Blockchain analytics in sanctions screening: OFAC and OFSI compared

A payments firm operating between London and New York processes a crypto transfer. Its name-screening tool clears the transaction. Two weeks later, the firm learns that the sending wallet was flagged in a blockchain analytics report as belonging to a designated person. The transaction was not illegal on its face – but was it blocked property? This question, and the compliance programme architecture it exposes, sits at the centre of how OFAC and OFSI are diverging on blockchain analytics in sanctions screening.

As of January 2026, both OFAC and OFSI treat blockchain analytics as an expected component of a sanctions compliance programme for virtual-asset businesses – but the two regimes apply different legal tests, operate different enforcement frameworks, and reach different conclusions about what "adequate screening" requires. OFAC's position is anchored in its strict-liability model, where a blocked wallet triggers liability regardless of knowledge. OFSI's strict-liability enforcement posture, in force since 2022, has moved the UK closer to that position, but the ownership-and-control analysis and the licensing architecture differ in ways that produce materially different compliance obligations.

This analysis sets out the divergence thesis, examines the evidence across the major points of difference, and closes with the practical steps a cross-border business should take before the next transaction clears.

The divergence thesis: two regimes, one technology, different legal consequences

The central claim of this analysis is that OFAC and OFSI have reached broadly similar conclusions about the importance of blockchain analytics but have built that expectation on structurally different legal foundations – and that difference produces real operational divergence for a business subject to both regimes.

OFAC's approach draws on the same legal architecture it applies to all sanctions compliance: the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). That architecture is technology-neutral. A wallet address is treated as property. If blocked persons own or control the wallet, the property is blocked. The fact that the asset is digital changes nothing about the legal conclusion. Blockchain analytics is not mandated by name in any OFAC instrument, but it is the principal tool by which a virtual-asset business can satisfy OFAC's expectation of a risk-based compliance programme. Regulators have made clear that name screening alone is insufficient.

OFSI's position rests on SAMLA and the relevant thematic regulations. Its ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) looks at actual, not theoretical, influence – and UK case law distinguishes existing influence from a hypothetical ability to exert control, as currently in force. That distinction matters for wallet attribution. A wallet may be technically accessible by a designated person but not "owned or controlled" within the meaning of the UK test if the connection is remote or indirect.

The result: an OFAC analysis of a given wallet might produce a blocked-property finding that an OFSI analysis would not, or would reach more slowly. For a business operating in both jurisdictions, the safer discipline is to apply the more conservative analysis – and to document why.

How does OFAC treat wallet attribution and the 50 percent rule?

Under OFAC, a wallet associated with a designated person is treated as blocked property, and any transaction involving it constitutes a violation unless licensed or exempted. The analysis does not require intent. OFAC's civil-penalty model is strictly applied, and the liability attaches at the moment of the transaction. A business that did not know the wallet was associated with a designated person may still face civil exposure.

The 50 percent rule extends this further. An entity owned 50 percent or more, directly or indirectly in the aggregate, by one or more blocked persons is itself treated as blocked. In the digital-asset context, this rule reaches beyond named wallets: if a designated person controls the private key to a set of wallets through an intermediary structure, each of those wallets may be blocked. Blockchain analytics is the mechanism by which a compliance programme traces those chains.

What does good analytics practice look like under OFAC? In our experience, effective programmes do four things. First, they screen wallet addresses at origination and receipt, not only the name of the counterparty. Second, they apply clustering analysis to identify wallets operated by the same entity. Third, they monitor for transaction patterns that suggest association with a blocked cluster. Fourth, they re-screen on a periodic basis, because designations occur after account opening.

A business that screens only names and ignores wallet-level analytics is, in OFAC's framing, operating an incomplete compliance programme. That incompleteness is a factor in enforcement categorisation – the distinction between "egregious" and "non-egregious" cases, as set out in OFAC's Enforcement Guidelines, turns partly on the adequacy of the compliance programme in place at the time of the apparent violation. Regulators have also noted that blockchain is used to trace wallet clusters, and that a designation can extend to addresses associated with a designated person.

One further point that firms often miss: facilitation. Under OFAC, a US person who facilitates a transaction that would be prohibited if done directly by that person is itself in violation. A US correspondent bank that processes a payment for a non-US virtual-asset exchange without adequate analytics may be facilitating a blocked transaction, even if the primary relationship is one step removed.

How does OFSI apply ownership and control to digital assets?

OFSI's analysis of digital-asset exposure begins in the same place as its analysis of any other asset class: is the wallet or the underlying asset "owned or controlled" by a designated person within the meaning of the applicable UK thematic regulations? The ownership threshold for asset-freeze purposes is more than 50 percent, consistent with the EU position – though the UK control test extends the analysis beyond that bright line.

