Sanctions screening
Sanctions screening API — every list, one GET request
A sanctions screening API is an HTTP endpoint that checks an identifier against current sanctions lists and returns whether it is listed, on which list, and the official record behind the match. CompliAPI's is one authenticated GET per crypto address, email, website, government ID or country across the US OFAC SDN and Consolidated (non-SDN) lists, the EU consolidated financial sanctions list, the UK Sanctions List (FCDO), the French Trésor asset-freeze register, the Japan MOF list, Israel NBCTF seizure orders and FBI-published Lazarus Group addresses — with sanctioned set only by a sanctions-list hit and flagged covering the crime and risk lists too.
GET /api/v1/screen/crypto/{address}
curl https://api.compliapi.com/api/v1/screen/crypto/0x94f1b9b64e2932f6a2db338f616844400cd58e8a \
-H "Authorization: Bearer $COMPLIAPI_TOKEN"import requests
resp = requests.get(
"https://api.compliapi.com/api/v1/screen/crypto/0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
headers={"Authorization": f"Bearer {COMPLIAPI_TOKEN}"},
)
print(resp.json())const resp = await fetch(
"https://api.compliapi.com/api/v1/screen/crypto/0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
{ headers: { Authorization: `Bearer ${process.env.COMPLIAPI_TOKEN}` } },
);
console.log(await resp.json());Response
{
"value": "0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
"flagged": true,
"sanctioned": true,
"lists_checked": ["ofac", "ofac_consolidated", "us_fbi_lazarus_crypto", "fr_tresor", "jp_mof_sanctions", "uk_fcdo_sanctions"],
"matches": [
{
"list": "us_fbi_lazarus_crypto",
"list_name": "FBI Lazarus Group crypto addresses",
"list_type": "sanctions",
"match": "exact",
"value": "0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
"source_url": "https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom",
"metadata": { "symbol": "ETH", "network": "Ethereum", "name": "Lazarus Group (APT38)" }
},
{
"list": "tornado_cash",
"list_name": "Tornado Cash depositors & relayers",
"list_type": "risk",
"match": "exact",
"value": "0x94F1b9B64E2932F6A2Db338F616844400cd58e8a",
"source_url": "https://etherscan.io/tx/0x5c8b...",
"metadata": { "name": "Tornado Cash", "role": "depositor", "network": "ethereum", "symbol": "ETH" }
}
]
}Every enabled list in one call
A single request checks every list CompliAPI ingests; lists_checked in the response names each one, and ?lists= narrows the scope when your policy needs it.
Every match names its list
Each match carries the list slug, its display name and its list type — sanctions, crime or risk — so your code can tell a legal obligation from a risk signal.
Official source record on every match
source_url points at the publisher's own record — OFAC's Sanctions List Search entry, the FBI press release, the FCDO or EU listing — for review.
Refreshed on a published schedule
OFAC's publication stream is checked every 15 minutes; the other lists re-ingest daily or weekly as stated on each data-source page, with delistings tracked.
One engine, three surfaces
The same screening code answers the REST API, the MCP server's tools and the free browser search; every metered call lands in your organization's audit trail.
What is a sanctions screening API?
A sanctions screening API answers one question per request: is this identifier on a sanctions list right now? It takes a crypto address, an email, a website, a government ID or a country, checks it against the current data from each list it covers, and returns a verdict with the list that produced any match and a link to the official record. The screening is exact-match on normalized identifiers — a lower-cased address, a resolved ENS name — which is what makes the answer defensible: a hit means the identifier appears in a published designation, not that a name resembles one.
It is not a search box (the free search endpoint ranks candidates by similarity and renders no verdict), not identity verification, and not a transaction monitor. The table below is every list CompliAPI screens, with its publisher and refresh cadence; the public data-sources pages carry the live entity counts and downloads for each.
| List | Publisher | List type | Refresh |
|---|---|---|---|
| US OFAC SDN | US Department of the Treasury, Office of Foreign Assets Control | sanctions | every 15 minutes |
| US OFAC Consolidated (non-SDN) | US Department of the Treasury, Office of Foreign Assets Control | sanctions | every 15 minutes |
| EU consolidated financial sanctions | European Commission (DG FISMA) | sanctions | daily |
| UK Sanctions List (FCDO) | UK Foreign, Commonwealth & Development Office | sanctions | daily |
| French Trésor asset-freeze register | Direction générale du Trésor | sanctions | daily |
| Japan MOF sanctions list | Japan Ministry of Finance | sanctions | daily |
| Israel NBCTF seized crypto wallets | Israel National Bureau for Counter Terror Financing | sanctions | weekly crawl, daily reconcile |
| FBI Lazarus Group crypto addresses | US Federal Bureau of Investigation | sanctions | daily reconcile |
| Ransomwhere ransomware payment addresses | Ransomwhere (Jack Cable) | crime | weekly |
| Tornado Cash depositors & relayers | CompliAPI on-chain crawl | risk | daily on-chain crawl |
Sanctions API: the request and the response
Five endpoints, one envelope. GET /api/v1/screen/crypto/{address} screens a crypto address on any chain, or an ENS name; /screen/email/{email} an email address; /screen/website?address= a website or domain; /screen/id/{government_id} a government-issued ID; /screen/country/{country} a country or region's sanctions designations. Each is one authenticated GET with a bearer token, and each accepts an optional ?lists= filter — a comma-separated set of list slugs — when your policy wants OFAC alone, or the EU and UK lists only.
