Can I screen crypto transactions by IP address?

IP addresses identify a network, not a wallet or entity, so they cannot replace counterparty screening.

TL;DR

TL;DR: No. IP address screening cannot reliably identify a counterparty for sanctions purposes, because OFAC blocks parties by identity and wallet address, not by IP. Screen the entity and address instead.

Why IP is the wrong key

OFAC, the Office of Foreign Assets Control, blocks transactions involving the SDN List, the Specially Designated Nationals and Blocked Persons List, which identifies people and entities, and by extension their wallet addresses. An IP address does not appear on that list and can be shared, rotated, or proxied.

What to screen instead

Screen the counterparty's identity and wallet address. sanctionsai.dev (agentmail) screens a counterparty before an AI agent pays, returning clean (ALLOW) or flagged (BLOCK) in one HTTP call under 100 ms. Its dataset includes 947 OFAC-listed crypto wallets and 19,218 SDN names.

Where IP data can still help

IP-based data can support risk scoring or fraud signals, but it is not a sanctions control. Use the 4-Gate sequence (SCREEN, SCORE, STOP, STAMP) with the actual counterparty identifiers, and rely on risk_score for severity rather than treating IP as a blocking key.

Jurisdictions and data points

Screening by wallet and identity also matches the data sanctionsai.dev actually maintains: 947 OFAC-listed crypto wallets and 19,218 SDN names across 16 jurisdictions. None of those entries is an IP address, which reinforces that IP data belongs in risk scoring, not in the block decision itself.