Address screening is one component of a sanctions program. A complete control model maps legal exposure, list data, ownership and control, blockchain evidence, decision logic, technical enforcement, and incident duties.
Start with capability truth
Document what the organization can actually stop or influence. A custodial service may hold a transfer. An interface may deny a managed route. A relayer may refuse submission. A contract may support a pause or allowlist. An immutable contract may remain callable even when the principal website blocks access. Internal reporting and user communications must reflect that distinction.
Screen at decision points
- Customer onboarding and periodic rescreening
- Wallet connection or address enrollment
- Pre-transaction simulation and destination entry
- Deposits, withdrawals, managed contract calls, and counterparties
- Treasury, governance, vendor, and grant payments
- Material changes to lists, attribution, or jurisdictional exposure
Use explainable evidence
Separate direct list matches, ownership or control conclusions, likely name matches, attributed addresses, indirect exposure, and behavioral indicators. Record provider, list version, confidence, chain, distance, timestamp, and rule. A composite risk score should never erase the facts that determine the outcome.
| Control asset | Security requirement | Failure signal |
|---|---|---|
| List ingestion | Authenticity, integrity, timely update, historical versioning | Stale or failed refresh |
| Analytics labels | Coverage, confidence, change monitoring, dispute process | Unsupported chain or conflicting attribution |
| Policy engine | Approved rules, testing, least privilege, safe failure | Unexpected overrides or rule drift |
| Control adapter | Authenticated action and success confirmation | UI denial but relayer submission |
| Case records | Restricted access, tamper evidence, retention, recovery | Missing rationale or altered evidence |
Build incident-ready governance
The runbook should identify legal, compliance, engineering, security, operations, communications, and executive roles. It should cover preserving evidence, restricting relevant services, assessing similar exposure, contacting providers, deciding reports, and reviewing control failure. Test weekend designations, vendor outages, compromised administrator credentials, data exfiltration, and a high-profile false positive.
Measure effectiveness
Track screening coverage, update latency, unsupported volume, alert aging, confirmed matches, false-positive causes, override rate, control outage, repeated counterparties, and remediation. Segment by product, chain, jurisdiction, and enforcement point. Alert count alone does not measure effectiveness.
Continue with the full guides on sanctions controls for decentralized services and the compliance-by-design stack.