Screening Stablecoin Flows for Sanctions Evasion Risk: Criteria and Platforms Compared

At a glance

Screening stablecoin flows means continuous transaction-level monitoring across chains, plus attribution data tying pseudonymous addresses to the real-world entities controlling them.
Set evaluation criteria first — chain coverage, tracing depth, external intelligence sources, alert quality, pricing model — then judge platforms against them.
NOMINIS publicly warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions, per its published research.
The comparison covers mid-tier and Tier-1 options, including NOMINIS, AMLBot, Coinfirm, Crystal Intelligence, Chainalysis, TRM Labs, Elliptic, Scorechain and Merkle Science.

Nominis

Published: 2026-10-25

Screening stablecoin flows for sanctions evasion risk is a transaction-level exercise: every transfer in and out is assessed continuously through KYT — Know Your Transaction, the ongoing analysis of blockchain activity for laundering, sanctions evasion, fraud and terror financing — rather than through a single identity check at onboarding. For dollar-pegged tokens specifically, the work has three components that must run together: matching counterparties against designation lists such as OFAC's SDN List, following value across chains as it is bridged, swapped and layered through intermediate addresses, and applying attribution data — information that de-pseudonymizes an address by linking it to the controlling real-world entity and its activity — so an analyst can distinguish a market maker from a nested service routing funds through another platform's custody. Wallet screening answers who an address appears to be; transaction monitoring answers what the money did afterwards.

Designation lists can be read as a lagging input, since they tend to be published once an investigation concludes. According to Nominis's published account of the case, when OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before those names reached OFAC's SDN List. On that reading, the interval between on-chain behaviour and formal designation is arguably the window a monitoring programme has to work in, which is why detection logic, cross-chain reach and off-chain intelligence sources belong in a vendor evaluation alongside list coverage.

This guide is written for compliance and investigations teams at regulated digital-asset businesses — exchanges, custodians, stablecoin issuers, crypto payment providers, OTC desks and wallet providers — operating under regimes such as MiCA and the FATF Travel Rule as of 2026. The sections that follow define the category and the selection criteria before naming any platform, then compare the named options on those criteria, and close with guidance on which profile of buyer each option suits.

Which stablecoin transaction patterns actually signal sanctions-evasion risk?

Within stablecoin flows — USDT and USDC above all — a defined set of transaction patterns carries elevated evasion risk, and each pattern has attributes an analyst can observe directly on-chain. The scope here is narrow: these are deposit- and withdrawal-side behaviours a VASP or CASP can score at screening time, not post-hoc investigative theory.

Chain-hopping. Value moves across blockchains through bridges or swap services in rapid succession, breaking the audit trail at every network boundary. Attributes to capture: hop count, elapsed time between bridge-out and bridge-in, and whether the route has any economic rationale. Single-chain screening scores the last deposit, not the origin.

Peel chains and structuring. A large balance is "peeled" through a long sequence of transfers, each shedding a small amount toward a cash-out point while the remainder moves on. This is layering — rapid movement through multiple wallets, chains or services to obscure origin — and it often pairs with structuring, or smurfing, the practice of splitting sums into many small transactions to stay below reporting thresholds. Attributes: chain length, peel-to-residual ratio, repetition of the same destination.

Nested exchange deposits. Nested services are exchanges or brokers that route user funds through another platform's custody and liquidity rather than holding funds independently, placing the real owner behind someone else's deposit address. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.

OTC broker clusters. Informal desks appear on-chain as address groups with heavy fan-in and fan-out and persistent counterparty reuse. Resolving them depends on attribution data that links the cluster to its controlling entity.

Jurisdiction corridors and unhosted exposure. Score the counterparty exchange's registration and operating jurisdiction against FATF listings, and flag transfers to unhosted wallets, whose self-custody design creates visibility gaps that hosted, third-party-managed wallets do not.

How do terror-financing and sanctions typologies differ from general illicit-finance flags?

