Wallet risk triage & sanctions screening

The three documents a crypto compliance desk produces every day: a screening log that checks an address against the sanctions list, a triage note that scores a wallet’s activity against named rules, and a SAR-style escalation summary for the wallets that warrant a human’s attention. The sanctions list is real; the chain is not.

OFAC list as of 2026-10-03

Method, in plain language

The OFAC data is real. It is every digital currency address on the U.S. Treasury’s SDN list — 1066 of them — downloaded from https://www.treasury.gov/ofac/downloads/sdn.xml on 2026-10-03 (the file’s own publish date is 10/02/2026; sha256 0367408834e4af4d262ccc7e329e300b1a5b1430e1e4bcc4debbdd5b927b4cad). The list is refreshed by hand, never while you use the page, so the date above is the date of every match.
The wallets and transactions are synthetic. 60 invented wallets on a fictional ledger whose addresses begin syn1, a prefix no real chain uses, with values in invented units. The sanctioned parties in it are stand-ins, marked “OFAC-listed (stand-in)”; no synthetic transfer involves a real listed address. The exchanges, mixer, bridge and gambling service are invented too.
The scoring rules, each worth the points shown, summed into a tier:
1. Direct sanctioned exposure. The wallet is a listed party (+100), or sent to or received from one directly (+60).
2. Indirect exposure by hop distance. A listed party is two hops away (+30) or three (+15). Exposure is not followed through a labeled service.
3. Mixer contact. Any transfer to or from a labeled mixer (+25).
4. Peel-chain pattern. The wallet is a link in a run of at least 3 wallets that each pass on at least 75% of what they received and peel the rest off (+25).
5. Rapid pass-through. At least 90% of an inflow of 5,000 units or more leaves within 6h (+20).
6. Fresh-wallet high value. The wallet receives 50,000 units or more within 72h of its first transfer (+20).
7. Structuring just under a threshold. At least 3 transfers out within 72h, each within 10% below 10,000 units (+30).
Tiers: Low from 0, Medium from 25, High from 50, Severe from 80 points. A wallet at High or above gets an escalation summary. Labeled services are not scored.
This is a demo of compliance tooling, not a compliance determination. Only wallets in the synthetic dataset are ever scored. An address you paste is screened against the list and nothing more: no score, no tier and no opinion about whoever holds it.
“SAR-style” means the format only. The summary follows the shape of a suspicious activity report narrative; nothing on this page is submitted to any authority or institution, and its sign-off line is left for a human reviewer.

Check an address

Synthetic wallet

syn19sethjsy2eje6sznt3263rnmybx8k3 · Severe (125)

syn1asqv6vfp4ypap2yxjhn4izua6w2cbz · Severe (105)

syn1397zai6cgttduzb7whujhuqjfap2km · Severe (100)

syn1cbji9zmq4v2hcs4xa6thbe5xet9mrr · Severe (100)

syn12x9vtf8vqzg8va6x8qeecvvaqhfkqp · Severe (95)

syn1259kn397dwzifndzrqeuhrwgas4tyv · High (70)

syn139zc7d53x6g2zyve7phphkbx6f2p7q · High (60)

syn196g6273762dpevx2gsyfxexat9d2cm · High (60)

syn1zx5dcsuj8endisavwunrp27mbpf7si · High (55)

syn1gn24krqyr8bm8hz4k9pgbskzi3vs37 · Medium (45)

syn1m5wh627vgdhwwz6yskjwb7ypwbhhm2 · Medium (45)

syn13t9pmg5w4rk6hxvwdsa9ipr4apziei · Medium (30)

syn1cfh5htgexjth8j77vc8e9dkpmxmhqu · Medium (30)

syn1r9nnrt44jwvv3pv26xa92n9tcbyw9z · Low (20)

syn1t623zqxr6mgf7kgbnvin4uuuckaxvf · Low (15)

syn12b325xdgw4fsadfm3csn47csxstxfm · Low (0)

syn12b843cmenya3ghna6kctidz74zirrr · Arcspan, Bridge (synthetic)

syn132r4ajfsa3fxtne7e96catcg2n7vq8 · Low (0)

syn152qn2kkw6ez583u8mxa28zbnhftvu3 · Low (0)

syn169jc3atpm8fni7sajeb86txpc8f6qz · Low (0)

syn169rt32qvsewz4c99wmx3g5mh9yad26 · Low (0)

