Sanctions and blockchain tracing: What an OFAC match proves

A blockchain tracing report says a wallet is “connected to a sanctioned exchange.” That phrase may describe an exact address published by the U.S. Department of the Treasury's Office of Foreign Assets Control, a commercial attribution to a listed person, an indirect transaction path, or a vendor-generated risk score. Those findings are not interchangeable.

A public blockchain can establish transactions between addresses. It does not, by itself, establish who controlled an address, who owned the property, what a party knew, which sanctions authority applied, or whether a transaction was prohibited. Counsel should begin with a narrower question: What exactly matched, on what date, under which authority, and based on what evidence?

Why is an OFAC designation not a tracing conclusion?

OFAC administers sanctions programs under different statutes, executive orders, and regulations. The legal effect of a match depends on the governing program, the parties and property involved, jurisdiction, ownership, and timing. A blockchain trace may supply relevant facts, but it does not determine which legal rule applies.

The September 17, 2026 BitBank action illustrates the distinction. OFAC added BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three individuals to the Specially Designated Nationals and Blocked Persons List. Treasury described BitBank as a digital asset venture controlled by OFAC-designated Iranian financier Babak Zanjani and stated that Zanjani used it to facilitate transfers of hundreds of millions of dollars' worth of Bitcoin to the Islamic Revolutionary Guard Corps. Those are Treasury's administrative findings and allegations, not judicial findings. (Treasury release; OFAC list update)

The public entries issued with that action did not publish a digital currency address for BitBank. A later provider label connecting an address to BitBank would therefore be a third-party attribution unless OFAC separately published the address. Calling it an “OFAC-listed address” would overstate the official record.

The designation date also is not necessarily the first date on which restrictions applied. OFAC FAQ 1250 states that Iranian digital asset exchanges meet the regulatory definition of an Iranian financial institution and are blocked under Executive Order 13599 and the Iranian Transactions and Sanctions Regulations regardless of whether they appear by name on the SDN List. Property and interests in property of those exchanges within U.S. jurisdiction or the possession or control of a U.S. person are blocked and must be reported.

The analysis for non-U.S. persons is different. OFAC FAQ 1257 identifies separate potential consequences: designation of a person that materially assists or supports a designated exchange; correspondent or payable-through account restrictions on a foreign financial institution that knowingly conducts or facilitates a significant financial transaction for the exchange; and statutory sanctions involving significant transactions with designated Iranian financial institutions. Those authorities address different actors, conduct, and consequences.

What are the five findings that reports often collapse into one match?

1. An exact match to an address published by OFAC

OFAC may add digital currency addresses to an SDN List entry as identifiers associated with a blocked person, although OFAC FAQ 562 warns that published addresses are not likely to be exhaustive. The absence of an address from an entry does not prove that the listed person has no interest in it.

OFAC FAQ 594 directs users to enter a digital currency address in the Sanctions List Search tool's ID # field. That field does not use fuzzy logic, so it returns only exact matches. The search result should still be validated under the relevant network's parsing and canonicalization rules.

Ethereum is an important example. An Ethereum address represents a 20-byte value, while mixed capitalization can encode an ERC-55 checksum. A casing correction can therefore identify the same underlying address. A report should not claim that every visible character difference necessarily creates a different Ethereum address without first applying the network's rules.

A network-validated exact match supports the statement that OFAC publicly associated the identifier with the listed person as of the applicable entry. It does not independently establish who controlled the address on every earlier date, who authorized a transaction, or what another party knew.

2. A third-party attribution to a listed person or entity

A commercial analytics provider may attribute addresses that OFAC has not published. The report should identify the provider, product, query date, label, confidence or category, and disclosed basis. “The provider attributed this address to BitBank” accurately describes the evidence. “OFAC listed this address” does not, unless the official entry contains it.

Attribution also does not necessarily resolve ownership. Exchange records, account data, device evidence, corporate records, signed messages, and testimony may be needed to connect an address to a person or entity. Understanding wallet ownership evidence explains why control of keys, account ownership, and ownership of the assets are separate questions.

3. An unlisted entity blocked under the 50 Percent Rule

An entity need not appear by name on the SDN List to be blocked. OFAC FAQ 401 states that an entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked. OFAC's 50 Percent Rule guidance explains that qualifying interests held by multiple blocked persons are aggregated.

