Wallet screening for stablecoin payouts is the check a payments company runs on a blockchain address before it sends funds there and after funds arrive from it. It pairs a sanctions list lookup with blockchain analytics that score its exposure to listed or illicit activity, and it repeats when a list, a score or the customer's data changes.
A wallet address has no bank behind it, so the address is itself a counterparty. The wider program is in the AML guide for stablecoin fintechs, and the data that travels with a transfer is in guidelines for the Travel Rule.
What does wallet screening check?
It checks three layers, and each catches what the others miss.
The three layers of wallet screening and where each one stops.
Layer | Question it answers | What it misses |
List lookup | Is this exact address on a sanctions list? | Addresses published later, and new addresses of a listed party |
Exposure scoring | How close is this address to listed or illicit activity, directly or through intermediate addresses? | A fresh address with no history, and trails split across blockchains |
Holder verification | Who controls the address: the customer or someone else? | A false declaration that nothing else contradicts |
On Lumx, the customer behind a wallet is verified through Sumsub KYC (know your customer, the verification of an individual) or KYB (know your business, the verification of a company and its owners) before the wallet is enabled, and the custodial wallets sit under Chainalysis blockchain transaction monitoring. Chainalysis KYT covers only blockchain activity, across every type of wallet, including funds received from an external address, and Lumx screens every transaction, inbound and outbound, before it executes. Its monitoring rules and thresholds are internal compliance policy and are not published.
Why a list lookup alone falls short
The US Treasury's Office of Foreign Assets Control (OFAC) publishes digital currency addresses on some entries of its Specially Designated Nationals (SDN) list. It first did so on November 28, 2018. Its FAQ 562, released March 19, 2018, says that "OFAC's digital currency address listings are not likely to be exhaustive."
So a list match is the floor. OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021), page 15, says unlisted addresses that share a wallet with a listed address "may pose sanctions risk". It adds that a company may consider a historic lookback after OFAC lists an address.
Page 6 of the same guidance says OFAC may impose civil penalties generally on a strict liability standard, so a team unaware of a link can still have processed a prohibited payment.
That gap is what exposure scoring covers. An analytics tool clusters the addresses it believes one entity controls and traces where an address received from and sent to. Direct exposure, a transfer with a risky address, is the strong signal. Indirect exposure, where funds passed through one or more intermediate addresses, weakens with each hop. The hop limit and the score threshold are policy choices, because no rule read for this post fixes either. Too wide and every address that touched an exchange looks risky. Too narrow and layering passes unseen.
On Lumx, Chainalysis provides continuous blockchain monitoring, and a transaction flagged by Lumx's transaction monitoring is held pending compliance review. Entities on OFAC, EU, UN and UK sanctions lists are prohibited customers, per the prohibited activities page.
When to screen: before a payout, on a deposit, on a saved address
Screen wherever an address enters your flow. You choose where a payout goes, so you can stop it. You do not choose who sends to your deposit address, so that decision comes after the funds land.
Where screening sits in a payout flow, and what a hit means at each point.
Moment | Do you control it? | What you screen | What a hit means |
Registering a payout address | Yes | The address, its holder and their link to your customer | Do not save the address |
Sending a payout | Yes | The saved address again, plus the holder | Stop before the transfer is broadcast |
Receiving a deposit | No, anyone can send to a public address | The sending address, once funds arrive | Do not credit the funds until someone decides |
Paying a bank account | Yes | The holder's name and country, since there is no address | Hold the payout |
In our view the deposit row is the one a policy most often skips. A small transfer from a listed address can land in a clean customer's wallet without their involvement, so the policy must say in advance what that triggers. OFAC's guidance, page 16, lists screening transactions "to identify addresses, including physical, digital wallet, and IP addresses" among its best practices.
On Lumx, each off-ramp pays a destination registered under the customer with a holder relationship (SELF or a third-party type), and the payout debits the customer's own wallet. A Lumx wallet address is a real blockchain address that anyone can send supported stablecoins to, so the deposit case applies. A named virtual account (a local account number issued in the customer's own name) ties fiat deposits to an onboarded customer, per the named virtual accounts page. Destination wallet addresses are due to become destinations in the API, like fiat destination accounts, with no date yet.