syn16ne9r7rest6wnyg59vr4cz98n7g3s2 · Low (0)

syn16nz2hpxw2u7tj68nbit6d2r5mas4uk · Low (0)

syn17v5cvwkwpizp73dacmbkwdwev89b55 · Low (0)

syn17v7ir7d5axdtwfmy8refkna5dwjxwe · Low (0)

syn18baeatrh7ruemb9cpw7g9bd3j7wwcv · Low (0)

syn1947n2rg2adgpjgpn7mujvtu65q66vt · Low (0)

syn19xhhs9t73hwjxk8kz4cdjjrmujhewx · Low (0)

syn1a5drjth7tdf4mxn54rzsa33nnzqthc · Low (0)

syn1c39iaj6cc97h9r6khmr5f7vq7rhjg6 · Low (0)

syn1daq23p6zukg8cevyk27dmpktk52js9 · Low (0)

syn1dr9uepd4tvmcptr6b3s95848bsby9b · Low (0)

syn1e3qwf2tsfwzmtppf24avbd8966b7fh · Lucky Hex, Gambling service (synthetic)

syn1egdhu75xkhaukwdyfcqkx28vywidbk · Low (0)

syn1f84h43i7f3pjrywghshypvgy4bawjy · Low (0)

syn1fgs2uitbx2vfj69cthj5ydn82vjs6x · Harborline, Exchange (synthetic)

syn1fhk99xk8qunhftqavmi4etwbka297m · Low (0)

syn1figvuxaxhnbzkad55pr7meazu54qry · Low (0)

syn1fynfwuibi3xag6pbdjfdxb2fmcp2sf · Low (0)

syn1grb7cx8n57sbaeqjngy9ejcjwzmusd · Low (0)

syn1gu2u3b5ser9vythx9xb3wvyunjd46j · Fogbank, Mixer (synthetic)

syn1iigxqv6x52gv2cg7n98dggemc5vw8p · Low (0)

syn1j2de5yp9n9kq5g576jmxbqdg9nkcjt · Low (0)

syn1jjfx4upuvu7xji5qn3m8zcatrg27b8 · Low (0)

syn1ksncbphjdgs8cc7vsrvgzu6svrkc5j · Low (0)

syn1m8g8yyhs6w2skw4g5zmwgarcwjaaxr · Low (0)

syn1ma9is393b4kq7qtayku9arb4xuydfn · Northgate, Exchange (synthetic)

syn1mie4rvk4bscf4g7ut6vgfhc89k4bi5 · Low (0)

syn1phpuqyvryvggii9ayw2asjs7ayggyk · Low (0)

syn1q82ac53a95hqqm9f3te7gyixty6cfs · Low (0)

syn1r895fsx7gu465a7b7vik6esfdsprpt · Low (0)

syn1te4wy5pdsrqagbv37wing6eb2k769y · Low (0)

syn1uzepy8xcy5jsj8ce68mm3er8jh8bag · Low (0)

syn1vrizqnmg4aitbjxy3r2jctzt8dssyk · Low (0)

syn1x36u966qihjr5wnityywskb4ypvvvr · Low (0)

syn1xue7shvhz3hg8qtftq99d5rpr6jrxa · Low (0)

syn1yxdmspderncw64ug43vmuh56vfdekv · Low (0)

syn1z59zdwzg59pm2c3c8ij2gn2t3zkkhy · Low (0)

syn1zaqhsrj46phfbvshzt3k4xmndqtfk8 · Low (0)

syn1zkvvntawvtqszs3mpe7vpzdpfbmthg · Low (0)

Or paste any address

The result below was computed on the server for the highest-scoring synthetic wallet. Loading the engine so you can run your own checks…

Result

Not on OFAC list as of 2026-10-03. Synthetic wallet on the Synthetic ledger (fictional).

