Mentioned in This Article
1. What the OFAC Sanctions Search Tool Can and Cannot Tell You
The US Treasury Department's Office of Foreign Assets Control (OFAC) offers a free, official lookup that lets anyone check whether a name or a cryptocurrency address appears on its sanctions records. As of November 7, 2026, its guidance remains that a match requires further identity verification, and that a result showing no match does not clear a counterparty. For exchanges, custodians, over-the-counter desks and anyone moving digital assets across borders, that gap shapes how screening has to be done.
The tool is the Sanctions List Search, which was established in May 2021. It serves as OFAC's main lookup for the Specially Designated Nationals (SDN) List, the register of individuals, companies and entities with which US persons are generally prohibited from dealing. Users can type in a name or paste a digital currency address, and address searches rely on exact matching.
Exact matching has an obvious strength: a hit on a listed address is a precise signal. It also has a built-in limit, because an address that differs by a single character from a listed one returns nothing, and an address that was never listed returns nothing either. The search therefore answers a narrow question, whether a specific string appears on a specific list, rather than the broader question compliance officers actually care about, which is whether a counterparty is exposed to sanctions.
For readers unfamiliar with the agency, OFAC administers and enforces economic and trade sanctions for the United States. Its lists are the reference point for banks, payment companies and crypto businesses that need to avoid dealing with blocked parties. Violations can carry civil penalties, and the rules apply to US persons wherever they operate, which is why even small platforms with international customers pay close attention to the list.
The distinction between a lookup and a screening program is therefore important. A lookup is a single query made at a moment in time. A screening program is a documented set of procedures that decides which parties are checked, how often, against which data, and what happens when something looks suspicious. The free search is a useful building block for the first, but it was never designed to replace the second.
2. Why Is a Positive Match Only a Starting Point?
A positive hit is where the work begins rather than where it ends. Names can overlap, and people or companies with similar names are common, so a user who sees a match must confirm that the party in front of them is actually the listed one. Acting on a name match alone could lead a firm to freeze or reject a legitimate customer.
Address matches are more specific than name matches, but they still call for review. A firm needs to understand how it came into contact with the address, what the transaction was, and what obligations follow under the sanctions rules that apply to it. The lookup supplies the first piece of evidence and leaves the analysis to the person or compliance team using it.
The outcome that deserves more caution, the author argues, is the negative one. A clean search can feel like reassurance, yet OFAC's own guidance states that the absence of an address from the list does not mean that no risk exists. Wallets are cheap to create, and sanctioned actors are under no obligation to keep reusing addresses that are already known to regulators.
Firms that handle a positive result well usually follow a consistent routine: they pause the transaction, gather identifying information, compare it with the details on the listing, escalate unresolved cases to a compliance officer and record the outcome. A documented process also helps demonstrate good faith if a regulator later asks why a particular decision was made.
3. Ownership Rules Can Reach Entities That Are Not Listed
Ownership adds a separate layer. Under OFAC's 50% rule, a company that is owned fifty percent or more, directly or indirectly and in the aggregate, by one or more sanctioned persons is treated as blocked even when it does not appear on the list by name. Compliance obligations can therefore arise for an entity that a name or address search would never flag.
This matters for trading firms, payment processors and market makers. Any of them might look clean in an address search and still carry exposure through the people who own them. Checking ownership turns screening from a quick lookup into corporate due diligence, which takes more time and judgment than pasting an address into a search box.
The practical consequence is that no single check can serve as a complete safeguard. A firm needs to combine list searches with ownership review, transaction monitoring and an understanding of the jurisdictions in which its customers and counterparties operate.
Aggregation is the technical heart of the ownership rule. Several sanctioned owners with small stakes in the same company can add up to a controlling share even though none of them holds a majority alone. Spotting that situation requires ownership records, which are often incomplete or held in jurisdictions that disclose little, so firms frequently have to ask counterparties directly and document the answers.
4. From Two Bitcoin Addresses to Today's Multi-Chain Designations
OFAC's treatment of digital assets has expanded considerably in a short period. In November 2018, the agency published its first digital currency addresses, two Bitcoin wallets tied to ransomware activity linked to Iran. Those entries were limited to a single blockchain and a small number of addresses.
More recent actions show how the scope has widened. On October 28, 2026, OFAC designated ten individuals and one entity in connection with North Korean information technology worker schemes, targeting facilitators and workers based in North Korea and Russia. The action named two Russian nationals, Ilya Boykov and Vitold Obertas, whom the Treasury says converted millions of dollars in cryptocurrency for North Korean networks since 2024. It also added Ethereum and TRON addresses to the list.
The mix of networks has changed along with the volume. The 2018 entries involved only Bitcoin, while the newest additions sit on Ethereum and TRON. Designations now follow illicit activity across several chains, which means a screening program built around one network leaves obvious blind spots.
The shift toward several networks also reflects how illicit actors behave. Moving value between chains, or between assets on the same chain, makes tracing harder, and listings that name addresses on more than one network help close part of that gap. Even so, a listing can only describe the addresses known when it was published, which is another reason a clean search carries limited weight.
5. Why Should Compliance Teams Screen Continuously?
Compliance teams should screen continuously because the list changes. An address that is clean today can be designated tomorrow, as the October 28 action demonstrated when new addresses were added in a single announcement. A check performed once, at the moment a customer is onboarded, captures only that moment and says nothing about what happens afterward.
For crypto firms, the OFAC search is best understood as a minimum baseline. The author describes it as a floor rather than a ceiling. Ongoing monitoring of customers and counterparties, combined with review of ownership, is needed to cover the cases that exact matching misses.
The list also trails real activity. New designations add the addresses that authorities already know about, while bad actors can generate fresh ones quickly and move funds before any listing occurs. That lag is the reason OFAC treats a non-match as inconclusive instead of as a clearance, and it is why firms are expected to look at behavior and relationships as well as lists.
In practical terms, continuous screening means re-checking the existing customer base and recent counterparties whenever the list is updated, rather than waiting for the next scheduled review. Many firms automate this, since the volume of addresses and transactions is far too large for manual checks, but the same caveat applies: automation is only as good as the data and the rules behind it.
6. What the Growth of Crypto Sanctions Means for the Market
The progression from two addresses in 2018 to the multi-chain entries added in 2026 indicates where sanctions enforcement is heading. Digital assets have become a routine tool for the Treasury when mapping and targeting illicit networks, ranging from ransomware operators to state-linked IT worker schemes. Firms entering the sector should expect that trend to continue.
The compliance bar is rising for institutions as they move into crypto. Companies that operate across jurisdictions or handle large volumes face the greatest exposure, because they are more likely to encounter a listed address or an owned-by-sanctioned-party counterparty, and because regulators expect their controls to scale with their activity.
The North Korean case is worth watching in particular. The October 28 designations connected North Korean IT workers to Russia-based facilitators and placed Ethereum and TRON addresses on the list, showing that the Treasury follows both the people and the on-chain flows that support such schemes.
Reputation is a further consideration. A platform that is found to have served sanctioned parties can lose banking relationships and customers even when no penalty follows, so many firms hold themselves to standards stricter than the legal minimum and treat the official list as one input among many.
7. What Firms Should Take Away
The tool itself is useful, free and official, and its limits are stated by OFAC. The firms most likely to run into trouble are those that read a search result without reviewing its caveats, treating the absence of a match as permission rather than as one data point among several.
In practice, that means pairing the Sanctions List Search with continuous screening, ownership analysis and transaction monitoring, and documenting why each decision was made. A clean result remains a useful signal, but only one part of a larger compliance picture, and it should never be the sole basis for deciding that a wallet or a counterparty is safe.