OFAC SDN List

The SDN List is the most consequential sanctions instrument for payment operators with US nexus. OFAC’s jurisdiction extends beyond US-incorporated entities: non-US operators that process USD, use US correspondent banks, or have US-person employees or shareholders are exposed to OFAC enforcement authority. OFAC has levied nine-figure penalties against non-US financial institutions for SDN violations.

List Composition and Update Cadence

The SDN List contains entries across multiple designation programmes — sanctions programmes targeting specific countries (Russia, Iran, North Korea, Cuba, Syria), terrorism financing (SDGT designations), narcotics trafficking (Kingpin Act), and targeted individuals subject to executive order designations. Each entry includes identifiers: for individuals, date of birth, passport numbers, and known aliases; for entities, jurisdiction of incorporation and known addresses; for vessels and aircraft, registration details.

OFAC publishes updates to the SDN List through its website and via a consolidated sanctions list file available in XML and CSV formats. Real-time SDN screening requires operators to synchronise against the current list, not a cached weekly snapshot — OFAC has cited batch-update failures as contributing to violations where transactions processed between list updates.

Crypto Wallet Address Extensions

OFAC first designated a cryptocurrency wallet address in 2018. Since then, the volume of crypto identifiers on the SDN List has expanded significantly, including:

• Tornado Cash: OFAC designated the Tornado Cash smart contracts and associated wallet addresses in August 2022, creating the first instance of a protocol (rather than a person or entity) being listed.
• Ransomware operator addresses: OFAC has designated wallet addresses associated with REvil, Darkside, and other ransomware groups.
• DPRK and Iran-linked wallets: Multiple address clusters associated with Lazarus Group and other state-linked actors.

For payment operators accepting stablecoins, SDN screening of crypto wallet addresses requires integration with chain analysis tooling — a traditional SDN list lookup against a text identifier is insufficient to detect indirect exposure through mixed or layered on-chain fund flows.

Operator Screening Obligations

Operators should maintain real-time SDN screening at onboarding (against all entity identifiers) and at transaction time (particularly for crypto payments against wallet address designations). Compliance programmes that rely solely on periodic KYB reviews without transaction-level SDN screening create material exposure windows.