto Addresses Against OFAC

What to check

A complete OFAC screening for crypto should cover:

1. Direct address match — Is the exact wallet address on the SDN list?
2. Indirect exposure — Has the wallet transacted with a sanctioned address in its recent history?
3. Mixer exposure — Has the wallet interacted with Tornado Cash or other OFAC-designated mixing services?

The third point is important: OFAC designated Tornado Cash in August 2022, making any interaction with its smart contracts a potential sanctions issue. Simply having sent funds through Tornado Cash does not automatically constitute a violation, but it is a material risk signal that requires documented review.

Screening with AMLRadar

The AMLRadar Wallet Screener checks all three of these dimensions simultaneously:

• Direct match against the OFAC SDN list (synced every 6 hours from the official XML feed)
• Indirect exposure via transaction history analysis on EVM chains
• Known mixer and Tornado Cash pool detection

Results include the entity name, program designation, and date added to the list for any OFAC match — exactly the information your compliance documentation needs to capture.

Documenting your screening

For audit trail purposes, each screening should record:

• The wallet address checked
• The blockchain
• The timestamp of the check
• The result (clear or match)
• Which version of the SDN list was in effect at the time of the check

AMLRadar's MLRO Audit Trail logs all of this automatically and exports to CSV for regulatory submissions.

OFAC vs EU vs UK: Do You Need to Check All Three?

Yes. The three lists are maintained independently and diverge significantly for crypto:

The EU Consolidated List currently contains no cryptocurrency wallet addresses — sanctions are applied at the entity name level. This does not mean EU sanctions are irrelevant to crypto: it means that for direct wallet address screening, OFAC and UK OFSI are the operative lists, while EU sanctions require entity name matching separately.

Under MiCA's AML requirements and the forthcoming AMLR, CASPs are expected to screen against all three simultaneously as part of a defensible compliance program.

Common Mistakes in OFAC Crypto Screening

Checking only at onboarding. OFAC updates continuously. A counterparty address that was clean at onboarding may be designated six months later. Transaction-time screening is essential.

Relying on manual lookups. The OFAC website search is useful for occasional checks but does not scale and does not provide indirect exposure analysis or audit logging.

Ignoring mixer exposure. An address may not be on the SDN list but may have routed funds through Tornado Cash or another designated mixer. This creates residual risk that a reasonable compliance program should flag.

Not documenting the list version. If you are ever challenged on a compliance decision, you need to show which version of the SDN list was in effect when the check was performed, not just that you ran a check.

Conclusion

OFAC is the most important sanctions database for crypto AML compliance, and its reach extends well beyond US-incorporated businesses. For any CASP operating under MiCA, a robust compliance program includes OFAC screening at transaction time, indirect exposure analysis, and immutable documentation of every check.

The AMLRadar Wallet Screener provides all of this in a single, free tool — synced against the live OFAC SDN list every 6 hours, with a documented audit trail built in.

---

This article is for informational purposes only and does not constitute legal advice. Always consult a qualified compliance professional for guidance specific to your jurisdiction and business.