How often should you rescreen?
Rescreen when something changes, instead of on a calendar. OFAC's guidance, page 16, lists "ongoing sanctions screening and risk-based re-screening" to account for updated customer information, updates to OFAC sanctions lists, or changes in regulatory requirements. It sets no interval, so a daily, weekly or monthly batch is a house choice that leaves a window for a newly listed party.
We think events are the defensible default because of strict liability: a list change on Tuesday makes Wednesday's payment the exposure.
Events that should trigger a rescreen, what to rescreen and where the trigger comes from.
Event | What to rescreen | Where the trigger comes from |
A payout address is added | The address and its holder | Our view. OFAC guidance, page 16, lists screening addresses as a practice but names no such trigger |
Before each outbound payout | The saved address and the holder | A saved address can be listed after it was registered |
OFAC lists a new digital currency address | Every stored address, plus a lookback on past transfers | OFAC guidance, page 15: historic lookback |
A sanctions list changes (OFAC, UN, EU, UK) | Customers, owners and payout holders, by name | OFAC guidance, page 16: re-screening for list updates |
A customer's ownership, address or country changes | The customer and the new parties | OFAC guidance, page 16: updated customer information |
A deposit lands | The sending address | A blockchain transfer cannot be refused, so the screen follows it |
An issuer blocks an address | Counterparties that transacted with it | Issuer terms, covered below |
OFAC is the only authority in the table whose rescreening language was read for this post. Since January 28, 2026, the UK Sanctions List is the single source for UK designations, and the page read sets no rescreening interval. The EU sanctions overview sets none either.
On Lumx, Chainalysis provides continuous transaction monitoring, and the country tiers are reassessed as the sanctions lists and FATF guidance change. The tiers are on the supported countries page.
How do you choose a hop limit and an alert threshold?
Start narrow, review after 30 days and widen one setting at a time. No rule read for this post sets either number, so this is our recommendation.
Setting | Starting point | What to watch |
Hop limit | Direct exposure only, one hop | Whether cleared alerts cluster at a second hop |
Score threshold | High enough that only strong signals alert | Alerts cleared as false against alerts escalated, reviewed 30 days after launch |
Measure false positives by that ratio, from the log of decisions kept below.
On Lumx, what reaches the platform is the outcome of monitoring: a transaction held pending compliance review, and an RFI (request for information, a compliance hold that asks for a document or an explanation) when compliance needs more.
Beyond the wallet, screen every party whose money or interest is in the payment, because a wallet screen sees one identifier. A business customer's beneficial owners are verified like individuals, which KYB verification covers, and each belongs in the rescreen above. A destination held by someone else needs the holder's identity too.
On Lumx, a business customer's representative, beneficial owners and shareholders above 25 percent submit an identity document, proof of address and source of funds. Customers in a high-risk tier get Enhanced Due Diligence with ongoing monitoring, and the nested payments rule ties every transaction to an onboarded customer acting on their own behalf.
What to do when an address is flagged
Stop the money first and decide second, for a list match or a high exposure score alike.
Hold the payout before broadcast, or leave inbound funds uncredited.
Confirm the match: for a list hit, compare the exact address and network to the SDN entry, and for a score, read the trace and amounts.
Check the customer side: verified, and a payment that fits its business.
Ask when the exposure is indirect.
Decide, and record who decided and on what evidence.
Block and report a confirmed match. Per OFAC FAQ 646, a US person holding virtual currency that must be blocked has to deny all parties access to it, is not required to convert it to fiat, and must report it to OFAC within 10 business days and annually afterward while it stays blocked.
I recommend that a platform write its inbound rule before the first payout, with one named owner and one deputy beside it. The rule needs three lines: what happens to funds from a listed address, from a high-score address and from an indirect exposure. I would rescreen stored payout addresses on every list update and before every payout, and keep the exposure threshold high enough that an address which once touched an exchange does not look risky, because a team buried in alerts starts clearing them unread.
