File format guide

sdn_advanced.xml: OFAC's advanced SDN list file, explained

sdn_advanced.xml is the richest machine-readable form of the US Treasury's SDN list: every designation published as normalized XML, including the digital-currency addresses, identity documents and party relationships the simpler formats flatten or drop. This page covers where to download it, how the schema is organized, and how to parse it — verified against the live file in August 2026.

What is sdn_advanced.xml?

Where to download sdn_advanced.xml

Advanced vs basic SDN formats

Every format carries the same designations; they differ in how much structure survives. Pick by what you need to extract:

The Non-SDN consolidated files document OFAC's separate Consolidated Sanctions List, and the EU publishes its own XML with a different schema entirely — see the EU consolidated sanctions list page for that format.

The OFAC advanced SDN schema

The root element is <Sanctions> in the …/exports/ADVANCED_XML namespace. Six top-level sections do the work — here is the path to a designated party's crypto address, abridged from the real record for the Lazarus Group (FixedRef 27307):

<Sanctions xmlns="https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/ADVANCED_XML"
           Version="3">
  <DateOfIssue CalendarTypeID="1">…</DateOfIssue>

  <ReferenceValueSets>   <!-- lookup tables; everything below points here by ID -->
    <FeatureTypeValues>
      <FeatureType ID="344" FeatureTypeGroupID="1">Digital Currency Address - XBT</FeatureType>
      <FeatureType ID="345" FeatureTypeGroupID="1">Digital Currency Address - ETH</FeatureType>
      …
    </FeatureTypeValues>
  </ReferenceValueSets>

  <DistinctParties>      <!-- one DistinctParty per designated party -->
    <DistinctParty FixedRef="27307">
      <Profile ID="27307" PartySubTypeID="3">
        <Identity …>     <!-- names, as Alias → DocumentedName → NamePartValue -->

        <Feature ID="50215" FeatureTypeID="345">   <!-- 345 → Digital Currency Address - ETH -->
          <FeatureVersion ID="47914" ReliabilityID="1560">
            <VersionDetail DetailTypeID="1432">0x098B716B8Aaf21512996dC57EB0615e2383E2f96</VersionDetail>
          </FeatureVersion>
          <IdentityReference IdentityID="19011" IdentityFeatureLinkTypeID="1" />
        </Feature>
      </Profile>
    </DistinctParty>
  </DistinctParties>

  <ProfileRelationships>…</ProfileRelationships>  <!-- who owns / acts for whom -->
  <SanctionsEntries>…</SanctionsEntries>          <!-- program and legal basis per party -->
</Sanctions>

The practical consequence of the ID-reference design: you cannot read a party record in isolation. To know that FeatureTypeID 345 means an Ethereum address, you first index ReferenceValueSets — which is exactly how the parsing example below works.

Parsing sdn_advanced.xml in Python

import xml.etree.ElementTree as ET

NS = "{https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/ADVANCED_XML}"

crypto_types = {}  # FeatureTypeID -> "Digital Currency Address - ETH", ...
addresses = []

for _, elem in ET.iterparse("sdn_advanced.xml", events=("end",)):
    tag = elem.tag.removeprefix(NS)
    if tag == "FeatureType" and (elem.text or "").startswith("Digital Currency Address"):
        crypto_types[elem.get("ID")] = elem.text
    elif tag == "DistinctParty":
        name = next(
            (
                " ".join(v.text or "" for v in alias.iter(f"{NS}NamePartValue"))
                for alias in elem.iter(f"{NS}Alias")
                if alias.get("Primary") == "true"
            ),
            "",
        )
        for feature in elem.iter(f"{NS}Feature"):
            feature_type = crypto_types.get(feature.get("FeatureTypeID"))
            if feature_type is None:
                continue
            detail = feature.find(f"{NS}FeatureVersion/{NS}VersionDetail")
            if detail is not None and detail.text:
                addresses.append((feature_type, detail.text, name))
        elem.clear()  # keep memory flat: the file is ~120 MB

print(f"{len(addresses)} digital-currency addresses")
for feature_type, address, name in addresses[:3]:
    print(f"{feature_type}: {address}  ({name})")

977 digital-currency addresses
Digital Currency Address - TRX: TNiq9AXBp9EjUqhDhrwrfvAA8U3GUQZH81  (BANK MARKAZI JOMHOURI ISLAMI IRAN)
Digital Currency Address - TRX: TTiDLWE6fZK8okMJv6ijg42yrH6W2pjSr9  (BANK MARKAZI JOMHOURI ISLAMI IRAN)
Digital Currency Address - TRX: TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp  (BANK MARKAZI JOMHOURI ISLAMI IRAN)

Update cadence: the part that hurts