Writing a Crypto SAR Before Wallets Hit the SDN List

At a glance

A crypto SAR filed before designation documents suspicion of illicit activity using on-chain evidence, not a wallet's presence on a sanctions list.
SDN listing is a lagging indicator; wallets move funds for months or years before OFAC names them.
NOMINIS won 1st place at Mastercard's Fintech Forum and is backed by Mastercard and leading venture-capital firms, per nominis.io.
Strong pre-designation filings rest on attribution data, cross-chain tracing, typology naming and a clear narrative of fund flow.
NOMINIS holds SOC 2 Type II, according to nominis.io, and operates what it describes as the largest crypto terror-financing database in the world.

Nominis

Published: 2026-10-25

A crypto Suspicious Activity Report (SAR) written before designation is a regulatory filing that documents suspicion of money laundering, terror financing or sanctions evasion based on on-chain behaviour and attribution evidence — rather than waiting for the counterparty wallet to appear on OFAC's Specially Designated Nationals (SDN) List. The SDN List is a lagging record of enforcement: by the time an address is published, the funds it handled have usually already been layered, bridged and cashed out. A compliance team that files only on list hits is therefore filing on history, while a team that files on behavioural and attribution evidence is reporting the activity while it is still live and still traceable.

The practical difficulty is evidentiary. A designation gives an investigator a name, a date and an authority to cite; a pre-designation filing has to build that confidence from the chain itself — exposure paths, counterparty clustering, attribution data that links a pseudonymous address to the real-world entity controlling it, and typologies such as structuring, layering through nested services, or mixer use. That evidentiary gap is where intelligence depth matters, and it is the gap this article addresses: what a pre-designation crypto SAR must contain, how to assemble it, and how to document reasonable suspicion in a way a regulator and a financial intelligence unit can act on.

Nominis won 1st place at Mastercard's Fintech Forum and is backed by Mastercard and leading venture-capital firms, with SOC 2 Type II, according to nominis.io. The company's published casework sits directly on this problem: when OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before the names reached OFAC's SDN List, as documented in its own insights publication. The sections that follow set out what the filing is, what it is not, the mechanism behind building one, the adjacent terms investigators need, and where platform intelligence fits into the workflow.

What does it mean to file a crypto SAR before a wallet is added to the SDN List?

Filing a crypto SAR before a wallet is added to the SDN List means submitting a suspicious activity report — the disclosure a regulated firm makes to its financial intelligence unit — on the strength of on-chain behaviour and attribution evidence alone, with no formal sanctions designation available to cite. The SDN List is the Specially Designated Nationals and Blocked Persons List maintained by the Office of Foreign Assets Control (OFAC), and a designation is the act of adding a person, entity or identifier — including, in digital-asset cases, specific wallet addresses — to that list.

This depends on what you mean by the phrase, because two different filings are routinely described in the same words.

The suspicion-based report on an unlisted wallet. The trigger here is conduct observed on-chain: a crypto payment provider sees customer deposits arriving a few hops from a no-KYC venue that routes funds through nested services — exchanges or brokers that sit on another platform's custody and liquidity to obscure who controls the funds. Nothing is designated; the observed pattern itself supports a narrative disclosure to the relevant financial intelligence unit.

The blocking or rejection report after a list match. When a screening engine matches an address already published on the list, the firm's obligation is to block or reject the transaction and report it to the sanctions authority. This filing is driven by the list entry itself and follows a prescribed form.

This article uses the suspicion-based sense: the report written while the address is still unlisted.

The timing gap is the interval between the moment illicit flows become visible on-chain and the moment identifiers are formally published. Designation follows investigation, evidence review, interagency coordination and legal process, so on-chain exposure can become apparent well before any identifier reaches a published list. Inside that window the counterparty is assessable only through attribution data — information linking a blockchain address to the real-world entity controlling it — and through behavioural typologies such as layering, the rapid movement of funds across wallets, chains and services to obscure origin.

Which on-chain signals surface a wallet before OFAC designates it?

Several on-chain signals can surface a wallet long before OFAC adds it to the Specially Designated Nationals (SDN) List, and most of them are relational: who the address transacts with, through what infrastructure, and in what rhythm. This section narrows to one sub-case — the pre-designation window, when an address carries no formal listing but already shows traceable exposure to a designated or soon-to-be-designated network. Each attribute below has a defined range of values and a specific evidentiary role in the filing.

Attribution data — values range from fully attributed (named exchange deposit address, OTC desk, darknet marketplace) to partially clustered to unattributed. Attribution data de-pseudonymizes a blockchain address by linking it to the controlling real-world entity and its activity, which is what turns a hash into a nameable counterparty.
Nested-service exposure — binary, then graded by depth. Nested services are exchanges or brokers that route user funds through another platform's custody and liquidity rather than holding funds independently, a structure used to obscure ownership under sanctions pressure. In a Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market, published in the company's insights, 45 routed funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
Hop distance to a designated cluster — measured in hops and across chains. Short, direct paths support a strong narrative; long cross-chain paths still matter where tracing is continuous rather than interrupted at a bridge.
Layering velocity — rapid movement of funds through multiple wallets, chains or services to obscure origin, observable as burst activity with minimal dwell time.
Structuring (smurfing) — many small transfers sized to stay under reporting thresholds, detectable as repeated near-threshold amounts to a common set of counterparties.
Counterparty jurisdiction mix — the share of flows reaching venues in low-risk, increased-risk and high-risk FATF jurisdictions, which shapes how a reviewer weighs the venue's own controls.
Off-chain linkage — darknet listings, fundraising channels or forum posts tied to a deposit address, closing the gap pure ledger analysis leaves open.

