A crypto wallet sanctions check is the control a regulated business runs to establish whether a blockchain address it is about to interact with is subject to sanctions, or is meaningfully connected to a party that is. It answers a narrow, high-consequence question — may the firm send value to, or accept value from, this address at all — and it operates on the address itself rather than on a name.
For a crypto exchange, a custodian or any regulated firm moving value on-chain, this is not a discretionary control. Sanctions authorities in the United States, the United Kingdom and the European Union now publish specific wallet addresses alongside the designated parties, and a firm that processes a transfer to or from a listed address can breach sanctions even where no name was presented to it. At real transfer volumes, against lists that change frequently, the check is run in software rather than by hand.
This article explains what the check is, why addresses have to be screened and not only names, how a direct match differs from indirect exposure, where it fits in an exchange or payment platform, and where its boundaries lie.
What a Crypto Wallet Sanctions Check Is
A wallet sanctions check compares a blockchain address against the addresses that sanctions authorities have designated, and against the addresses that on-chain analysis ties to those designations, to establish whether interacting with it is prohibited or requires escalation. The input is an address on a public ledger, not a person's name or a company's registration number.
That makes it structurally different from the name-based checks at the centre of customer due diligence. A name check asks whether a person or company appears on a list; a wallet check asks whether an address does, and whether the value passing through it can be traced to one that does. The two are complementary layers of the same obligation, and running one without the other leaves an obvious gap.
The consequence of a positive result is specific as well. Unlike a politically exposed person flag, which calls for proportionate due diligence, a confirmed sanctions match is generally a hard stop: the firm is prohibited from completing the transaction and must act on the match rather than weigh it.
Why Addresses, Not Only Names, Must Be Screened
The case for screening addresses rests on how sanctioned parties actually use crypto. Designating authorities recognised some years ago that a name-only list could not reach value held and moved on public blockchains, and began publishing wallet addresses in their own right. Addresses attributed to designated individuals, entities and networks now appear on the sanctions lists that United Kingdom and European Union firms screen against, maintained by bodies such as OFAC in the United States and OFSI in the United Kingdom.
Because value moves between addresses without a name attached, the exposure a firm faces is transactional rather than nominal. A customer can pass identity verification cleanly and still fund a deposit from, or send a withdrawal to, an address that belongs to a sanctioned party — or one only a few transfers removed from it. Screening the counterparty address is the point at which that specific risk becomes visible.
The lists are not static either. Authorities add, amend and remove designated addresses on a rolling basis as investigations progress. An address that was clean when a customer was onboarded can be designated later, which is why the control has to run again over time rather than only once.
Direct Matches and Indirect Exposure
A wallet sanctions check produces two broad kinds of result, and conflating them causes both missed risk and needless friction. A direct match is the simpler case: the address a firm is about to transact with is itself on a sanctions list, and the handling is unambiguous — the transaction is stopped and escalated.
Indirect exposure is the harder and more common case. Here the address is not itself listed, but on-chain analysis shows that the value it holds has passed to or from a designated address through one or more intermediary transfers. The question becomes how close that connection is, and how much of the value is traceable to the sanctioned source — a matter of exposure and attribution rather than a simple yes or no.
Assessing it means tracing transaction flows across a ledger and attributing clusters of addresses to real parties, work that on-chain analytics performs. The output is a graded risk signal rather than a binary hit, and the firm sets the level at which exposure becomes disqualifying. The specific distances and thresholds it adopts follow its own risk appetite and supervisory expectation, not a fixed industry constant, and sit outside the scope of a general description like this one.
Where a Wallet Sanctions Check Runs
In a working exchange or payment platform, wallet screening is not a single gate but a set of checks at the points where value enters, leaves or has already moved. A declared address at onboarding, an incoming deposit at the point of credit and — most importantly — an outgoing withdrawal before it is authorised each catch a different slice of the same risk.
