How to screen virtual-asset transfers under OFAC

A payment firm routes a token transfer through its platform. The originator passes name screening. The transaction settles. Six months later, the compliance team discovers the receiving wallet address is associated with a blocked person. The transfer was prohibited the moment it was initiated. That gap – between a clean name screen and a complete OFAC analysis – is where virtual-asset enforcement risk lives.

Virtual-asset transfer screening under OFAC requires more than matching names against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The governing authority is IEEPA and the regime-specific regulations OFAC administers. US persons and entities subject to US jurisdiction are prohibited from transacting with blocked persons or property – and blocked property includes digital wallets associated with designated individuals or entities. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) applies to virtual-asset businesses just as it does to any other counterparty.

This guide walks through the screening decision tree a virtual-asset business, exchange, or compliance team should apply at each stage of a transfer – from originator identification through wallet analysis, transaction-level checks, and the travel rule overlay – and flags where OFAC diverges from the EU and UK positions.

If you are a US person or serving US customers: does OFAC jurisdiction attach?

OFAC jurisdiction is the first branch in the decision tree. If your platform is US-incorporated, operated by US persons, or processes transactions involving US-dollar stablecoins or US infrastructure, OFAC's rules apply to you. Full stop.

The reach extends further than many businesses expect. A non-US exchange that processes a transfer touching a US correspondent account, a US-based node operator, or a US-issued stablecoin may bring itself within OFAC's jurisdiction for that transaction. OFAC's authority under IEEPA operates extraterritorially in defined circumstances, and facilitation by a US person of a transaction that would itself be prohibited – even if routed through a non-US entity – is itself prohibited.

What does this mean practically? If your token is issued on a US blockchain infrastructure or your stablecoin is backed by a US custodian, you should treat OFAC obligations as engaged regardless of where your legal entity is incorporated. We regularly advise non-US businesses that are surprised to find themselves within scope on precisely this point.

For businesses without any US nexus, OFAC jurisdiction may not attach directly. But the analysis does not stop there. The UK regime under OFSI and SAMLA, the EU Council regulations, and the UAE's national framework each impose their own screening obligations. Where two regimes both apply, the stricter prohibition governs.

If jurisdiction attaches: have you identified the originator and beneficiary accurately?

Accurate counterparty identification is a prerequisite for any screening to mean anything. Under OFAC's rules – and, critically, under the travel rule as applied to virtual assets – the originator and beneficiary of a transfer must be identified before the transaction is processed.

The travel rule in the virtual-asset context requires that originator and beneficiary information accompany a transfer above defined thresholds. For US-regulated virtual-asset service providers, FinCEN's rules and OFAC's compliance expectations operate in parallel: the travel rule provides the information; OFAC screening uses it. A transfer without adequate originator identification cannot be screened effectively against the SDN List or blocked-wallet databases. It is therefore itself a compliance failure, independent of whether any designated party is involved.

In practice, the most common information gaps arise at the edges: transfers from unhosted wallets, transfers from foreign exchanges that do not apply the travel rule, and transfers where the stated originator name does not match the on-chain activity. Each gap degrades the quality of the screen. A compliance programme that treats a missing field as an acceptable data quality issue rather than a control failure is building on sand.

Gather – at minimum – the full legal name, wallet address, and, where required, identifying information for both originator and beneficiary before screening commences. Where a counterpart exchange does not supply this information, the risk decision cannot be reduced to "screen what you have."

Have you screened the wallet address, not just the name?

Name screening alone does not satisfy OFAC's compliance expectations for virtual-asset transfers. OFAC has the authority to designate specific wallet addresses, and a designated address is blocked property regardless of whether the person controlling it appears by name in the transaction record.

Blockchain analytics tools are used by regulators to trace wallet clusters. A designation can extend to addresses associated with a designated person, and the association does not require a direct relationship with the listed name. In our experience, firms that run name screening only – without a wallet-address check against OFAC's published list of digital currency addresses – are running an incomplete screen by definition.

