In July 2025 the Office of Financial Sanctions Implementation (OFSI) published a Cryptoassets Threat Assessment, and one recommendation in it puts a number on a question that often goes unanswered: how deep should a check go? UK cryptoasset firms checking where crypto has come from are advised to scan at least three to five hops of transaction history, or until the funds reach an identified service provider.
Each hop is one transfer between wallets, and that includes moves through exchanges and smart contracts. Addressed to cryptoasset firms, the recommendation does not say how far it applies to a company taking the occasional payment in USDT, which is a question for that company’s adviser. As a yardstick for how deep a sensible check goes, it is a useful one.
Why one step back is not enough
Whoever pays an invoice is rarely where the money began. Their wallet is one stage in a path, and the stage that matters can sit two or three transfers earlier.
OFSI’s own examples are simple chains. A one-hop chain has a designated address, meaning one that belongs to a sanctioned person, paying the end user directly. Two hops put an intermediate address between them, and three hops put two. Applied to a business, the end user is the wallet that paid it, so a check that looks only one step behind that wallet could miss a designated address sitting three transfers back.
Exposure does not disappear as hops are added, the assessment says. Extra hops only make the link harder to see, and some services exist to stretch the path: OFSI points to mixing and tumbling services designed specifically to increase hop distance.
What the stopping rule adds
The second half of OFSI’s rule matters as much as the number. A trail through unlabelled wallets keeps going, while one that reaches an identified service provider has arrived somewhere with a name attached. Knowing where that point falls is as useful as counting the hops to it.
That figure is also a minimum, in OFSI’s words, and the assessment asks firms to take a risk-based approach, so it works as a floor and not a ceiling.
Where manual checking runs out
Block explorers show every transfer, but they show one address at a time. Following five hops by hand means opening an address, reading its counterparties, choosing which to follow and starting again, and a single transfer can fan out into several. Five hops can easily mean dozens of addresses, and the work repeats for every payment worth checking. Add a bridge between networks and the trail changes chains halfway through.
OFSI acknowledges the problem. Blockchain analysis tools, it notes, can trace connections across hops, and it encourages firms to consider specialised software as part of their due diligence.
Image by tirachardz on Magnific
What a network map changes
FinTracer is a blockchain intelligence platform built for institutions such as banks, payment providers and exchanges, and it approaches the depth problem visually. Its network maps present transaction flows as wallets joined by the transfers between them, so counting hops becomes a matter of following lines instead of opening addresses. Among its investigation features, the site includes cross-chain wallet tracing.
Alongside the map sits FinTracer’s entity risk analysis, which the site describes as identifying risky wallets and entities and evaluating exposure to sanctions. This speaks to the second half of OFSI’s rule: recognising where a trail has reached a named party. Getting started with FinTracer takes a short registration.
Why the question is arriving now
By its own account, OFSI treats the use of cryptoassets to evade sanctions no differently from the misuse of traditional currencies. In January 2026 it described joint work with partners including the National Crime Agency, the Metropolitan Police, HMRC, the Financial Conduct Authority and the City of London Police, which led to action against potential breaches involving cryptoassets by UK-based individuals.
Elsewhere, the assessment judges that most non-compliance by UK cryptoasset firms has occurred inadvertently, with direct and indirect exposure and delayed attribution among the common causes. Put practically, a business that takes crypto payments should pick a depth deliberately and not leave it to whatever the first lookup happens to show.
A reference point worth keeping
How far back is far enough? OFSI’s rule for crypto firms has two halves: a minimum number of hops, and a stopping point at a service the trail has already named. Any business can borrow that structure and set its own line on purpose, and FinTracer pairs its maps with entity analysis, which gives a reviewer something firmer to work from than a bare list of addresses.
None of this is legal advice, and a company with significant crypto exposure should speak to a qualified adviser.
Leave a Comment