How to screen virtual-asset transfers under UN

A virtual-asset service provider processes hundreds of transfers each day. Its screening tool checks sender and recipient names against the UN Consolidated List. A transfer slips through. The counterparty wallet belongs to an entity whose beneficial owner is listed – but the listing appears under a transliterated variant the tool never matched. The breach surfaces weeks later, during a regulatory review. By then, the options have narrowed considerably.

Screening virtual-asset transfers against the UN Consolidated List (the list of individuals and entities designated by UN Security Council Sanctions Committees under Chapter VII of the UN Charter) requires more than name-matching. A complete programme identifies beneficial owners and wallet clusters, applies fuzzy-matching logic across transliteration variants, and integrates the travel rule – the obligation to pass originator and beneficiary information with each transfer – as a source of verification data, not merely a reporting formality. As of January 2026, every major jurisdiction implementing UN measures has added layers on top of the baseline Consolidated List obligation, and those layers diverge in material ways.

This guide walks through the screening task from initial classification to ongoing monitoring, using a representative VASP engagement as the organising thread. It covers the UN baseline obligation, how OFAC, OFSI, and the EU build on it, and the risk flags that cause real breaches in virtual-asset businesses.

Understanding the UN baseline before you screen anything

The UN Consolidated List is the foundation on which every national regime rests. Security Council Sanctions Committees designate individuals and entities under Chapter VII resolutions; member states are legally required to implement the resulting asset-freeze, travel-ban, and arms-embargo measures. For a virtual-asset business, the operative obligation is the asset-freeze: making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person is prohibited.

That phrase – "directly or indirectly" – is the technical heart of the screening obligation. A transfer to a non-listed wallet address may still be prohibited if the economic benefit flows to a listed person. Name-matching on the counterparty alone cannot answer that question. You also need to know who controls the wallet and whether any intermediate party in the payment chain is itself caught.

What does the list actually contain? Each entry has a reference number, aliases, date and place of birth where known, document identifiers, and – for some newer entries – associated identifiers such as blockchain addresses. The Consolidated List is updated on a rolling basis. In our experience, VASPs that download the list on a weekly cycle have a material gap during the interval. Daily or real-time API consumption is the operational standard now.

One further baseline point: UN sanctions operate differently from autonomous measures imposed by individual jurisdictions. A UN listing obligates all member states simultaneously. An autonomous OFAC or EU designation does not carry that universal legal force, though it may bind persons subject to the relevant national regime. Understanding which obligation is carrying the prohibition in a given transaction is not merely academic – it affects which licensing route, if any, is available.

Mapping the travel rule onto the UN screening obligation

The travel rule (the obligation on virtual-asset service providers to obtain, hold, and transmit originator and beneficiary information with each qualifying transfer) was developed by the Financial Action Task Force and implemented at national level with varying thresholds and scope. Its relevance to sanctions screening is direct: the information that the travel rule requires you to collect is precisely the information you need to run an effective sanctions check.

For UN-based obligations, the travel rule matters in two directions. Outgoing transfers: before you transmit, you should verify the originator data you hold and screen the beneficiary information you are about to send against the Consolidated List and any overlapping national list. Incoming transfers: you receive beneficiary information and should screen both originator and beneficiary before crediting the receiving wallet.

The EU transfer-of-funds rules apply a zero threshold to transfers between crypto-asset service providers – originator and beneficiary information is required regardless of transfer value. That is materially stricter than some other jurisdictions, which apply a value threshold before the obligation triggers. Where a VASP operates across multiple jurisdictions, the stricter rule governs the conduct of that VASP in each jurisdiction; you cannot satisfy the EU rule by applying a threshold standard for EU-facing transfers.

A practical difficulty arises with unhosted wallets – addresses not held by a regulated service provider. Many jurisdictions impose enhanced due diligence for unhosted wallet transfers. The information flow that the travel rule depends on is absent or incomplete. For sanctions purposes, an unhosted wallet with no verifiable beneficial owner is a high-risk situation, not a neutral one. Screening the address against blockchain analytics data is a supplement, not a substitute, for knowing who owns it.

In our practice, the most common structural weakness we see is a VASP that has travel-rule compliance and sanctions compliance operating as separate workstreams, with no data feed between them. The travel-rule team collects originator names; the sanctions team screens a different data set derived from the onboarding record. The two sets diverge over time. Transfers carry information that the sanctions screen never sees.

How OFAC, OFSI, and the EU build on the UN baseline – and where they diverge

Every major autonomous regime layers additional obligations on top of the UN Consolidated List, and those layers create meaningful divergence for a VASP operating across jurisdictions. Understanding the divergence is not optional for compliance counsel advising a multi-market business.

