Understand the screening response: sanctioned, flagged, and matches

Every /screen/* endpoint returns the same response envelope, regardless of whether you're screening a crypto address, email, website, government ID, or country. Understanding the three key fields — sanctioned, flagged, and matches — is essential for building correct compliance logic.

sanctioned vs. flagged

sanctioned: true means the value matched at least one government sanctions list — for example, the OFAC SDN list, the EU consolidated financial sanctions list, or the UK Sanctions List. This is the field to act on when you need to block or flag an entity for regulatory compliance reasons.

flagged: true means there was any kind of match: a sanctions list hit, a crime-intelligence list hit, or a risk-exposure list hit. Every sanctioned: true response is also flagged: true, but not every flagged: true response is sanctioned: true. When only flagged is true, the match came from a non-government source — for example, the ransomwhe.re ransomware payment dataset (list_type: "crime") or the Tornado Cash depositor/relayer list (list_type: "risk").

The matches array

Each entry in matches names the source list that produced the hit, including:

list — the list slug (e.g. ofac, tornado_cash)
list_name — a human-readable label
list_type — sanctions, crime, or risk
match — exact or partial
source_url — a link to the original published source
metadata — list-specific attributes such as the SDN name, programs, or blockchain details

One request checks every enabled list, and each list that matched gets its own entry in matches. A clean result returns flagged: false, sanctioned: false, and an empty matches array.

The flagged-without-sanctioned case

The Tornado Cash depositor and relayer list is a good example of a risk-list hit. An address that deposited into Tornado Cash returns flagged: true and sanctioned: false, with a matches entry showing list_type: "risk". Tornado Cash was removed from the OFAC SDN list in March 2025, so a match on the tornado_cash list is exposure intelligence — not a government designation. How you respond to a risk-list hit is a business decision; CompliAPI surfaces the signal and leaves the policy to you.

Tips

Build your blocking logic on sanctioned, not flagged, if you only need to enforce sanctions compliance.
Use lists_checked to confirm which lists were searched — this changes if you pass a ?lists= filter to narrow the scope.
Every request, whether it matches or not, is written to your organization's audit trail.