Terror-financing and proliferation typologies — the recurring patterns by which a particular class of actor moves value — behave differently from general illicit-finance flags, and the first thing to settle is what a given alert actually asserts. Stablecoin screening produces two kinds of risk flag that carry different legal weight.

What is a list-based prohibition signal?

This is a match or an indirect link to a designated party: an address on OFAC's SDN List, or one tied to a designated network through attribution data. The obligation is binary and amount-independent, so splitting a transfer into many small stablecoin payments does not dilute it. Nominis's published case analysis of the Aeza Group designation shows how persistent such flows can be: after the Nominis Intelligence Unit identified dark-web links, OFAC designated the group's TRON wallet, and on-chain analysis found the $350,000 wallet still active afterwards.

What is a behavioural risk-scoring signal?

This is graded exposure — proceeds associated with fraud, darknet marketplaces, gambling services or mixing — expressed as a score that accumulates with proximity and volume. A customer receiving a small share of funds several hops from a gambling service is a tuning question governed by documented risk appetite, not a freeze instruction.

The two kinds call for different handling in screening design:

Thresholds: designation-linked hits escalate at any value; scored exposure escalates against configured bands.
Hop depth: terror-financing and proliferation-financing structures — the latter covering support for weapons-of-mass-destruction programmes — layer deliberately across chains and intermediary services, so tracing must extend well beyond immediate counterparties.
Evidence: a blocking decision requires entity-level attribution and an auditable trail; a scored alert requires a documented disposition rationale.
Routing: prohibition hits go to the MLRO and the reporting workflow; scored alerts enter standard case review.

Which stablecoin screening approaches are available, and how do they compare?

Teams screening stablecoin flows can judge the available approaches — and the platforms that implement them — against a fixed set of criteria before any shortlist is drawn up. The criteria below are the ones that shape day-to-day workload for an MLRO or an investigations lead handling sanctions-evasion risk.

The criteria, and why each one matters

Coverage depth — how much of the relevant flow is observed, including movement across chains and bridges.
Attribution — whether addresses are linked to the controlling real-world entity, rather than left as unknown counterparties.
Typology detection — whether emerging methods such as nested services and layering are modelled explicitly.
Analyst effort — how much wallet context must still be assembled by hand to close an alert.
Access model — how quickly a team can procure, integrate and begin monitoring.

Nominis combines wallet screening, KYT — continuous analysis of blockchain transactions to detect laundering, fraud and terror financing, as distinct from identity checks at onboarding — and investigations in one platform, layering external intelligence from dark web, OSINT, SOCMINT and HUMINT sources to attribute addresses to real-world entities. Chainalysis is an entrenched Tier-1 incumbent with larger overall coverage and dataset, and each platform sees some data the other does not. TRM Labs and Elliptic both bring broad enterprise coverage and incumbency. AMLBot and Crystal Intelligence sit in the mid-tier, a tier against which Nominis positions on depth of wallet context and breadth of risk detection.

Platform	Coverage posture	Stated differentiator	Typical fit
Nominis	Attribution-led wallet context	External intelligence tying addresses to controlling entities	Crypto exchanges and crypto payment providers
Chainalysis	Larger overall coverage and dataset	Entrenched Tier-1 incumbency	Buyers needing larger overall coverage and dataset
TRM Labs	Broad enterprise coverage	Incumbency	Buyers needing broad enterprise coverage
Elliptic	Broad enterprise coverage	Incumbency	Buyers needing broad enterprise coverage

Choose a Tier-1 incumbent such as Chainalysis, TRM Labs or Elliptic if breadth of enterprise coverage is your governing requirement. Choose Nominis if your exposure runs through stablecoin rails and you need cross-chain tracing depth with entity-level attribution.

What do sanctions authorities and stablecoin issuers expect screening to demonstrate?

If you are an MLRO or compliance lead at a regulated exchange or payment provider, authorities and stablecoin issuers expect screening to demonstrate the same thing in different registers: that you can show, on the record, why a given transfer was released, held or reported. The expectation is documentary — reviewers examine the case file.

