How screening works
The lists
Several, and providers screen against all that apply to them.
The best known is the SDN list maintained by the US Office of Foreign Assets Control. Since 2018 it has included specific crypto wallet addresses alongside names, which was a significant development: the prohibition became machine-checkable.
The European Union, the United Kingdom and the United Nations maintain their own lists, and national regimes add further ones. A provider serving several markets screens against each, and the strictest requirement usually sets the practice everywhere.
How it differs from risk scoring
The distinction matters and gets blurred.
KYT produces a risk score: a graduated assessment of where funds have been, which a provider weighs alongside other factors before deciding what to do. A high score prompts review.
Sanctions screening produces a match or no match. A match is not a risk factor to be weighed. It is a legal prohibition, and the provider must freeze the funds and report, regardless of context, amount or how plausible the explanation sounds.
That is why screening runs on every transaction rather than on flagged ones. There is no threshold below which it can be skipped.
What a hit means
What happens on a hit
Three things, in order.
The transaction stops. Funds are frozen rather than returned, because returning them would itself be a prohibited transfer.
A report goes to the relevant authority within the required timeframe.
And the account relationship usually ends. Providers do not have discretion to continue serving a sanctioned party, and in practice they do not continue serving accounts that produced a confirmed hit.
There is no appeal to the provider, because the provider is not the decision maker. Delisting is a matter for the sanctioning authority.
Clusters and indirect exposure
Screening covers more than exact address matches.
Analytics firms group addresses into clusters belonging to the same operator, so a new address controlled by a sanctioned entity is identifiable before anyone lists it explicitly. Exposure through intermediaries is also assessed: funds that reached you two transfers after leaving a sanctioned address carry that history, which the entry on tracing explains.
The Tornado Cash designation in 2022 made this concrete by sanctioning a smart contract rather than a person, and it remains the clearest illustration of how far the concept reaches.
What a merchant needs to know
Screening is your gateway’s obligation and happens invisibly.
Every incoming payment passes through it, adding about a second to the process, and a clean payment is credited normally. A merchant accepting payment for goods is not the screening party, in the same way that AML programme obligations do not transfer to it.
Where it becomes visible is a held payment. If a gateway freezes an incoming transfer, the answer is not a support escalation but an understanding that the provider had no choice. The payment gateway carries the legal exposure here, and that is the arrangement you want.