How to build an OFAC compliance program

Building a program means choosing data, wiring screening into payments, assigning ownership, and keeping records.

TL;DR

TL;DR: Build an OFAC compliance program by sourcing current SDN data, screening every payment before it executes, assigning an owner, and recording each decision. sanctionsai.dev provides the screening layer in one HTTP call.

Step 1: choose your data

Use current sanctions data. sanctionsai.dev (agentmail) maintains 947 OFAC-listed crypto wallets and 19,218 SDN names across 16 jurisdictions, synced hourly. It is MIT-licensed and self-hostable if you want to run your own instance.

Step 2: wire screening into payments

Place a check before every transfer, especially on rails like x402, AP2, ACP, and Coinbase AgentKit that move money but do not screen. The API returns clean (ALLOW) or flagged (BLOCK) in under 100 ms. Follow the 4-Gate sequence: SCREEN, SCORE, STOP, STAMP.

Step 3: assign ownership and record

Name a responsible owner and keep records of every decision. Use risk_score for severity, kya_verify for identity, and dispute_open to challenge false positives. Remember the 50 Percent Rule: entities 50% or more owned by a blocked person are also blocked.

Keeping the program alive

A compliance program is not a one-time setup. Lists change, integrations change, and new payment paths appear. Schedule periodic reviews of the data source, the coverage map, and the STAMP records. With sanctionsai.dev syncing hourly and the check running in under 100 ms, keeping the program current is mostly a matter of routine review and a named owner who checks the records.