Control, under UK authority, must be actual rather than theoretical. This is where the digital-asset context introduces genuine legal complexity. A designated person may have historically operated a wallet, may have transferred assets from it, or may have signatory access alongside other persons. Whether that constitutes "control" within the statutory meaning requires a fact-specific assessment. The question is not whether the wallet is associated with the designated person in a blockchain analytics report – it is whether the legal test is satisfied on the available evidence.

This does not mean OFSI's standard is lower. OFSI operates on a strict-liability basis for monetary penalties, in force since 2022. A relevant firm that makes funds or economic resources available to a designated person – directly or indirectly – incurs liability regardless of knowledge. The critical difference is that the legal analysis of "ownership and control" precedes the penalty question. If a wallet is not "owned or controlled" by a designated person under the UK test, the prohibition does not engage. Under OFAC's wallet-attribution approach, the analysis can reach that conclusion more quickly.

In our cross-border practice, we advise clients to treat the OFSI analysis as an additional layer, not a replacement. Where OFAC analytics identify a wallet as associated with a designated person, the OFSI position should be assessed separately. The two findings may coincide. They may not. Documenting both positions – and the evidence underlying each – is the foundation of a defensible compliance record.

There is also a reporting dimension that OFSI adds. There is a legal obligation on "relevant firms" to report knowledge or suspicion of designated persons to OFSI, as currently in force. A blockchain analytics alert that rises above the level of mere suspicion – because the attribution evidence is strong – may trigger that reporting obligation independently of any decision to block or refuse the transaction.

Where does the EU position sit – and why does it matter for cross-border businesses?

A business subject to UK financial sanctions is commonly also subject to the EU regime, whether through EU-incorporated entities, EU-regulated counterparties, or the residual reach of EU law into certain cross-border transactions. Understanding where the EU position sits – and where it diverges from both OFAC and OFSI – is not optional for most multinationals.

The EU asset-freeze prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU ownership threshold, for asset-freeze purposes, is more than 50 percent. The control analysis is similar to the UK's: an EU court ruling has held that control must be proved by objective and sufficiently weighty evidence. That evidential standard matters for digital assets, where attribution evidence is probabilistic rather than documentary.

The EU transfer-of-funds regime applies a zero threshold to transfers between crypto-asset service providers, meaning that originator and beneficiary information is required regardless of value – and, as currently in force, that requirement applies to on-chain transfers as well as off-chain settlement. This is an operationally significant obligation that sits alongside, and is distinct from, the sanctions-screening obligation.

For the cross-border business, the practical consequence of this three-regime picture is that a single crypto transaction may need to be assessed under OFAC (wallet attribution, 50 percent rule, facilitation), OFSI (ownership and control, reporting obligation), and EU rules (asset-freeze, transfer-of-funds). Where all three regimes apply, the stricter prohibition governs the conduct of a person subject to each. That principle does not allow a firm to net out its obligations; it requires full compliance with the highest applicable standard. A compliance programme designed around one regime alone will not hold under multi-regime scrutiny.

We regularly advise on how to structure analytics and screening programmes that satisfy each of these regimes simultaneously, including how to document the analysis in a way that is legible to multiple regulators.

Risk flags: when does blockchain analytics exposure escalate?

Not every analytics alert represents the same risk. The severity of exposure depends on a set of factors that compliance teams should map before deciding how to respond. Escalation is warranted – and counsel should be involved – when one or more of the following conditions is present.

High-confidence attribution. Blockchain analytics tools assign probability scores to wallet attributions. A low-confidence match is a different compliance position from a high-confidence cluster attribution to a named designated person. The higher the confidence, the more likely a regulator will treat the transaction as a violation. Firms that treat all alerts as equivalent – blocking everything or clearing everything – are not applying a risk-based approach.

Transaction already settled. If the transaction has cleared before the analytics alert is generated, the compliance team faces a different question: is there blocked property that must now be reported? Under OFAC, blocked-property and rejected-transaction reports are due within 10 business days of the blocking or rejection. If the transaction cannot be unwound, that reporting window is already running. Under OFSI, the reporting obligation runs from the point of knowledge or suspicion.

Facilitation risk for intermediaries. A correspondent bank, a payment processor, or a card-network operator that sits between two virtual-asset businesses cannot assume that upstream analytics performed by the originating firm discharges its own obligation. Each institution in the chain must assess its own exposure. The definition of a financial institution under the relevant US authority can extend beyond banks to insurers and card-network operators, as currently in force. The analytics obligation follows the institutional classification.

