Sanctions screening

The Veris engine consults six concurrent sanctions sources on every payment. A hit on any one returns sanctions_clean = false. The matched source is recorded in the audit trail.

Six feeds

Source	Cadence	Coverage
OFAC SDN (US Treasury)	6 h	Specially Designated Nationals + sectoral sanctions
UN Security Council	6 h	Consolidated sanctions list
EU Sanctions Map	12 h	EU restrictive measures
Chainalysis Sanctions API	live	Address-level taint
TRM Labs API	live	Address-level taint, mixer indicators
Internal labeled-address graph	live	Mixers, sanctioned protocols, fraud rings

Multi-source dispatch is intentional: if any one provider goes offline, the others still cover the high-value sanctions lists.

Risk-tier rules

Veris assigns a tier on every payment by composing twelve features.

Low

• Counterparty in the agent’s whitelist, OR
• Counterparty in a known-good cluster (verified merchant, registered exchange).
• Amount under $1,000.
• Drift score under 100 bp.

Medium

• Counterparty unknown to the labeled-address graph.
• No historical drift.
• Amount under $10,000.

High

• Counterparty unknown.
• Mild drift (above 200 bp, under 1000 bp).
• Amount under $100,000.
• One sanctions source returned a soft match (similar address, not exact).

Blocked

Any of:

• Hard sanctions hit on either party.
• Severe drift (above 1000 bp).
• Amount above $100,000 without L4 enterprise attestation.
• Counterparty in a known mixer or sanctioned protocol cluster.

Blocked is a hard stop. The bundle does not assemble. The audit row is SAR-flagged.

Drift threshold

Drift score is recorded in basis points (0 to 10,000). Above the policy threshold the agent demotes one KYA level on the next evaluation cycle. Default thresholds:

KYA level	Drift threshold
L1	500 bp
L2	1000 bp
L3	2000 bp

Thresholds are configurable per tenant.

Where to go next

• L3 Veris for the BLS attestation behind every verdict.
• Compliance screening feature for the operator view.
• Audit trail for SAR flagging.