The practical steps are:

• Screen the originator and beneficiary names against the SDN List and all other OFAC-administered lists relevant to the transaction.
• Screen every wallet address in the transaction chain – originator, beneficiary, and any intermediate custodial wallet – against OFAC's published digital currency addresses.
• Use a blockchain analytics tool to identify whether any wallet in the chain has a material cluster risk score, and treat a high-risk score as a flag requiring enhanced review rather than an automated block.
• Document the screen, the tool used, the date, and the result – OFAC's record-keeping obligations require that sanctions records be maintained for five years.

None of these steps is optional if OFAC jurisdiction attaches. The question a compliance officer should be able to answer under examination is: on this transaction, on this date, using this tool and this list version, these were the results. If that reconstruction is not possible, the control did not exist in any meaningful sense.

Has a blockchain analytics review identified indirect exposure?

Even a clean name screen and a clean direct wallet screen may leave indirect exposure undetected. The ownership and control question for virtual assets mirrors the 50 percent rule in traditional finance: an entity controlled by a blocked person, or a wallet cluster demonstrably associated with one, carries the same prohibition.

Blockchain analytics identifies patterns that name and wallet screening alone cannot: layered transfers through mixer services, rapid chain-hopping across asset classes, and high-volume pass-through wallets with no evident commercial purpose. A sharp change in routing patterns – for example, an originator that previously transferred directly beginning to route through multiple intermediate wallets – is a diversion red flag.

What should a compliance programme do with a material cluster risk flag? The threshold for action is not binary. A high score on a blockchain analytics tool is a risk signal, not a legal determination. The correct response is:

• Suspend processing of the transfer pending enhanced review.
• Investigate the flagged relationship – is the cluster association based on shared infrastructure, shared custody, or an actual transactional relationship with a blocked person?
• Apply the proportionality principle: the response to a marginal flag on a low-value transfer from a well-known counterpart is different from the response to a high-risk flag on a large transfer from an unverified wallet.
• Document the decision and the reasoning, whether you proceed or block.

Where the investigation cannot resolve the flag, the default position under OFAC's regime is that a blocked transaction must be rejected and reported. Blocked property must be reported to OFAC within 10 business days of blocking, and rejected transactions within the same window. That deadline begins to run from the moment the decision to block or reject is taken.

Does the travel rule apply across jurisdictions – and where do regimes diverge?

The travel rule applies differently across the major jurisdictions, and understanding those differences is not optional for any business that moves virtual assets across borders.

Under the US position, FinCEN's rules on funds transfers apply to banks and money-service businesses, and OFAC's compliance guidance reinforces the expectation that virtual-asset service providers maintain a sanctions compliance programme commensurate with their risk profile. The EU goes further in one specific direction: the EU transfer-of-funds regime applies a zero threshold to transfers between crypto-asset service providers, meaning originator and beneficiary information is required regardless of the value of the transfer. The UK position under OFSI and HMRC's rules broadly mirrors the EU's approach but operates under SAMLA and the relevant thematic regulations.

What is the practical consequence of this divergence? A platform that calibrates its travel rule compliance to the US threshold may be non-compliant under the EU rules for the same transaction, if that transaction touches EU infrastructure or a EU-supervised counterparty. Cross-border virtual-asset operations cannot be run on a single jurisdictional standard.

For businesses active in the UAE, Singapore, and Japan, the position differs further. Each of those regimes implements UNSC measures and maintains its own national virtual-asset framework. The UAE's Executive Office and the national licensing regime for virtual-asset service providers each impose screening obligations, as do MAS rules in Singapore and FEFTA-based controls in Japan. We have acted for multi-jurisdiction virtual-asset businesses navigating this patchwork and the starting point is always the same: map every jurisdiction in which you are licensed, provide services, or touch infrastructure, and apply the strictest applicable standard.

