Free Crypto Sanctions Screening: 2026 Tools and Limits

Last updated: 4 October 2026

Free sanctions screening tools are a reasonable search. Screening is a legal obligation with no minimum revenue threshold, and an early-stage team with no budget still has to do it. So what can you actually get for nothing, and where does it stop being enough?

The short answer: in 2026 you can screen names for free against the official government lists (OFAC's Sanctions List Service, the UK Sanctions List, the EU and UN lists), screen wallet addresses for free with the Chainalysis sanctions oracle or TRM's public Sanctions API, and use the OpenSanctions dataset at no cost if your use is non-commercial. What none of them give you is continuous re-screening, fuzzy name matching, indirect on-chain exposure and an audit trail. Those four gaps are what decide when free stops being defensible.

The free crypto sanctions screening tools that exist in 2026

Each of these was checked on 4 October 2026. Free tiers change, so re-check the terms before you build a process on any of them.

OFAC: the Sanctions List Service and the address field

OFAC's Sanctions List Service (checked 4 October 2026) offers the SDN List and the Consolidated Non-SDN List as free downloads in an advanced data format and in legacy flat files, plus archived delta files and a tool for building a custom dataset. It also hosts the Sanctions List Search web app.

Crypto addresses are part of the SDN List itself. Each address entry identifies the asset it belongs to, in the format "Digital Currency Address" followed by the asset's symbol (for example XBT or ETH). According to OFAC FAQ 594 (checked 4 October 2026), you can search an address by entering it in the "ID #" field of Sanctions List Search, but that field "does not use fuzzy logic", so only exact matches are returned.

If you want the addresses as a plain list, the open-source ofac-sanctioned-digital-currency-addresses project (MIT licence, checked 4 October 2026) extracts them from the SDN List each night with a GitHub Actions workflow. Its author gives no warranty on completeness, so treat it as a convenience copy and keep OFAC as the source of record.

The UK Sanctions List (the single UK list since January 2026)

From 28 January 2026 the UK Sanctions List became the only source for UK sanctions designations. The OFSI Consolidated List of Asset Freeze Targets was discontinued on that date and is kept for reference only (gov.uk, checked 4 October 2026). It is free to search and to download in CSV, XML, HTML, PDF, text and spreadsheet formats. If your free process still pulls the old OFSI file, it has been screening against a list that stopped updating in January.

OpenSanctions

OpenSanctions' sanctions collection aggregates 93 data sources into 302,038 entities, 72,805 of them designated targets, and includes 2,830 crypto wallet addresses. It refreshes four times a day (figures as of 4 October 2026). It is the most complete free dataset available, with one important condition: the licence is Creative Commons BY-NC 4.0. That makes it free for non-commercial use, but a business screening its own customers needs a paid data licence or the pay-as-you-go API, which comes with a 30-day free trial. Self-hosting the bulk data commercially without a licence is not a free option.

Chainalysis sanctions oracle

Chainalysis launched its free sanctions screening tools in March 2022. The oracle documentation (checked 4 October 2026) says the smart contract "is available for anyone to use and does not require a customer relationship with Chainalysis". It is deployed on Ethereum, Polygon, BNB Smart Chain, Avalanche, Optimism, Arbitrum, Fantom, Celo, Blast and Base. It checks addresses against embargo lists from organisations including the US, EU and UN. Chainalysis also states that it "cannot guarantee the accuracy, timeliness, suitability, or validity of the data". The oracle returns a yes or no, with no list name, designation details or timestamp. That is fine for blocking a contract call and not enough as compliance evidence.

Chainalysis also released a free REST sanctions API alongside the oracle in 2022. When we checked on 4 October 2026, the old public documentation link for that API redirected to the Chainalysis homepage. Confirm it is still available before you design a process around it.

TRM Sanctions API

TRM Labs publishes its Sanctions API documentation openly (checked 4 October 2026). Without a key, the screening endpoint is limited to 1 request per second and 100 requests per day. For more volume you request a key, and the documented limit rises to 1,000 requests per second and 100,000 per day. Keys generated in TRM's paid platform do not work on this endpoint. Like the oracle, it answers one question: does this address have sanctions exposure?

What free tools genuinely do

Put together, the free resources cover three jobs:

• Official list lookups. OFAC's SDN search, the EU consolidated list, the UK Sanctions List and the UN list are all publicly searchable, free, and authoritative. For a one-off check on a name or a wallet address published on a list, they are the primary source.
• Free address checkers. Some blockchain analytics vendors, currently Chainalysis (oracle) and TRM (public API), expose a limited lookup that tells you whether an address appears on a sanctions list or has direct exposure to one.
• Open-source datasets. Aggregated sanctions data is published in machine-readable form and can be self-hosted. Check the licence before commercial use.

For a genuinely pre-revenue team doing occasional manual checks, this is a legitimate starting point. It is better than nothing, and "nothing" is the actual alternative for a lot of early projects.