This is an API for sanctions screening in the narrow sense: it returns facts about current list data, in the fields below, and leaves the decision to your code. One request costs one credit however many lists match, and every match is written to your audit trail attributed to its list.
| Field | Meaning |
|---|---|
| value | The identifier as screened, normalized — lower-cased addresses, resolved ENS names. |
| sanctioned | true only when a government sanctions list matched: OFAC SDN, OFAC Consolidated, EU, UK, France, Japan, Israel NBCTF or FBI Lazarus. |
| flagged | true for any match on any enabled list, including the crime-intelligence (Ransomwhere) and risk-exposure (Tornado Cash) lists. |
| lists_checked | The list slugs the request covered — every enabled list by default, or the set named in ?lists=. |
| matches[].list / list_name / list_type | Which list produced the match, its display name, and its type: sanctions, crime or risk. |
| matches[].match | exact for addresses, emails, websites and countries; exact or partial for government IDs, where partial values surface candidates ranked by similarity. |
| matches[].source_url | The publisher's record behind the match — OFAC's Sanctions List Search entry for OFAC hits, the listing page or press release for the other lists. |
| matches[].metadata | The list entry's published attributes: the listed name and programs for OFAC, symbol and network for crypto addresses, the regime for UK entries. |
Free sanctions screening API: what the free tier includes
Every account starts on the free tier: an API key with 10,000 screening requests a month and no credit card, against the same lists and endpoints as every paid plan — paying raises the quota, not the feature set. As of October 2026 the Developer plan is $199 a month ($149 a month billed annually) for one seat, and the Team plan $249 per seat a month ($199 billed annually) with a three-seat minimum and the quota pooled at 10,000 requests per seat.
Two more ways in cost nothing to start. For a one-off lookup there is a free, unauthenticated search endpoint and a browser tool built on it — a sanctions check by name, address or identifier that ranks candidates by similarity but renders no verdict and keeps no audit trail, which is why it is a lookup, not screening. And an agent or script with no account can pay per request with x402 USDC micropayments on Base — $0.01 per screening call and $0.05 for a PEP check, settled before the response is returned.
Sanctions screening API vs AML screening API
An AML screening API usually bundles several checks: sanctions lists, politically exposed persons, adverse media, internal watchlists, sometimes identity verification. CompliAPI is the sanctions-screening component of that stack, scoped on purpose. It screens the sanctions, crime and risk lists in the table above with the official record on every match, and it offers PEP status through a separate endpoint, GET /screen/pep, powered by the OpenSanctions matching API over their PEP dataset — a due-diligence signal, not a sanctions designation, and not a PEP list of CompliAPI's own.
What it does not do: adverse-media screening, identity verification, transaction monitoring, or blockchain analytics and fund-flow tracing. Teams that need those pair CompliAPI with the tooling built for them and keep this API as the fast, source-transparent answer to the one question it is built for.
Sanctions screening requirements: when to screen and what to keep
Screen at the decision point: when an account is opened, before a payout or withdrawal is released, when a wallet connects to your front end, before a listing or a counterparty goes live. A screening call is a point-in-time fact, so re-screen when the lists change — either on the schedule your policy sets, or by registering stored identifiers as monitored entities so a signed webhook fires on a new listing, delisting or relisting.
Keep the evidence. Every metered request is recorded in your organization's audit trail with its result, and every match carries the source_url of the official record, so what was screened, when, and against which list is answerable later. Which rules bind your business, and what a match obliges you to do, are questions for your compliance team and counsel — the API supplies the data, not the policy.
One call instead of one feed per publisher
Screening against several sanctions lists in-house means one pipeline per publisher — OFAC's XML and CSV files, the EU's consolidated feed, the FCDO's UK list, the French and Japanese registers — each in its own format on its own schedule, plus normalization, matching, delisting tracking and an audit log, all of which drift the moment nobody is watching.
CompliAPI ingests each list from its publisher on a published cadence, normalizes the identifiers, and answers one authenticated GET per check with a sanctioned and a flagged verdict, the list behind every match and the official record — at onboarding, before a payment, or wherever a screening decision belongs in your workflow.
CompliAPI is a screening data layer, not a compliance program. It does not verify identity, screen adverse media, monitor transactions or decide your policy — your team defines what happens when a check returns a match.
How it works
Send an identifier
Pass a crypto address or ENS name, an email, a website, a government ID or a country to the matching /screen endpoint with your bearer token.
CompliAPI checks every enabled list
Exact lookups on the normalized identifier across every list — or the subset named in ?lists= — with partial government IDs returning candidates ranked by similarity.
Act on a structured result
JSON with sanctioned and flagged verdicts, the list, list type and match type for each hit, and the official source record — ready for your application logic.
