The "dangerous" case: sanctions exposure

• Score85+/100. In the breakdown — the sanctions category.
• Risky contactAt 1–2 hops — an address from the OFAC list. In our own practice this was an episode with ~$3.1M of sanctions exposure at a counterparty.
• DirectionIncoming — that is, the dirt "dripped" onto you specifically.

1. Sanctions. There is a link to an OFAC address at 1–2 hops. This alone is enough for a stop.
2. Materiality. The category carries the maximum weight (sanctions). The direction is incoming, the hop is short. Even a small share is critical.
3. Conclusion. No need to check further — the decision is obvious.

Decision: do not accept. Any KYC exchange will freeze such funds on deposit, and send your account for review. The risk is not only financial but legal — a sanctions regime.

If the funds have already arrived:

1. Do not mix these funds with others — keep them on a separate address.
2. Gather evidence of good faith: where and from whom it came, the correspondence, a screenshot of the counterparty's AML check (if you did one).
3. Do not try to "run it through" an exchange — this will make things worse and almost certainly lead to a freeze.
4. Prepare a compliance escalation and, for a large amount, a consultation with a crypto-compliance lawyer (Section 8).

Section "Practice" wrap-up

• One checklist yields three different conclusions depending on the findings.
• "Clean" — accept and record; "grey" — request the source of funds; "dangerous" — decline at once.
• Sanctions/a mixer/theft in a short hop — a stop with no arithmetic of shares.
• Always draw up a written conclusion with a date.