Wallet screening and blockchain analytics

Key facts (as of 29 October 2026)

• Public ledgers: every stablecoin transfer on a public blockchain is visible. Analytics tools group addresses into entities and trace flows between them.
• Listed addresses: since 2018, OFAC has included virtual currency addresses on the SDN List. They can be searched in the "ID #" field of OFAC's Sanctions List Search.
• Industry role: FATF's June 2025 targeted update acknowledged data from blockchain analytics firms, including Chainalysis, Lukka, Merkle Science and TRM Labs.
• Stablecoin focus: FATF said in July 2026 that "most identified on-chain illicit activity now involves stablecoins", and flagged a criminal-linked project designing a stablecoin to resist freezing.
• Issuer freezes: Tether reported more than US$4.4bn frozen by 23 April 2026 (Tether).

What screening checks

This is often called KYT (know your transaction): screening each transfer before sending, and before crediting received funds.

Direct and indirect exposure

Thresholds are a policy choice. Document them and review them.

Where it fits

flowchart TD
    A[Customer onboarding] --> B[Screen declared wallets; verify control above EUR 1,000 in EU]
    B --> C[Pre-send: screen destination, identify VASP for Travel Rule]
    C --> D{Risk within policy?}
    D -- Yes --> E[Send]
    D -- No --> F[Hold and review]
    G[Incoming transfer] --> H[Screen source before crediting]
    H --> I{Hit?}
    I -- No --> J[Credit]
    I -- Yes --> K[Hold; sanctions and AML escalation]
    E --> L[Ongoing re-screening as attributions change]
    J --> L

1. Onboarding. Screen the wallets a customer will use. Apply the EU's self-hosted address verification for transfers over €1,000 (see Travel Rule).
2. Pre-send. Screen the destination address and identify the receiving VASP for Travel Rule messaging.
3. On receipt. Screen the source before crediting. If a hit appears, hold the funds and escalate under your sanctions and AML procedures.
4. Ongoing. Re-screen as attributions change. OFAC suggests a historical lookback after an address is listed.

Evidence for source of funds

Banks and off-ramps increasingly ask for a blockchain-forensics report as part of a source-of-funds file. private.law lists wallet addresses, transaction hashes, exchange statements and a forensics report on the addresses as typical evidence, together with a signed message proving control of the address.

WarningAnalytics produces risk scores, not verdicts. Attributions can be wrong or outdated, and vendors differ. Use the results inside a documented risk-based procedure with human review. Do not rely on a single number.

NoteIndirect exposure matters. Funds a few hops from a hack or sanctioned address can still lead a counterparty to reject them. Screen before accepting, because finality makes returns harder later.

Choosing a vendor

Illustrative example: a player withdrawal

Illustrative example. The operator and figures are invented.

A licensed operator allows withdrawals in USDC to verified players' own wallets, where its licence permits. A player requests US$8,000 to a new address. Screening shows no direct hits, but 12% of the address's inflows came two hops from a known scam cluster. The operator holds the withdrawal, asks the player to sign a message proving control and to explain the wallet's history, then pays out after review. See Player payouts and withdrawals.

Timeline

Q/A

Does screening replace KYC?

No. It shows what a wallet has done, not who controls it. See AML and KYC.

Are analytics tools legally required?

Not by name. OFAC says no particular software is required but notes such tools "can be helpful". Regulators expect controls proportionate to risk, and for most VASP-facing businesses that means analytics.

Should we use more than one vendor?

Larger flows often do, to cross-check attributions. It adds cost and reconciliation work.

What if a counterparty's address is flagged after we paid?

Record it, review the relationship and consider a lookback. Take advice if sanctions are involved.

Can we refuse a payment with indirect exposure?

Usually yes, under your policy and contracts. Be consistent and document it.

Do privacy coins or mixers always mean refusal?

Most regulated providers treat mixer exposure as high risk. Policies vary.

Sources

• OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021): https://ofac.treasury.gov/media/913571/download?inline
• FATF, seventh targeted update (16 July 2026): https://www.fatf-gafi.org/en/news/targeted-updated-va-vasps-2026.html
• FATF, targeted update on virtual assets and VASPs (26 June 2025): https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html
• EBA, Travel Rule Guidelines: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/anti-money-laundering-and-countering-financing-terrorism/guidelines-information-requirements-relation-transfers-funds-and-certain-crypto-assets-transfers
• private.law, Crypto private wealth: https://wiki.private.law/en/crypto-private-wealth
• private.law, Stablecoins: https://wiki.private.law/en/stablecoins
• Tether, freeze of more than US$344m (23 April 2026): https://tether.io/news/tether-supports-freeze-of-more-than-344-million-in-usdt-in-coordination-with-ofac-and-u-s-law-enforcement/