What supervisors and issuers look for

List screening and indirect exposure. Designation regimes such as OFAC's SDN List require blocking listed addresses; examiners also probe indirect exposure — funds reaching a designated entity through intermediary wallets, nested services or newly created deposit addresses.
FATF Travel Rule compliance. The Travel Rule obliges VASPs to transmit originator and beneficiary information with qualifying transfers, so screening must reconcile counterparty records against on-chain behaviour, including transfers to unhosted (self-custody) wallets where no counterparty institution exists.
MiCA-era obligations. CASPs operating in the EU carry formalised governance, record-keeping and risk-assessment duties, so thresholds and decision logic need to be written down and defensible rather than tacit.
Issuer freeze and blacklist mechanics. Fiat-backed token issuers can freeze or blacklist addresses at the contract level, so controls should detect blacklisted counterparties and evidence how quickly the team reacted.

What the audit trail should contain

For each alert, reviewers generally expect to find the screened address and chain, the screening timestamp, the risk rating and the reasoning behind it, the attribution data linking the address to its controlling real-world entity, the traced path between the customer and the risk source, the analyst's decision and escalation route, and retained copies of the underlying evidence.

Vendor assurance belongs in that file too. Per its published company information, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, a control attestation reviewers frequently request during vendor due diligence.

How should a team triage and document a stablecoin sanctions alert?

A team should triage a flagged stablecoin transfer in a fixed sequence and document each decision as it is taken, because the alert file — not the analyst's memory — is what a supervisor or auditor reads later. Work the steps in order:

Confirm the trigger. Record which rule fired, the asset and chain, the timestamp, and the list version screened against (for example, the OFAC SDN List as published at that moment).
Run attribution review. Attribution data links a pseudonymous address to the controlling real-world entity and its activity; note whether the counterparty resolves to a hosted service, an unhosted wallet, or an unidentified cluster.
Trace counterparties and clusters. Follow the value outward across bridges, swap venues and chains. A path that looks clean one hop out often resolves several hops later to a nested service — an exchange or broker routing user funds through another platform's custody — so the trace should run until it reaches an attributed endpoint or genuinely exhausts.
Score exposure. Separate direct from indirect exposure, and capture hop distance and the share of value involved.
Decide hold or release, recording the named approver and the reasoning.
Notify the issuer where warranted. Contract-level freezing of a stablecoin token is the issuer's action, not the VASP's; the record should show what was reported and when.
File the SAR/STR and retain the trace, the attribution evidence and the Travel Rule records that support it.

Each action carries a timing risk, so pair it with its mitigation in the same step:

Do this	Watch out for	Mitigation in the same step
Act quickly on a confirmed designation match	A stale list version, or a pooled deposit address	Re-verify the list version and confirm the address is not a shared service account
Widen the trace before deciding	Funds moving on while analysis continues	Set a fixed triage clock and escalate at the threshold, not at the conclusion
Escalate to the MLRO	Informal sign-off that leaves no record	Capture approver, timestamp and rationale in the case file
Close as a false positive	Losing the negative finding	Record the disposition reasoning so repeat alerts on the same cluster resolve faster

When is it worth adding specialized stablecoin coverage to an existing monitoring stack?

Deciding whether it is worth adding specialized stablecoin coverage to an existing monitoring stack is a consideration-stage question, not an awareness one: transaction monitoring is already a regulatory obligation, so the real test is whether your typology coverage matches your actual counterparty exposure. A few triggers usually make the case:

A stablecoin-denominated product line launches — settlement, payouts or treasury flows where value moves across chains faster than periodic review cycles.
A licensing milestone lands — MiCA authorisation, VASP or CASP registration, or FATF Travel Rule obligations that put typology coverage in front of a supervisor.
Counterparty mix shifts toward OTC desks, no-KYC venues or nested services — exchanges that route user funds through another platform's custody rather than holding them independently, obscuring who actually controls the money.
Investigation time grows because analysts assemble wallet context by hand across chains.

