Noble Sight
The country field said Russia. The address said Simferopol.
In 2023 OFAC settled with three virtual-asset firms for the same screening gap. A customer picked a non-embargoed country from a drop-down and typed a Crimean city, or the word Crimea, somewhere else on the form. The screening tool read the country field and nothing else. This page quotes the three releases, states the control Noble applies to the whole record, and gives requests you can run against production with your own key, including the one that must stay silent.
Sources: CoinList Markets LLC, ofac.treasury.gov/media/932406 (PDF, 4 pages) · Poloniex, LLC, ofac.treasury.gov/media/931701 (PDF, 5 pages) · Uphold HQ Inc., ofac.treasury.gov/media/931556 (PDF, 4 pages). Every quotation below is verbatim from those documents. Part of Noble's enforcement series.
CoinList · 2023-12-13
89 accounts opened with "Russia" as the country and a Crimean city or "Crimea" in the address. 989 transactions over two years.
$1,207,830Poloniex · 2023-05-01
Customers who gave a sanctioned-jurisdiction address at onboarding were never re-screened when the program started. 65,942 apparent violations.
$7,591,630Uphold · 2023-03-31
A non-sanctioned country from a drop-down menu, Iran or Cuba in the free-text address field, which "Uphold did not screen".
$72,230.32KEY to a Noble API key. A free-tier key works; keys are invite-only while Noble is in beta (sales@noblesight.io). The names are synthetic; the geography is the point.
"Russia" in the country field, "Crimea" in another one
However, CLM’s screening procedures failed to capture users who represented themselves as resident of a non-embargoed country but who nevertheless provided an address within Crimea. In particular, CLM opened 89 accounts for customers, nearly all of whom had specified “Russia” as their country of residence but all of whom provided addresses in Crimea upon account opening, e.g., by identifying a city in Crimea or providing the term “Crimea.” Because “Russia” was provided in the country-of-residence field in these instances, CLM’s screening protocols failed to recognize that “Crimea” or a city name in Crimea, provided in another data field, indicated likely residence in Crimea.
CoinList Enforcement Release, page 1. Aggravating factor 1: CLM "failed to institute internal controls able to flag accounts whose owners described themselves as resident of Crimea" (page 2).
What failed
The customer told the truth. They just told it in the wrong box. A control that reads one field is a control the form design can defeat, and nobody has to intend it.
Noble's control
When no declared field carries an embargo, Noble scans location.region, location.city and the free-text address for a whole word naming the Crimean peninsula or a town on it, in Latin or Cyrillic. A hit raises the Crimea or Sevastopol advisory whatever the country field says, and jurisdiction_nexus names the field and the word, so the analyst sees that the address, not the country, was decisive. The country field is outranked, not ignored: under a declared country other than Russia or Ukraine the same word — a Crimean town is also a street in Sydney — is reported as a possible nexus, with the contradicting field named and the advisory at level possible_embargo_nexus, so a definitive embargo is never asserted on a Houston address.
Run it: the CoinList shape
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Ivan Petrov","country":"RU","address":"ul. Lenina 12, Simferopol, Crimea"}'
Run it: a city in the structured location, country Ukraine
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Ivan Petrov","location":{"country":"UA","city":"Yalta"}}'
Run it: the same thing in Cyrillic
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Ivan Petrov","country":"RU","address":"г. Севастополь, ул. Ленина 12"}'
The fields: jurisdiction_risk.jurisdiction, jurisdiction_nexus
# country RU, address "ul. Lenina 12, Simferopol, Crimea"
"jurisdiction_risk": { "jurisdiction": "UA-43", "name": "Crimea region of Ukraine", "program": "Ukraine-/Russia-Related Sanctions (embargoed region)", "authority": "E.O. 13685; 31 CFR Part 589", "level": "comprehensive_embargo", ... },
"jurisdiction_nexus": { "evaluated": "Simferopol", "source": "address", "status": "embargoed" }
# location {country UA, city Yalta}
"jurisdiction_risk": { "jurisdiction": "UA-43", ... },
"jurisdiction_nexus": { "evaluated": "Yalta", "source": "location.city", "status": "embargoed" }
# country RU, address "г. Севастополь, ул. Ленина 12"
"jurisdiction_risk": { "jurisdiction": "UA-40", "name": "Sevastopol (Crimea region of Ukraine)", ... },
"jurisdiction_nexus": { "evaluated": "Севастополь", "source": "address", "status": "embargoed" }
Captured from production on 2026-10-23, engine 2.4.0. The advisory is exactly the one a declared location.region: "UA-43" would raise; the nexus is the only thing that differs, and it says where the signal came from. Nothing about the name's score changes: the advisory is beside the matches, never inside them.
