Bitcoin Address Screening Tools Compared: OFAC & Sanctions Compliance

Bitcoin Address Screening Tools Overview

Bitcoin address screening is the process of checking whether a wallet address appears on a sanctions list, has transacted with sanctioned entities, or carries risk indicators that would trigger compliance obligations. Every exchange, payment processor, and VASP handling Bitcoin must screen addresses before processing transactions to comply with the Bank Secrecy Act (BSA), OFAC regulations, and the FATF Travel Rule.

Five providers dominate Bitcoin address screening: Chainalysis, Elliptic, TRM Labs, Crystal Intelligence, and Scorechain. While our crypto AML tool comparison covers their broader analytics capabilities, this guide focuses specifically on the address screening workflow: how each tool handles OFAC SDN list lookups, UTXO-based taint analysis, API integration for real-time screening, and the regulatory requirements that make this screening mandatory.

Feature Comparison

The following table compares the core address screening capabilities across all five providers. Screening is typically the first compliance check in any transaction flow: an address is submitted via API or dashboard, the tool checks it against sanctions lists and risk databases, and a risk score or pass/fail result is returned.

OFAC SDN List and Crypto Sanctions

The Office of Foreign Assets Control (OFAC) maintains the Specially Designated Nationals (SDN) list, which includes cryptocurrency addresses associated with sanctioned individuals, entities, and jurisdictions. OFAC first added Bitcoin addresses to the SDN list in November 2018 when it designated two Iranian nationals involved in the SamSam ransomware campaign. Since then, OFAC has expanded crypto-related designations significantly: addresses linked to North Korean hacking groups (Lazarus Group), Russian darknet markets (Hydra, Garantex), ransomware operators, and sanctioned exchanges.

As of mid-2026, OFAC has designated approximately 518 Bitcoin addresses on the SDN list. Those addresses received roughly 250,000 BTC and sent approximately 240,000 BTC, leaving a net balance of around 9,300 BTC. The agency also sanctioned Tornado Cash smart contracts in August 2022 (overturned by a Fifth Circuit ruling in November 2024, leading to delisting) and Garantex exchange in 2022, then again as Grinex in 2025 after it attempted to rebrand. In July 2026, OFAC added 134 crypto addresses to the ISIL-Khorasan SDN entry, primarily on TRON.

A critical concept for Bitcoin screening is the OFAC 50% rule: if a sanctioned person owns 50% or more of an entity, that entity's assets are blocked even if the entity itself is not listed. For UTXO-based assets like Bitcoin, this creates complexity. When a sanctioned address sends Bitcoin, the receiving UTXO carries taint. But when that UTXO is later spent alongside clean UTXOs in a new transaction, determining how much taint propagates to each output requires a methodology: direct ownership analysis, proportional taint, or binary (any exposure flags the output).

UTXO Screening Challenges

Bitcoin's UTXO model creates unique screening challenges that do not exist on account-based chains like Ethereum. Each Bitcoin transaction consumes one or more UTXOs as inputs and creates new UTXOs as outputs. When a sanctioned address sends funds, the taint propagates through the UTXO graph, but the degree of propagation depends on the screening tool's methodology.

Taint Propagation Methods

Providers use different approaches to calculate how risk flows through the UTXO transaction graph. Most major providers default to the haircut (proportional) approach, which aligns most closely with OFAC's ownership-percentage framework:

• Poison: any UTXO that has any connection to a sanctioned address, regardless of hop count or proportion, is flagged. This approach minimizes false negatives but generates high false positive rates.
• Haircut (proportional): taint is distributed proportionally across outputs based on value. If a transaction has two inputs (one sanctioned, one clean) of equal value, each output carries approximately 50% taint. This is the approach most aligned with OFAC's 50% ownership rule and the default for most providers.
• FIFO/LIFO: taint is assigned to specific outputs based on input ordering, treating the transaction as if inputs map to outputs in sequence. Less commonly used for sanctions screening.
• Configurable decay: taint decreases with each hop from the sanctioned source. After N hops, the risk score drops below a threshold. TRM Labs and Scorechain both allow compliance teams to configure the decay rate and hop depth.

