Sanctions lists, labels and on-chain checks

Sanctions lists: where to get the primary source

A sanction is not "a service's opinion" but a legal fact from an official registry. You must check the primary sources, not retellings.

• OFAC SDN List (USA)Specially Designated Nationals — the world's leading list. Since 2018 OFAC has also published crypto addresses right inside the entries (the Digital Currency Address field). The official source is the site of the U.S. Treasury's Office of Foreign Assets Control; the data can be pulled machine-readably (SDN.XML / the consolidated list).
• EU Consolidated List (European Union)The EU's consolidated sanctions list. Published officially, available for download, and including more and more crypto identifiers.
• UK OFSI / HMT (United Kingdom)The list of the UK's Office of Financial Sanctions Implementation. A separate jurisdiction — important for clients dealing with the UK.
• Local lists (Rosfinmonitoring and others)National lists in the jurisdiction where you operate. Their composition and availability depend on the country.

Public address labels

A label (or tag) is an attribution of "who this address belongs to." Beyond paid databases there is a substantial free layer, which is enough for a basic check.

1. Explorer labels. Etherscan and its equivalents tag exchanges (Binance, Coinbase), contracts, and also dangerous addresses: Fake_Phishing, Heist, Exploit, Blocked.Free, right on the address page.
2. Open label datasets. Public lists of mixer, scam-project, hack and sanctions addresses (including repositories and communities that maintain such databases).AMLConsensus uses its own layer of tens of thousands of labels on top of the open data.
3. Incident registries. Public databases of known hacks and exploits with the list of the attackers' addresses.Useful for checking whether "the money came from a known hack."
4. Community reports. Chainabuse and similar platforms where scam victims publish addresses.A weaker signal than an official one, but useful as an early flag.

On-chain checking of USDT/USDC freezes

The most underrated free technique. The issuers of centralised stablecoins (Tether — USDT, Circle — USDC) can freeze addresses right in the smart contract at the request of regulators and law enforcement. A frozen address cannot move its tokens. This is an objective fact that reads straight out of the contract — without a single paid service.

1. Open the stablecoin contract in an explorer. For example, the USDT (ERC-20) contract on Etherscan, the Contract → Read Contract tab.For USDC and on other networks it is similar; the method may be named differently.
2. Find the block-check function. For USDT it is isBlackListed(address); for USDC — isBlacklisted(address) / the blacklist-role status.Enter the address in question and read the answer.
3. Read the result. A return of true = the address has been frozen by the issuer. This is a confirmed hard fact: you cannot work with this address.It is stronger than any probabilistic score — the issuer itself has confirmed the problem.
4. Check the issuer's freeze history. The AddedBlackList / DestroyedBlackFunds events in the contract logs show who was frozen and when.Helps you understand the issuer's activity in your category.

The free foundation of a check: assembling the checklist

Combining lesson 5.1 (explorers) with the material of this lesson gives us a full basic check without a single paid tool.

• Is the address itself on the sanctions lists?A direct match → stop.
• Are the direct counterparties (1 hop) under risk labels?An exchange/mixer/sanction among the sources or recipients.
• Is there a stablecoin freeze on the address or on close counterparties?Read Contract → isBlackListed.
• Explorer labels (Fake_Phishing, Heist)?A strong local signal.

Where the free level ends

This foundation covers most simple cases: direct sanctions, obvious labels, freezes, plain patterns. But it has a limit.

• Deep multi-hopWalking 4–6 hops through hundreds of addresses by hand is all but impossible — this needs an automatic taint engine.
• Clustering and de-anonymisationDetermining that 200 addresses share one owner cannot be done by hand.
• Fresh, non-public attributionNew mixers and hacks reach commercial databases earlier than open ones.

Another limit of the free layer is the versioning and jurisdiction of the lists. The same address may be under OFAC sanctions but absent from the EU list, and vice versa; moreover, sanctions entries are sometimes lifted (delisting), and an address that was "dirty" a year ago is formally clean now. So record not only the fact of a match, but also which list, which revision, and as of what date you checked — this is both legally correct and protects you during a later audit of your own decision.