AML check crypto
Someone is sending you USDT. Before you accept, paste their address here. In 30 seconds you'll know if it's on the OFAC sanctions list, if Tether has blacklisted it, and whether the money behind it traces back to anything flagged.
The check reads the Tether freeze list directly from the USDT smart contract, matches against the OFAC sanctions file from the US Treasury, and traces two hops of funding sources — across Tron, Ethereum, BNB Chain, Polygon, Bitcoin and Solana. Free, no signup required.
What happens when you paste an address.
First runs the on-chain freeze check — one contract call, binary answer, no interpretation. Then sanctions matching against the OFAC SDN file. Then a two-hop trace through the funding chain, each counterparty screened against the same datasets. Last, behavioural pattern detection — signals that raise the score but never decide the verdict alone.
Tether freeze registry
isBlackListed() is a public function in every USDT contract Tether has ever deployed. One call, one boolean. True = frozen. The tokens show on-chain but cannot move in any direction. The list grows continuously — Tether adds addresses on law enforcement and OFAC requests without public notice.
Sanctions screening
OFAC publishes sanctioned crypto addresses in a file called sdn_advanced.xml. Not the CSV — the CSV omits crypto entries. We parse the XML directly from Treasury. Since December 2023, Tether has frozen every SDN-listed wallet as a matter of policy. So an OFAC match is usually a freeze that hasn't executed yet.
Counterparty trace
Hop 1: every address that sent money to this wallet. Hop 2: every address that funded those senders. Each gets the same sanctions and freeze screening as the target. Two hops is the standard for deposit-intake screening at major exchanges. The difference is timing — they run it after your money arrives. You can run it before.
Pattern detection
Twenty inbound transfers of exactly $10,000 from twenty different wallets in sixty minutes. Could be an OTC desk. Could be layering. The pattern raises the score but never decides the verdict — that takes a sanctions match or a freeze hit. These are marked as behavioural signals in the output — separate from the hard findings above.
AML check vs block explorer — what's the difference.
A block explorer tells you that address X received 50,000 USDT from address Y on Tuesday. An AML check tells you that address Y is on the OFAC sanctions list and was blacklisted by Tether three weeks ago. One shows raw activity. The other tells you what it means for your risk.
Who needs to screen USDT — and who can skip it.
It's the sender's address that gets screened, not yours. The question is whether accepting their transfer will cause you problems later.
P2P traders
USDT lands in your wallet, you're about to send fiat back. If that USDT traces to a flagged source, the exchange will hold your deposit and ask you to explain where it came from. By then the buyer is gone. Run the screening while they're still in the chat.
Freelancers paid in crypto
You did the work. The client pays in USDT. You deposit to an exchange and the deposit goes on hold — because the client's wallet has a sanctions flag you never checked. Your income, their history, your problem. Screen the address before you invoice.
OTC desks
Screening at quote stage costs nothing. Unwinding a settled trade costs everything. Dated evidence that you did due diligence before the deal, not after.
Merchants
Every USDT payment settlement carries the history of the wallets behind it. One flagged source three hops back, and the exchange holds your batch. Screening at intake catches it before it reaches your balance sheet.
Who doesn't need this.
Sending your own USDT to an exchange? They screen it at intake — you don't need to screen yourself. Buying on Binance or Coinbase? Their compliance handles it. This screening exists for the gap: P2P trades, direct payments, OTC deals, freelance invoices — situations where nobody screens the sender except you.
What the risk score means.
The score tells you whether to accept, investigate, or walk away. It runs 0 to 100: below 20 means nothing matched, 20–59 means the address is clean but something in the funding chain raised a flag, 60 and above means sanctions hit, active freeze, or flagged counterparties at close range. Score, verdict, and evidence come in one document — forward it to a compliance desk or keep it on file.
No matches found
Clean across the board. No sanctions match, no freeze hit, no flagged counterparties in two hops of funding. You can proceed — but if the transfer is large enough that you'd want to explain it later, keep the report. It dates exactly what you checked and when.
Review the evidence first
Every direct check passed. But the wallet that funded this address — or the wallet that funded that one — has a flag. Or the transfer pattern looks like layering: identical amounts, rapid pace, many sources. Read the evidence table before you send fiat or release goods.
Do not accept
Sanctions match found, Tether has blacklisted the address, or its direct funding sources include designated wallets. In the worst case the USDT is already frozen — the balance shows on-chain but cannot be moved. Accepting this transfer means the problem moves from their wallet to yours.
Six chains — what runs on each one.
Tron and Ethereum get full depth — freeze registry, sanctions, tracing, abuse tags — because the USDT contract on both chains exposes isBlackListed() publicly. BNB Chain, Polygon and Bitcoin get sanctions and tracing but no freeze screening (BEP-20 USDT has no public blacklist function). Solana gets sanctions and balance only — tracing ships Q4 2026. The report prints what ran and what didn't.
