OFAC Compliance for Crypto Exchanges and Web3 Companies: Wallets, Mixers, and the SDN List

Yes, OFAC Rules Apply to Your Exchange or Wallet

If you are a US person, or your platform touches US infrastructure, US customers, or the US financial system, OFAC's rules apply to you exactly as they apply to a bank. There is no crypto carve-out. Exchanges, custodial and non-custodial wallet providers, stablecoin issuers, DeFi front ends operated by a US entity, and NFT marketplaces all fall under the same sanctions regime as a community credit union.

Treasury has said this directly, repeatedly, and backed it with enforcement. If your business processes transactions, holds customer funds, or facilitates trades, you are expected to have a sanctions compliance program, screen the people you do business with, and block property in which a sanctioned person has an interest. "We're just a protocol" or "we don't custody funds" has not been a reliable defense.

Strict Liability: Intent Is Not a Defense

OFAC sanctions are enforced on a strict liability basis. You do not need to know a counterparty was sanctioned, and you do not need to intend a violation, for a violation to occur. An automated matching engine that fills an order for a wallet linked to a sanctioned entity, or an onboarding flow that never checks a user's name against the SDN list, creates liability the same way a human decision would.

This is the single most important fact for a crypto startup to internalize early. "We didn't know" reduces a penalty under OFAC's Economic Sanctions Enforcement Guidelines; it does not prevent the violation from happening in the first place. See our breakdown of OFAC penalties and enforcement for how intent, and the existence of a compliance program, actually factor into penalty calculations.

The SDN List Now Speaks Blockchain

The Specially Designated Nationals list has included digital currency addresses as identifiers for years now, alongside the traditional name, date of birth, passport number, and physical address fields. When OFAC designates a person or entity tied to crypto activity, the SDN entry typically lists one or more wallet addresses, tagged by chain, for example a "Digital Currency Address - XBT" field for a Bitcoin address or "Digital Currency Address - ETH" for an Ethereum address.

A single designated actor can carry dozens of addresses across multiple chains, and OFAC updates these entries as new addresses surface. That means SDN list matching for a crypto business has two layers: name and identity matching, exactly like a bank does, plus exact-string matching against a list of designated addresses. Our guide to the SDN list covers how the list is structured; the address fields are simply another identifier type on the same entries.

The Enforcement Cases That Set the Rules

Four actions define how OFAC treats this industry:

• SUEX (September 2021). The first virtual currency exchange OFAC ever designated, sanctioned for processing a large share of transactions tied to ransomware proceeds. It established that an exchange itself, not just its users, can end up on the SDN list.
• Chatex (November 2021). A peer-to-peer exchange designated for its ties to SUEX and for facilitating ransomware-linked transactions, reinforcing that nested and affiliated exchanges are in scope too.
• Tornado Cash (August 2022). OFAC designated the Ethereum mixing protocol under its cyber-related sanctions authority, alleging it laundered billions in stolen crypto, including funds tied to the North Korea-linked Lazarus Group. The designation was challenged in court, and in late 2024 the Fifth Circuit ruled OFAC had exceeded its statutory authority, finding that immutable smart contracts are not "property" belonging to a "person" under the sanctions statute. Treasury delisted Tornado Cash in March 2025. But Roman Semenov, a co-founder OFAC designated separately in 2023, remains on the SDN list. The lesson for compliance teams: protocol-level designations are legally contested, designations of the people behind them are not.
• Exchange settlements for sanctioned-jurisdiction users. Several major exchanges have paid OFAC settlements ranging from the hundreds of thousands to, in the largest case, close to a billion dollars, for allowing users connected to Iran, Cuba, Syria, North Korea, or Crimea to trade on their platforms. These cases turned on weak or absent geoblocking and KYC location checks, not a single bad actor.

Two Screening Surfaces: Who Your Users Are, and Where Their Coins Have Been

Crypto businesses need to run sanctions screening on two separate surfaces, and it is easy to build only one and assume you are covered.

• KYC name screening. Screen the legal name, and any known aliases, of every user against the SDN list and the other sanctions and denied-party lists at onboarding, and rescreen periodically since the lists change constantly. This is standard identity screening, the same discipline a bank applies to new account holders.
• On-chain address exposure. Separately, check whether a deposit or withdrawal address matches a designated address directly on the SDN list, or has material exposure to one through the chain of transactions. Direct address matching against OFAC's published identifiers is something you can build into your own screening. Deeper transaction-graph exposure, tracing funds several hops from a sanctioned wallet, typically requires a dedicated blockchain analytics tool alongside your sanctions list screening.

Both surfaces matter. A user can pass a clean name check and still send you funds from a sanctioned wallet, and a wallet can look clean while the user behind it is a designated person using a fresh alias.

Geoblocking Sanctioned Jurisdictions

Beyond screening individual names and addresses, OFAC expects crypto platforms to block access from comprehensively sanctioned jurisdictions: Iran, North Korea, Cuba, Syria, and the Crimea, Donetsk (DNR), and Luhansk (LNR) regions of Ukraine. In practice this means combining IP geolocation blocking with KYC data such as declared address, phone country code, and ID document issuing country, since any one signal alone is easy to spoof.

VPN and proxy evasion of geoblocking is a known, recurring focus in OFAC examinations and settlements. Past enforcement actions have called out exchanges with geoblocking in place but no process for detecting VPN traffic that masked a user's true location. IP geolocation alone tends to get flagged; layering it with behavioral signals (currency preferences, language settings, time-zone activity) is what examiners now expect.

How Lean Teams Start

You do not need an enterprise compliance budget to get a real program running. A common path:

• Start with manual, ad hoc checks during onboarding review using a free sanctions search, which returns full results against all eight lists we screen (OFAC SDN, OFAC Non-SDN Consolidated, BIS Denied Persons, UN Consolidated, EU FSF, UK OFSI, Canada SEMA, and Swiss SECO) with no signup required.
• Generate a one-time, audit-ready PDF report for $9.99 when you need a documented record of a specific check, for example ahead of an investor's due diligence or an examiner request.
• As onboarding volume grows, move to automated screening through our REST API or MCP server integration, so every new user is screened the moment they sign up and rescreened on a schedule, without a human in the loop for the clean majority of cases.

OFAC's 2021 Guidance for the Virtual Currency Industry

In October 2021, OFAC published sanctions compliance guidance specifically for the virtual currency industry, applying its general Framework for OFAC Compliance Commitments to this sector. It expects five components in a program:

• Management commitment. Leadership resources and empowers the compliance function.
• Risk assessment. A documented assessment of your exposure, covering customer base, products, geographies, and transaction types.
• Internal controls. Written policies and procedures for screening, geoblocking, and blocking or rejecting prohibited transactions.
• Testing and auditing. Regular, independent review of whether the controls actually work in practice, not just on paper.
• Training. Role-specific sanctions training for staff who touch onboarding, transaction monitoring, or customer support.

These five components mirror the general framework we cover in our five-pillars overview; the virtual currency guidance simply applies them to wallets, exchanges, and on-chain risk.

What to Do on a Hit

If a name or address screen returns a true match: block the transaction and freeze the account, do not return the assets to the user or move them anywhere, and file a blocking report with OFAC within 10 business days as required under 31 CFR 501.603. Keep the funds blocked and reported annually until you receive guidance from OFAC, and do not tip off the user that they have been flagged. Getting the hit-response workflow right matters as much as catching the match in the first place; our guide to handling an OFAC match walks through the process step by step.