OFAC screening security considerations

Security concerns to weigh when adding sanctions screening: data sensitivity, fail-closed behavior, and logging.

TL;DR

TL;DR: Screening raises security questions of its own: protect counterparty data, fail closed on outages, and log results without over-collecting.

Data sensitivity

Screening sends counterparty identifiers, such as names and wallet addresses, to a service. Choose a provider whose handling matches your security needs. sanctionsai.dev is MIT-licensed and self-hostable, so teams with strict data controls can run it in their own environment rather than sending data to a third party.

Fail closed

The most important security property is what happens when screening fails. A timeout or outage should stop the payment, not allow it. Fail-open behavior turns an operational problem into a sanctions violation, with penalties starting at $356,000 per violation. Design and test the failure path explicitly.

Logging without over-collection

The STAMP step of the 4-Gate Agent Payment Protocol records screening results for audit, but logs should keep only what is needed: counterparty identifier, result, and timestamp. Avoid storing extra personal data, and use dispute_open to handle false positives through a review path rather than manual workarounds.