Digital-asset counterparty diligence under OFAC: a practical guide

A payment firm is mid-close on a digital-asset transaction. Its compliance team runs the counterparty's wallet address and corporate name through standard screening. Both come back clean. The deal proceeds. Three weeks later, a blockchain analytics alert flags a wallet cluster linked to a designated entity that transacted with the counterparty six months earlier. Was there a violation? Could the firm have known? And what, precisely, was the obligation in the first place?

Digital-asset counterparty diligence under OFAC is not simply a name-screen. As of January 2026, OFAC's position – grounded in its authority under IEEPA – is that the 50 percent rule (the rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked) applies fully to virtual-asset businesses and wallets. Designation can extend to specific addresses. Blockchain analytics is used by regulators to trace wallet clusters. Liability is strict: no knowledge of the violation is required for a civil penalty to attach.

This guide works through the diligence analysis as a decision tree – from the initial counterparty classification, through address and ownership screening, to the risk flags that require you to stop, and the cross-regime considerations that a US-focused screen alone will miss.

Step one: classify the counterparty before you screen anything

The first question is not whether the counterparty is on a list – it is what kind of entity you are dealing with, because that determines which screening layers apply and how deep you need to go.

A digital-asset counterparty can present as a natural person, a corporate entity, a decentralised-protocol address, or a custodial intermediary acting for an undisclosed principal. Each of these has a different risk profile under OFAC.

A natural person triggers a direct SDN-List check and, where relevant, a nationality and residency assessment for comprehensive territorial programmes. A corporate entity requires both a name screen and an ownership-chain review against the 50 percent rule. A custodial intermediary – an exchange, a prime broker, a payment processor – may sit between your firm and the ultimate counterparty, and the obligations do not disappear simply because you cannot see the underlying customer.

In our experience, the classification step is routinely skipped. Compliance teams run the name or the wallet address and move on. The question of whether the counterparty is itself a custodian for a disclosed or undisclosed third party is not asked. That omission is where exposure originates.

Practical checkpoint: before you run any screen, document the entity type, the role it plays in the transaction, and whether it holds assets for its own account or for underlying clients. That documentation anchors the rest of the analysis and is the first record a reviewer will look for if the transaction is later queried.

If the counterparty is a corporate entity: how does the 50 percent rule apply?

Where the counterparty is a company, the ownership analysis must go beyond the immediate shareholder register. The 50 percent rule aggregates holdings across all blocked persons – two designated individuals each holding a meaningful stake can together reach the threshold even if neither does alone. And the rule applies at every layer of the structure, not just the first.

The mechanics matter. If a designated person holds a majority stake in a holding company that in turn holds a stake in your counterparty, the analysis must follow the chain. Legal form does not interrupt the calculation. An intermediate entity that is itself treated as blocked because it is majority-owned by a designated person passes that status through to any entity it in turn owns at the requisite level.

This is where digital-asset transactions create distinctive complications. Ownership and control in the digital-asset sector can be structured through token holdings, governance rights, and protocol-level voting mechanisms that bear little resemblance to conventional share registers. We regularly advise clients on structures where the formal shareholder list is clean but the economic and governance reality points to a different conclusion.

OFAC's guidance under IEEPA makes clear that it looks past legal form to the practical and economic reality of a transaction. US guidance treats the 50 percent ownership threshold as a floor rather than a ceiling. That framing matters: a minority holding by a blocked person that falls below the threshold is not automatically safe – it is a red flag that requires an explanation and a documented assessment, not a closure.

One further point that is often under-appreciated: a significant minority holding is treated as a red flag rather than a safe harbour. Document your analysis of why the minority holding does not give the blocked person effective control before you close the file.

If the counterparty is a wallet or address: what does address-level screening involve?

OFAC has designated specific wallet addresses as part of SDN listings. A transaction that sends value to a designated address is a blocked transaction – regardless of whether you knew the wallet belonged to a designated person, and regardless of whether the blockchain transaction was initiated by a human counterpart or by a smart contract.

