Address screening, the Travel Rule and on-chain investigations: what brokers and PSPs need

Three jobs, three questions

Address screening, the Travel Rule and investigation answer different questions. Address screening, part of KYT (know your transaction), asks whether an address is linked to a sanctioned or high-risk party right now. The Travel Rule asks whether the sending and receiving providers have exchanged who stands behind a transfer. An investigation asks where the money came from and went, and whether you can prove it. KYC and KYT covers the identity checks before all three.

Mixing them up is expensive: a screening feed is not Travel Rule messaging, and an investigation tool that runs after the fact will not hold a deposit before it is credited.

Job one: screening an address before and after funds move

Screening has two moments. Before a deposit is credited or a withdrawal is broadcast, the address goes to a screening provider and hits wait in a review queue. Afterwards, history is screened again when lists change, because a clean address today can be listed tomorrow. The US Treasury's Office of Foreign Assets Control (OFAC) adds digital currency addresses to its Specially Designated Nationals (SDN) list, but says those listings are not likely to be exhaustive.

OFAC's sanctions compliance guidance for the virtual currency industry (15 October 2021) reads as a practical checklist: screen customers at onboarding; screen transactions for wallet, physical and IP addresses linked to sanctioned persons or places; re-screen when lists change; and consider a lookback after an address is listed, since unlisted addresses linked to it may also carry risk. OFAC requires no particular software but says blockchain analytics tools can help.

The Financial Action Task Force (FATF), in its July 2026 update on virtual assets, asks virtual asset service providers for wallet screening, blacklists, whitelists where appropriate, and freezing and blocking controls that can be updated quickly, plus transaction monitoring and blockchain analytics to detect rapid transfers. Regulation (EU) 2023/1113, the EU's transfer regulation, names a pattern used to evade traceability: a large transfer split into smaller amounts across seemingly unrelated and one-time addresses.

Job two: the Travel Rule is messaging, not screening

Under FATF's standard, the originating virtual asset service provider (VASP) obtains accurate originator and required beneficiary information, sends it to the beneficiary's provider immediately and securely, and makes it available to authorities; the beneficiary's provider holds it too. FATF applies the same obligations to financial institutions that send or receive virtual asset transfers for a customer. Recommendation 16 lets countries set a de minimis threshold of no more than USD/EUR 1,000 for cross-border transfers, below which less information is required; the EU sets none for crypto-asset transfers.

The same regulation spells out the receiving side, where a firm taking deposits sits if it is a crypto-asset service provider. The beneficiary's crypto-asset service provider must have procedures to detect missing originator or beneficiary information, and must verify its own client's details before making the funds available. When information is missing it must, on a risk-sensitive basis and without undue delay, reject or return the transfer, or request the information first. A counterparty that repeatedly fails to send data can be warned, then rejected, restricted or cut off, and the failure is reported to the supervisor. A transfer counts even when sender and recipient are the same person, so a client topping up from their own exchange account is one.

The European Banking Authority's Travel Rule guidelines (EBA/GL/2024/11, applying from 30 December 2024) add two points. Missing information does not by itself make a transfer suspicious. And to show that a client owns a self-hosted wallet, a firm can use a remote verification with or without an employee, a small predefined amount sent from and to the address, a message signed with the address's key or another reliable technical means, combining them where one is not enough, and can then whitelist the address while watching for changes in its risk or ownership.

The Monetary Authority of Singapore sets its rules for digital payment token service providers, transfers included, in Notice PSN02 (last revised 30 June 2025), and other jurisdictions differ again. Whether any of this applies to you depends on your licence, so get a written view from counsel.

Job three: investigation, and what the report must contain

An investigation starts from an address or transaction hash and works outwards: trace each hop, group addresses probably controlled by one party, label known counterparties and draw the graph. Grouping is inference. The Bitcoin white paper notes that a transaction with several inputs reveals that they were owned by the same owner; investigators treat this as a heuristic, because transactions built jointly by several people, such as CoinJoins, are designed to break it. Clustering builds on signals like that, so a report must say which links are on-chain facts and which are attributions.

