Get alerted the moment a crypto address is added to the OFAC SDN list

1. Pick what to watch — individual (chain, address) pairs, or a whole sanctions program.
2. We re-check the SDN list every hour and diff it against the previous snapshot — added, removed, or modified.
3. You get pushed within minutes over webhook, email, and Telegram — the same speed on every plan, including Free.

We don't resell the data — the SDN list is public and free. We monitor it and tell you the instant it changes for the addresses you watch.

Webhooks arrive as a signed POST (HMAC-SHA256) the moment a watched address changes. The payload tells you exactly what happened and to whom:

{
  "event_id": 84213,
  "event_type": "address_added",
  "detected_at": "2026-05-31T14:02:11.530000+00:00",
  "entity_name": "SUEX OTC, S.R.O.",
  "entity_country": "Russia",
  "entity_programs": ["CYBER2"],
  "chain": "ETH",
  "address": "0x2f389ce8bd8ff92de3402ffce4691d17fc4f6535",
  "fields_changed": ["status"],
  "raw_diff": { "status": { "old": null, "new": "active" } }
}

• event_type — address_added or address_removed for wallet-level changes (entity-level events are also available).
• fields_changed / raw_diff — the precise before/after, so your pipeline can act on exactly what moved.
• entity_programs — the OFAC program codes, so your routing rules can filter.

Full payload spec, signature verification (Python & Node), and retry semantics are on the API & webhooks reference.

OFAC removes addresses as well as adding them — Tornado Cash was de-listed in 2025. A monitoring tool that only watches for additions leaves you acting on stale risk. OFAC Alert fires address_removed events too, so your records stay accurate in both directions.

• OFAC's govdelivery email list is generic press-release email — not crypto-specific, no addresses, nothing to route into your systems.
• The free Chainalysis oracle / screening APIanswers “is this address sanctioned right now?” on demand — but it's pull-only. To get notified you'd have to poll it, diff the results, and build the delivery yourself. See the Chainalysis Sanctions Oracle alternative for the full comparison.
• A DIY cron jobworks until it doesn't — the poller dies quietly and you find out when an examiner does. We run that layer with delivery retries and a transparent freshness record.