This page is the map: what the rules are, why they reach crypto, how screening works, and where each deep guide lives. The enforcement numbers quoted below come from the public record, linked where they appear.
What OFAC Sanctions Are
OFAC sanctions are the economic restrictions the U.S. Treasury's Office of Foreign Assets Control places on foreign targets: blocked assets, prohibited dealings, and penalties for businesses that cross the line. For crypto teams they arrive as three working duties, screen, check, record, and this hub maps every piece with a dedicated guide below.
The machinery in one breath. Sanctions programs, built on statutes and executive orders, define who is targeted, country by country and sector by sector. Designations turn programs into names on the SDN list, and from that moment U.S.-nexus businesses must refuse and block. Licenses open narrow exceptions, enforcement prices failures, and the whole system runs on strict liability: intent is not an element, controls are the defense.
Each clause of that paragraph has a page in this family. What the office is and what powers it holds sits in What Is OFAC?, the list itself in The OFAC SDN List, and the day-to-day working process in Sanctions Screening. The primary sources are public: OFAC publishes the programs and country information on its official site, and this hub links the deep pages throughout.
Blocking deserves its own sentence, because it is the operative word. A blocked person's property must be frozen, not seized: it sits where it is, untouchable, and reporting duties attach to it. Prohibited dealings cover the rest: no payments, no services, no contracts that benefit the listed side. Both duties bite on new business and on relationships already running, which is why the re-check clock matters as much as the first check.
Where the rules come from is part of the answer. Statutes passed by Congress and executive orders signed by the President create the programs; the Treasury office administers them, publishes the lists, issues the licenses, and enforces the line. That chain explains why the same office appears on every page in this family, and why its site is the source every claim here links back to.
Why OFAC Sanctions Matter for Crypto Businesses
Crypto sits inside U.S. sanctions reach through three doors at once: the customers, the addresses, and the dollars. A non-U.S. exchange serving U.S. users holds the nexus; a desk clearing dollar-backed assets through U.S. banks holds it; a protocol with U.S. persons in it holds it too. Once inside, the duties are identical to any bank's, with one addition, the chain side, where a listed address is blocked property the way a listed person is.
The risk picture is specific. Onboarding brings names that transliterate unevenly and companies that screen clean while their ownership does not. Payments bring addresses, which carry list entries of their own. Time brings drift: a party cleared in January can be designated by March, and strict liability prices every month the book went unscreened. The parallel AML rulebook, run under FinCEN's legal authorities, reads the same records, which is why one workflow usually answers both.
None of this is theoretical for the sector. The office has published sanctions compliance guidance written for the virtual currency industry. Enforcement settlements have named trading platforms, and the exam question a crypto compliance team should expect is concrete: show me what you screened, when, and what you did about it.
The sector's own texture changes the odds, not the rules. Customers can arrive as addresses rather than names, value moves in minutes rather than days, and a single service can touch thousands of wallets a day. That combination pushes the working answer toward screening that runs inside the product, at deposit and withdrawal speed, with a record written for every check.
Pricing the downside is not guesswork either. Civil penalties run to six and seven figures for process failures, and the published record shows small companies on the same page as large ones. Against that, the control stack is modest: screening at the door, ownership checks behind it, records everywhere, and a re-check cadence tied to the list.
OFAC Sanctions Compliance at a Glance
The working year of OFAC compliance is five moves: screen every party, check every hit, block or refuse what fails, record the whole chain, and re-screen when the list moves. Miss one move and the others inherit its gap. Each move has a guide in this family, and the map below is the shortest honest overview.
Around the table sit the reference pieces: what the SDN list actually is, what the office behind it does, and how the rules land on chain in crypto sanctions. A compliance lead can hand any row of that table to the person who owns the task and be understood in one read.
The compliance piece deserves its own sentence of scope. OFAC's published framework expects five parts: management commitment, risk assessment, internal controls, testing, and training. The OFAC compliance guide walks all five for a crypto firm, from the first written risk map to the training log an examiner asks for by name.
Two reading orders cover most visitors. New to the topic, read the office first, then the list, then screening: each page assumes the one before it. Building a program this quarter, start at the compliance guide, pull the screening guide for the core control, and keep the enforcement page open for the budget conversation.
What good looks like has a short answer: current, documented, and proportionate. Current means the list version driving your decisions is the live one. Documented means every decision, including the clears, carries a reason and a name. Proportionate means a five-person desk is not expected to field a bank's org chart, but it is expected to screen, record, and re-check all the same.
How Sanctions Screening Works in Practice
Screening in practice is a loop, not a line. Names, ownership, and addresses go in at onboarding; list data goes in continuously; hits come out as questions; triage turns them into decisions; records accumulate behind every step. The loop re-runs whenever the list moves, which is often and without notice, so the design goal is a system whose default state is current.
The chain half is where crypto teams live. Deposits and withdrawals carry addresses, addresses carry list entries, and the check that matters runs inside the payment path, not beside it. Phalcon Compliance screens addresses and transactions against a label library of over 600 million labeled addresses (per BlockSec), and sanctioned entities are one of 17 risk indicator categories its screens flag. A screening response in about 100 milliseconds in the API pipeline (per BlockSec) lets the check sit inside deposit and withdrawal flows, where it writes the record as a side effect, risk levels and all.
