Digital-asset counterparty diligence across regimes: a practical guide

A digital-asset business receives a transfer request from a wallet linked to an entity in a jurisdiction where several major sanctions regimes converge. The compliance team's screening returned no direct hit. But is that enough? A deal that proceeds on incomplete diligence can collapse on a late sanctions hit – and in cross-border digital-asset transactions, that hit can come from OFAC, OFSI, the EU Council, or several other regimes at once.

Digital-asset counterparty diligence across a cross-border footprint means mapping your counterparty's wallet exposure, ownership chain, and jurisdictional connections against the major sanctions and financial-crime regimes before the transaction settles. As of January 2026, the core obligation runs under OFAC's blocking rules and 50 percent ownership guidance, OFSI's financial-sanctions regime, and the EU transfer-of-funds rules – each with distinct tests, and each capable of catching a transaction the others miss. The strictest prohibition in play governs conduct.

This guide walks through the diligence process in sequential steps, from initial counterparty mapping through wallet screening, ownership analysis, multi-regime cross-check, and the point at which outside sanctions counsel should be engaged.

Step 1: Map your counterparty's jurisdictional connections before screening begins

Effective digital-asset counterparty diligence starts not with a screen but with a map. Before any list-check, establish which regimes could apply: where is the counterparty incorporated, where does it operate, where does it hold licences, and where are its owners domiciled? A crypto exchange incorporated in one jurisdiction but serving clients from another may sit within OFAC's reach, OFSI's reach, and the EU's, simultaneously.

For a business subject to US jurisdiction – whether through US persons, US-origin technology, or US correspondent accounts – OFAC's rules apply globally. For EU-supervised entities, the Council regulations apply to any transaction processed within the EU, regardless of where the counterparty sits. OFSI's regime bites on any person in the UK and on UK persons wherever they are. Start by listing every legal entity, its domicile, and the regimes to which it is subject. That list is the scope of your diligence exercise.

At this stage, also identify whether the counterparty holds a regulatory authorisation – as a crypto-asset service provider, a virtual-asset service provider, or an equivalent category – in any of the relevant jurisdictions. An authorised entity is not automatically clean, but authorisation creates a paper trail and a regulatory relationship that feeds the risk assessment. In our experience, counterparties that cannot demonstrate a clear regulatory footprint in any jurisdiction are a diligence red flag before the first name-screen is run.

Step 2: Screen wallets, addresses, and associated entities – not just names

Digital-asset sanctions screening differs from conventional counterparty screening in one material respect: the asset itself – the wallet address – can be designated, not only the legal person who controls it. OFAC designates wallet addresses directly as Specially Designated National identifiers (a listed person's associated cryptocurrency addresses, appended to their SDN entry), and dealings with those addresses are prohibited regardless of whether the human counterparty's name triggers a match.

A name-only screen therefore misses the core risk. Best practice for digital-asset counterparty diligence under a cross-border compliance programme includes: screening the wallet address against published address lists from OFAC and equivalent regimes; running blockchain analytics to identify whether the wallet has transacted with addresses previously flagged in law-enforcement or regulator actions; and checking whether the wallet cluster shows patterns consistent with mixing, layering, or passage through jurisdictions that feature prominently in diversion risk guidance.

Blockchain analytics is now used by regulators themselves to trace wallet clusters and extend designations to associated addresses. A compliance team that relies solely on a name-screen is, in practical terms, leaving the most distinctive digital-asset risk unexamined. Under the EU transfer-of-funds rules, a zero threshold applies to transfers between crypto-asset service providers: originator and beneficiary information is required regardless of transaction value, which means there is no de minimis screen below which the obligation falls away.

For jurisdictions covered by other regimes – Canada, Australia, Switzerland, Singapore, Japan – the same wallet-level logic applies, even where the national legislation has not yet produced regime-specific address designation lists. The cross-cutting principle is clear: where two or more regimes apply to the same transaction, the stricter prohibition governs.

Step 3: Apply the ownership and control tests regime by regime

A counterparty that clears the wallet and name screen may still be caught by an ownership-or-control analysis. The tests differ across regimes and the divergence is consequential.

Under OFAC's 50 percent rule (the rule that treats any entity owned in the aggregate by blocked persons at 50 percent or more as itself blocked), the test is mechanical and does not require a finding of practical control. Aggregation matters: two designated persons each holding a minority stake can together breach the threshold. The rule applies whether ownership is direct or layered through intermediate entities. In our cross-border practice, the intermediate-layer problem is consistently the one that produces unexpected hits late in a deal.

The UK and EU tests operate differently. OFSI's ownership and control test (the rule that can catch a non-listed entity controlled by a designated person) looks at actual, not theoretical, control. UK case law, as currently in force, distinguishes existing influence from a hypothetical ability to exert control: control must be real and demonstrable, not merely possible. The EU formulation is similar – it requires objective and sufficiently weighty evidence of control, and the character of a broader legal or political system is not by itself proof that a particular company is controlled by a listed person.

The practical implication for a cross-border digital-asset diligence exercise is that you must run both the mechanical OFAC test and the qualitative UK/EU control assessment. A company that sits below the OFAC threshold is not cleared for OFSI or EU purposes if there is credible evidence of designated-person control in practice. How far down the ownership chain should you go? As a working rule, apply documented analysis to every layer where a sanctioned-nexus is identified at any intermediate level, and treat unexplained beneficial-ownership opacity as a risk flag that warrants escalation.

Step 4: Identify and document the risk flags specific to digital assets

Several patterns carry elevated sanctions risk in digital-asset transactions and should be treated as mandatory escalation triggers in any cross-border diligence programme.