Do you know which regime sets the highest bar for your specific transaction flow? If not, that is the first question to resolve before building your screening architecture.

What does a compliant virtual-asset screening programme look like as a checklist?

A compliance programme that satisfies OFAC's five-element framework – management commitment, risk assessment, internal controls, testing, and training – looks different for a virtual-asset business than for a traditional financial institution, but the structural requirements are the same.

The following checklist reflects the standard we apply when reviewing a virtual-asset compliance programme. It is not exhaustive, and your specific risk profile – the jurisdictions you serve, the assets you handle, the counterparts you deal with – will determine where additional controls are required.

• Jurisdiction mapping: confirm whether OFAC, OFSI, EU, and/or other regimes apply to each product line and transaction flow.
• Originator and beneficiary identification: collect full legal name and wallet address for all counterparties before processing; apply travel rule data collection consistently.
• SDN and blocked-address screening: screen names against the SDN List and all applicable OFAC lists; screen wallet addresses against OFAC's published digital currency address list.
• Blockchain analytics: apply a risk-scored blockchain analytics tool to every transfer; define escalation thresholds and document decisions at each threshold.
• Unhosted wallet policy: apply enhanced due diligence to transfers involving unhosted wallets; document your risk tolerance and the controls that compensate for reduced transparency.
• Reporting readiness: have a documented process for blocking and reporting within the required window – blocked property within 10 business days; ensure the process is tested and the responsible person is identified.
• Record-keeping: retain all screening records, transaction data, and decision documentation for five years.
• Voluntary self-disclosure policy: understand that voluntary self-disclosure (a recognised mitigating factor in OFAC's Enforcement Guidelines) is a decision that should be taken with counsel, not reflexively; have a protocol for escalation when a potential violation is identified.
• Training: ensure front-line and compliance staff understand the specific risks of virtual-asset transfers – wallet-address blocking, cluster risk, and the travel rule data requirement.
• Programme review: test and audit the programme at intervals calibrated to your risk rating; update the risk assessment when you launch a new product, enter a new market, or list a new asset class.

Sanctions screening obligations attach on a risk basis. "We screened the name" is not, by itself, a complete control. OFAC's liability for civil penalties is generally strict – no knowledge or intent is required for a violation to exist. The question is not whether you intended to transact with a blocked person. The question is whether you did.

Correcting a common misconception: is name screening enough?

The most persistent myth in virtual-asset sanctions compliance is that name screening against the SDN List is sufficient. It is not, and OFAC's published guidance on virtual assets is explicit on this point.

The misconception arises from the traditional financial-institution model, where the counterparty is identified by name, account number, and jurisdiction. In virtual-asset transfers, the blocking may attach to the wallet address, not to any name. A wallet address associated with a blocked person is blocked property. Transferring value to or from it – even without any name match – is a prohibited transaction under the applicable OFAC regulations.

There is a second dimension to the myth: the belief that a low-value transfer is a low-risk transfer. OFAC's civil-penalty authority does not have a de minimis threshold. A transfer of modest value to a blocked wallet is a violation in the same way that a large transfer is. The value of the transfer affects the calculation of the potential penalty, but it does not determine whether a violation occurred.

A third misconception is that real-time screening is impossible and therefore partial screening is acceptable. This is not a position OFAC recognises. Compliance programmes are expected to screen at the point of initiation, not after settlement. Where real-time screening creates operational friction, the answer is to design the product architecture around the compliance requirement – not to accept a post-settlement review as a substitute.

In our experience, the firms that face the most significant enforcement exposure are not those that have no programme, but those that have a programme designed around the wrong model. A name-only screen that catches nothing and generates no escalations is not a functioning control; it is the appearance of one.

Related practices

• Affiliate-level restrictions under BIS and the EAR – assessing how entity-list controls interact with your supply chain and ownership structure.
• Virtual-asset travel rule: UAE guide – how the UAE's national virtual-asset regime applies the travel rule and screening obligations.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.