Speed matters. FATF's 2026 update notes that stolen assets can be moved and split quickly through stablecoins, decentralised exchanges, bridges and several providers, which makes tracing and freezing harder, and that some legitimate stablecoin issuers can block transactions or freeze tokens at the request of competent authorities. A report another party can rely on contains:

• The scope: which client, which transfers and dates, and why the case was opened.
• Every address and transaction hash, with chain, time and amount, exported as a file another party can load.
• The path hop by hop, marking on-chain facts apart from clustering or attribution, with the source of each label.
• Screening results, with the data source and the date checked.
• What the client said and supplied, such as source-of-funds documents.
• The conclusion, the decision and who took it, including a decision not to report.

Recording the assessment and its result becomes an EU rule from 10 July 2027: the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, requires obliged entities to keep a record of each assessment of client transactions for suspicion, with the information considered and the result, whether or not a report is made.

What does a broker or payment provider accepting USDT actually need?

For a forex broker or payment service provider (PSP) taking USDT, Tether's dollar stablecoin, the three jobs come down to six steps. The USDT deposits guide covers the deposit flow itself.

1. 01
   Settle your status first Ask counsel whether taking and paying out USDT makes you a virtual asset or crypto-asset service provider, or a financial institution sending or receiving transfers for clients, where you are licensed. The answer decides whether Travel Rule messaging is your job.
2. 02
   Screen before credit and before payout Connect a screening provider to deposits and withdrawals, hold hits in a queue, and re-screen history when lists change.
3. 03
   Know the other end Record whether each client address belongs to an exchange or is self-hosted, prove ownership where the law or your policy requires it (in the EU, a crypto-asset service provider must assess it for self-hosted transfers above EUR 1,000), and pay withdrawals only to verified addresses.
4. 04
   Watch self-hosted flows In FATF's 2026 survey, 88% of responding jurisdictions (58 of 66) rated peer-to-peer transfers through unhosted wallets as high risk, and FATF asks virtual asset service providers to apply enhanced due diligence to higher-risk unhosted wallet activity.
5. 05
   Be able to investigate Have a tool and a trained person who can trace a flagged deposit, answer a source-of-funds question and produce an evidence pack.
6. 06
   Keep the records FATF asks for at least five years of transaction records and the EU transfer regulation sets five years for Travel Rule data; keep screening results and case files under your own retention rules too.

Questions to ask each vendor

• Which of the three jobs does your product do, and which does it leave to another provider?
• Which chains and tokens do you cover today, including USDT on Tron?
• How fresh is your risk data when a deposit is screened, and how do list updates reach us?
• When an address is newly listed, do you re-screen our history and alert us?
• Do you show the source of each label, and separate on-chain facts from inference?
• Can a third party re-verify an investigation export from the hashes alone?
• For Travel Rule providers: how do you spot a self-hosted wallet, and which ownership checks do you support?

Where EntropyX Labs fits

Crypto Tools does the investigation job. It traces fund flows across the major Ethereum Virtual Machine (EVM) chains, Tron (including TRC20 USDT) and Bitcoin, clusters and tags addresses, visualises counterparty graphs, flags anomalies in volumes and patterns, and exports CSV and PDF evidence with the raw transaction references, block numbers, timestamps, the source of each address tag and your annotations, so any party can re-verify the findings on-chain. It runs in a managed cloud or self-hosted and sits beside enterprise screening vendors rather than replacing them.

EntropyX PSP runs the payment flow: USDT deposits and withdrawals on BEP20, TRC20 and ERC20 on your infrastructure with your wallets and keys, with risk hooks to plug in an address-screening provider and set limits before a deposit is credited. Withdrawals can be limited to whitelisted addresses, clients can prove they own a self-hosted wallet with a signed message or a small test amount, and past deposits can be re-screened through the same hook when sanctions lists change. EntropyX Labs never holds funds.