What you can screen
- Crypto addresses on any chain the lists carry (including ENS names)
- Email addresses
- Websites and domains
- Government-issued IDs — passports, tax IDs, registration numbers (exact or partial, ranked by similarity)
- Countries and regions under OFAC sanctions programs
- IP geolocation and VPN detection via companion endpoints
Where teams use it
Account onboarding
Screen the email and government ID a new user submits before activating the account, across every list in one call.
Payouts and withdrawals
Check the destination wallet or the counterparty's email and website before releasing funds, and hold matches for review with the source record attached.
Marketplace listings and partners
Screen the websites, emails and IDs submitted by sellers, merchants and partners before they go live.
Jurisdiction and session policy
Pair the country endpoint with IP geolocation and the VPN signal to apply sanctioned-country rules to sessions and signups.
Agent-driven checks
Let an AI agent run the same screening through the MCP server tools, with the same token, quota and audit trail as your platform code.
Scope and limitations
CompliAPI screens identifiers for direct appearance in the lists it ingests. Knowing what it does not do is as important as what it does:
Exact match on identifiers
Addresses, emails, websites and countries match exactly on their normalized form; government IDs match exactly or on a substring, ranked by similarity. Names are not screened by this API — the free search endpoint is the lookup for names, and it renders no verdict.
The lists above, and no UN list directly
Coverage is the registry on this page. United Nations regimes are not ingested as a list of their own, though UN-derived designations appear through the national lists that implement them.
PEP via OpenSanctions only
PEP status comes from the OpenSanctions matching API through /screen/pep as a due-diligence signal; CompliAPI maintains no PEP list and does no adverse-media screening.
Data, not policy
A match is input to your compliance process. Thresholds, escalation and blocking behaviour are your organization's decisions, ideally with qualified counsel.
Frequently asked questions
How does a sanctions screening API work?
You send one identifier per request — a crypto address, email, website, government ID or country — with an API token. The API normalizes it, looks it up across every enabled sanctions, crime and risk list, and returns JSON with two verdicts: sanctioned, true only for a government sanctions-list hit, and flagged, true for any match. Each match names its list, its list type, the match type and the official source record, and the request is written to your organization's audit trail.
Which sanctions lists does the API screen?
The US OFAC SDN list and OFAC's Consolidated (non-SDN) list, the EU consolidated financial sanctions list, the UK Sanctions List published by the FCDO, the French Trésor asset-freeze register, the Japan MOF sanctions list, Israel NBCTF seizure orders and FBI-published Lazarus Group addresses, plus two non-sanctions lists — Ransomwhere ransomware payment addresses (crime) and Tornado Cash depositors and relayers (risk). The public data-sources pages carry each list's live entity count, refresh cadence and downloads, and GET /api/v1/screen/lists returns the same registry.
Is there a free sanctions screening API?
Yes. Every CompliAPI account includes a free API key with 10,000 screening requests a month and no credit card, against the same lists and endpoints as the paid plans. For one-off lookups the search endpoint and the browser-based SDN search tool are free with no account at all, and agents without an account can pay $0.01 per screening call with x402 micropayments.
Does the API screen names against sanctions lists?
Not as a screening endpoint. The /screen endpoints take identifiers — addresses, emails, websites, government IDs and countries — and match them exactly, which is what makes a hit defensible. Names are served by the free search endpoint, which matches listed names and aliases by similarity and returns ranked candidates with no verdict and no audit trail: a lookup aid for an analyst, not a compliance check.
What is the difference between a sanctions API and an AML screening API?
An AML screening API bundles several controls — sanctions, PEP, adverse media, watchlists and often identity verification. A sanctions API does the sanctions-list check alone, in depth: list coverage you can audit, the official record on every match, and a published refresh schedule. CompliAPI is the latter, with PEP status available separately through the OpenSanctions-powered /screen/pep endpoint and no adverse-media, KYC or transaction-monitoring features.
Can AI agents call the sanctions screening API?
Yes. The MCP server exposes the same screening as tools — screen_crypto_address, screen_email, screen_website, screen_government_id, screen_country, screen_pep, plus detect_vpn and geolocate_ip — over streamable HTTP with the same API token, quota and audit trail. Agents with no account can pay per request with x402 instead of a token.
Related
Sanctions screening
OFAC API — screen against the official SDN list
Screen crypto wallets, emails, IDs and countries against the official US Treasury OFAC SDN list, refreshed every 15 minutes.
Sanctions screening
Wallet screening API for crypto compliance
Automated crypto wallet and address screening against OFAC and global sanctions lists — REST, MCP or webhooks.
AI infrastructure
OFAC MCP server for AI agents
Give AI agents sanctions screening tools over the Model Context Protocol.
Use case
Crypto sanctions screening for exchanges
Crypto sanctions screening for exchanges: screen deposit and withdrawal addresses, emails and IDs against the OFAC SDN list in one GET request.
Use case
Sanctions screening for stablecoin payments
OFAC screening for stablecoin payment flows: check sender and recipient wallets against the SDN list and screen counterparty details before funds move.
Add sanctions screening to your application
Get a free API key and make your first screening request in minutes.
14-day free trial. No credit card required.
CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.