Free Crypto Sanctions Screening: What It Covers and Where It Fails
Free crypto sanctions screening tools exist and have real uses. Here is what they actually check, the four gaps that make them unusable as a compliance control, and when to upgrade.
Free sanctions screening tools are a reasonable search. Screening is a legal obligation with no minimum revenue threshold, and an early-stage team with no budget still has to do it. So what can you actually get for nothing, and where does it stop being enough?
What free tools genuinely do
Several useful free resources exist:
- Official list lookups. OFAC's SDN search, the EU consolidated list and the UN list are all publicly searchable, free, and authoritative. For a one-off check on a name or a wallet address published on a list, they are the primary source.
- Free address checkers. Some blockchain analytics vendors expose a limited lookup that tells you whether an address appears on a sanctions list or has direct exposure to one.
- Open-source datasets. Aggregated sanctions data is published in machine-readable form and can be self-hosted.
For a genuinely pre-revenue team doing occasional manual checks, this is a legitimate starting point. It is better than nothing, and "nothing" is the actual alternative for a lot of early projects.
The four gaps that break it
1. No continuous re-screening
This is the big one. Sanctions lists change constantly. A customer who cleared at onboarding may be designated three months later, and the obligation is to know. Free tools give you a point-in-time answer. Compliance requires a standing one — every customer re-screened against every list update, automatically, with a record.
Manually re-checking a book of 2,000 customers each time OFAC updates is not a process anyone sustains.
2. No fuzzy matching
Real screening has to catch transliteration variants, name ordering, nicknames and deliberate misspellings. "Mohammed" versus "Muhammad", surname-first conventions, and Cyrillic transliteration all defeat exact-match lookups. Commercial engines score partial matches and let you tune the threshold; free lookups return a match or nothing.
An exact-match-only control creates the illusion of screening while missing the cases most likely to matter.
3. No indirect exposure
A wallet is rarely on a list itself. What matters is whether funds reached it through a sanctioned entity two or three hops back. That requires clustering and attribution data, which is precisely the expensive part of the product. Free address checkers typically flag direct designation only.
4. No audit trail
Even if you catch everything, you cannot prove it. Supervisors ask for evidence of who was screened, against which list version, on what date, with what result and what decision followed. A browser search leaves no record. This alone fails an inspection regardless of how diligent the underlying work was.
The honest threshold
Free tools are defensible while you have no customers. The moment you onboard third parties and hold their assets, you need screening that is continuous, fuzzy-matched, exposure-aware and logged. That is not a vendor upsell, it is what the obligation actually says.
The practical trigger points:
- You are onboarding customers rather than testing with your own funds
- You are preparing a licence application — the file will be assessed on this
- You have banking relationships that ask about your controls
- Your customer count has passed the point where manual re-screening is realistic (in practice, low hundreds)
What to move to
When you upgrade, the questions that matter are list coverage and refresh frequency, fuzzy-match tuning, indirect exposure depth, chain coverage for the networks you actually settle on, and the quality of the audit export. We compare the options in best sanctions screening software for crypto exchanges.
Screening is one control among several. It pairs with ongoing behavioural monitoring — see crypto transaction monitoring software — and with identity checks at onboarding, covered in best crypto KYC providers. Screening beyond sanctions into PEP and adverse media is set out in watchlist and PEP screening explained.
One thing not to do
Do not build a partial in-house solution on free datasets and describe it to a regulator as a screening programme. Self-hosting sanctions data is legitimate engineering, but without fuzzy matching, continuous re-screening and an audit trail it will be assessed as inadequate — and having built something makes the gap look deliberate rather than resource-constrained.
If budget is the constraint, say so and document a dated plan to close it. Supervisors deal with that far better than with a control that looks complete and is not.
For the full programme view, see our crypto AML compliance guide for exchanges and VASPs.
