All source lists: what they cover and how often they refresh
Updated
Every screening call checks all enabled source lists at once and tells you which list produced each match. This article describes what each list covers, who publishes it, how often CompliAPI refreshes it, and whether a match sets sanctioned: true or only flagged: true.
A match on a sanctions list (list_type: "sanctions") sets both sanctioned: true and flagged: true — it reflects a government designation. A match on a crime-intelligence list (list_type: "crime") or a risk-exposure list (list_type: "risk") sets only flagged: true — it signals elevated risk, not a legal designation.
Sanctions lists
| Slug | Publisher | What it covers | Refresh |
|---|---|---|---|
ofac | US Treasury OFAC | SDN (Specially Designated Nationals) list | Every 15 minutes |
ofac_consolidated | US Treasury OFAC | Consolidated non-SDN list — SSI, NS-MBS, NS-CMIC, NS-PLC, and other non-SDN programs | Every 15 minutes |
us_fbi_lazarus_crypto | US FBI | Lazarus Group crypto addresses (Stake.com theft) | Static, reconciled daily |
il_mod_crypto | Israel NBCTF | Administrative seizure orders covering crypto wallets | Curated, reconciled daily |
fr_tresor | French Trésor | National asset-freeze register | Daily |
jp_mof_sanctions | Japan Ministry of Finance | Japan sanctions list | Daily |
eu_fsf | European Union | EU consolidated financial sanctions list | Daily |
uk_fcdo_sanctions | UK FCDO | UK Sanctions List — the sole UK designation list since January 2026 | Daily |
The two OFAC lists (ofac and ofac_consolidated) share one publication stream and are both checked at the same 15-minute interval. You can confirm the exact check schedule — including the UTC minutes each hour and the next scheduled check — by calling GET /api/v1/stats.
Crime-intelligence list
| Slug | Publisher | What it covers | Refresh |
|---|---|---|---|
ransomwhere | Ransomwhe.re (Jack Cable) | Ransomware payment addresses | Weekly |
Addresses from Ransomwhere appear in CompliAPI 90 days after submission. A hit sets flagged: true but never sanctioned: true — this is crime intelligence, not a government designation. Data is used under CC BY 4.0.
Risk-exposure lists
| Slug | Publisher | What it covers | Refresh |
|---|---|---|---|
tornado_cash | On-chain crawl (Ethereum mainnet) | Tornado Cash depositors and withdrawal relayers | Daily |
tornado_cash_recipients | On-chain crawl (Ethereum mainnet) | Tornado Cash withdrawal recipients | Daily |
Tornado Cash itself was removed from the OFAC SDN list in March 2025, so neither of these lists represents a sanctions designation. A hit sets only flagged: true. The tornado_cash list covers addresses that actively deposited into or relayed withdrawals from the mixer — a stronger signal of intentional use. The metadata.role field on each match is depositor, relayer, or recipient.
tornado_cash_recipients is disabled by default. Since 2022, dusting attacks have sent small Tornado Cash withdrawals to prominent addresses that never opted in, so receiving a withdrawal is not meaningful evidence of intent. If you enable this list, treat its hits as a very weak signal requiring manual review rather than automatic action. The tornado_cash (depositor/relayer) list is enabled by default and carries a stronger signal, though addresses identified via smart-contract wallets or bundlers identify the contract rather than the person behind it.
Check what's currently enabled
Call GET /api/v1/screen/lists (unauthenticated and free) to see every list's current status, entity count, and last-updated timestamp. The enabled field shows whether a list is active for screening calls. You can also download the full current dataset for any individual list via GET /api/v1/screen/lists/{slug}/entities.