OFAC Sanctions List: How OFAC Screening Works in Crypto
What the OFAC SDN list is, how crypto wallet addresses appear on it, the 50% rule, strict liability, how OFAC screening works and what Tornado Cash changed.
The OFAC sanctions list most people mean is the Specially Designated Nationals and Blocked Persons List (SDN List), published by the US Treasury's Office of Foreign Assets Control. US persons, including crypto exchanges, must not deal with anyone on it and must block their property, and since 2018 the list has also named specific crypto wallet addresses. OFAC screening is the process of checking customers, transactions and wallet addresses against that list.
This guide explains what the SDN List contains, how crypto addresses appear on it, the 50 percent rule, why liability is strict, how screening works in practice, and what the Tornado Cash case changed. It is written for compliance teams at exchanges and VASPs, and for users wondering why a transfer was blocked.
What the OFAC SDN List is
OFAC administers US economic sanctions. Its sanctions compliance guidance for the virtual currency industry, published in October 2021, explains that OFAC runs more than 35 sanctions programmes, and that the SDN List is "the most prominent" of its lists. It names individuals, groups and entities such as terrorists, narcotics traffickers and human rights abusers, alongside people and companies linked to sanctioned countries and regimes. OFAC also publishes a Consolidated Sanctions List covering its other lists.
The general rule, in OFAC's words: unless exempt or authorised, US persons are prohibited from dealing with SDNs or blocked persons, "directly or indirectly", and "must block any property in their possession or control" in which an SDN has an interest. OFAC says these obligations "apply equally" whether a transaction uses crypto or fiat.
The list is large and changes often. As of 9 October 2026, OFAC's downloadable SDN file contained about 19,400 entries, by our count of the SDN.CSV export. Anyone can search it for free with OFAC's Sanctions List Search tool.
Crypto wallet addresses on the SDN List
On 28 November 2018 OFAC designated two Iran-based individuals who helped convert SamSam ransomware payments, and for the first time publicly attributed digital currency addresses to designated people: two bitcoin addresses that had processed more than 7,000 transactions (US Treasury).
Address listings appear inside an SDN entry as "Digital Currency Address" followed by the asset ticker and the address. Two caveats from OFAC's FAQ 562 matter in practice:
- OFAC's address listings "are not likely to be exhaustive". A sanctioned person almost certainly controls other wallets.
- If you identify wallets you believe belong to an SDN and hold such property, you should block it and report it to OFAC.
By our count of the SDN and SDN comments files on 9 October 2026, around 1,050 address listings were attached to roughly 100 SDN entries. Most were bitcoin, Tron, Ethereum and USDT addresses. That is a small slice of the list, which is why name screening still does most of the work.
The 50 percent rule
Under OFAC's 50 Percent Rule, any entity owned 50 percent or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself blocked, even if it does not appear on the list. OFAC's virtual currency guidance points to its revised guidance of 13 August 2014 on this point.
For an exchange, that means screening a corporate customer's name is not enough. You need to know who owns it, which is where beneficial ownership checks and KYB come in.
Strict liability: who must comply and what is at stake
OFAC rules bind all US persons: US citizens and permanent residents wherever they are, anyone in the United States, and US-organised entities including their foreign branches. Non-US companies can also be caught, for example when they cause a US person to violate sanctions.
Civil penalties are based on strict liability. OFAC says a US person "may be held civilly liable for sanctions violations even without having knowledge or reason to know" it was violating them. A risk-based compliance programme and prompt remediation can count as mitigating factors, and a voluntary self-disclosure may halve the base penalty.
The largest crypto case so far shows the scale. On 21 November 2023 OFAC announced a $968,618,825 settlement with Binance covering 1,667,153 apparent violations between 2017 and 2022, involving users in sanctioned jurisdictions and blocked persons. OFAC judged them egregious and not voluntarily disclosed, and Binance agreed to a five-year independent compliance monitor (OFAC).
What happens when there is a match
When a US exchange finds it holds crypto that must be blocked, OFAC's FAQ 646 says it must deny all parties access to it and follow OFAC's rules on holding and reporting blocked property. The main obligations are:
| Obligation | Deadline |
|---|---|
| Initial blocked property report | Within 10 business days of blocking |
| Annual blocked property report | By 30 September each year, covering property held on 30 June |
| Rejected transaction report | Within 10 business days of the rejection |
| Recordkeeping | Five years after the transaction, or after the property is unblocked |
Blocked crypto does not have to be converted into dollars or held in an interest-bearing account. It stays frozen until OFAC authorises its release or the sanction no longer applies.
For users, this is why an account or deposit can be frozen without much explanation. If your funds are blocked, OFAC's FAQ notes that owners of blocked virtual currency can contact OFAC about how it is treated.
