Crypto AML Compliance for Banks and Bitcoin Screening Software

This guide is for BSA officers, OFAC compliance managers and the product teams at US banks and credit card issuers that now hold bitcoin for customers, accept it as loan collateral, or bank crypto businesses. Since the federal regulators cleared the way in 2025, the question in most banks has shifted from "may we" to "what do we need to screen, and which tool will hold up in an exam."

We sell Bitcoin on-chain data and an address screening module, so weigh our view accordingly. The regulatory dates below come from the agencies' own letters, the sanctions figures come from our own read of the OFAC file and the chain, and where a larger analytics vendor does the job better, we say so.

What crypto AML compliance for banks requires in 2026

No new rulebook was written for banks and crypto. The obligations are the ones you already carry: a Bank Secrecy Act program with customer due diligence, transaction monitoring and suspicious activity reporting, and OFAC sanctions compliance, which is strict liability. What changed is permission. On 7 March 2025 the OCC issued Interpretive Letter 1183, which rescinded the earlier requirement that national banks obtain supervisory non-objection before crypto custody and related activities. Interpretive Letter 1184 followed on 7 May 2025 and confirmed that national banks may buy and sell crypto held in custody at the customer's direction. The FDIC's FIL-7-2025, issued 28 March 2025, told state nonmember banks they no longer need prior approval either.

Permission came with the expectation that the controls are the same quality as for fiat. For the blockchain side, the clearest primary text is OFAC's October 2021 sanctions compliance guidance for the virtual currency industry. It names the practices examiners look for: screen at onboarding, screen transactions including the wallet addresses involved, rescreen on a risk basis, and use geolocation to block IP addresses from comprehensively sanctioned jurisdictions. It also says firms can use listed addresses to find other addresses tied to the same blocked person, and that OFAC does not require any particular software.

How many bitcoin addresses are on the OFAC sanctions list?

532 unique addresses. We downloaded the SDN XML published 5 October 2026 (19,363 records), took every identifier typed "Digital Currency Address - XBT" and got 534 entries that collapse to 532 addresses, because one address is listed under two people and another twice under one entity. One of the 532, TUCsTq7TofTCJRRoHk6RvhMoS2mJLm5Yzq, is a Tron address mislabeled as bitcoin, so 531 are valid on the Bitcoin chain. Read from the CSV instead of the XML, you would see roughly half of them, because the CSV crams crypto addresses into a remarks field capped at 1,000 characters.

Then we looked each address up on the chain at block 970,336 on 7 October 2026.

The held balance is concentrated: three addresses under a single SDN entry in the TCO program hold 77.7 percent of it, and the total moved by only 0.00203104 BTC since we last read it at block 965,562 in early September. Over their lifetime the listed addresses have received 249,771.46 BTC. Almost all of that has moved on, which is the real point for a bank. Your customer is far more likely to receive coins that passed through a listed address than to receive them from one directly.

Do banks need blockchain analytics for crypto?

Yes, in practice, though not by name. OFAC does not require a particular product, but a bank cannot meet its own screening expectations for wallet addresses with a name-matching engine built for wires. Something has to read the chain: whether an address matches a listed one, who paid it, and where its coins came from one step back. That can be a large analytics vendor, a narrower screening API, or both, and the choice depends on which crypto activities you actually run.

Which bank activities need bitcoin screening

Banking a crypto business, an exchange or a kiosk operator on the fiat side is a different job. Your monitoring there runs on wires and ACH, and the blockchain screening is your customer's control. You review their program rather than screen their addresses yourself.

Best crypto AML software for banks compared

Five tools come up in almost every bank evaluation. The first three are full blockchain analytics suites, the fourth sells the same idea at a published entry price through a node marketplace, and the last is ours.

