Sanctions screening is the part of compliance that sounds simplest — "check people against a list" — and turns out to have the most moving parts. There is more than one list. The lists change. A crypto payment has a sender, an address, a location and a history, and each can carry sanctions risk on its own. And unlike a card network, a blockchain won't stop a payment from a sanctioned address from arriving in your wallet. This guide is organised around the five questions an examiner — or your own compliance lead — will ask about any payment gateway's screening programme, and what a good answer looks like for each. It explains how the pieces fit together; it isn't legal advice, and your obligations depend on where you operate.
Three things get screened, all the time. Who the customer is (name and identity against sanctions and PEP lists), which addresses funds come from or go to (on-chain risk screening), and where the customer is (jurisdiction and location). Each runs at onboarding and again as the lists and the transactions change.
Question 1 — Who do you screen? Customers, counterparties, and the addresses behind them
The obvious answer is "our customers", and it's the right place to start: every business or person you onboard is checked against sanctions lists, and usually against lists of politically exposed persons (PEPs) too. But a payment gateway has a second population that card businesses rarely think about — wallet addresses. since 2018, OFAC has included certain virtual currency addresses as identifying information on entries of its Specially Designated Nationals (SDN) list, which means a sanctioned party can be identified by the address it pays from, not only by its name.
So a complete answer covers three things: the customer (your merchant or user), the counterparty addresses that send or receive funds through you, and — where the address doesn't appear on any list directly — its exposure: whether funds have recently passed through sanctioned addresses, mixers or other high-risk services. The last one is what on-chain risk scoring (KYT) exists for.
Question 2 — Against which lists? OFAC is one list among several
"OFAC screening" has become shorthand for sanctions screening, but the US list is only one of the sets that may apply. Depending on where you and your customers are, the relevant lists typically include the US OFAC lists, United Nations sanctions, the EU consolidated list and the UK list — and others in other jurisdictions. Screening against all of them by default is easier than working out, case by case, which ones apply to a given payment. CPAY's compliance layer screens against global sanctions and PEP lists including OFAC, UN, EU and UK at onboarding, and keeps re-screening afterwards.
Two details matter as much as the choice of lists. Freshness: lists are updated frequently, so a check is only as good as the date of the list it ran against. And matching: names are transliterated, abbreviated and misspelled, so screening uses fuzzy matching, which inevitably produces near-misses that a person has to review. Plan for false positives from day one; they are a cost of doing the job properly, not a sign it's broken.
Question 3 — When do you screen? At the door, and every day after
A one-time check at sign-up answers yesterday's question. A customer who was clean when they onboarded can be designated next month, and an address that was unremarkable on Monday can be identified on Friday. The answer an examiner wants to hear is "at onboarding, and continuously after that."
In CPAY's KYC module this is concrete: post-screening runs daily — document expiry checks at 09:00 and database screening against the selected sanctions, restrictions and crime databases at 10:00 — and lists the applicants for whom anything was found, with a downloadable report and a callback to your system. Address-level screening runs where the money moves: on-chain risk scoring of wallets and transactions, so exposure to sanctioned addresses or mixers raises an alert in real time rather than at the next review cycle.
Location belongs on the same timeline. OFAC's guidance for the virtual currency industry specifically points to geolocation tools, including IP address blocking, as part of a risk-based programme for keeping users in sanctioned jurisdictions out. Checking at sign-up and again at login or payment closes the most common gap: an account opened from one place and used from another.
Question 4 — What happens on a hit? Hold, review, decide, record
This is where crypto differs most from cards. On a card network, a payment that fails screening can be declined before it settles. On a blockchain, a payment is a push from the sender's wallet — you cannot stop it arriving. A non-custodial gateway can't refuse delivery to an address; what it controls is what happens next. So the question isn't "did you block the payment?" but "what did you do once you knew?"
A defensible answer has four steps:
- Hold. Funds linked to a potential match are not released, swapped or paid onward while the alert is open. Automation should do this, not a person remembering to.