How OFAC screening works in practice
OFAC's guidance sets out five components of a sanctions compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training. For crypto businesses, its screening recommendations translate into four layers:
- Customer screening at onboarding and on an ongoing basis. Names, dates of birth, addresses and nationality from KYC are checked against the SDN List and other OFAC lists, then re-screened whenever the lists change. OFAC tells firms to use fuzzy matching, giving the example that "Krayinvestbank" may be listed while "Kray Invest Bank" appears in the data.
- Geographic controls. OFAC stresses IP address screening and blocking for sanctioned jurisdictions. Its guidance cites a case where a company collected login IP addresses but never used them to screen, and so served users in Crimea, Cuba, Iran, Sudan and Syria.
- Wallet address screening. Deposits and withdrawals are checked against listed addresses. OFAC also suggests a historic lookback whenever a new address is listed, and notes that unlisted addresses sharing a wallet with a listed one may also carry risk.
- Blockchain analytics. Because listings are not exhaustive, firms use blockchain analytics to trace indirect exposure, such as funds that passed through a sanctioned service.
OFAC's red flags include inaccurate or incomplete KYC information, access from an IP address or VPN connected to a sanctioned jurisdiction, and attempts to transact with an address associated with a blocked person.
Most exchanges buy screening rather than build it. Vendors such as iDenfy run automated sanctions, PEP and watchlist checks; for a wider comparison, see our guide to sanctions screening software, or free sanctions screening options for smaller teams.
The Tornado Cash case
On 8 August 2022 OFAC added Tornado Cash, an Ethereum-based mixing protocol, to the SDN List along with dozens of its smart contract addresses (OFAC). Users challenged the designation. On 26 November 2024 the US Court of Appeals for the Fifth Circuit held in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts are not the "property" of a foreign national or entity, so they cannot be blocked under the relevant statute, and that OFAC had overstepped its authority (Fifth Circuit opinion).
On 21 March 2025 Treasury announced it had removed the sanctions, while saying it remained "deeply concerned" about North Korean hacking and laundering and that US persons "should exercise caution" with transactions that present such risks (US Treasury). Delisting the protocol did not delist everyone connected to it: as of 9 October 2026, an SDN entry for Tornado Cash co-founder Roman Semenov, with his own Ethereum address, was still on the list.
The practical lesson: sanctions screening is about specific listed persons and property, the list changes in both directions, and screening data must be refreshed whenever it does.
JewelSwap's DeFi apps are non-custodial and do not run KYC themselves; our KYC in DeFi explainer covers how compliance works around protocols like these.
Frequently asked questions
What is the OFAC sanctions list?
Usually it means the Specially Designated Nationals and Blocked Persons List (SDN List), maintained by the US Treasury's Office of Foreign Assets Control. US persons must not deal with listed people or entities and must block their property. OFAC also publishes other lists, combined in its Consolidated Sanctions List.
What is OFAC screening?
It is checking customers, counterparties, transactions and, in crypto, wallet addresses and IP locations against OFAC's sanctions lists, both at onboarding and every time the lists change, so that a business does not deal with a sanctioned person or jurisdiction.
Does the OFAC list include crypto wallet addresses?
Yes. OFAC first attributed digital currency addresses to sanctioned people in November 2018. As of 9 October 2026 there were around 1,050 address listings attached to roughly 100 SDN entries, but OFAC says its address listings are not likely to be exhaustive.
What is the OFAC 50 percent rule?
Any entity owned 50 percent or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself treated as blocked, even if it is not named on the SDN List.
Is Tornado Cash still sanctioned?
No. Treasury removed the Tornado Cash sanctions on 21 March 2025, after the Fifth Circuit ruled in November 2024 that its immutable smart contracts could not be blocked as property. Some individuals linked to it, such as co-founder Roman Semenov, remained on the SDN List as of 9 October 2026.
Why did my exchange freeze my transfer for sanctions reasons?
A name, location, IP address or wallet address involved may have matched or come close to a sanctions listing. US exchanges must block property of sanctioned persons and report it to OFAC within 10 business days. False positives happen and are usually cleared once you provide information.
Keep reading
- Best sanctions screening software for crypto exchanges
- Crypto watchlist and PEP screening
- Money transmitter licences for crypto
- What is a VASP?
- Crypto AML compliance guide for exchanges and VASPs
This article is educational and is not legal advice. Sanctions obligations depend on your jurisdiction and facts; consult qualified counsel. SDN List counts are our own count of OFAC's SDN.CSV and SDN_COMMENTS.CSV exports downloaded on 9 October 2026 and will change as OFAC updates the list. Sources checked on 9 October 2026.