Be clear about what each gives you. The large suites attribute addresses to mixers, darknet markets, scams and thousands of named services, which is what lets them say an address is "high risk" without any sanctions match. We do not do that. Our labels are a short list we can source, and we do not cluster addresses by heuristics. What we do is the sanctions half carefully: we read the structured XML, validate every address, trace direct counterparties in both directions and the funding behind inbound coins, and return the transactions behind each finding with the list version and block height the decision was made against. Our comparison of Scorechain pricing and a Bitcoin-only alternative goes through the trade-offs line by line, as does our AMLBot alternative page, and our earlier guide to sanctions screening APIs for fintech compliance covers the free list-only options.

How much does crypto AML software cost for a bank?

The big three do not publish prices, so expect an annual contract sized by volume, chains and seats, negotiated after a demo. Scorechain's QuickNode add-on is the one public entry point we found, from $50 a month for 100 checks. Our Enterprise plan is $1,498 a month, or $749 a month billed yearly, and one screening costs 10 of its 100 million monthly credits. For a bank, the bigger cost is usually analyst time spent clearing alerts, so weigh how quickly a tool shows the evidence behind a hit, not only the license line.

What examiners ask to see

An examiner reviewing a crypto custody program will pick a sample of deposits and withdrawals and ask you to show the screening for each: what was checked, against which list, when, and what the result was. Three habits make that easy:

• Record the list version. OFAC updates without a schedule. Store the publish date and record count of the file you screened against, so a decision from March can be rebuilt in October.
• Record the block. An address's history grows. A screen "at block 970,336" can be re-run and give the same answer. A screen "on Tuesday" cannot.
• Record coverage. A busy address may have hundreds of thousands of transactions. If your tool read only the newest few hundred, the file should say so, and a partial trace should never be filed as clean.

Our Bitcoin audit trail API covers the period-end side of the same evidence: balances at a named block for custody reconciliations and loan collateral.

How to set up bitcoin screening at a bank

1. Inventory the addresses that touch customer accounts: custody deposit addresses, declared self-custody wallets, collateral addresses and withdrawal destinations.
2. Screen at onboarding and keep each address in a screening book, so it is rescreened automatically when OFAC publishes a new list.
3. Screen every deposit before credit and every withdrawal before signing. Hold the transaction on a direct match; route exposure findings to review.
4. Route alerts to named analysts with a deadline, the same way you handle wire alerts. If your case queue is a shared inbox, a tool that will assign each alert to the right analyst automatically keeps hits from sitting overnight.
5. Document the decision with the list version, block height, transactions relied on and the reviewer's conclusion, and file a SAR where your policy requires it.
6. Test it yearly: screen a known listed address and a known clean one through the live pipeline and keep the output with your independent testing workpapers.

On BitcoinDatabase, step 2 is one call: POST /v1/screening/book takes up to 1,000 addresses at a time, the SDN XML is fetched twice a day, and every book entry is rescreened when a new list version lands. Step 3 is GET /v1/screen/{address}, which returns a risk level, the findings with their txid, hop and direction, and a coverage block that says how much of the address history was read. The Bitcoin address screening API page shows the response and lets you run the demo console.

Can a bank hold a customer's bitcoin if it came from a mixer?

That is a risk decision for your policy, not a yes or no in the rules. Mixer use is not itself a sanctions violation unless a listed mixer or listed address is involved, but most banks treat it as a high-risk indicator that triggers enhanced due diligence and, depending on the facts, a SAR. Detecting it needs attribution data that the large analytics vendors sell, which is one reason many banks run a broad vendor next to a high-volume sanctions screen.

For banks lending against bitcoin rather than holding it, our guide to bitcoin collateral monitoring for crypto lenders covers spend alerts and month-end balances, and the crypto transaction monitoring page covers watching addresses continuously.

BitcoinDatabase provides informational on-chain data and compliance tooling only. A risk signal is context for your own review, not a legal determination about any person, and this article is not legal advice. Regulatory letters are described as issued in 2025, the OFAC file was read as published 5 October 2026, and balances were read at block 970,336. Confirm current requirements with your counsel and your primary regulator before changing your program.