How to run a free screening check properly

If you are going to rely on free tools for now, use them consistently:

1. Screen the person or entity. Search the customer's full name, with variants, in OFAC Sanctions List Search and the UK Sanctions List, plus the EU and UN lists if you serve those markets. Try surname-first ordering and common transliterations yourself, because exact-match tools will not do it for you.
2. Screen the wallet. Run every deposit and withdrawal address through a free address checker, and through OFAC's "ID #" field if you need the primary source. Address screening and name screening cover different risks, so you need both.
3. Record the result. Log the name or address, the lists checked, the date, the result, and who ran the check. A screenshot of a "no results" page with a date stamp is better than no record at all.
4. Decide on hits. A possible match goes to a named person who documents the decision either way. Never clear a possible match silently.
5. Re-run on a schedule. Lists change in both directions: Treasury removed Tornado Cash from sanctions on 21 March 2025. A customer cleared today can be designated next month, and a blocked counterparty can be delisted.

The four gaps that break it

1. No continuous re-screening

This is the big one. Sanctions lists change constantly. A customer who cleared at onboarding may be designated three months later, and the obligation is to know. Free tools give you a point-in-time answer. Compliance requires a standing one: every customer re-screened against every list update, automatically, with a record.

Manually re-checking a book of 2,000 customers each time OFAC updates is not a process anyone sustains.

2. No fuzzy matching

Real screening has to catch transliteration variants, name ordering, nicknames and deliberate misspellings. "Mohammed" versus "Muhammad", surname-first conventions, and Cyrillic transliteration all defeat exact-match lookups. Commercial engines score partial matches and let you tune the threshold; free lookups return a match or nothing. OFAC itself notes that its address search is exact-match only.

An exact-match-only control creates the illusion of screening while missing the cases most likely to matter.

3. No indirect exposure

A wallet is rarely on a list itself. What matters is whether funds reached it through a sanctioned entity two or three hops back, sometimes across a crypto bridge. That requires clustering and attribution data, which is precisely the expensive part of the product. Free address checkers typically flag direct designation only.

4. No audit trail

Even if you catch everything, you cannot prove it. Supervisors ask for evidence of who was screened, against which list version, on what date, with what result and what decision followed. A browser search leaves no record, and a yes/no oracle response names no list and no version. This alone fails an inspection regardless of how diligent the underlying work was.

A defensible interim process when there is genuinely no budget

If the choice is between a documented manual process and nothing, run the manual process. Regulators are considerably more sympathetic to a small firm with a modest, evidenced control than to one that skipped the obligation because tooling was expensive. What makes it defensible is the record, not the sophistication.

A minimum viable process looks like this:

• A written procedure. One page stating which lists you check, who checks them, at what points, and what happens on a hit.
• A screening log. One row per customer per check: name screened, lists checked, date, result, who ran it. A spreadsheet is acceptable. An empty spreadsheet is not.
• A re-screening calendar. A recurring task to re-run the standing book against current lists. Monthly is a reasonable floor at low volume.
• An escalation path. A named person who decides on a hit, and a rule that they document the reasoning either way.
• Retention. Keep the log, including negative results, for your jurisdiction's retention period.

This process breaks at a volume you can predict in advance, roughly the point where re-screening the book takes longer than a working day. Plan the upgrade before you hit it rather than after.

What screening has to cover beyond names

Free tools tend to answer one question: is this name or address on a list? Real obligations are broader, and the gaps are where enforcement actually lands.

• Indirect exposure. An address that is not itself designated may have received funds from one two hops ago. Direct-match tools return clean. Analytics tools score the exposure. This distinction is the substance of most crypto sanctions enforcement.
• Ownership and control. Sanctions extend to entities owned or controlled by designated persons, commonly at a 50% threshold, even when the entity itself is not listed. Detecting that requires ownership data, not a name lookup. This is also where a KYB process earns its keep.
• Jurisdictional exposure. Comprehensive country programmes prohibit dealings with entire jurisdictions regardless of whether a specific party is named.
• Counterparty screening. Under travel-rule obligations you may need to assess the receiving institution, not only the customer. See the travel rule for how that interacts, and our 2026 travel rule explainer for the 2026 picture.

None of these are available in a free list lookup, and none of them are optional at scale.

Stablecoin issuers are a separate case. In the US, the GENIUS Act requires them to run sanctions compliance and to be technically able to freeze or block tokens on lawful orders.

The honest threshold

Free tools are defensible while you have no customers. The moment you onboard third parties and hold their assets, you need screening that is continuous, fuzzy-matched, exposure-aware and logged. That is not a vendor upsell, it is what the obligation actually says.

