What Is Sanctions Screening?
Sanctions screening is the habit of checking every customer, payment, and address against the sanctions lists governments publish. In crypto, one transfer to a listed person can be a violation even when nobody meant harm. This page walks the whole process for teams that must explain each step to a regulator. The OFAC sanctions hub collects the related guides.
Screening means comparing the people and activity you touch against names that the U.S. Treasury's Office of Foreign Assets Control, and agencies like it, have placed off limits. The comparison is simple. The practice is not, because lists change without notice, names arrive in many spellings, and a clean answer today can be wrong tomorrow.
Two ideas anchor everything else. First, screening is a process, not a button: it has inputs, decision points, and records. Second, screening is only one layer of the wider anti-money-laundering frame, where sanctioned parties sit inside a broader set of risk types a crypto business checks, an angle the AML family covers in depth.
If you are new to the agency behind the lists, the what-is-OFAC guide in this family explains who issues them and why they carry force. Here the focus stays on the working process itself.
Why Sanctions Screening Is Non-Negotiable for Crypto Teams
U.S. sanctions apply on a strict-liability basis: a prohibited transfer is a violation even without intent, and "we did not check" is not a defense. Crypto adds address-level exposure and instant cross-border reach. Regulators expect documented screening at onboarding and after, and the process below is what a risk-based program typically looks like.
The lists come from sanctions programs, each one aimed at a country, a sector, or an activity. The official programs and country information page on OFAC's site is where each program's scope is published. When a person or company lands on a list, dealing with them becomes illegal for U.S.-nexus businesses, and the block follows ownership, not intent.
Crypto teams feel this in three specific places. Onboarding: a new customer can be a listed individual or a named company. Payments: a withdrawal address can belong to a listed entity. Time: a party that was clean at signup can be listed a month later, so a single check at the door ages fast.
Penalties scale with the weakness of the process, not just the count of bad transfers. Teams that screen, record, and re-check show a working control. Teams that cannot show their work show a gap, and the enforcement guide in this family shows what that costs.
What regulators expect has a shape, and it is not a mystery. Screening at onboarding, screening again when the lists move, a named owner for every decision, and records that survive being pulled a year later. The five-part program frame examiners read, from management commitment down to training, has its own page in this family; this one owns the screening core inside that frame.
Each stage of that flow gets its own guide, and the OFAC sanctions hub indexes the full set.
The Sanctions Screening Process, Step by Step
Working screening has five steps: collect the details, screen them against current lists, triage any hit, decide and document, then re-screen when lists change. Each step leaves a record. Follow them in order and the audit story writes itself; skip one and the gap shows up exactly when a regulator asks.
| Step | What you do | What it produces |
|---|---|---|
| 1. Collect | Gather names, aliases, and addresses at onboarding | A clean input set to screen |
| 2. Screen | Run inputs against current sanctions lists | Raw hits or a clean result |
| 3. Triage | Separate true matches from lookalikes | A decision on each hit |
| 4. Document | Record what was screened, seen, and decided | An audit trail |
| 5. Re-screen | Run the book again when lists update | Coverage that stays current |
Step one deserves more respect than it usually gets. Transliterated names split into fragments, shared addresses hide company structures, and free-text fields swallow the data you need. The matching traps and how to work around them have their own section in the OFAC check guide.
Step two is the check itself. You can search the official SDN list by hand through the Sanctions List Search tool that OFAC hosts, which is the right way to look up a single name once. Working teams automate the same comparison so every customer and every address is checked, every time, against the current list version.
Step three is where most real work happens. A hit is rarely a verdict: it is a question. Is this John Smith the listed John Smith? Triaging false positives without missing real ones is a skill, and the check guide covers the patterns, from name fragments to shared tokens, that trip honest teams.
Steps four and five close the loop. Record the list version, the match logic, and the decision. Then re-screen, because designations land any day: the SDN list guide shows how often the list moves and why yesterday's clean answer expires. And remember that even a perfect list check can miss indirect exposure, the trap the 50 percent rule guide unpacks.
Cadence deserves its own sentence, because it is where programs quietly fail. A list update is the trigger, not a calendar quarter: the day designations land is the day the book goes stale. Working teams let the screening system watch for updates and re-run on its own, and they treat the re-run log as evidence of currency rather than overhead.
Screening Results You Can Explain to a Regulator
A screening program is judged by its records: what was checked, which list information was used, who decided, and when. Results you can explain beat results that are merely fast. Address screening in an API pipeline records screening events; the institution adds the human decisions, list evidence, and other materials needed to explain its handling.
The exam question is never whether you owned a tool. It is this: show me what happened. A team that can pull the history for any customer, any address, and any alert, with the list version attached, has answered before the regulator finishes asking. A team that must reconstruct history from memory has not, no matter how good its screening was in practice.
One habit separates programs that survive audits from programs that merely pass them: closing every alert with a reason. A cleared hit gets one sentence naming the identifier that separated the lookalike from the match. Six months later that sentence is the difference between a reconstructed guess and a record.
This is where tooling earns its place. Phalcon Compliance screens both addresses and transactions, and sanctioned entities are one of 17 risk indicator categories it flags. Every result comes back on the five-level scale this family keeps returning to, Critical, High, Medium, Low, and No Risk, so a human can read it and cite it. The record behind each check holds the screened object, the risk level, the risk indicators that fired, the person who handled it, and the time.
The point is not speed for its own sake. It is that screening which lives inside the payment path, with risk levels a human can read and cite, supplies reviewable screening records to support the institution's wider evidence file. The Phalcon Compliance page lays out the current plans. The OFAC sanctions hub collects the rest of the family, from the office itself to how designations reach addresses.