OFAC Wallet Clustering

Grouping blockchain addresses controlled by the same entity to reveal sanctions exposure across an entire wallet cluster.

TL;DR

TL;DR: Wallet clustering groups addresses that share an owner, so a sanctions link on one address flags the whole cluster. It catches exposure a single-address check misses.

Why a Single Address Is Not Enough

A sanctioned party rarely uses one address. Clustering analyzes on-chain behavior to group addresses controlled by the same entity. Once grouped, a designation on any address in the cluster marks the rest, so screening one address in isolation gives a false sense of safety.

How Clustering Helps Agents

An AI agent paying a counterparty should check the address and its cluster, not just the address. sanctionsai.dev screens against 947 OFAC-listed crypto wallets, which reflects the cluster-level view rather than a bare address string, and returns clean equals ALLOW and flagged equals BLOCK.

Where It Fits the Protocol

Clustering feeds the SCREEN and SCORE gates of the 4-Gate Agent Payment Protocol (SCREEN, SCORE, STOP, STAMP). A risk_score that incorporates cluster exposure catches a wallet that looks clean on its own but is tied to a designated cluster.

Practical Guidance

• Screen the address and its cluster, not just the address.
• Treat a cluster link to a mixer as a risk indicator.
• Re-check clusters periodically, since attribution improves over time.