Mapping Sanctions Lists for Business

If you accept cryptocurrency in a business — an exchange desk, a payment gateway, a swap frontend that charges a fee, a P2P platform — sanctions compliance stops being theory and becomes a matter of survival. A single unscreened sanctioned transfer can cut off your access to banks and stablecoins for good. In this lesson we build a practical map of the sanctions lists (OFAC, EU, UK, UN), unpack the extraterritorial reach of OFAC, review sanctioned venues, and show how to embed screening into a business process. And we drive it home with a real case: a counterparty carrying OFAC exposure of roughly $3.1M — why any fee-charging frontend is obliged to screen for sanctions.

Four key lists

There are many sanctions regimes worldwide, but for a crypto business a core of four matters most. You need to know them by purpose and coverage.

OFAC SDN (USA)The Office of Foreign Assets Control at the U.S. Treasury. The Specially Designated Nationals list contains names, companies and — since 2018 — specific crypto addresses (Digital Currency Address). The most influential list and the most complete on addresses. The core of any crypto screening.
EU Consolidated List (EU)The single consolidated sanctions list of the European Union. Mandatory for anyone operating in the EU jurisdiction or with counterparties from it.
UK OFSI (United Kingdom)The Office of Financial Sanctions Implementation. Since Brexit the UK maintains its own consolidated list, largely overlapping with OFAC and the EU but not identical.
UN Consolidated List (UN)The sanctions of the UN Security Council. They carry global legitimacy and underpin the national regimes of many countries. They less often contain crypto addresses directly, but set the baseline international minimum.

The practical takeaway: build screening around OFAC (the best address coverage), complementing it with the EU/UK for completeness and the UN for international legitimacy. Add local lists (Rosfinmonitoring and others) as needed for your own jurisdiction.

OFAC SDN
core, addresses

UK OFSI

UN
intl. baseline

OFAC extraterritoriality: why it concerns everyone

The main misconception among businesses outside the U.S.: "we're not in America — OFAC sanctions don't apply to us." In practice it's the opposite. OFAC sanctions are extraterritorial in nature and reach you through the dollar infrastructure.

Why this matters. The moment USDT or USDC appear in your activity (issued by Tether and Circle, both U.S.-oriented), or a U.S. correspondent bank, a U.S. exchange in the chain, or a server in a U.S. jurisdiction, you fall under U.S. law. For violations OFAC applies secondary sanctions and fines to foreign persons and — above all — can cut you off from the dollar system and compel issuers to freeze your stablecoins. For a crypto business that is corporate death.

Hence the rule: even if you work "only with rubles and crypto" but touch stablecoins or international exchanges, OFAC is a mandatory standard for you, not a foreign whim.

Sanctioned venues

OFAC adds to the SDN not only individual addresses but entire services. Funds that have passed through them carry a sanctions mark retroactively.

Sanctioned exchangesGarantex (designated in 2022, dismantled at the infrastructure level in 2025 with a freeze of USDT), among other venues. Any withdrawal from them "taints" the recipient's wallet.
MixersTornado Cash, Blender.io, Sinbad and other tumblers under sanctions. Passing funds through them is direct sanctions exposure.
State hackersThe Lazarus Group (North Korea) and affiliated clusters. Exposure to them is treated as financing weapons programmes — the harshest category of all.
Darknet and ransomwareAddresses of ransomware operators and illegal marketplaces regularly land in the SDN.

How to embed screening into the process

For a business, sanctions screening is not a one-off check but continuous control at several points. Design it as a built-in stage, not a manual check "whenever we remember."

Screening on the way in (before accepting funds). Before crediting any large or client transfer, run the sending address through sanctions screening and taint analysis. A direct match or significant exposure → refusal.This is the main barrier: stop sanctioned funds before they become your problem.
Screening on the way out (before sending). Check the recipient address you are sending funds to. You cannot transfer assets to a sanctioned address.Sending to an SDN address is a violation regardless of who the client is.
Direct match and indirect exposure. Screen not only for the literal presence of an address on the list, but for taint — the share of funds tracing back to the SDN through the chain. 95% of real cases are precisely the indirect ones.A shallow "blacklist check" misses funds contaminated one or two hops away.
Freshness of the database. Use current lists: an address clean yesterday may land in the SDN today. A week-old cache is a vulnerability.OFAC publishes the SDN in machine-readable formats; crypto-address aggregators update regularly.
Logging. Record every accept/reject decision with the screening result and the date. Under a regulator's inspection this is your defence.More on the decision log and a minimal policy in Lesson 9.3.

A real case: OFAC exposure of ~$3.1M

Attention. A case encountered in practice: a counterparty through which funds moved carried aggregate sanctions exposure on the order of $3.1M, tied to a sanctioned address (OFAC ↔ a sanctioned venue). For an ordinary user this is a nuisance. For a fee-charging swap/exchange frontend it is direct liability: by charging for the operation, you become a participant in the deal, not a bystander. By letting sanctioned funds through, you profit from them — and share in the violation.

The takeaway for a product team is unambiguous: any fee-charging frontend is obliged to screen for sanctions on the way in and out. Technically pleading "we're just an interface to a DEX" does not remove liability if you monetise the flow. The right architecture is a sanctions gate before swap confirmation: exposure above the threshold blocks the operation, and the decision is logged. This is exactly the principle built into the ecosystem's branded swap product (CleanRoute): a fee obliges you to screen, it does not exempt you from it.

Client

→

Sanctions gate
OFAC screening

→

Swap + fee

Refusal + log

Practical takeaways

OFAC is mandatory for everyoneExtraterritoriality through the dollar and stablecoins makes it relevant regardless of your jurisdiction.
Sanctions are binaryEven small exposure = stop. You cannot "average it out" with clean funds.
A fee = liabilityMonetise the flow — obliged to screen. Otherwise you share the violation.
Screening is a process, not an eventInbound, outbound, a fresh database, a log. Embed it, don't check by hand.

In the next lesson we cover the practical layer of corporate compliance: the Travel Rule, KYC/CDD/EDD and KYT — what they are, where the thresholds sit and how it looks in practice for an exchange desk and P2P.

← Programme Programme →

This material is educational and does not constitute legal advice.