Under OFAC, the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) applies fully to the virtual-asset context. An entity that is not on the SDN List may still be a blocked person if the aggregate ownership by listed parties reaches that threshold. Blockchain analytics has made this operationally tractable: regulators now use wallet-cluster analysis to trace economic benefit. OFAC's civil liability is strict – no knowledge or intent is required for the violation itself – and blocked-property reports are due within 10 business days of a blocking event. That window is tight for a business processing transfers at volume.

OFAC designations can extend to wallet addresses directly. When an address is added to the SDN List, any VASP that processes a transfer involving that address after the designation date is engaging with a blocked person. Screening tools that check only human-readable identifiers and not on-chain addresses will miss this category of designation entirely.

Under OFSI, the UK ownership-and-control test goes further than the mechanical 50 percent threshold. A non-listed entity may be caught where a designated person controls it, even without majority ownership. OFSI can impose monetary penalties on a strict-liability basis, with the maximum set at the greater of £1,000,000 or 50 percent of the breach value (as currently in force; verify the current position, as the UK government has consulted on increasing both the ceiling and the percentage). There is also a legal obligation on relevant firms to report knowledge or suspicion of a designated person to OFSI. For a VASP, that reporting obligation runs alongside – and is separate from – any AML suspicious activity report.

Under the EU regime, asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. That formulation tracks the UN baseline but the EU also operates its own autonomous lists, which differ from both the UN Consolidated List and the OFAC SDN List. A VASP subject to EU rules must screen against all three. The EU control test for non-listed entities looks at ownership exceeding 50 percent and at control, which is a broader concept. EU dual-use and transfer-of-funds rules add further layers for specific asset categories and transfer types.

For a VASP operating in Singapore or the UAE, the position is implemented through national frameworks that track the UN Consolidated List but may add domestic designations. Japan implements through the Foreign Exchange and Foreign Trade Act. Switzerland aligns closely with EU measures in practice. The compliance design must account for which national list applies to which customer relationship and which transfer – not just the Consolidated List in isolation.

Where two regimes both apply, the stricter prohibition governs. You cannot rely on the UN baseline being satisfied to excuse a breach of an OFAC or EU rule that bites harder on the same facts.

Step-by-step: running the virtual-asset screening process

What follows is the operational sequence we work through with VASP clients. It is not a checklist to tick once; it is a continuing discipline applied to every qualifying transfer.

Step one – classify the obligation. Before you screen, identify which regimes apply to the transfer. A transfer between two EU-regulated counterparties triggers EU rules and the zero-threshold transfer-of-funds requirement. The same transfer may also trigger OFAC rules if a US-person nexus exists. Map the applicable regimes first; screening only one list when three apply is a structural gap.

Step two – obtain the travel-rule data. Collect originator and beneficiary name, account or wallet address, and – where the regime requires it – additional identifiers such as date of birth or legal entity identifier. Do not proceed to screening without this data. A transfer where the required information is missing or incomplete is itself a compliance concern, independent of whether the counterparty turns out to be listed.

Step three – screen names with fuzzy logic. Run originator and beneficiary names against all applicable lists using a tool configured for transliteration variants, name-order reversals, and common aliases. The UN Consolidated List entries often include multiple script variants; your tool must match across them. A single exact-match rule will miss most real-world hits.

Step four – screen addresses on-chain. Check wallet addresses against designated-address lists maintained by OFAC and, where applicable, by the relevant national authority. Run the addresses through a blockchain analytics provider to identify cluster associations with known designated wallets. A clean name is not a clean wallet; the two checks are independent.

Step five – assess beneficial ownership. For the counterparty entity, apply the 50 percent aggregation analysis under OFAC and the ownership-and-control test under OFSI and the EU. If the ownership chain is opaque – trust structures, bearer instruments, jurisdictions with limited public registry data – that opacity is itself a risk flag requiring escalation. In our experience, the beneficial-ownership step is the one most commonly omitted from a VASP's automated flow and the one that causes the most significant breaches.

Step six – hold, review, and escalate potential matches. A potential match freezes the transfer pending review. Assign it to a sanctions analyst who reviews the underlying data, checks additional identifiers, and either clears the transfer with documented reasoning or escalates to compliance counsel. The documented reasoning is evidence: if the decision is later questioned, the record of the analysis is what the regulator will examine.

Step seven – report if blocked. If the transfer is blocked – meaning the asset is determined to be blocked property – report to the relevant authority within the applicable window. Under OFAC, that window is 10 business days. Do not release the asset pending resolution. Record all information relating to the blocked property and retain it for the required period; under OFAC the retention period is five years.

Step eight – document and review the programme. Screening is not a one-time calibration. As blockchain analytics improves, as designation practices evolve, and as new wallet-address entries appear on the SDN List and other lists, the programme must adapt. Quarterly testing of match rates, calibration of fuzzy-match thresholds, and review of escalation decisions are the minimum maintenance cycle.

