Sanctions list screening
How addresses are checked against the U.S. Treasury sanctions list, how fresh the list is kept, and what a non-match does and does not mean.
#Plain languageIn plain terms
Governments publish lists of sanctioned people and organisations. The U.S. Treasury's list includes cryptocurrency addresses tied to some of them. Dealing with a listed address can have legal consequences.
Forensia checks the address you searched, and the addresses it dealt with, against that list. A match is shown as the government's listing, with the list's date. It is not Forensia's opinion about anyone.
#How it worksHow it works
- Twice a day, download the published list and pull out every cryptocurrency address in it.
- Refuse the download if it looks truncated or malformed.
- On each lookup, check the subject and its counterparties for an exact match.
- Report the outcome with the list's publication date.
- If the list is missing, too old or unreadable, say that no sanctions status can be shown.
#Technical detailThe exact rules
The source is the OFAC Specially Designated Nationals list, in its published XML form. Entries marked "Digital Currency Address" are extracted, whatever the currency.
| Setting | Value |
|---|---|
| Refresh | Every 12 hours |
| Freshness limit | 36 hours since the last successful refresh |
| Smallest list accepted | 250 addresses |
| Largest download accepted | 96 MiB |
| Addresses screened per lookup | The subject plus up to 256 others |
The 250-address floor exists so that a cut-off or broken download can never silently replace a good list. If a refresh fails, the previous list stays in place until it ages past the freshness limit.
Matching is exact. Ethereum-style addresses are compared without regard to letter case. SegWit Bitcoin addresses are lowercased. Legacy Bitcoin addresses are compared exactly as written. Screened addresses are the subject plus every sender, recipient and token contract in the activity, plus every node on the graph.
| Outcome | Finding | Class |
|---|---|---|
| The subject is listed | finding:ofac-sdn-listed-subject | Attribution |
| A counterparty is listed | finding:ofac-sdn-listed-counterparties | Attribution |
| The subject is not listed | finding:ofac-sdn-not-listed-subject | Limitation |
| Nobody in a transaction is listed | finding:ofac-sdn-not-listed-participants | Limitation |
| The list could not be used | finding:sanctions-screening-unavailable | Limitation |
On the Analysis view, a non-match or the unavailable notice appears under "Lists checked", labelled "List check". A match on the subject appears on the fact sheet at the top and a match on a counterparty under "Who it dealt with", each labelled "Sanctions list".
A listed counterparty is drawn with risk emphasis on the graph. This is the only thing that ever marks a graph node that way.
#LimitsWhat it does not tell you
- Only this one list is checked. Other countries' lists are not.
- The match is on the address alone, across networks. A listing recorded for one currency will match the same address string on another network, and the result says which network you are on.
- A recorded interaction with a listed address does not make the searched address sanctioned or establish intent.
- Listings change. Confirm current status with the Treasury's own search before acting.
- When the list is stale, screening fails closed: no status is shown, including for addresses that may be listed.