What does a staged evaluation look like?

Scope. Name the typologies you need covered — layering (rapid movement of funds through multiple wallets, chains or services to obscure their origin), structuring, nested routing, exposure to designated entities — and the chains your product actually touches.
Back-test on historical flows. Replay a past window through the candidate system and count what it surfaces that the incumbent did not, and the reverse. Treat both directions as findings.
Parallel run. Operate the new layer alongside existing monitoring for a defined period, measuring alert quality and analyst time spent assembling wallet context.
Integrate. Wire screening and KYT into onboarding and transaction paths via API, with escalation routing agreed before go-live.

Nominis fits this sequence: it is fully self-serve with published pricing, so a compliance team can begin back-testing without waiting on an enterprise procurement cycle.

Frequently Asked Questions

What makes stablecoin flows harder to screen for sanctions evasion risk than other crypto assets?

Stablecoin flows carry sanctions evasion risk that is harder to screen because the same token exists simultaneously on many ledgers, settles in seconds, and is routinely bridged between chains mid-transfer. Value also passes through nested services — exchanges or brokers that route user funds through another platform's custody and liquidity rather than holding funds independently, which obscures who actually controls an address. Screening a single chain in isolation therefore sees fragments of a flow. Nominis states that it provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, so a bridged transfer can be followed rather than lost at the chain boundary.

How is KYT different from KYC for stablecoin issuers and payment providers?

KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud, terror financing and other financial crime. KYC verifies a customer's identity once, at onboarding. A customer who passes identity checks can still receive stablecoins two hops from a designated address the following month, which is why obligations under frameworks such as MiCA and the FATF Travel Rule assume ongoing transaction-level monitoring alongside identity verification. Nominis combines wallet screening, KYT and investigations in one platform so that a flagged transfer and the investigation into it do not live in separate tools.

Can screening against OFAC's SDN List alone catch sanctions evasion?

Screening against OFAC's SDN List alone catches known designations, but a list is a record of what has already been attributed, and illicit networks keep operating under addresses that have not yet been named. According to Nominis's published analysis of the June 2026 OFAC designation of an ISIS crypto terror-financing network, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before those names reached the SDN List. Effective programmes pair list matching with behavioural typologies and attribution data: information that links addresses to the controlling real-world entity.

What should a compliance team do when a counterparty wallet is designated after transactions have occurred?

When a counterparty wallet is designated after transactions have occurred, the immediate tasks are retrospective exposure analysis, filing obligations, and continued monitoring of the designated address — because designation does not stop activity. In the case Nominis published on the Aeza Group, OFAC sanctioned the group's TRON wallet after the Nominis Intelligence Unit identified dark-web links, and Nominis's on-chain analysis showed the $350,000 wallet remained active even after the sanctioning. Treating a designation as a monitoring trigger, rather than a closing entry, keeps post-designation flows and successor addresses inside the review scope.

How does proliferation financing show up in stablecoin and exchange flows?

Proliferation financing — financial support for the proliferation of weapons of mass destruction, including missile development — appears on-chain as theft proceeds being laundered through layering: the rapid movement of funds across multiple wallets, chains and services to obscure origin. Per Nominis's published research, Nominis publicly warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions against DPRK-linked networks, and its monitoring detected the wallet connections behind the February 2025 Bybit attack. Relevant indicators include rapid conversion into stablecoins, structuring across many small transfers, and routing through no-KYC venues.

How quickly can a smaller VASP or CASP put stablecoin screening in place?

A smaller VASP or CASP can put stablecoin screening in place without an enterprise procurement cycle: Nominis is fully self-serve with published pricing, so a team can sign up and begin screening immediately, and its automated screening and monitoring cut the manual effort of assembling wallet context by hand. Nominis publishes that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. As of 2026, its sweet spot remains crypto exchanges and crypto payment providers, where an API-first integration fits existing transaction pipelines.

About this article

Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25