[wallet_screening] Aug 2026 sanctions / risk-list refresh (OFAC + peer lists)

[Hendobox]

Parent: #115 (Ph 1.x knowledge-base / data pipeline)

Context

Ross flagged that Chainalysis / OFAC recently added new crypto-related sanctions and that we should refresh our bundled lists. Trigger action:

• 2026-08-07 OFAC — Shelbit / SHPS Shelbit / Siavash Kayvanpour network + Aban Tether (OFAC recent actions, Treasury PR)
• Public identifiers include Digital Currency Address entries (BTC / ETH / TRX / SOL). Aban Tether has entity-level designation with no published wallet IDs — screeners still need the entity name on file for non-address matching / docs, but ETH hit coverage comes from the Shelbit-network addresses.
• Source UI: OFAC Sanctions List Search (CSV download; columns must be mapped into our normalized schema / FTM ingest).

Current Skillware gap (as of bundled data)

Dataset	Notes
entities.ftm.json	OpenSanctions-style FTM dump; datasets: il_mod_crypto only; last_seen max 2025-07-22 — pre-dates 2026 OFAC waves
ETH publicKey in FTM	Very few ETH keys (~14); Shelbit ETH (0xe05f…, 0x6b69…) not present
normalized_* (FBI / NBCTF / Uniswap-TRM)	Stamped 2025-07-22 / static TRM export
malicious_scs_2025.json	Tiny mixer/scam contract set

So this is not a one-off Shelbit patch — the whole Ph 1 refresh is overdue for Aug 2026.

Goal

Bring finance/wallet_screening bundled sanctions + high-risk wallet/contract lists current as of Aug 2026, with a repeatable normalize → commit → version-bump path (extend maintenance/, do not one-off edit JSON by hand if avoidable).

Scope

A. OFAC digital-currency refresh (priority)

1. Export from Sanctions List Search / OFAC SDN (CSV or advanced XML) filtering Digital Currency Address identifiers.
2. Add normalize_ofac_sdn_csv (or refresh OpenSanctions FTM crypto slice) in skills/finance/wallet_screening/maintenance/.
3. Map into our record shape used by _build_sanctions_index / additional datasets:
   • address, network (ETH/BTC/TRX/SOL/…), label, source (OFAC SDN), source_url, reason / program tags (SDGT, IRAN-EO13902, etc.), jurisdiction, extra (UID, entity name, listing date).
4. For ETH: ensure lowercase 0x keys land in the sanctions index (non-ETH can be stored for future multi-chain; document current ETH-only screening limit).
5. Include Aug 7 2026 Shelbit-network ETH addresses at minimum; ideally full delta since last bundle (last_seen 2025-07-22 → now).
6. Note Aban Tether: no wallet IDs in designation — document limitation (address screen alone will not catch Aban Tether counterparties unless addresses are later published or inferred from other lists).

B. Aug 2026 peer-list sweep (wallets + contracts)

Sweep / re-ingest public lists we already claim or that are adjacent to Ph 1.x in #115:

Must refresh (already in skill / RFC)

• OFAC SDN crypto identifiers (above) — primary
• OpenSanctions FTM crypto / il_mod_crypto (or broader sanctions crypto wallets) — replace stale entities.ftm.json
• Israel NBCTF wallet orders CSV → normalize_israel_nbctf_csv
• FBI Lazarus / cyber wanted crypto appendices → normalize_fbi_lazarus_csv
• Uniswap Labs / TRM public high-risk address list → normalize_uniswap_trm.py
• malicious_scs_2025.json — dedupe mixers + expand from current public mixer / scam-contract research sources (also closes the duplicate-addr cleanup quick win)

Strongly recommended 2026 deltas (public, high signal for ETH wallets/contracts)

• OFAC 2026 actions with published crypto IDs (at least since Jul 2025 bundle): Jan Zedcex/Zedxion; Mar DPRK IT workers; Apr CBI Tron + Cambodia scam network; May Sinaloa fentanyl-crypto; Jun Nobitex/Wallex/Bitpin/Ramzinex; Jun ISIS MSB facilitators; Aug Shelbit/Aban Tether
• UK OFSI May 2026 HTX / A7 / Russia-evasion crypto designations (addresses where published)
• EU 20th package Russia crypto sectoral measures — document policy impact; ingest only if concrete address lists exist
• MEW darklist / phishing contract lists (called out in [RFC]: Harden wallet_screening data pipeline, parsing, coverage, and report schema v2 #115 RFC)
• Chainalysis blog / public OFAC tracker as a checklist, not a data dependency (we cannot ship proprietary Chainalysis labels)

Out of scope for this sub-issue (already tracked elsewhere in #115)

• Live Chainalysis / TRM API (Ph 2.3)
• Schema v2 / risk_level (Ph 3)
• Etherscan tokentx / txlistinternal (Ph 2.2b remainder)

Deliverables

1. New/updated normalized JSON under skills/finance/wallet_screening/data/ + maintenance scripts/docs for re-run.
2. Short changelog note: source dates, entry counts, ETH unique delta, known gaps (Aban Tether, non-ETH chains).
3. Tests: at least one fixture asserting Shelbit (or other new) ETH address → sanctioned_entity_match.
4. Docs: fix stale “880+ lists” / Architecture counts in docs/skills/wallet_screening.md if still wrong after refresh.
5. Version bump for the skill package (patch) when data ships.

Acceptance

• Fresh OFAC (or OpenSanctions-backed) crypto addresses from post-2025-07-22 designations are hittable via screen_wallet.
• Maintenance path documented (CSV/FTM drop → normalize → data/).
• Peer-list sweep checklist above completed or explicitly deferred with reason in the PR.
• No secrets / proprietary Chainalysis dumps committed — public sources only.

References

• OFAC Sanctions List Search: https://sanctionssearch.ofac.treas.gov/default.aspx
• OFAC 2026-08-07: https://ofac.treasury.gov/recent-actions/20260807
• Treasury Shelbit / Aban Tether: https://home.treasury.gov/news/press-releases/sb0598
• Chainalysis OFAC tracker (sweep aid): https://www.chainalysis.com/blog/ofac-sanctions/

[Hendobox]

Parent tracker: #115.

Happy to take this as the next wallet_screening data slice after confirming with @rosspeili / picking it up formally.

[rosspeili]

This looks like a very good direction @Hendobox. While our kb/datasets work for wallet screening, I wonder if @rizzoMartin, who's tackled data engineering skills and our cli before, has a better idea of how we can create a knowledge base that would be liteweight, easy to maintain and scale, and easy to parse for any model via our adapters. <3