Full depth. Freeze registry via direct contract call, OFAC, balance and tracing via TronGrid API, TronScan community abuse tags. Over 50% of all USDT circulates on Tron — this chain matters most and gets the deepest screening.
Full depth · freeSame depth as Tron — freeze, sanctions, balance, trace. Ethereum carries the original USDT deployment — its freeze list has been active since 2017. Tracing runs through Etherscan V2.
Full depth · Etherscan V2Sanctions and tracing only — BEP-20 USDT on BNB Chain does not expose a public freeze function the way TRC-20 and ERC-20 do. If Tether blacklists a BNB address, we catch it through OFAC, not the contract. Tracing runs through the same Etherscan V2 multichain API.
Full depth · Etherscan V2Same coverage as BNB Chain — sanctions and tracing, no direct freeze read. Why the network picker exists: an EVM address is valid on Ethereum, BNB and Polygon simultaneously. Without the picker, we'd trace the wrong chain.
Full depth · Etherscan V2Sanctions, balance, and tracing via mempool.space — no API key needed. Bitcoin doesn't carry USDT, so the freeze check genuinely doesn't apply. Marked as "not applicable" in the result rather than hidden.
Full depth · freeSanctions and balance via public RPC — available today. Tracing on Solana requires a transaction indexer that isn't live yet. We chose to ship what works now and add tracing in Q4 2026 rather than wait and launch with nothing.
Sanctions + profile · tracing Q4 2026Why USDT gets frozen — and how to catch it before it's yours.
In spring 2026, Tether blacklisted 371 addresses across Tron and Ethereum in a single 30-day period — $515 million in USDT locked. Most people learn how the freeze works after their deposit is already on hold. By then the options are patience, lawyers, and the agency that requested the freeze.
The mechanism
Built into every USDT contract Tether has ever deployed: a blacklist function. Listed address = frozen balance. Visible on-chain, impossible to move. Public code, permanent effect — until Tether removes the entry.
The trigger
Tether freezes on law enforcement and OFAC requests. April 2026: two Tron wallets, $344 million, coordinated with OFAC. Not an outlier — this is the pace.
The consequence
Nobody reverses a freeze except Tether. Not your exchange. Not a lawyer. Not the Telegram accounts offering "USDT recovery services" for a fee — those are scams. Run it before you accept the transfer. After is too late.
The PDF report — what's inside.
Your exchange puts a deposit on hold. The support ticket asks: "Please provide documentation showing the source of these funds." You attach the PDF — it lists every dataset checked, every result, and the exact time. Or: a P2P buyer disputes a trade six months later, claiming the USDT was dirty. You pull the report. The SHA-256 hash proves it hasn't been edited since the day of the trade. That's what this document is for.
- Header
- Report ID, address, network, scan depth, UTC timestamp. SHA-256 hash of the raw result — verifiable by anyone.
- Verdict
- Clear, caution, or flagged. The score and the one finding that decided it.
- Findings
- Each screening step: dataset, snapshot date, pass or hit. If a step didn't run, it's listed as such — nothing quietly omitted.
- Counterparties
- Every traced address: hop distance, direction, volume. Up to 100 rows, total count printed even when truncated.
- Methodology
- What was checked and what wasn't. Written so nobody reads it as claiming more than it does.
Pricing.
The core screening is free — permanently, not as a trial. Tether's freeze list is on-chain, OFAC publishes the SDN as a government file, and chain APIs are open — there's nothing to pay for. Paid plans exist for teams that need commercial attribution (Chainalysis, Elliptic, TRM-level data), API access, and higher throughput.
- Tether freeze registry
- OFAC SDN sanctions
- Two-hop counterparty trace
- Balance and activity profile
- Dated PDF report
- Commercial attribution
- API access
- Everything in Free
- EU, UK and UN designations
- Higher rate limits
- Saved scan history
- Bulk address upload
- API access
- Everything in Pro
- Commercial attribution provider
- REST API and webhooks
- Volume rate limits
- Priority disclosure response
No wallet access. No signup. No stored data.
Every address checked on this site is public data — the same bytes visible to anyone running a block explorer. The screening engine makes read-only API calls against public chain endpoints. It cannot initiate transactions, sign messages, or access private keys by design.
amlsecurity.financial
We operate one domain. If you arrived through a forwarded link, look at the address bar before you paste an address. Phishing clones copy everything except the domain.
No wallet, no keys, no signature
No wallet-connect button exists on this site. The engine reads public chain data — it cannot access, move, or interact with your balance.
Vulnerability reporting
If you find a security issue, the disclosure contact is in security.txt. Vulnerability reports are handled before anything else — features, partnerships, press.