- Review. A person compares the match with the customer or address: is this the listed party, or a near-miss? Most name hits are near-misses; most direct address hits are not.
- Decide. A confirmed match is handled under your programme and the law that applies to you — which for some businesses includes blocking the property and reporting it to the authorities. Get counsel to write this part of the procedure; it differs by jurisdiction.
- Record. Every alert ends with a decision, a reason, a reviewer and a timestamp — including the false positives you cleared.
The numbers in that sketch are placeholders, not recommendations — your risk assessment sets them. What matters is the shape: every combination of signals maps to an explicit action and an owner, and every decision is written down with the version of the list it was made against.
In screening, the alert is the easy part. The decision — and the record of it — is the programme. (A rule of thumb, not a quote.)
Question 5 — Can you prove it? The audit trail is the product
Sanctions enforcement doesn't only ask whether something slipped through; it asks whether you had a reasonable programme and followed it. OFAC's guidance is blunt on one point: civil penalties for violations can be imposed on a strict liability basis — that is, even without knowledge or reason to know — and a risk-based compliance programme is among the mitigating factors it considers. That makes the record as important as the screening itself.
A good trail answers, for any customer or payment: which lists it was checked against and when; what the result was; who reviewed any alert; what they decided and why. CPAY keeps verification records per applicant — status, verification and external IDs, document data and face matching, and the history of status callbacks — and its compliance layer adds case management with alerts, review queues, decisions and an audit trail, plus regulator-ready exports. Whatever tools you use, test the trail the way an examiner would: pick a customer at random and try to reconstruct every check in ten minutes.
Tools support the programme. They don't replace it. A provider can supply lists, matching, KYT scores and the audit trail. It can't decide your risk appetite, own your relationship with regulators, or make the call on a confirmed match. Name an accountable person, write the procedure, and review it when the business or the rules change — the KYC & AML guide sets out who owns which part.
Checklist: A screening programme on one page
- Scope: customers, counterparty addresses, and address exposure are all screened.
- Lists: OFAC, UN, EU and UK (plus local lists where relevant), with the list version recorded on every check.
- Timing: at onboarding, daily re-screening, and per transaction for addresses.
- Location: jurisdiction and IP/geolocation checks at sign-up and at login or payment.
- Hits: automatic hold; human review; documented decision; escalation path to counsel for confirmed matches.
- False positives: a review queue with an owner and a target time — and cleared alerts recorded, not deleted.
- Records: reconstructable for any customer or payment within minutes.
- Review: the programme itself is reviewed on a schedule and whenever you add a market, a product or a chain.
FAQ — Common follow-ups
Does OFAC screening apply to businesses outside the US?
US sanctions apply to US persons and can reach transactions with a US nexus, and many non-US businesses screen against OFAC lists anyway because their banks, partners and customers expect it. Your local sanctions regime applies in addition. Which obligations bind you is a question for counsel; screening against all the major lists by default is the practical answer.
Can a non-custodial gateway block a payment from a sanctioned address?
It can't stop a transfer from arriving — blockchain payments are pushed by the sender. What it can do is detect the exposure, hold the funds from further movement, route the case for review and act on the decision. That is why address screening has to be automatic and immediate.
What's the difference between sanctions screening and KYT?
Sanctions screening checks who someone is against lists. KYT (know-your-transaction) scores the on-chain history of addresses and transactions — including indirect exposure to sanctioned addresses, mixers and other high-risk services. A complete programme uses both.
How often should customers be re-screened?
Continuously, in practice: lists change often, so re-screening the whole customer base on a daily schedule — as CPAY's post-screening does — is the norm for payment businesses. Address screening runs per transaction.
What should happen to false positives?
They should be reviewed by a person, cleared with a written reason, and kept in the record. A well-documented false positive is evidence that the programme works; a deleted one is a gap an examiner will find.
Want screening built into the stack that moves the money? See CPAY KYC & AML or book a call.
Sources: OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (2021), CPAY KYC & AML, CPAY Docs — Post-screening, CPAY Docs — Verifications. This article is general information, not legal advice.