The single lookup, the match traps, and the false-positive patterns each have a full page in this family, and the Phalcon Compliance page covers plans and pricing.
False positives are the operating cost of any list check, and triage is where a program shows its shape. A hit means a possible match, not a verdict: an analyst compares identifiers, clears the lookalikes with a reason, and escalates the rest. The reasons matter later, because an examiner reads the cleared ones first, and a close without a reason reads as a gap.
The tooling question follows the same logic. A batch job that screens overnight answers yesterday's question; a check inside the payment path answers today's. Screening and operation events can be recorded automatically with timestamps, inputs, and outcomes. The institution must add the human judgment, approval reasons, identity checks, and external evidence its program requires; system logs support that record rather than replacing every part of it.
Explore the OFAC Family
Nine guides, nine angles, no overlap. Depth over breadth: each page owns one question completely, and no page repeats another's ground. Start anywhere; the map below says which page answers which question.
Sanctions screening is the main working guide: the five-step process, the records it produces, and what a regulator actually asks to see. If one page replaces a consultant call, it is this one. The five-step table near the top is the piece most teams screenshot for their own runbook.
OFAC check slows the loop down to a single lookup: how to run one, why clean companies get flagged, and what an audit-grade record of it looks like. It is the page to hand a new analyst on day one.
The OFAC SDN list is the reference piece for the list itself: where entries come from, how often it updates, and how to search it with the official tool, including by digital currency address. It also covers what an entry contains and which fields matter for matching.
What Is OFAC? covers the office: what it stands for, what its four working moves are, and who its rules bind, written for readers who need the institution before the mechanics. It is the shortest read in the family and the right first click for an executive outside compliance.
OFAC compliance is the program guide: the five-part framework an examiner reads, the risk assessment that starts it, and the records that prove it runs. The five parts are the same five an enforcement settlement quotes when they are missing.
The OFAC 50 percent rule explains the trap that catches careful teams: how blocked ownership adds up past 50 percent, silently, in companies no list ever names. The worked example alone is worth the two minutes it takes to read.
Sanctions evasion and enforcement prices the gap: how penalties work, what the 2026 record shows, and how enforcement reaches exchanges and off-ramps. The 2026 civil penalty table there is read line by line, with every number checked at the source.
Crypto sanctions takes the chain-native view: how designations reach addresses, what listing means for an exchange's flows, and why off-ramps concentrate the exposure. Its three-layer table, address, entity, service, is the fastest way to see where your controls sit.
Sanctions screening software is the buyer's page: the five dimensions to compare before choosing a tool, from list coverage and re-checks to API integration and exportable records. The comparison table names no vendors and quotes no scores. It is the page to hand finance when compliance asks for a budget.
Four neighboring families each own one adjacent dimension, and the borders are clean.
The AML family holds the wider frame: sanctions is one of the risk types a crypto business screens, and the anti-money-laundering stack, monitoring, reporting, records, is where the sanctions layer lives. The VASP family covers the licensed-institution side: what a virtual asset service provider owes its regulator, jurisdiction by jurisdiction, a different question than what U.S. sanctions reach demands. The wallet screening family goes deep on the address pipeline itself, the mechanics of checking wallets at deposit and withdrawal speed. And the KYT family owns continuous transaction monitoring, the watching half that pairs with the at-the-door checks this hub describes.
Cross-family reading is one-directional by design: this hub owns the sanctions question, the neighbors own theirs, and each links the other where the borders meet. Nothing on those pages repeats what a page here already covers, so the set reads as one document split by topic rather than four overlapping ones.
OFAC Enforcement Background
Enforcement is the price tag on everything above, and its shape is administrative: no prosecutor required. The office investigates, weighs the case under published enforcement guidelines, and issues civil penalties, with the year-by-year civil penalties and enforcement record public on its site. The 2026 record to date runs seven settlements at roughly $284 million combined, from a $60,764 August case to a $275 million May outlier. A September settlement with an individual at over $1.4 million is the most recent entry.
How a case unfolds is worth knowing before it happens. A trigger surfaces, often a bank filing or a pulled record; questions arrive; the response either reconstructs the decisions or does not; the office weighs the guideline factors and proposes a number. The settlements that read worst are the ones where the record had nothing to say.
Two features of that machinery matter for reading everything else here. Voluntary self-disclosure earns substantial mitigation credit, which is why finding your own violation and reporting it is a strategy, not a confession. And program gaps raise the number. The absence of screening, records, or a risk assessment is quoted in settlements as an aggravating fact, which turns the compliance guide in this family from best practice into price control.
License work sits beside enforcement on the same spectrum. Most businesses never need one; the ones that do, usually for a transaction that touches a sanctioned country for a permitted reason, apply in writing and wait. The general licenses published program by program cover defined exceptions automatically, and reading them before deciding you need a specific one saves a cycle.
The single-case stories, the crypto patterns, and the off-ramp mechanics have their own page: sanctions evasion and enforcement.