The withdrawal check carries particular weight, because it is the moment a firm is about to push value to an address it does not control. Screening the destination before the transfer is released keeps the platform from becoming the step that moves funds to a sanctioned party. Deposits are screened to establish where incoming value came from, and both feed the transfer-information controls a regulated crypto exchange already operates.
| Point in the flow | What the check evaluates |
|---|---|
| Onboarding | Addresses a customer declares, screened before the relationship is active to establish a baseline. |
| Incoming deposit | The source address funding a deposit, to assess where the value has come from. |
| Outgoing withdrawal | The destination address, screened before the transfer is authorised so a prohibited transfer is stopped rather than reviewed after the fact. |
| Ongoing and retrospective | Cleared addresses re-screened as designations change, with historical exposure reviewed when a counterparty is newly listed. |
The ongoing dimension matters as much as the point-in-time checks. Because designations change, a counterparty that cleared yesterday can be listed today, and a firm is expected to re-screen retained addresses and review historical exposure. Screening of this kind can be consumed as a hosted API or deployed so that data stays inside the firm's own environment; firms with stricter data-residency requirements use on-premises or dedicated storage, the same architectural choice that recurs across regulated fintech platforms.
How It Differs From Name and Wallet-Risk Screening
A wallet sanctions check is the transactional counterpart to name screening: the same sanctions obligation, evaluated against an address and the value flowing through it rather than against a person or company. A regulated firm needs both, because who a customer is and which addresses they transact with are separate surfaces of the same risk.
It is also narrower than a general wallet-risk score. Broad wallet-risk screening weighs a range of typologies — exposure to theft, fraud, high-risk mixing services and darknet activity — of which sanctions exposure is one, and the most consequential, because it alone carries a legal prohibition rather than a risk weighting. A capable platform keeps the sanctions signal legible as a hard control inside the wider risk picture rather than averaging it into a single number.
Grumpio provides multi-blockchain wallet risk screening, alongside person and company screening against sanctions and PEP data, through Legichain, its AML and KYC product, with results available through both an API and a web panel and a single credit pool across checks; pricing and product detail are published on the Legichain site. Screening a company or an address in this way is not a substitute for full know-your-business (KYB) verification, and no dataset attributes every address across every chain without gaps.
Scope and Boundaries
The most important limit is attribution. A sanctions check can establish that an address is listed or exposed; it cannot, on its own, always establish who controls it. With self-custodial wallets in particular there is a gap between screening an address and attributing it to an identified person, and closing that gap is a matter of judgement and further enquiry, not of the screen alone. Coverage and timing are limits too: no dataset reflects every designation across every blockchain the moment it is made, and lists carry lag.
False positives have to be managed as well. Shared infrastructure, reused deposit addresses and the ordinary structure of on-chain activity can connect an otherwise clean counterparty to a distant designated address; a screen tuned too tightly stops legitimate transfers, while one tuned too loosely misses real exposure. A flagged result, like a clean one, leaves the regulated firm responsible for the decision it records. We do not provide legal opinions or guarantee authorisation. We implement regulatory and audit requirements across technology, infrastructure and operations.
Note: A wallet sanctions match is generally a hard stop, not a risk weighting to be balanced against others. The regulated firm — not the screening vendor — owns the decision to block, escalate or report, and records the basis for it.
Summary and Next Steps
A crypto wallet sanctions check screens the addresses a regulated business is about to transact with, and the value flowing through them, against the parties sanctions authorities have designated — a transactional counterpart to name screening, and a hard control rather than a risk weighting. It matters because sanctioned parties move value on public blockchains, because the lists identifying them change frequently, and because a single unscreened withdrawal can put a firm in breach.
Choosing and building it well means treating direct matches and indirect exposure as different problems, running the check where value actually enters and leaves — above all before a withdrawal is authorised — and keeping it running as designations change, while holding the line between the signal the software raises and the decision the firm owns. Building that discipline in from the start is an exercise in regulatory readiness rather than a later retrofit.
Adding or reviewing wallet sanctions screening? Grumpio designs and implements sanctions and AML controls that fit a regulated crypto, e-money or payments operation.