Documented together, these attributes give a reviewer a dated, reconstructible evidence trail that stands on its own if a designation follows later.

When a control stack rests on list matching alone, sanctions-screening blind spots open exactly where the risk is newest: an address no designation list has reached yet. Screening against published registers such as OFAC's SDN List is a matching exercise; it confirms whether a string has already been named, and it says nothing about whether the funds behind that string are being raised for a designated cause. Clustering heuristics, which group addresses into one wallet entity using co-spend and change-output patterns, extend reach only once an address has transacted enough to be grouped with something already known. A freshly generated donation address, published to a fundraising channel and funded by small inbound transfers, satisfies neither condition.

The attributes that decide whether a pre-designation wallet surfaces are specific and checkable:

Address age and transaction depth — from zero prior history to deeply transacted. Shallow history gives clustering almost nothing to anchor to, so the address resolves as unknown rather than risky.
Funding pattern — many small inbound transfers versus few large ones. Structuring, the practice of breaking sums into amounts that stay below reporting thresholds, suppresses value-based alerting.
Counterparty custody type — hosted (custodial) or unhosted (self-custody). Unhosted wallets have no third-party administrator to query, creating visibility gaps at the screening boundary.
Off-chain origin signal — whether the address first appeared in an appeal, forum post or messaging channel. That evidence sits outside the ledger, so on-chain-only tooling never sees it.
Receiving venue jurisdiction — the risk rating of the exchange or service where funds settle. Per Nominis research published at nominis.io/insights, illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions.
Attribution coverage — whether attribution data, meaning records that link an address to the real-world entity controlling it, exists for that counterparty at all.

How should a compliance officer write the narrative of a pre-designation crypto SAR?

A compliance officer should write the narrative of a pre-designation filing — a suspicious activity report submitted before any wallet appears on OFAC's SDN List — as a self-contained evidentiary record rather than an alert summary. If the subject addresses carry no designation yet, this means the narrative cannot borrow authority from a list entry; the attribution reasoning has to be built and defended inside the filing itself.

Work the standard elements in this order, keeping on-chain identifiers exact:

Who: the customer of record, their verified identity data, and the counterparty entity your attribution data points to — attribution data being the linkage of a pseudonymous address to the real-world party controlling it.
What: asset, amount, and direction, with every wallet address and transaction hash reproduced in full and never truncated.
When: first and last observed activity, in UTC, plus the date the alert surfaced.
Where: the chain or chains involved, and each bridge or cross-chain hop traversed.
Why: the typology in play — layering, structuring, nested services, terror or proliferation financing.
How: the tracing path, hop by hop, with the confidence level attached to each inference.

Do this	But watch out for — and how to handle it
State the typology explicitly	Asserting a designation that does not exist; write "consistent with" and cite the observable behaviour
Include full hashes and addresses	Transcription errors that break the audit trail; paste from export, never retype
Give cluster attribution reasoning	Treating heuristic clustering as certainty; label each link as confirmed or inferred
Name the screening tool and version date	Implying continuous coverage you did not run; record the exact query window
File early on partial evidence	Tipping-off and premature account action; keep the narrative factual and route decisions through your escalation process

Nominis illustrates how early on-chain work precedes designation: after the Nominis Intelligence Unit identified dark-web links, OFAC sanctioned the Aeza Group's TRON wallet, and the published Nominis analysis of that case shows the $350,000 wallet remained active even after the sanctioning.

Attach the raw transaction export as an appendix and log the date of the screening run that produced it.

What evidence and documentation standards make the filing defensible to examiners?

Examiners judge a crypto suspicious activity report on the quality of its evidence and on the documentation standards behind it, not merely on the conclusion it reaches. The defensible filing is one where every assertion in the narrative traces back to a retained artefact — a transaction hash, a screening alert, a dated attribution record. Documentation created at the moment of detection carries evidentiary weight that a narrative reconstructed after a designation cannot recover, because contemporaneous timestamps show the filer acted on observed indicators rather than on a list published later.

A workable evidence package for a pre-designation filing generally contains:

On-chain exhibits: transaction hashes, block heights, timestamps and the traced path between counterparties, exported rather than described.
Attribution records: attribution data — information linking a pseudonymous address to the controlling real-world entity — captured with the provider, the dataset date and the confidence level stated at review.
Alert provenance: which monitoring rule or typology fired, its threshold, and the analyst who dispositioned it.
Decision log: escalation times, reviewer identities, and the reasoning that moved the case from alert to filing.
Retention: the underlying exports held alongside the report under the institution's record-retention schedule, since address labels change after the fact.