This is one of the most consequential features of OFAC's digital-asset enforcement position. The obligation to screen addresses is not optional. Blockchain analytics tools identify wallet clusters – groups of addresses that heuristic analysis attributes to the same controlling entity. A designated address and a cluster of addresses associated with it may all be within scope.

What does address-level screening require in practice? At minimum: a check of the current SDN List for designated addresses before any on-chain interaction. Where the transaction value, the sector, or the counterparty's profile elevates the risk, blockchain analytics at the cluster level is the appropriate standard. A tool that checks only exact-match addresses against a static list does not meet that standard for higher-risk transactions.

Screening is a process, not a single query. The list changes. An address that was clean yesterday may be designated today. For ongoing relationships with digital-asset counterparties, periodic rescreening – rather than a one-time check at onboarding – is the correct approach. Sanctions records, including the results of screening queries, must be kept for five years as currently in force.

A blocked transaction must be rejected or, where property is blocked, reported to OFAC within 10 business days. That window starts on the date of the blocking or rejection – not on the date you decided to review it internally. Ask yourself whether your current process would identify and report a blocked on-chain transaction within that window.

What are the risk flags that require you to stop?

Not every diligence issue is a clear-cut hit. Many situations sit in an intermediate zone where the screen does not produce a direct match but the facts generate a pattern of concern that OFAC's Enforcement Guidelines treat as relevant to the overall assessment.

The following patterns warrant a formal pause and legal review before proceeding.

• Unexplained wallet history: a counterparty wallet that has transacted, even at one remove, with a known designated address – particularly where the transaction predates your relationship and no explanation has been offered.
• Ownership-chain opacity: a corporate structure that cannot be traced to natural-person ultimate beneficial owners, or where intermediate entities are registered in jurisdictions that do not maintain accessible registers.
• Geographic inconsistency: a counterparty whose stated business location does not match the geographic spread of its wallet activity, its IP metadata, or its declared trading relationships.
• Custodial ambiguity: a counterparty that acts as an intermediary but declines to confirm whether it operates a KYC programme for its underlying clients or to provide certifications about the source of funds.
• Facilitation risk: a proposed transaction where your role is to facilitate a step that would be prohibited if your firm conducted it directly. OFAC's prohibition on facilitation by US persons is explicit and extends to enabling a foreign entity to do what a US person could not.
• Stablecoin and protocol risk: proposed payment stablecoin issuers are subject to AML and sanctions compliance requirements as financial institutions; the obligations attach to the issuer, not only to the customer.

In our practice, the situations that result in voluntary self-disclosure – VSD (a disclosure of a potential violation made proactively to OFAC, which is a recognised mitigating factor under the Enforcement Guidelines) – most commonly arise from one of the first three patterns above. They are rarely a surprise in retrospect. The warning sign was present; the question is whether the process was designed to surface it.

How does the OFAC analysis differ from the UK, EU, and other regimes?

OFAC is not the only regime that applies to a cross-border digital-asset transaction. A business operating between the United States and a European counterparty, or handling payments through a UK-regulated institution, must map the full set of applicable obligations – and the regimes diverge in ways that matter operationally.

Under OFSI in the United Kingdom, the test for whether a non-listed entity is caught by financial-sanctions obligations is an ownership and control test, not a purely mechanical ownership threshold. The UK ownership-and-control test can catch a non-listed entity that is controlled by a designated person even where the formal ownership stake falls below fifty percent. UK case law distinguishes existing actual influence from a hypothetical ability to exert control; the leading authorities hold that control must be actual, not theoretical. The practical implication: a counterparty that passes the OFAC 50 percent rule may still be caught under OFSI's control analysis. Running a US screen and concluding the entity is clear does not close the UK position.

Under EU Council regulations, the asset-freeze prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test looks at both control and an ownership criterion. For digital-asset transactions touching the EU – including transactions settled through euro-denominated stablecoins or involving EU-regulated counterparties – the EU analysis runs independently of OFAC.

