Overview#
A financial institution's compliance team receives an alert moments before a customer's withdrawal is processed: the destination wallet address appears on the OFAC Specially Designated Nationals list and is linked to a known ransomware operator. The transaction is automatically held, the compliance officer is notified, and a case is opened for review, all before any funds leave the platform. This is the day-to-day reality of real-time blockchain threat intelligence and sanctions screening.
The module continuously monitors blockchain addresses and transactions against authoritative global sanctions lists, including OFAC SDN, the UN Consolidated List, and EU restrictive measures, as well as curated threat actor databases maintained by specialist blockchain analytics providers. It integrates pre-transaction screening and post-transaction exposure tracing into a single workflow, giving compliance, fraud, and operations teams the visibility they need to meet regulatory obligations and mitigate financial crime risk across digital asset operations.
Key Features#
- Real-time address screening: Every blockchain address involved in an inbound or outbound transaction is screened against live sanctions lists and threat intelligence feeds before the transaction is finalised, with sub-second response times suitable for high-throughput environments.
- Continuous list synchronisation: Sanctions lists from OFAC, the United Nations, and the European Union are ingested and reconciled automatically as authoritative sources publish updates, ensuring the screening database is never more than minutes behind official publications.
- Risk scoring and severity thresholds: Each screened address receives a composite risk score drawn from sanctions status, known association with illicit activity clusters, and transaction graph proximity to flagged entities, allowing organisations to configure automated block or review thresholds appropriate to their risk appetite.
- Automated flagging and alerts: Matches above configurable thresholds trigger immediate notifications to compliance officers via the organisation's existing incident response tooling, with structured alert payloads that include match provenance and recommended next steps.
- Historical exposure analysis: Compliance teams can run retrospective screening across historical transaction records to identify past exposure to addresses that were subsequently added to sanctions lists, supporting suspicious activity report (SAR) preparation and regulatory disclosure obligations.
- Threat actor graph traversal: Beyond direct address matches, the module traces multi-hop relationships across the transaction graph to surface indirect exposure to sanctioned entities or known criminal infrastructure such as mixing services and darknet markets.
- Audit trail and evidence packaging: Every screening decision, whether cleared, flagged, or blocked, is recorded with full provenance including the list version consulted, the match confidence, and the analyst actions taken, producing a defensible audit trail for regulatory examination.
Use Cases#
- Pre-transaction compliance screening for exchanges and custodians: Cryptocurrency exchanges and custodial wallet providers screen all deposits and withdrawals in real time to prevent interactions with sanctioned parties and meet obligations under anti-money laundering (AML) regulations.
- Pre-transaction risk assessment for institutional trading desks: Institutional desks executing large on-chain transactions assess counterparty wallet risk before signing, reducing the likelihood of inadvertently facilitating transactions linked to sanctions evasion.
- Post-incident exposure tracing: Following a ransomware attack or fraud event, security and compliance teams trace ransom payment flows and identify whether funds have passed through addresses associated with designated threat actors or sanctioned jurisdictions.
- Regulatory reporting support: Compliance analysts use historical exposure reports and pre-packaged audit evidence to prepare SARs, respond to regulatory enquiries, and demonstrate due diligence to auditors.
- Correspondent banking and DeFi bridge monitoring: Institutions offering fiat-to-crypto conversion or operating bridges to decentralised finance protocols screen on-chain counterparts to ensure correspondent relationships do not expose the institution to sanctions liability.
Integration#
The module connects to sanctions list authorities and blockchain analytics providers through standards-based interfaces. OFAC SDN data is consumed directly from official government publication feeds, while UN and EU list updates are normalised to a common address-entity schema on ingestion. Threat intelligence enrichment is available via integration with leading blockchain analytics platforms such as Chainalysis and Elliptic, which supply cluster-level attribution and risk categorisation alongside raw address data. Screening results and case records are published to the organisation's incident response and case management platform via webhook or a structured event stream, so compliance workflows already in place for traditional financial crime continue to function without modification.
Open Standards#
- FATF Recommendation 16 (Travel Rule): The module supports Travel Rule compliance by screening originator and beneficiary virtual asset service provider (VASP) identifiers as well as wallet addresses, aligning with FATF guidance on information sharing for virtual asset transfers.
- STIX 2.1 (OASIS): Threat actor and indicator-of-compromise data is modelled using the Structured Threat Information eXpression (STIX) vocabulary, enabling interoperability with any STIX-compatible threat intelligence platform or information sharing community.
- TAXII 2.1 (OASIS): The module can consume and publish threat intelligence over the Trusted Automated eXchange of Intelligence Information (TAXII) protocol, supporting participation in financial sector and government information sharing networks.
- ISO/IEC 27001: Screening data handling, access controls, and audit logging are aligned with the information security management requirements of ISO/IEC 27001, supporting certification audits.
- FATF Recommendation 15: The module's risk-based approach to virtual asset screening directly addresses FATF guidance on applying AML and counter-terrorist financing measures to virtual assets and VASPs.
- OpenAPI 3.1 (OAI): All screening and alert interfaces are described using the OpenAPI specification, allowing integration with existing compliance and case management tooling without bespoke connectors.
- W3C Verifiable Credentials: Where address ownership attestations are available from identity verification processes, they are handled as W3C Verifiable Credentials to support portable, privacy-respecting identity assurance alongside on-chain screening.
Availability#
- Enterprise Plan: Included
- Professional Plan: Available as an add-on; contact sales for screening volume limits and list coverage options.
Last Reviewed: 2026-05-26