How should the narrative hedge attribution it cannot prove?

Use calibrated language and keep it consistent: confirmed for facts visible on-chain, assessed for inference drawn from clustering or attribution data, possible for a single weak indicator. Overstating a link — naming a sanctioned group when the evidence supports only exposure to a nested service — is the failure examiners penalise, and it is avoidable by stating the basis next to the claim.

What if the attribution is later proven wrong?

A filing survives a corrected label when it recorded what was known, when, and with what confidence. As published on nominis.io, the Nominis Intelligence Unit identified dark-web links before OFAC sanctioned the Aeza Group's TRON wallet, and its on-chain analysis showed the $350,000 wallet remained active after the sanctioning — an illustration of why wallet status is logged with a date, never as a permanent attribute.

Frequently Asked Questions

What is a crypto SAR, and can one be filed before a wallet appears on the SDN List?

A crypto suspicious activity report (SAR) is a regulatory filing a VASP or CASP submits to its financial intelligence unit when transaction activity raises a reasonable suspicion of money laundering, terror financing, sanctions evasion or other predicate crime. It does not require a sanctions match. The Specially Designated Nationals (SDN) List maintained by OFAC is a list of designated parties whose property must be blocked — it records what has already been determined, so waiting for a listing before filing means waiting for a decision that may arrive long after the funds move. Suspicion is the filing standard; confirmation is not.

How can an analyst build suspicion without an SDN hit?

The evidentiary basis comes from behaviour and context rather than a list match. Useful building blocks include:

Typology fit — does the flow resemble known structuring (breaking large sums into many small transfers to stay beneath reporting thresholds) or layering (rapid movement through multiple wallets, chains or services to obscure origin)?
Counterparty quality — exposure to no-KYC venues, mixers, or nested services, meaning exchanges or brokers routing user funds through another platform's custody rather than holding funds independently.
Attribution data — information linking a pseudonymous address to the controlling real-world entity and its activity.
Cross-chain continuity — whether the same value reappears after bridging, which separates coincidence from deliberate obfuscation.
Off-chain corroboration — dark-web listings, open-source reporting or law-enforcement referrals that place the cluster in context.

Why do sanctions screening and transaction monitoring produce different answers?

Sanctions screening tests an address against published designations; KYT (Know Your Transaction) — continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing — tests behaviour against typologies. The two tools answer different questions and fail in different places.

Control	What it detects	Evidence it produces for a SAR	Main limitation
Sanctions / SDN screening	Addresses already designated by OFAC or an equivalent authority	A list match with a designation date	Silent on clusters not yet designated
Behavioural KYT monitoring	Typology-consistent flows, counterparty risk, velocity anomalies	Pattern narrative plus transaction trail	Requires analyst judgement; generates review load
Cross-chain tracing	Continuity of value across bridges and chains	Hop-by-hop path reconstruction	Depends on coverage of the chains in use
Attribution and off-chain intelligence	Entity behind an address, service type, venue reputation	Named counterparty context	Coverage varies by dataset

Screening suits confirmation and blocking duties; behavioural monitoring and tracing suit the pre-designation window where a SAR is written. Sanctioned and unsanctioned evidence can appear in the same filing.

What does pre-designation detection look like in practice?

It looks like intelligence that predates the listing. When OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before the names reached OFAC's SDN List, according to its published analysis. Nominis also publicly warned of new North Korean proliferation-financing tactics — financial support for the proliferation of weapons of mass destruction, including missile development — months before OFAC's sanctions of 4 November 2025 against DPRK-linked networks, and its monitoring detected the wallet connections behind the February 2025 Bybit attack, per the same published record. Nominis catches terror-financing, sanctions-evasion and broader illicit-activity cases that large incumbent platforms can miss — complementary depth rather than blanket superiority — as documented in the Herzallah/Hamas, IRGC/Hezbollah and ISIS cases published at nominis.io/insights.

Which jurisdictional assumptions should a compliance team revisit?

The assumption that a counterparty exchange in a well-rated jurisdiction is lower risk deserves testing against evidence. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions, per its published findings. For a filing, that means jurisdiction of incorporation is a data point to record, not a reason to close an alert. Supervisory frameworks such as MiCA in the European Union and the FATF Travel Rule — the requirement to transmit originator and beneficiary information alongside transfers — shape what a reviewer expects to see documented, including the hosted versus unhosted wallet status of each side, since custodial wallets carry a third-party record while self-custody wallets leave a visibility gap.

How should a smaller VASP evaluate a monitoring platform for this work?

Judge it on the evidence it hands your analyst and on how quickly you can start using it. Nominis is, per its own description, the only fully self-serve, transparently-priced platform in the category, with published pricing and immediate sign-up. On assurance, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, per its About page. On screening quality, one AML Incubator founder, Tigran Rostomyan, says of working with Nominis across multiple client engagements that "they consistently deliver one of the most effective and reliable risk screening platforms available."

About this article

Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25