Triage note

WALLET-RISK TRIAGE NOTE
Address:   syn19sethjsy2eje6sznt3263rnmybx8k3
Ledger:    Synthetic ledger (fictional)
Label:     Unlabeled wallet
Screening: not on OFAC list as of 2026-10-03; 1 hop(s) from the nearest listed-party stand-in
Score:     125
Tier:      Severe

Rules that fired (4):
  1. Direct sanctioned exposure (+60)
     Transacted directly with syn1397zai6cgttduzb7whujhuqjfap2km (Stand-in B, OFAC-listed (stand-in)), one hop: tx-0045 (80,000 units).
     Evidence: tx-0045
  2. Peel-chain pattern (+25)
     Link 1 of a 4-link peel chain: received 80,000 units in tx-0045, passed 68,000 units (85%) on in tx-0046 and peeled 12,000 units off in tx-0047.
     Evidence: tx-0045, tx-0046, tx-0047
  3. Rapid pass-through (+20)
     Received 80,000 units in tx-0045 and sent 80,000 units (100%) out within 1h05m: tx-0046 (68,000 units), tx-0047 (12,000 units).
     Evidence: tx-0045, tx-0046, tx-0047
  4. Fresh-wallet high value (+20)
     Received 80,000 units in tx-0045, 0h after its first transfer on the ledger (tx-0045).
     Evidence: tx-0045

Rules that did not fire: Indirect exposure by hop distance; Mixer contact; Structuring just under a threshold

Recommended action: escalate — pass the escalation summary to a human reviewer.

Generated from fixed rules over a synthetic dataset. A demo of compliance tooling, not a compliance determination.

Transfer neighborhood

Wallets within two hops on the synthetic ledger. Arrows point the way value moved; the subject is in the center. stand-in listed party mixer other service wallet

Escalation summary

SAR-STYLE ESCALATION SUMMARY
Format only. Synthetic subject, synthetic transfers; not submitted to any authority or institution.

Subject:          syn19sethjsy2eje6sznt3263rnmybx8k3 (Unlabeled wallet, Synthetic ledger (fictional))
Risk tier:        Severe (score 125)
Activity window:  2026-01-25 08:00 UTC to 2026-01-25 09:05 UTC
Total value:      160,000 units across 3 transfers (in 80,000 units over 1; out 80,000 units over 2)

Transaction trail:
  2026-01-25 08:00 UTC  tx-0045  IN   80,000 units  counterparty syn1397zai6cgttduzb7whujhuqjfap2km (Stand-in B, OFAC-listed (stand-in))
  2026-01-25 09:00 UTC  tx-0046  OUT  68,000 units  counterparty syn12x9vtf8vqzg8va6x8qeecvvaqhfkqp
  2026-01-25 09:05 UTC  tx-0047  OUT  12,000 units  counterparty syn1ma9is393b4kq7qtayku9arb4xuydfn (Northgate, Exchange (synthetic))

Red flags:
  - Direct sanctioned exposure (+60): Transacted directly with syn1397zai6cgttduzb7whujhuqjfap2km (Stand-in B, OFAC-listed (stand-in)), one hop: tx-0045 (80,000 units).
  - Peel-chain pattern (+25): Link 1 of a 4-link peel chain: received 80,000 units in tx-0045, passed 68,000 units (85%) on in tx-0046 and peeled 12,000 units off in tx-0047.
  - Rapid pass-through (+20): Received 80,000 units in tx-0045 and sent 80,000 units (100%) out within 1h05m: tx-0046 (68,000 units), tx-0047 (12,000 units).
  - Fresh-wallet high value (+20): Received 80,000 units in tx-0045, 0h after its first transfer on the ledger (tx-0045).

Narrative:
Between 2026-01-25 08:00 UTC and 2026-01-25 09:05 UTC, wallet syn19sethjsy2eje6sznt3263rnmybx8k3 on the Synthetic ledger (fictional) received 80,000 units across 1 transfer(s) and sent 80,000 units across 2. Under the lab's fixed rules it scored 125, tier Severe, from: direct sanctioned exposure; peel-chain pattern; rapid pass-through; fresh-wallet high value. Exposure: 1 hop(s) from the nearest listed-party stand-in. The rules flag patterns for a person to review; they do not establish what the activity was or who controls the wallet.

Human reviewer sign-off: ________________________________  Date: ____________

Screening log, this session

Time (UTC)	Address	Chain	List	Result	SDN entry	Hops
No checks yet in this session. Every check you run is added here.

How the synthetic wallets score

Tier	From	Wallets
Low	0 points	42
Medium	25 points	4
High	50 points	4
Severe	80 points	5

What a screening hit does and does not mean

An exact match against the SDN list says that string is on the list as of its date. It does not identify who controls the address today, and a miss does not clear anyone: lists change, and real screening programs add fuzzy name matching, exposure analysis on real chain data and human review on top of the exact match shown here. The triage rules are simple on purpose so every point in a score can be traced to a transfer. Real tools weigh far more signals and are tuned on real data; these thresholds are illustrative and live in one constants file.