Risk flags that cause real breaches in virtual-asset businesses

Most VASP breaches we have seen in practice trace back to a predictable set of gaps. None of them is exotic. All of them are correctable, but correction requires acknowledging that name screening alone is not enough to meet the rules.

The first flag is list-version lag. A VASP that refreshes its list data weekly has a gap during which a new designation is not being screened. New SDN entries and UN Consolidated List additions take effect immediately. The gap between designation and the VASP's next scheduled download is a live compliance window. Daily or API-connected refresh is the operational standard; weekly cycles are a structural vulnerability.

The second flag is transliteration gaps. Names of designated individuals transliterated from Arabic, Cyrillic, Persian, or other scripts can appear in dozens of variants across different lists and different entry sources. A tool calibrated only for a single transliteration of a name will produce false negatives. The UN Consolidated List itself lists multiple name variants for many entries; your tool must consume and match against all of them.

The third flag is wallet-address blind spots. As noted above, OFAC designates wallet addresses directly. A VASP whose screening operates only at the identity layer and does not check on-chain addresses will process transactions to and from designated wallets without any alert. This is not a marginal risk: designated-address lists have grown materially in recent years, and blockchain analytics can link a non-designated address to a designated cluster.

The fourth flag is broken data flows from travel-rule counterparties. If an ordering VASP transmits incomplete or inaccurate originator data, your screening of that data may clear the transfer while the real originator is listed. Your screening is only as good as the data it runs on. Where a counterparty consistently provides incomplete travel-rule data, that pattern is itself a risk indicator warranting enhanced scrutiny of the relationship.

The fifth flag is beneficial-ownership opacity. Institutional counterparties in the virtual-asset space – OTC desks, exchanges, custodians – often have layered ownership structures. If the ultimate beneficial owners have not been identified and screened, a listing one or two levels up the chain may be invisible to your programme. The 50 percent aggregation rule under OFAC and the control test under OFSI and the EU both require you to look through the legal structure.

The sixth flag is treating the travel rule and sanctions compliance as separate programmes. The information the travel rule collects is sanctions-screening data. If the two programmes do not share data, you may be screening a name that differs from the name on the actual transfer instruction. Integrating the two workflows is a design requirement, not a nice-to-have optimisation.

When to involve sanctions counsel – and what that engagement looks like

A VASP should involve specialist sanctions counsel in several distinct situations, and the earlier the involvement, the broader the options remain.

The first situation is programme design. If a VASP is entering a new jurisdiction, launching a new product type, or onboarding a new category of institutional counterparty, the sanctions architecture should be reviewed before the product goes live. Retrofitting a compliance programme after a breach is more expensive and more limited in its effect than building one correctly at the outset. We regularly advise VASPs at the design stage on how to integrate travel-rule data into the sanctions screening workflow and how to calibrate the beneficial-ownership analysis for their counterparty mix.

The second situation is a potential match or a blocked transfer. If a transfer has been held because of a potential SDN or Consolidated List match, and your in-house team cannot clear it within the working day, involve counsel. The analysis required – ownership aggregation, wallet-cluster tracing, cross-regime comparison – is not straightforward, and an incorrect decision in either direction carries consequences. If the transfer is incorrectly cleared, you have processed a prohibited transaction. If it is incorrectly blocked, you may be in breach of contractual obligations to the counterparty. Document every step of the analysis.

The third situation is a suspected breach or a regulatory enquiry. If your programme has produced a breach – a transfer that should have been blocked was processed – you are facing the question of voluntary self-disclosure. Voluntary self-disclosure (a proactive report to the regulator of an apparent violation) is a recognised mitigating factor under OFAC's Enforcement Guidelines and under comparable frameworks in other jurisdictions. The decision whether to disclose, and how to frame a disclosure, is one that requires legal advice. We advise clients through this process, including the preparation of the disclosure package and the management of the regulator's queries.

The fourth situation is programme testing and assurance. If a regulator is conducting a thematic review of VASPs and your business is in scope, or if your own internal audit has flagged weaknesses in the screening programme, an independent review by external counsel provides a view that differs from the one your implementation team holds. In our experience, the gaps that a structured external review finds are rarely dramatic – but they are real, and they are the gaps that regulators find.

For an assessment of your VASP's sanctions screening programme, contact Calder & Vance at info@caldervance.com. If a transfer has been flagged or a regulatory enquiry is under way, contact us promptly – options narrow with time.

Related practices

• BIS/EAR affiliate-level restrictions – understanding how US export-control rules affect group-level counterparty relationships
• Aggregating holdings under OFAC – how the 50 percent rule applies across layered ownership structures

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.