First: AIS-analogue behaviour at the wallet level. Just as a vessel that disables its AIS transponder raises a maritime red flag, a wallet that shows gaps in its on-chain history – through mixers, privacy coins, or chain-hop sequences – raises an equivalent signal. Blockchain analytics tools flag these patterns; a compliance programme that does not use them is not benchmarked to the current regulatory standard.

Second: geographic concentration. A counterparty whose wallet history is predominantly linked to addresses associated with jurisdictions subject to comprehensive or thematic sanctions controls – or to exchanges that do not apply know-your-customer controls – requires enhanced due diligence regardless of whether the counterparty's own name appears on a list.

Third: de-risking cascades. A financial institution exiting a relationship to avoid sanctions exposure can itself be a signal: if a counterparty's primary banking relationship has recently terminated for stated compliance reasons, that fact warrants direct investigation before proceeding.

Fourth: foreign financial institution exposure. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons. For digital-asset businesses with US touchpoints, a counterparty whose settlement arrangements route through an institution with unresolved correspondent-account issues is a secondary-sanctions risk that sits outside the primary name-screen entirely. Are your due-diligence templates designed to surface this category of risk?

Fifth: a sudden change in transaction patterns or counterparty geography. A sharp shift in the origin of incoming transfers – particularly from jurisdictions adjacent to those under comprehensive measures – is a documented diversion red flag. Transit through a third country does not change a transaction's controlled status, and the regulator's analysis follows the economic substance, not the routing.

Step 5: Cross-check against all applicable regimes and resolve conflicts

Once the wallet screen, ownership analysis, and risk-flag assessment are complete, the results must be run against each regime that could apply. This is the step that most generic compliance checklists skip – and it is the step where cross-border digital-asset diligence most commonly fails.

The practical framework for a cross-border digital-asset counterparty diligence checklist runs as follows. First, confirm which regimes apply to the transaction: identify the US-nexus (US person, US technology, US dollar clearing), the UK-nexus (UK entity, UK authorisation, UK person), the EU-nexus (EU-supervised entity, EU resident counterparty), and any other national-regime nexus (Canada, Australia, Switzerland, Singapore, Japan, UAE). Second, for each applicable regime, confirm that the counterparty passes the primary test: SDN/list clearance, the ownership/control analysis, the wallet-address screen. Third, where a hit or a flag is identified under any regime, apply the strictest prohibition: do not net out a clearance under one regime against a flag under another.

The EU transfer-of-funds rules and the OFAC blocking rules are not substitutes for each other. A transaction cleared by OFAC is not automatically cleared by OFSI or the EU; the tests differ and the listed persons differ. We regularly advise clients who have run a single-regime screen and missed a designation that sits on a different regime's list. That is not a theoretical risk; it is a recurrent practical problem.

Where the cross-check reveals a conflict – for example, where an EU operator is faced with both a potential EU prohibition and a potential US obligation that point in different directions – the EU Blocking Regulation (the EU measure that can prohibit EU operators from complying with specified third-country measures) may be relevant. The interaction between the Blocking Regulation and OFAC obligations is a legal question that requires specialist counsel; it is not resolvable by a compliance team working from a checklist alone.

Step 6: Record, retain, and know when to escalate to sanctions counsel

Documentation closes the diligence loop and is itself an obligation. Under the major regimes, record-keeping requirements (the obligation to maintain full records of transactions, screening outcomes, and decisions) extend over a significant period: US rules require sanctions records to be kept for five years, as currently in force. UK and EU rules impose comparable retention obligations, though the specific periods vary by instrument and should be confirmed for the applicable regime.

The documentation package for each digital-asset counterparty diligence exercise should, at minimum, include: the wallet addresses screened and the tools and date of the screen; the ownership and control analysis, including the source data and the conclusions reached at each layer; the risk-flag assessment and the basis for any escalation or clearance decision; and the cross-regime matrix showing which regimes were checked and what result each produced.

Escalation to external sanctions counsel is appropriate – and in some circumstances legally prudent – in at least four situations. First, where the ownership analysis cannot be completed because beneficial-ownership information is unavailable or inconsistent. Second, where a risk flag has been identified and the internal team cannot reach a confident conclusion on whether the transaction is prohibited. Third, where a potential block, freeze, or rejection is identified and the reporting clock may already be running: under OFAC, blocked-property and rejected-transaction reports are due within 10 business days of the event, as currently in force. Fourth, where the Blocking Regulation conflict described above is live.

A common myth in cross-border digital-asset transactions is that the seller's representations and warranties remove the buyer's sanctions risk. They do not. Contractual reps shift civil liability between the parties but have no effect on the regulatory obligation: if the buyer is a person subject to sanctions law, the obligation to screen, the obligation to block or reject, and the obligation to report, all run independently of any contractual arrangement. In our experience, this is one of the most persistent misconceptions we encounter in deal teams operating across jurisdictions.

The point at which you involve specialist counsel is not the point at which a problem has already crystallised. The earlier a cross-border digital-asset diligence analysis is stress-tested against the applicable regimes, the more options remain open. Decisions made late in a transaction – after a deal is signed, after a transfer has settled – narrow the range of available responses and can convert a manageable compliance issue into a reportable one.

Related practices

• AIS anomaly indicators – EU service – identifying vessel-tracking red flags for sanctions diligence under EU rules
• Digital-asset counterparty diligence: OFAC guide – step-by-step OFAC analysis for virtual-asset and crypto counterparties

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.