The EU transfer-of-funds regime applies a zero threshold to transfers between crypto-asset service providers, meaning originator and beneficiary information is required regardless of transaction value. That is a more demanding standard than a pure sanctions screen: it is a data-collection and transmission obligation that runs alongside, not instead of, the sanctions check.

Where two regimes both apply, the stricter prohibition governs. There is no netting or averaging across regimes. A transaction that is conditionally permissible under a US general licence may still be blocked under EU law. We regularly advise on precisely this multi-regime junction, where a licence obtained from one regulator does not resolve the exposure under another.

For transactions touching Switzerland, Canada, or Australia, the national regimes implementing UN Security Council measures apply to entities subject to those jurisdictions' law. Switzerland frequently aligns its sanctions with EU measures; Canada's regime operates under separate statutory authority. Neither is a mirror of OFAC, and each requires its own analysis for a cross-border digital-asset transaction.

When you have a hit or a potential violation: the decision sequence

A confirmed match to the SDN List or a designated address requires an immediate stop. Do not proceed with the transaction, do not release any blocked property, and do not notify the counterparty of the reason for the hold without legal advice on the tipping-off risk in the relevant jurisdiction.

The reporting obligation under OFAC is clear: a blocked transaction must be reported within 10 business days. The clock runs from the event, not from your internal review of it. Where property is blocked rather than a transaction rejected, the reporting and record-keeping obligations are parallel.

For a potential – as opposed to confirmed – violation, the question of whether to pursue VSD is a legal judgment that turns on the specific facts. VSD is a recognised mitigating factor under OFAC's Enforcement Guidelines and can affect the outcome of an enforcement assessment materially. But the submission must be accurate and complete; a partial or misleading disclosure will not attract the mitigation and may aggravate the position. This is a decision to take with counsel, not to defer until the matter reaches an enforcement stage.

The decision matrix in simplified form:

Confirmed SDN match or designated address → block the transaction → report within 10 business days → preserve all records → assess VSD for any apparent preceding violation → involve counsel immediately.

Probable match, unclear ownership chain → pause the transaction → conduct accelerated ownership-chain analysis → if the chain cannot be resolved to a clean conclusion, treat as blocked → involve counsel before proceeding.

Inconclusive screen with risk flags present → pause → request additional information from the counterparty → document the response or non-response → make a recorded legal determination of whether to proceed → do not rely on the seller's representations as a substitute for independent analysis (see the myth addressed below).

The third scenario is the one that most frequently presents in our practice. A hit is unambiguous. A risk-flag situation requires a legal judgment, and that judgment needs to be documented in a form that would withstand regulatory scrutiny if the file is later reviewed.

A common objection: do the seller's representations remove my sanctions risk?

A persistent misunderstanding in digital-asset transactions is that a seller's representations and warranties – a contractual statement that the seller is not a designated person and that the transaction complies with applicable sanctions – transfer the buyer's legal exposure to the seller.

They do not. OFAC liability is strict. A civil penalty can attach without any knowledge or intent on the part of the person in violation. A contractual representation does not change the underlying legal obligation; it creates a right of indemnification against the seller if the representation is false, but that right is worth nothing if the seller is itself subject to sanctions or is insolvent. The buyer still has the violation on its record.

More precisely: representations are a contractual tool, not a compliance control. They are appropriate as one layer in a well-constructed transaction structure, alongside – not instead of – independent screening, ownership-chain analysis, and a documented legal assessment. In our cross-border practice, we see this substitution most frequently in situations where time pressure on a closing has caused the diligence process to be compressed. That compression is the source of most of the avoidable exposure we encounter.

The same logic applies to certifications provided by digital-asset intermediaries about their underlying clients. A certificate is useful evidence; it is not a substitute for the intermediary's own screening obligations, and it does not release the recipient from its independent duty to screen.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.