Control is a separate issue. OFAC FAQ 398 states that an entity controlled by blocked persons, but not owned 50 percent or more in the aggregate, is not automatically blocked under the rule. OFAC may separately designate the entity and urges caution when blocked persons hold significant minority interests or exercise control.

Blockchain activity rarely proves corporate ownership percentages by itself. Counsel may need shareholder records, beneficial-ownership information, formation documents, agreements, governance records, and testimony. Operational control of a wallet is not a substitute for the ownership analysis.

4. An indirect transaction path

A transaction graph may show funds moving from a listed or attributed address through intermediaries to the wallet under review. That path is transaction history. It is not automatic proof that each downstream wallet is blocked, owned by the sanctioned party, or involved in evasion.

OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry recommends a risk-based compliance program that may include address screening, transaction monitoring, investigation, and blockchain analytics. It does not establish a universal rule under which every wallet within a fixed number of hops acquires the legal status of the original listed address.

Terms such as “direct,” “one hop,” and “indirect” should describe the transaction path. They should not silently substitute for an ownership, attribution, knowledge, or liability conclusion. A sound blockchain tracing analysis separates ledger facts from the inferences drawn from them.

5. A vendor-generated risk score or alert

A risk score is an analytical output, not an OFAC determination. Counsel should obtain the transactions and attribution evidence behind it, including what triggered the alert, which addresses contributed, the exposure settings and time period, and when the provider applied or changed the label.

A score may be useful for triage, but its meaning depends on the provider's methodology. Why most blockchain forensic reports fail Daubert scrutiny addresses the broader problems created when a dispositive conclusion rests on untested commercial labels or opaque rules.

How should counsel build the sanctions timeline?

Chronology is often the difference between a useful trace and a misleading conclusion. Record at least:

1. the date and time of each relevant blockchain transaction;
2. the block number and transaction hash;
3. the date the person, entity, or address was listed;
4. any earlier authority under which the person or property may already have been blocked;
5. the date the analytics provider created, changed, or withdrew its attribution;
6. the date the client or institution received the alert;
7. any blocking, rejection, return, unblocking, or transfer date; and
8. any report, license request, subpoena response, or OFAC communication date.

OFAC FAQ 5 recommends that organizations investigating a potential name match identify the list or sanctions program that generated the alert, review the complete entry, compare available identifiers, obtain additional information where necessary, and follow their sanctions procedures for likely matches. It does not say that every doubtful match must be reported to OFAC. OFAC also explains that it does not confirm potential matches or false positives for organizations and instead expects risk-based determinations.

As an evidentiary practice, preserve the search result, list data, provider output, and analysis date so the decision can be reconstructed. That preservation recommendation is separate from FAQ 5. Questions about whether virtual currency must be blocked may be directed to OFAC's Compliance Hotline under FAQ 646.

What should a reproducible evidence package contain?

Preserve enough material for another qualified analyst to repeat the work:

• the complete address in plain text and the relevant blockchain or network;
• the canonical or checksum-validated form used for comparison;
• transaction hashes, block numbers, timestamps, asset type, and amount;
• raw transaction and receipt data where available;
• the dated OFAC entry or sanctions-list data;
• the provider, product, version, query date, report identifier, and settings;
• labels, confidence levels, exposure thresholds, hop settings, and the relied-upon path;
• analyst notes and any manual changes to automated output; and
• records showing when the alert was received, investigated, and resolved.

The current recordkeeping rule generally requires full and accurate transaction records for at least ten years. Records of blocked property must be retained while the property remains blocked and for at least ten years after it is unblocked. (31 C.F.R. § 501.601)

OFAC's 2021 virtual currency guidance PDF still contains a five-year recordkeeping statement. That text predates the amendment that extended the regulatory period from five to ten years, effective in March 2025. The current regulation controls. (2024 interim final rule; 2025 final rule)

What discovery is most useful?

Discovery should connect an address to a person, account, property interest, or business process. For a custodian, requests may seek KYC materials, beneficial owners, assigned deposit addresses, ledgers, internal identifiers, login and device data, withdrawal approvals, communications, sanctions alerts, investigation notes, and OFAC reports.

For an analytics provider or expert, seek the transaction set, source and date of each attribution, software and ruleset, exposure settings, overrides, validation procedures, limitations, and label history. A protective order may address proprietary material without preventing meaningful testing of a dispositive attribution.

For a 50 Percent Rule issue, request evidence of direct and indirect equity interests, intermediary entities, nominee arrangements, and ownership changes over time. Do not infer aggregate corporate ownership from wallet activity alone. The same separation of source data, method, and conclusion should appear in the final report and is part of ConsensusIntel's forensic methodology.