The fix OFAC recorded is a keyword list. So is ours.
Sixteen months later, in May 2015, Poloniex implemented a sanctions compliance program, which provided for a review of KYC information for new customers in jurisdictions subject to comprehensive OFAC sanctions; existing customers were not retroactively screened in this manner.
Creating a “Crimea IP blacklist” and “Crimean city/region keywords list” against which all account information was screened; and
Poloniex Enforcement Release, page 1 (the gap) and page 3 (remedial measure, from the mitigating factors).
What failed
Two things. New customers were reviewed, existing ones never were, so an address typed in 2014 stayed invisible for years. And "Crimea" in a profile was not a signal until a keyword list made it one, in August 2017.
Noble's control
The keyword list is in the engine, not in a spreadsheet, and it is tested against the release text it answers. The scan runs on every screening, and it also runs on the word that should not fire: "Krymskaya ulitsa" is a street in Moscow named after Crimea, and it stays silent, with the nexus saying what was evaluated instead. A name screened through POST /v1/screen is enrolled in portfolio monitoring on paid tiers and re-screened on every list change, which is the "retroactively" Poloniex lacked.
Run it: the word that must not fire
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Ivan Petrov","country":"RU","address":"Krymskaya ulitsa 4, Moscow"}'
The fields: jurisdiction_risk absent, jurisdiction_nexus present
"jurisdiction_nexus": { "evaluated": "RU", "source": "country", "status": "no_determination" }
# no "jurisdiction_risk" key in the response
Captured from production on 2026-10-23. Whole words only: a keyword inside a longer word never matches, and the adjective "Crimean" is not on the table. The response still says what it evaluated (the country, with no determination), so the absence of an advisory is an answer rather than a silence.
A drop-down, a free-text field, and a wallet address
For example, in some cases, while creating an account with Uphold, customers submitted their address location by selecting a non-sanctioned country from a drop-down menu, but also indicated their location in a sanctioned jurisdiction (i.e., Iran or Cuba) in the free text address field, which Uphold did not screen for sanctions compliance. In other cases, customers provided an identification document from a sanctioned jurisdiction, but Uphold did not screen or flag such documentation for sanctions compliance.
Uphold Enforcement Release, page 1. Among the remedial measures (page 3): "Implementation of an information technology solution to screen customer information provided in free text fields and identification documents" and "Real-time virtual currency wallet address screening".
What failed
Same shape as CoinList, different jurisdictions: the structured field was clean, the free-text field was not, and only the structured field was read. The remediation list is a product spec: screen the free text, screen the documents, screen the wallet.
Noble's control, and its edge
Iran and Cuba are countries, so Noble's control for them is the structured field: country: "IR" or location.country: "CU" raises the embargo advisory, and that is what a KYC form should send. The free-text keyword scan covers the Crimean peninsula, which has no country code to put in a drop-down; it does not look for "Iran" or "Cuba" in an address, and this page does not claim it does.
Wallet addresses are a different matter: every digital-currency address OFAC publishes on an SDN entry is an identifier Noble matches exactly, in the same request as a name or alone.
Run it: a listed wallet address, nothing else
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"ids":[{"number":"3Lpoy53K625zVeE47ZasiG5jGkAxJ27kh1"}]}'
The fields: matches[0].score, matches[0].matched_via, alert_id
"alert_id": 43354,
"summary": { "verdict": "confirmed_match" },
"matches": [
{ "uid": "36025", "score": 100, "last_name": "GARANTEX EUROPE OU", "programs": ["RUSSIA-EO14024", "CYBER4"], "prohibition_type": "blocking",
"matched_via": [{ "number": "3Lpoy53K625zVeE47ZasiG5jGkAxJ27kh1" }],
"ids": [
{ "id_type": "Digital Currency Address - XBT", "number": "3Lpoy53K625zVeE47ZasiG5jGkAxJ27kh1" },
{ "id_type": "Digital Currency Address - ETH", "number": "0x7FF9cFad3877F21d41Da833E2F775dB0569eE3D9" },
...
] }
]
Captured from production on 2026-10-23. The address is one OFAC published on the Garantex designation; it is public record. A wallet address on a deposit or withdrawal is screened the way a name is, scores 100 on an exact match, and raises an alert in the same response.
Run the five requests against your own key
Keys are invite-only while Noble is in beta. Ask for an invite code and you will have a key, and the five responses above, in a few minutes.