The practical trigger points:

• You are onboarding customers rather than testing with your own funds
• You are preparing a licence application, and the file will be assessed on this
• You have banking relationships that ask about your controls
• Your customer count has passed the point where manual re-screening is realistic (in practice, low hundreds)
• You want to use OpenSanctions data in a commercial product, which needs a licence anyway

What getting it wrong actually costs

Sanctions breaches are strict liability in most regimes. Intent is not a defence, and neither is a good-faith attempt with an inadequate tool. Penalties are assessed per violation, which for a payments or exchange business can mean per transaction. The arithmetic escalates quickly from a book of customers screened once and never again.

The secondary costs usually bite sooner than the fine. Banking partners run their own diligence on your compliance stack, and an undocumented screening process is a common reason for a correspondent relationship to be declined or withdrawn. Licence applications ask directly what you screen against and how. A free-tool answer will not clear a CASP file. See CASP licence cost for how the compliance stack is assessed.

What to move to

Paid screening splits into two layers, and most firms need both.

• On-chain address and exposure screening. Blockchain analytics platforms score indirect exposure, cover more chains and keep a record of each screen. When you upgrade, the questions that matter are list coverage and refresh frequency, indirect exposure depth, chain coverage for the networks you actually settle on, and the quality of the audit export. We compare the options in best sanctions screening software for crypto exchanges.
• Person and entity screening. This covers customers, directors and beneficial owners checked against sanctions, PEP and adverse-media data, with fuzzy matching and ongoing monitoring. Vendors in this layer include identity-verification providers such as iDenfy. Its documentation (checked 4 October 2026) describes AML monitoring as a recurring daily check of individuals and companies against PEP, sanctions and adverse-media databases, and its matching engine combines fuzzy and semantic name matching. Its pay-as-you-go plans start at a $135 monthly minimum, with a 14-day or 10-verification free trial. OpenSanctions' paid API and data licences are another route in this layer, as are the other providers in our KYB software for crypto comparison. Test any of them on your own customer data before committing.

Screening is one control among several. It pairs with ongoing behavioural monitoring (see crypto transaction monitoring software and our guide to AML transaction monitoring) and with identity checks at onboarding, covered in best crypto KYC providers. Screening beyond sanctions into PEP and adverse media is set out in watchlist and PEP screening explained.

One thing not to do

Do not build a partial in-house solution on free datasets and describe it to a regulator as a screening programme. Self-hosting sanctions data is legitimate engineering, but without fuzzy matching, continuous re-screening and an audit trail it will be assessed as inadequate. Having built something also makes the gap look deliberate rather than resource-constrained.

If budget is the constraint, say so and document a dated plan to close it. Supervisors deal with that far better than with a control that looks complete and is not.

For the full programme view, see our crypto AML compliance guide for exchanges and VASPs.

Frequently asked questions

Is there free crypto sanctions screening in 2026?

Yes. OFAC's Sanctions List Service and Sanctions List Search, the UK Sanctions List, and the EU and UN lists are free for name screening, and OFAC lists sanctioned wallet addresses on the SDN List. For addresses, the Chainalysis sanctions oracle is free on 10 EVM networks, and TRM's public Sanctions API allows 100 checks a day without a key. OpenSanctions is free for non-commercial use only.

Is free sanctions screening legal to rely on?

There is no rule prohibiting free tools, and official list lookups from OFAC, the EU and the UN are authoritative sources. What matters is whether your overall control meets the obligation: continuous re-screening, fuzzy matching, indirect exposure and a retained audit trail. A free point-in-time lookup does not meet that on its own, regardless of the quality of the underlying list.

What is the single biggest gap in free tools?

The absence of continuous re-screening. Lists change constantly, and a customer who cleared at onboarding may be designated months later while remaining an active customer. A point-in-time check answers a question the obligation does not ask.

Are official OFAC and EU list searches good enough for a one-off check?

Yes. For a genuine one-off, they are the primary source and better than any intermediary. The limitation is exact-ish matching: they will not reliably catch transliteration variants, OFAC's address search returns exact matches only, and they cannot tell you about indirect on-chain exposure. Use them for what they are good at.

Is OpenSanctions free for a crypto business?

Not for commercial screening. The data is published under Creative Commons BY-NC 4.0, so it is free for non-commercial use, but a business screening its own customers needs a data licence or the paid API, which offers a 30-day free trial.

At what point do I have to upgrade?

Three practical triggers: when re-screening your book manually no longer fits in a working day; when you take on a regulated obligation such as a CASP or VASP authorisation; or when a banking partner asks to review your screening process. Any one of these means the manual process has reached its limit.

Does screening a wallet address replace screening the customer?

No. They cover different risks and both are usually required. Name screening catches designated persons; address screening catches designated or exposed on-chain counterparties. See watchlist and PEP screening for how the screening types divide up.

What should I never do?

Screen once at onboarding, keep no record, and assume the obligation is discharged. That is the exact fact pattern that produces enforcement. The problem is not that the tool was free. It is that there was no evidence the control ever ran.