Wallet Screening

Wallet screening is the compliance process of checking a cryptocurrency wallet address for links to sanctioned persons, criminal activity or other high-risk sources before a business deals with it. Crypto exchanges, custodians, stablecoin issuers, payment firms and banks with crypto exposure screen addresses when customers deposit funds, request withdrawals or add a new address to their account. The result helps decide whether to process the transaction, ask for more information, freeze the funds or file a report.

Screening a wallet is different from screening a person. A blockchain address does not carry a name, so firms rely on blockchain analytics providers that link addresses to known entities, such as exchanges, darknet markets, scam operations, mixers and sanctioned groups. Wallet screening sits alongside traditional sanctions screening of customers and is part of a virtual asset service provider's anti-money laundering programme.

When an address is submitted, the screening tool checks it against two kinds of data. The first is official lists. The US Office of Foreign Assets Control has included digital currency addresses in some entries on its Specially Designated Nationals (SDN) list since 2018, and a direct match with a listed address is a clear sanctions hit. The second is the analytics provider's own attribution data, built from investigations, public information and clustering techniques that group addresses controlled by the same entity.

The tool then analyses the address's transaction history. Direct exposure means the address has sent funds to or received funds from a risky entity. Indirect exposure means the link runs through one or more intermediate addresses. Most tools express the result as a risk score or rating, often called a wallet score, together with a breakdown of the categories involved and the share of funds traced to each.

Screening tools typically flag exposure to:

• Sanctioned entities. Addresses listed by OFAC or other authorities, or attributed to sanctioned exchanges and groups.
• Illicit services. Darknet markets, ransomware operators, fraud shops and stolen funds from hacks.
• Obfuscation services. A coin mixer or similar privacy tool that breaks the link between sender and receiver.
• Scams. Addresses linked to investment fraud, impersonation and address poisoning schemes.
• High-risk platforms. Exchanges with weak or no customer checks, gambling services and peer-to-peer platforms in high-risk jurisdictions.

Firms set their own policies on how to treat each category and how much indirect exposure is acceptable. A small, distant link to a mixer may be noted, while a direct deposit from a sanctioned address usually requires the funds to be blocked and reported.

Wallet screening happens at several points. Deposits are screened before they are credited, so that tainted funds can be frozen. Withdrawal addresses are screened before funds leave, so the firm does not send money to a sanctioned or criminal address. Customer-supplied addresses may be checked when added to an address book, and existing customers' addresses are rescreened as attribution data and sanctions lists change. Screening also supports the Travel Rule, which requires firms to exchange originator and beneficiary information for transfers, and helps them assess whether a counterparty is a regulated firm or an unhosted wallet.

No single law prescribes wallet screening, but it follows from general obligations. Sanctions laws prohibit dealing with listed persons and their property, including crypto assets, and regulators have penalised firms that processed transactions with sanctioned addresses. FATF standards apply anti-money laundering duties to virtual asset service providers, including monitoring and risk assessment of transactions. National supervisors expect firms to use blockchain analytics proportionate to their size and risk, and to document how they act on the results. Firms are also expected to keep records showing which addresses were screened, which tool and data version were used and what decision was taken, so that examiners can test the process after the event.

Wallet screening is only as good as the attribution data behind it. Providers differ in coverage and accuracy, new criminal addresses take time to be identified, and clustering can be wrong. Criminals use chain hopping, cross-chain bridges and privacy coins to make tracing harder. Indirect exposure can also unfairly penalise ordinary users who received funds that passed through a risky service long before. For these reasons firms treat scores as one input, combine them with customer due diligence and transaction monitoring, and review decisions on borderline cases manually.