EntropyX Labs does not supply Travel Rule messaging or the screening data that decides whether a deposit is credited: it connects the Travel Rule provider and the screening provider you choose, per engagement, with no fixed list. Your screening policy, case decisions and any filing stay with your compliance team.

Sources and further reading

• FATF Recommendations (updated October 2025) — Read 13 November 2026: interpretive note to Recommendation 15, paragraph 7(b), originating and beneficiary VASP obligations, and the same obligations for financial institutions sending or receiving virtual asset transfers for a customer; interpretive note to Recommendation 16, paragraph 8, a de minimis threshold no higher than USD/EUR 1,000; Recommendation 11, transaction records for at least five years
• FATF: Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (July 2026), copy published by Malta's FIAU — Read 13 November 2026: private-sector recommendations on wallet screening, blacklisting, whitelisting, freezing and blocking that can be swiftly updated, enhanced due diligence for higher-risk unhosted wallet activity, and blockchain analytics to detect rapid transfers; 88% of jurisdictions (58 of 66) rated P2P transactions high risk; some legitimate stablecoin issuers can block transactions or freeze tokens at the request of competent authorities; stolen assets rapidly moved and fragmented through stablecoins, DEXs, bridges and multiple VASPs
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, OJ L 150, 9.6.2023 — Read 13 November 2026: Article 3(10), a transfer of crypto-assets irrespective of whether originator and beneficiary are the same person; recital 30, structuring into smaller amounts across unrelated and one-time addresses; Article 16, detection of missing information and verification before making assets available; Article 17, reject, return or request, and repeated failures reported to the competent authority; Article 26, five years (Official Journal text)
• EBA Guidelines on information requirements under Regulation (EU) 2023/1113 (Travel Rule Guidelines, EBA/GL/2024/11, 4 July 2024) — Read 13 November 2026: missing information does not per se give rise to suspicion (paragraph 48); ownership of a self-hosted address shown by unattended or attended verification, a predefined amount sent from and to the address, or a signed message (83); a combination where one method is not reliable enough (85); whitelisting (86); the EBA press release of 4 July 2024 states they apply from 30 December 2024
• MAS Notice PSN02: AML/CFT, digital payment token service — Read 13 November 2026: requirements for digital payment token service providers on AML/CFT; topics include correspondent accounts and wire transfers; last revised 30 June 2025
• OFAC FAQ 562: How will OFAC identify digital currency-related information on the SDN List? (19 March 2018) — Read 13 November 2026: OFAC may add digital currency addresses to the SDN List; its digital currency address listings are not likely to be exhaustive
• OFAC: Sanctions Compliance Guidance for the Virtual Currency Industry (15 October 2021) — Read 13 November 2026: screening customers at onboarding and transactions for physical, digital wallet and IP addresses; ongoing and risk-based re-screening; historic lookback after a listing; shared-wallet and counterparty risk of unlisted addresses; no particular software required; blockchain analytics tools (publication date from OFAC's recent action of 15 October 2021)
• Satoshi Nakamoto: Bitcoin: A Peer-to-Peer Electronic Cash System — Read 13 November 2026: section 10, multi-input transactions necessarily reveal that their inputs were owned by the same owner
• Bitcoin Wiki: Common-input-ownership heuristic — Read 13 November 2026: an assumption that all inputs to a transaction are owned by the same entity; CoinJoin transactions are built to break it
• Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation), OJ L, 19.6.2024 — Read 13 November 2026: Article 77(1)(b), a record of each assessment under Article 69(2), including the information considered and the results, whether or not a report is made; applies from 10 July 2027 (Official Journal text)

This guide is engineering and product guidance from EntropyX Labs, a technology provider. It is not legal, regulatory or investment advice.