On Lumx, on-ramps and off-ramps flagged by transaction monitoring are held pending review. Compliance reviews the flag manually and, if it is a real concern, reaches out on your usual channel (email or Slack) with an RFI. It usually asks about the relationship between sender and receiver, the purpose and the expected outcome. If you do not respond within 24 hours, the transaction may be refunded to the sender.
Stablecoin issuers can freeze addresses too
An issuer's block is separate from your screening and can reach you when your checks were clean. Circle's USDC terms reserve the right to block certain USDC addresses and, for addresses Circle custodies, to freeze the USDC in them. A user who sends USDC to or receives it from a blocked address may have it frozen and the account terminated. Tether's terms of service say Tether may freeze the Tether tokens a user holds, as the law requires or where it decides in its sole discretion that doing so is prudent.
What happens to a transfer sent to a blocked address depends on the token and the issuer, and the terms above promise neither outcome, so a payout can fail or leave funds stuck. An address you control can be blocked, with the balance stuck until the issuer lifts it.
On Lumx, wallets are custodied by BitGo, which carries insurance, and are fully segregated per customer with no omnibus account. The customer never manages keys. A flagged inbound or outbound transaction is held for compliance review, and compliance may send an RFI. The custodial wallets page and the custodial wallet explainer cover the model.
When wallet screening is the wrong tool
Wallet screening is the wrong control when the payout goes to a bank account, because there is no address to screen and the holder's name and country carry the check. It is also the wrong control for an unverified customer, since a clean score says nothing about who is behind an address. A virtual asset service provider carries duties of its own, and the operator map shows who operates in Latin America.
What this looks like on Lumx
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, Bre-B, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
For a platform running payouts, the wallet is enabled only once the customer reaches APPROVED.
A flag surfaces as a held transaction and an RFI on the compliance channel, which the platform answers inside the 24 hours. A customer RFI is different: it moves the customer to RFI, fires a customer.rfi webhook and names the documents at issue. What a named virtual account is explains the account that ties fiat deposits to one customer.
Methodology and sources
Read on November 1, 2026:
OFAC FAQ 562, FAQ 646, the recent action of November 28, 2018 and the Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021). Page numbers are the printed ones.
Circle USDC terms and Tether terms of service.
Lumx docs: request for information, nested payments, supported countries, destinations, transactions, wallets and identity verification.
The UK Sanctions List and the EU sanctions overview were read on the same date for list sources only.
Verified on November 1, 2026. Operational context, not legal, tax, or investment advice.
Cover photo: Gerrit Vermeulen on Unsplash.
What is wallet screening for stablecoin payouts?
Wallet screening checks a blockchain address against sanctions lists and blockchain analytics before a payout and after a deposit. On Lumx, the customer behind a wallet is verified through Sumsub before the wallet is enabled, and Chainalysis provides the blockchain transaction monitoring behind the custodial wallets.
How often should wallet addresses and customers be rescreened?
Rescreen on events: a new address, each payout, a list update, a change in customer data and a deposit. OFAC's October 2021 guidance asks for ongoing, risk-based re-screening and sets no fixed interval. On Lumx, monitoring through Chainalysis is continuous, and the country tiers are reassessed as the sanctions lists and FATF guidance change.
Is an OFAC address list enough to screen a wallet?
No. OFAC says its digital currency address listings are not likely to be exhaustive, and its guidance points to unlisted addresses that share a wallet with a listed one. On Lumx, Chainalysis provides continuous blockchain monitoring, a flagged transaction is held pending compliance review, and entities on OFAC, EU, UN and UK lists are prohibited customers.
What happens when a stablecoin payout address is flagged?
The payout is held before it is sent, and a person confirms the match and decides. A confirmed match on property a US person holds is blocked and reported to OFAC within 10 business days. On Lumx, a flagged on-ramp or off-ramp is held for compliance review, and compliance contacts the customer by email or Slack, with 24 hours to respond before the transaction may be refunded to the sender.
Can a stablecoin issuer freeze a wallet used for payouts?
Yes. Circle's USDC terms reserve the right to block addresses and freeze USDC it custodies, and Tether's terms reserve the right to freeze a user's tokens. On Lumx, wallets are custodial and segregated per customer, and the customer never manages keys.