Secondary-sanctions risk. A transaction that does not directly involve a designated person may still create secondary-sanctions exposure if it involves a foreign financial institution that conducts significant transactions for designated persons or for specified sectors. US authority allows measures against foreign financial institutions in these circumstances, as currently in force. This risk is particularly acute for correspondent-banking relationships and for crypto liquidity providers that serve multiple markets.

Regime divergence producing a compliance gap. Where the OFAC analysis produces a blocked-property finding but the OFSI analysis does not – or vice versa – the firm faces a structural compliance gap. Acting on the OFAC finding alone may not satisfy OFSI obligations, and vice versa. The gap should be escalated, not resolved unilaterally at desk level.

What does an adequate programme look like across both regimes?

The myth that name screening alone is enough to meet the rules is, in our experience, one of the most persistent compliance misconceptions in the virtual-asset sector. It is not a defensible position under either OFAC or OFSI. Both regulators have made clear – through enforcement guidance, industry statements, and, in OFAC's case, published enforcement actions – that a programme limited to name and entity screening is incomplete for businesses handling digital assets.

An adequate programme for a business subject to both regimes should be built around five elements. These are not proprietary; they reflect the structure that competent compliance programmes consistently exhibit when reviewed under either regime.

First: wallet-level screening at origination and receipt. Every wallet involved in a transaction should be screened against designated-person attribution databases, not only the name of the account holder. Name screening and wallet screening address different risks and should operate in parallel.

Second: risk-scored analytics with documented thresholds. The analytics tool should produce a risk score for each transaction. The programme should document the threshold above which a transaction is blocked, quarantined for review, or cleared. That threshold decision – and the evidence behind it – is what a regulator will examine in an enforcement context.

Third: periodic re-screening. Designations occur after account opening and after wallet creation. A wallet that was clean at onboarding may be linked to a designated person six months later. Re-screening on a defined cycle – the frequency determined by the risk level of the counterparty – is a basic requirement of a risk-based programme.

Fourth: a documented escalation path for analytics alerts. Every alert should follow a defined route: from the analytics tool, to the compliance function, to senior management if the alert meets specified criteria. The escalation path should be documented and tested. A programme that generates alerts but has no consistent record of what happened to them will not satisfy either regulator.

Fifth: records maintained for the required period. Under OFAC, sanctions records must be kept for five years. Under OFSI, record-keeping obligations are set by the relevant thematic regulations; the principle is the same. Analytics reports, alert dispositions, and escalation decisions should be preserved for at least that period and in a format that can be produced to a regulator.

A programme that satisfies these five elements across both regimes is significantly better positioned in an enforcement context than one that addresses only the most visible layer of screening. Voluntary self-disclosure is a recognised mitigating factor in OFAC's Enforcement Guidelines. A well-documented programme supports the factual basis for any such disclosure and demonstrates that the violation, if one occurred, was not the product of a systematic failure.

When should a cross-border business involve sanctions counsel?

The decision to involve counsel is not always made early enough. In our experience, the most consequential compliance decisions – whether to block, whether to report, how to document an analytics finding – are often made at desk level without legal input, and the position is harder to recover once those decisions are recorded.

Counsel should be involved at the outset of any programme-design exercise that touches digital assets and multiple regimes. The analytics architecture, the scoring thresholds, the escalation paths, and the record-keeping system should all be reviewed by someone who understands how each of OFAC, OFSI, and the EU would assess them in an enforcement context. Designing a programme in isolation from the legal standard it is meant to satisfy is a common and avoidable error.

Counsel should also be involved promptly when an analytics alert surfaces a high-confidence attribution to a designated person, when a transaction has already cleared and a blocking or reporting decision is now required, and when the OFAC and OFSI analyses diverge. These are not questions that a screening tool resolves; they require a legal judgment about the applicable test, the quality of the attribution evidence, and the regulatory consequences of each available course of action.

If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. The 10-business-day reporting window under OFAC is short. The OFSI reporting obligation runs from knowledge or suspicion, which may already have been established before the escalation reaches counsel. The record of what the firm knew, and when, is material to every subsequent enforcement assessment.

We have acted for financial institutions, payment firms, and virtual-asset businesses at each of these stages – programme design, alert management, voluntary self-disclosure, and enforcement defence. The position at each stage is different, and the advice needed is different. What does not change is that early involvement produces a better documented and more defensible record.

Related practices

• Affiliate-level restrictions under the EAR – understanding how BIS rules reach beyond the named entity to affiliated structures
• Control beyond the bright line: OFAC vs OFSI – how the ownership and control tests diverge across the two primary English-language regimes

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.