CoinJoin and Mixing Detection

CoinJoin transactions, where multiple users combine their inputs into a single transaction with equal-value outputs, break deterministic taint tracking. Screening tools must identify CoinJoin transactions (typically by detecting equal-output patterns and high input counts) and apply conservative risk scoring. Chainalysis identifies Wasabi Wallet, JoinMarket, and Whirlpool CoinJoin patterns specifically. Elliptic's Nexus engine applies probabilistic taint through mixing services. All five providers flag CoinJoin participation as a risk indicator, though the severity weighting varies.

Regulatory Requirements for Address Screening

Several overlapping regulatory frameworks mandate address screening for businesses handling Bitcoin:

Bank Secrecy Act (BSA)

Under the BSA, money services businesses (MSBs) registered with FinCEN must implement an AML program that includes screening customers and transactions against sanctions lists. This applies to crypto exchanges, Bitcoin ATM operators, payment processors, and custodians operating in the United States. FinCEN's 2019 guidance confirmed that virtual currency businesses are MSBs subject to BSA requirements, including Suspicious Activity Report (SAR) filing obligations. FinCEN has actively enforced these requirements: Bittrex paid $29.3 million in 2022 for BSA violations including failure to screen transactions against sanctioned jurisdictions, and in December 2025 FinCEN fined a peer-to-peer virtual currency platform $3.5 million for operating without an AML program.

OFAC Compliance Obligations

OFAC compliance is strict liability: even unknowing violations can result in civil penalties. OFAC issued guidance in October 2021 clarifying that the sanctions compliance obligations for the virtual currency industry are the same as for traditional financial institutions. This means exchanges must screen all counterparty addresses against the SDN list before processing any transaction. Notable enforcement actions include BitPay ($507,375 settlement in February 2021 for 2,102 apparent violations involving transactions from sanctioned jurisdictions) and Kraken ($362,158 settlement in November 2022 for 826 transactions tied to Iran). A common pattern across these cases: the companies had location and screening data available but failed to use it systematically.

FATF Travel Rule

The FATF Travel Rule requires VASPs to exchange originator and beneficiary information for transfers above jurisdiction-specific thresholds ($3,000 in the US, SGD 1,500 in Singapore, zero under EU MiCA). While the Travel Rule focuses on identity data exchange rather than address screening directly, screening is a prerequisite: VASPs must determine whether the counterparty address belongs to a sanctioned entity before initiating the data exchange. As of 2026, approximately 83% of surveyed FATF jurisdictions have passed Travel Rule implementing legislation. For jurisdiction-specific thresholds, see our Travel Rule lookup tool.

EU MiCA and Transfer of Funds Regulation

Under the EU's Markets in Crypto-Assets (MiCA) framework and the recast Transfer of Funds Regulation (TFR), crypto asset service providers must screen all transfers with no minimum threshold. For transfers involving unhosted wallets above EUR 1,000, additional verification measures are required. This makes automated address screening at the API level essential for any CASP operating in Europe.

Risk Scoring Methodologies

Each provider scores address risk differently, and understanding the methodology matters for both false positive management and regulatory defensibility. The following table summarizes the approaches.

TRM Labs stands out for explainability: every attribution includes a confidence level and explicit reasoning, which is valuable when defending screening decisions to regulators during examinations. Chainalysis provides the deepest entity database (1 billion+ labeled addresses across 15 million+ clusters mapping to 65,000+ real-world entities), which reduces false positives through more accurate attribution. Elliptic's Holistic Screening combines cross-chain and cross-asset risk into a single score per address, screening fully across 65+ blockchains with sanctions-only coverage on 75 more.

False Positives and Alert Management

False positives are the operational cost of sanctions screening. An address flagged incorrectly requires manual review by a compliance analyst, which delays transaction processing and adds cost. Providers do not publish false positive rates. One academic study (TU Delft, published via USENIX Security) tested Chainalysis clustering against ground-truth data from seized services and found approximately 94.85% completeness with a 0.01% false positive rate for entity clustering, but this measures clustering accuracy rather than sanctions screening alert rates specifically. The primary factors that influence false positive rates in practice are:

• Entity database size and accuracy: larger, better-labeled databases produce fewer false positives because more addresses are attributed to known entities rather than flagged as "unknown high risk."
• Taint propagation method: poison-based approaches (flag any connection) generate significantly more alerts than proportional or decay-based methods.
• Hop depth configuration: screening addresses within 1-2 hops of a sanctioned address is targeted; screening 5+ hops captures a large portion of the Bitcoin network and generates noise.
• CoinJoin handling: conservative tools that flag any CoinJoin participant as high risk produce more false positives, especially for privacy-conscious users who have never interacted with sanctioned entities.

