> ## Documentation Index
> Fetch the complete documentation index at: https://docs.range.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Sanctions and Compliance

> Screen counterparties against OFAC sanctions, issuer blacklists, malicious-address intelligence, and Range risk scores, for both transactions and watch-list changes.

These rules keep you on the right side of compliance by flagging interactions with
sanctioned, blacklisted, malicious, or high-risk addresses, and by alerting when a
monitored address's sanctions/blacklist status itself changes.

## Summary

| Rule | Account types | Status |
| - | - | - |
| Sanctions Check | Wallet (EOA) + counterparty | 🟢 Active |
| High-Risk Counterparty | Wallet (EOA) + counterparty | 🟢 Active |
| Risky Address Interaction | Wallet (EOA) / contract | 🟢 Active |
| Sanctions and Blacklist List Change | Any monitored address | 🟢 Active |
| Sanctioned Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Blacklisted Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Malicious Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Labelled Address Transaction | Wallet (EOA) | ⚪ Deprecated |

<Info>
  **Status note.** *Sanctions Check*, *High-Risk Counterparty*, *Risky Address
  Interaction*, and *Sanctions and Blacklist List Change* are live, they screen
  counterparties directly against the Range risk and sanctions APIs. The three
  **Address Token Interaction** rules are 🟡 **Building**: the rule logic is
  implemented, but they depend on per-block sanctioned / blacklisted / malicious
  address lists being fed in by the enrichment pipeline, which isn't wired up yet,
  so they don't emit alerts today.
</Info>

## Rules

<AccordionGroup>
  <Accordion title="🟢 Sanctions Check">
    **Detects.** A monitored wallet transacts with an OFAC-sanctioned or blacklisted
    address.

    | | |
    | - | - |
    | **Trigger** | A transfer where the counterparty is sanctioned or blacklisted, checked via the Range sanctions API. |
    | **Account types** | Wallet (EOA) + counterparty |
    | **Status** | Active |
  </Accordion>

  <Accordion title="🟢 High-Risk Counterparty">
    **Detects.** A monitored wallet transacts with a counterparty whose Range risk
    score exceeds a threshold.

    | | |
    | - | - |
    | **Trigger** | A transfer (above an optional minimum USD) where the counterparty's Range risk score ≥ the configured threshold. |
    | **Account types** | Wallet (EOA) + counterparty |
    | **Status** | Active |
  </Accordion>

  <Accordion title="🟢 Risky Address Interaction">
    **Detects.** A monitored address that carries a non-zero Range risk score has new
    transactions.

    | | |
    | - | - |
    | **Trigger** | A monitored address with a non-zero risk score is seen in new transactions, indicating possible association with malicious activity. *(Scheduled.)* |
    | **Account types** | Wallet (EOA) / contract |
    | **Status** | Active |
  </Accordion>

  <Accordion title="🟢 Sanctions and Blacklist List Change">
    **Detects.** A monitored address is added to or removed from the OFAC sanctions
    list or a stablecoin issuer blacklist.

    | | |
    | - | - |
    | **Trigger** | A watched address newly appears on, or drops off, the OFAC list or a stablecoin issuer blacklist (USDT, USDC, etc.). Filter by list type and change type (added / removed). *(Scheduled.)* |
    | **Account types** | Any monitored address (wallet / contract) |
    | **Status** | Active |
  </Accordion>

  <Accordion title="🟡 Sanctioned Address Token Interaction">
    **Detects.** A sanctioned address sends or receives a monitored token.

    | | |
    | - | - |
    | **Trigger** | A sanctioned address sends, receives, or holds the configured token. |
    | **Account types** | Wallet (EOA) + token / mint |
    | **Status** | Building: implemented, but not yet emitting (see note above). |
  </Accordion>

  <Accordion title="🟡 Blacklisted Address Token Interaction">
    **Detects.** An address on an issuer's blocklist sends or receives a monitored
    token.

    | | |
    | - | - |
    | **Trigger** | A blocklisted address (issuer blocklists, e.g. Circle / Tether) interacts with the configured token. |
    | **Account types** | Wallet (EOA) + token / mint |
    | **Status** | Building: implemented, but not yet emitting (see note above). |
  </Accordion>

  <Accordion title="🟡 Malicious Address Token Interaction">
    **Detects.** An address flagged for malicious activity (scams, exploits, wallet
    drainers) sends or receives a monitored token.

    | | |
    | - | - |
    | **Trigger** | A malicious-flagged address interacts with the configured token. |
    | **Account types** | Wallet (EOA) + token / mint |
    | **Status** | Building: implemented, but not yet emitting (see note above). |
  </Accordion>
</AccordionGroup>

## Deprecated

<AccordionGroup>
  <Accordion title="⚪ Deprecated rules (migration context)">
    Retired from a previous runner, kept for completeness:

    * **Labelled Address Transaction**: transactions involving labelled addresses (superseded by the risk- and sanctions-based rules above).
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.