SpendPreflight
Field notes · October 28, 2026

How to screen a crypto address against OFAC (free and API)

Start with the exact public address, check a dated sanctions source, and keep the result’s limits attached to it.

By SpendPreflight · Informational workflow, not legal advice or a compliance certification.

1. Know what an address check can tell you

OFAC publishes some digital-currency addresses associated with blocked persons in its Specially Designated Nationals and Blocked Persons List. OFAC says those identifiers are not exhaustive. A search that finds nothing cannot establish that a wallet, its owner or a transaction is outside sanctions restrictions. OFAC FAQ 562.

Address matching also does not resolve ownership. OFAC’s 50 Percent Rule can apply to entities owned directly or indirectly, in aggregate, 50 percent or more by blocked persons. Our address tool does not investigate that ownership. OFAC FAQ 401.

2. Use OFAC’s free search

  1. Copy the full public address. Keep the identifier exact; avoid names, transaction hashes or shortened explorer labels.
  2. Open OFAC Sanctions List Search.
  3. Use the ID # / Digital Currency Address field and search. OFAC describes address searches in this field as exact matching, with no fuzzy logic. The name-search similarity slider is a different feature. OFAC FAQ 594.
  4. Review any listed record and the source’s current update information. Keep the source, time and scope with your review.

For downloadable data and other list options, use OFAC’s Sanctions List Service. Our free tool below uses SDN address fields only; it does not combine every OFAC list.

3. Run a free check for up to 10 addresses here

Open the free OFAC address check

No wallet connection, account or payment is needed. The tool reads our existing SDN snapshot, shows its build time and refuses to make a determination when that snapshot is missing or older than 26 hours. That is our freshness boundary, not a claim of instantaneous OFAC updates. EVM identifiers compare without letter case; other identifiers compare exactly.

A successful result says whether the exact identifier appears in that snapshot. A match includes the associated SDN record. A non-match stays a non-match, never a “safe” or “compliant” verdict. An error, timeout or stale-data response is no determination.

4. Use the free API

curl -i https://api.spendpreflight.com/v1/ofac-address-check \
  -H 'Content-Type: application/json' \
  -d '{"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}'

This example uses a public Base USDC contract identifier. It demonstrates input syntax, not a recommendation, wallet-owner assessment or pre-recorded outcome. Send one address, or addresses with 1–10 items. A batch returns ordered results; duplicates remain separate rows. Any invalid item rejects the entire request. Extra fields are rejected. Inspect address_match, match, snapshot_built_at, checked_at, source and scope.

HTTP 400 is invalid input; 429 is a temporarily busy free service; 503 means fresh data is unavailable. GET/HEAD do not perform screening. There is no payment header or trial parameter. The shared per-instance abuse counter is best effort. OpenAPI.

5. Choose the next step for your workflow

For bounded batches in an existing automation, use our Sanctions Screener Actor on Apify and check its Store pricing. For a payee name or merchant domain alongside wallet screening, use the Payee Screening API. Name and domain signals still need interpretation; neither product supplies sanctions clearance.

If an exact address match appears, review the official record and follow the process appropriate to your organization. Do not let this tool make a legal determination or automatically move, freeze or reject funds. For broader program design, OFAC publishes sanctions compliance guidance for the virtual-currency industry.

Privacy and evidence

The free form sends the address in a POST body and does not create a public report or put it in a page URL. Our route processes the address and result transiently against existing data, without a chain lookup or a product-specific query/result store. Shared request counters contain no caller identity. Normal infrastructure policies still apply. Product privacy and retention.