Chainalysis addresses this with its exposure percentage breakdown: rather than a binary flag, the API returns the percentage of an address's funds that trace to each risk category (sanctions, darknet, mixer, gambling, etc.). This lets compliance teams set thresholds appropriate for their risk appetite. TRM Labs (with 150+ configurable risk indicators as of June 2025) and Scorechain similarly provide configurable alert thresholds and risk indicator weights.

API Integration and Deployment

For exchanges and payment processors, screening happens at the API level: every deposit address, withdrawal address, and counterparty address is checked in real-time before a transaction is processed. All five providers offer REST APIs with sub-second response times for single-address lookups. The industry target for pre-transaction screening latency is approximately 500 milliseconds end-to-end.

Key integration considerations include webhook support for continuous monitoring (an address that was clean at screening time may later be added to the SDN list), batch endpoints for backfilling historical address checks, and SDK availability for common languages. Chainalysis, Elliptic, and TRM Labs all provide client libraries for major languages. Crystal Intelligence offers both SaaS and on-premise deployment (Crystal PRO) for institutions that require data residency control. Scorechain provides a no-code web dashboard alongside its API, making it accessible for smaller teams without dedicated engineering resources.

Continuous monitoring is as important as point-in-time screening. Addresses designated today may have been clean yesterday: OFAC can add new addresses at any time, and screening tools must re-evaluate previously cleared addresses when the list changes. All five providers support ongoing monitoring with alert notifications when an address's risk profile changes.

Pricing for Address Screening

Blockchain analytics pricing is opaque across the industry. No provider publishes a public rate card for address screening specifically. Based on publicly available estimates for mid-sized CASPs:

• Chainalysis: approximately EUR 120,000 to 250,000 per year for the full KYT suite. Sanctions-only screening is not typically sold separately.
• Elliptic: approximately EUR 80,000 to 180,000 per year. Screening can be purchased as part of the Lens product.
• TRM Labs: approximately EUR 60,000 to 150,000 per year. Also offers a free sanctions-only screening API with rate limits (up to 1,000 requests per second and 100,000 requests per day with an API key).
• Crystal Intelligence: positioned below the top three on price, with both SaaS and on-premise options.
• Scorechain: offers a free sanctions screening tier covering 14 blockchains (3 checks per day), with paid plans starting at approximately EUR 500 per user per month for full monitoring.

Many large platforms run two providers simultaneously for defense in depth: if one tool misses a designation, the other serves as a backstop. This practice roughly doubles analytics spend but reduces regulatory risk.

How to Choose an Address Screening Tool

The right tool depends on your transaction volume, regulatory jurisdiction, and risk tolerance.

For high-volume exchanges and payment processors that need the deepest entity attribution to minimize false positives: Chainalysis KYT provides the largest labeled address database and the most mature investigation workflow for escalated alerts. It is also the tool most recognized by US regulators and law enforcement (used by 370+ government agencies), which matters for audit defense.

For businesses handling Bitcoin alongside tokens on multiple chains: Elliptic's Holistic Screening consolidates cross-chain risk into a single API call, reducing integration complexity. The AI Copilot (launched April 2025) accelerates alert triage by approximately 50%.

For teams that need transparent, audit-ready risk explanations: TRM Labs provides explicit confidence levels and reasoning for every attribution. Its June 2025 update expanded indirect exposure detection across 36 blockchains, strengthening the Wallet Screening API for Bitcoin-specific use cases.

For European CASPs operating under MiCA: Scorechain's EU-focused compliance framework, transparent pricing, and free sanctions screening tier make it the most accessible entry point.

For institutions requiring on-premise deployment: Crystal Intelligence's Crystal PRO offers self-hosted analytics with 335 blockchain coverage and 118,000+ verified entities, relevant for banks and custodians with strict data residency requirements.