What happens when property must be blocked?

Blocking freezes property; it does not transfer title to the government. OFAC FAQ 9 states that title remains with the blocked person, while transfers and other exercises of ownership are prohibited without authorization.

Once a U.S. person determines that it holds virtual currency required to be blocked, FAQ 646 requires denial of access, compliance with holding and reporting requirements, and risk-based controls. OFAC describes blocking each affected wallet or consolidating blocked virtual currency into another controlled wallet as permissible examples for a virtual currency company. It does not require every holder to move every blocked asset into a new wallet. Conversion to fiat currency is not required.

The initial blocking report is due within ten business days, with annual reports required while the property remains blocked. 31 C.F.R. § 501.603 assigns primary responsibility to the holder or other specified person and permits an attorney or agent to file on that person's behalf.

Regulatory blocking is also different from a stablecoin issuer's technical ability to blacklist tokens at an address. Stablecoins and the freeze option explains that separate mechanism.

How does the framework apply to a transaction path?

Hypothetical example: A client's wallet receives 12 ETH from Address B in June. In September, a tracing provider reports that Address B received funds two transactions earlier from an address the provider attributes to a newly designated exchange.

The blockchain may establish the transaction path. The provider's records may establish that it applied the exchange label to the upstream address on a particular date. Neither fact alone establishes that Address B was controlled by the exchange, that the client's June receipt involved property in which the exchange had an interest, that the client knew of the upstream source, or that the September designation was the first restriction applicable to the exchange.

A defensible analysis would verify the path, timing, any OFAC-published address, the governing authority, any earlier blocking status, ownership or control of Address B, available custodial records, and the client's jurisdictional status. The report should separate on-chain facts, third-party attribution, legal assumptions, and unresolved questions.

What is the practical response to an OFAC-related alert?

1. Preserve the exact result. Save the address, network, list entry, provider output, settings, date, and underlying transactions.
2. Validate the address correctly. Use the OFAC ID # field and apply the blockchain's canonicalization and checksum rules.
3. Identify what matched. Distinguish an OFAC-published address from a vendor attribution, ownership conclusion, indirect path, or score.
4. Identify the authority. Determine the sanctions program, executive order, regulation, and any earlier blocking rule.
5. Build the timeline. Separate transaction, designation, attribution, discovery, blocking, and reporting dates.
6. Determine jurisdiction and actor. Identify the relevant person, institution, holder, property, and conduct.
7. Investigate ownership and control. Apply the 50 Percent Rule to documented ownership, not wallet activity alone.
8. Separate fact from inference. State what the ledger records, what a provider attributes, and what counsel or the expert concludes.
9. Assess blocking and reporting duties promptly. Apply the governing authority rather than a generic “sanctions exposure” label.
10. Use program-specific legal advice. Blockchain expertise reconstructs transactions; it does not replace sanctions counsel.

Frequently Asked Questions

Q: Does an exact match to an OFAC-published address prove who owned the wallet?

A: No. It proves that OFAC publicly associated that identifier with a listed person as of the relevant entry. Ownership or control on a particular date may require exchange records, account data, device evidence, corporate records, signed messages, or testimony.

Q: Does a one-hop or indirect connection make the receiving wallet sanctioned?

A: Not automatically. The path establishes transaction history. Counsel must separately analyze attribution, property interests, ownership, jurisdiction, timing, knowledge where relevant, and the governing sanctions authority.

Q: Can an entity be blocked even if it is not named on the SDN List?

A: Yes. An entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked under OFAC's 50 Percent Rule. Control without the required ownership percentage does not automatically produce that result.

Q: How long should sanctions-related cryptocurrency records be retained?

A: The current OFAC recordkeeping rule generally requires transaction records for at least ten years. Records of blocked property must be kept while the property remains blocked and for at least ten years after unblocking. Other litigation, regulatory, or contractual preservation duties may require longer retention.

Q: What should counsel request from a blockchain analytics provider?

A: Request the underlying transactions, attribution sources and dates, product and version, ruleset, exposure and hop settings, confidence categories, overrides, validation procedures, limitations, and label history. The goal is to make the reported conclusion testable rather than relying on a score alone.

Every matter turns on its facts, the applicable sanctions program, and the evidence available. For a case-specific tracing or evidentiary question, contact ConsensusIntel to discuss the record and the scope of analysis needed.