For Bitcoin-native businesses building on layer 2 networks like Spark, address screening integration is a design consideration from day one. As stablecoins like USDB enable dollar-denominated payments on Bitcoin rails, the compliance infrastructure around address screening becomes as important as the payment infrastructure itself. For a broader look at custody and compliance architecture, see our Bitcoin custody solutions comparison.

Frequently Asked Questions

What happens if an exchange processes a transaction to an OFAC sanctioned Bitcoin address?

OFAC sanctions are strict liability, meaning even unknowing violations can trigger civil penalties. The exchange must block the transaction, freeze the funds, and file a report with OFAC within 10 business days. Penalties can range from the value of the blocked transaction up to approximately $330,000 per violation (adjusted annually for inflation), or twice the transaction value, whichever is greater. Willful violations carry criminal penalties of up to $1 million and 20 years imprisonment. OFAC considers the quality of your compliance program (including screening tools) as a mitigating factor during enforcement.

How quickly do screening tools update after OFAC adds new Bitcoin addresses?

All five major providers maintain continuous synchronization with OFAC's SDN list and update within hours of a new designation. OFAC publishes list updates on its website and via XML/CSV data feeds. Chainalysis, Elliptic, and TRM Labs also proactively identify addresses associated with sanctioned entities before OFAC formally designates them, using clustering analysis to find related wallets. This means the screening tools often flag addresses that share a cluster with a sanctioned address even when the specific address is not yet on the SDN list.

Do I need to screen Bitcoin addresses if I only handle small transactions?

Yes. Unlike the Travel Rule, which has jurisdictional thresholds (e.g., $3,000 in the US, zero in the EU), OFAC sanctions screening obligations apply to all transactions regardless of size. There is no de minimis exemption for sanctions compliance. Even a $1 transfer to a sanctioned address triggers blocking requirements. This applies to any US person or entity, including businesses processing Bitcoin payments.

How do address screening tools handle Bitcoin change outputs and address reuse?

When a Bitcoin transaction creates change outputs, screening tools must determine whether the change address inherits the risk of the transaction's inputs. Most tools attribute risk to the change output proportionally: if 10% of the input value came from a flagged source, the change output receives a 10% exposure score. Address reuse simplifies screening because repeated use of the same address builds a richer transaction history for risk assessment. Modern wallets that generate fresh addresses per transaction (following BIP-44 derivation) require the screening tool to cluster addresses by entity using heuristics like common-input ownership.

Can I use a free tool for Bitcoin sanctions screening?

Both TRM Labs and Scorechain offer free sanctions screening API tiers. TRM's free tier allows up to 100,000 requests per day with an API key, while Scorechain's free tier covers 14 blockchains at 3 checks per day. For basic sanctions screening at low volumes, these may be sufficient. However, a compliance program that relies solely on direct SDN list matching without clustering, taint analysis, or risk scoring is unlikely to satisfy regulatory expectations during an examination. Regulators expect a risk-based approach that goes beyond exact-match sanctions checks. For any business processing meaningful Bitcoin volume, a paid analytics provider is effectively required.

What is the difference between address screening and transaction monitoring?

Address screening is a point-in-time check: before processing a transaction, you query an address against sanctions lists and risk databases. Transaction monitoring is ongoing: the tool watches every transaction flowing through your platform, scoring them in real-time and generating alerts when risk thresholds are exceeded. Both are required for a complete compliance program. Transaction monitoring catches activity patterns (structuring, rapid movement, high-risk counterparties) that single-address screening would miss. See our crypto AML tool comparison for a full breakdown of transaction monitoring capabilities.

How do screening tools handle Bitcoin multisig and shared custody addresses?

Multisig addresses present a specific screening challenge because multiple parties control the same address. If one co-signer is sanctioned, the address may be blocked under OFAC's 50% rule even if the other co-signers are clean. Screening tools flag multisig addresses associated with sanctioned co-signers, but identifying all co-signers requires either on-chain analysis (for P2SH/P2WSH scripts that reveal public keys at spend time) or off-chain intelligence. Most tools flag the address-level risk rather than attempting to decompose co-signer ownership.

This tool is for informational purposes only and does not constitute financial, legal, or compliance advice. Sanctions screening requirements vary by jurisdiction. Pricing, capabilities, and regulatory frameworks change frequently. Data is based on publicly available information as of mid-2026. Always verify current provider capabilities and consult qualified compliance counsel before making decisions.