You've built a stablecoin compliance program, implemented transaction monitoring, and trained your team on sanctions screening. Now comes the hard part: deciding when to freeze an address on-chain.
This isn't just theoretical. Under proposed frameworks like the GENIUS Act, stablecoin issuers face Bank Secrecy Act-level obligations. California's SB 1208 allows law enforcement to require you to freeze funds for up to 10 business days. The expectation is clear: act when risk is identified.
But "when risk is identified" doesn't help much when you're staring at a flagged address late on a Friday. This decision matrix offers a structured framework for making freeze decisions under pressure.
Purpose of the Matrix
This matrix helps compliance teams at stablecoin issuers decide whether to freeze an address based on risk indicators, legal authority, and operational constraints. It's designed for real-time scenarios where you need to make defensible decisions with incomplete information.
Use it when:
- Your transaction monitoring system flags a high-risk address.
- Law enforcement contacts you about specific wallet activity.
- Sanctions screening identifies a potential match.
- Your blockchain analytics provider surfaces illicit activity exposure.
Prerequisites
Before using this matrix, ensure you have:
Technical capability: Smart contract functionality to freeze or blacklist addresses without a full contract upgrade.
Data sources: Subscriptions to at least one blockchain analytics platform and real-time sanctions screening against OFAC SDN, UN, EU, and UK HMT lists.
Internal governance: A documented escalation path defining who can authorize a freeze (typically your MLRO or legal counsel) and the timeline for doing so.
Documentation system: A secure case management tool to record risk indicators, decision rationale, and approval trail for each freeze action.
The Decision Matrix
Copy this table into your internal wiki or compliance playbook. Score each flagged address across these dimensions, then use the action threshold at the bottom.
STABLECOIN ADDRESS FREEZE DECISION MATRIX
Address: [wallet address]
Date flagged: [timestamp]
Flagged by: [system/person]
┌─────────────────────────────────────────────────────────────────┐
│ RISK INDICATOR SCORING (0-3 points each) │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. SANCTIONS MATCH │
│ □ 0 = No match │
│ □ 1 = Weak match (common name, no other identifiers) │
│ □ 2 = Moderate match (multiple shared attributes) │
│ □ 3 = Strong match (direct SDN hit or confirmed designation) │
│ │
│ 2. ILLICIT ACTIVITY EXPOSURE │
│ □ 0 = No known exposure │
│ □ 1 = Indirect exposure (3+ hops from flagged entity) │
│ □ 2 = Direct exposure (1-2 hops from ransomware/darknet) │
│ □ 3 = Primary actor (identified as mixer, scam, or theft) │
│ │
│ 3. TRANSACTION PATTERN RISK │
│ □ 0 = Normal activity │
│ □ 1 = Unusual but explainable (timing, amounts) │
│ □ 2 = Structured or layered movement │
│ □ 3 = Rapid liquidation or obfuscation behavior │
│ │
│ 4. LEGAL AUTHORITY │
│ □ 0 = No legal demand or regulatory guidance │
│ □ 1 = Informal law enforcement inquiry │
│ □ 2 = Formal request without court order │
│ □ 3 = Court order, warrant, or explicit regulatory directive │
│ │
│ 5. USER IMPACT ASSESSMENT │
│ □ 0 = High likelihood of legitimate user harm │
│ □ 1 = Mixed indicators (some legitimate activity present) │
│ □ 2 = Minimal legitimate activity │
│ □ 3 = No evidence of legitimate use │
│ │
├─────────────────────────────────────────────────────────────────┤
│ TOTAL SCORE: _____ / 15 │
└─────────────────────────────────────────────────────────────────┘
ACTION THRESHOLD:
12-15 points: FREEZE IMMEDIATELY
- Document decision and notify legal within 2 hours.
- Prepare for potential user dispute.
- Coordinate with law enforcement if applicable.
8-11 points: ESCALATE TO MLRO
- Do not freeze without approval.
- Gather additional intelligence.
- Set 24-hour decision deadline.
4-7 points: ENHANCED MONITORING
- Flag address for ongoing surveillance.
- Schedule 72-hour review.
- Document rationale for non-action.
0-3 points: STANDARD MONITORING
- Log incident.
- Return to normal surveillance.
- Reassess if new indicators emerge.
APPROVAL RECORD:
Decision: [Freeze / Escalate / Monitor / Clear]
Approved by: [Name, Title]
Timestamp: [Date/Time]
Rationale: [2-3 sentence explanation]
Customizing the Matrix
Adjust scoring weights if your risk appetite differs. Some issuers weight legal authority higher and won't freeze without formal process. Others prioritize sanctions matches and freeze on strong hits regardless of other factors.
Add jurisdiction-specific indicators if you operate in states with explicit digital asset enforcement frameworks. For example, if you're subject to California's SB 1208, add a checkbox under legal authority for "10-day freeze request from California law enforcement."
Define your escalation contacts in the approval section. Don't leave it generic. List your MLRO's name, your outside counsel's contact, and your internal legal team's Slack channel or ticketing queue.
Set clear timelines for each action threshold. Specify response windows: 2 hours for immediate freezes, 24 hours for escalations, 72 hours for enhanced monitoring reviews.
Integrate with your case management system. This matrix should live in the same tool where you document SARs, sanctions screening decisions, and transaction monitoring dispositions. Each scored address should generate a case ID you can reference if questioned by regulators or auditors.
Validation Steps
After customizing the matrix, test it against known scenarios:
Run historical cases through the scoring system. Take the last 10 addresses you froze (or considered freezing) and score them retroactively. Do the scores align with your decisions? If not, recalibrate your thresholds or adjust your indicator definitions.
Conduct tabletop exercises with your compliance team. Present a hypothetical flagged address with incomplete information and have team members score it independently. Compare results. If scores vary by more than 3 points, your indicator definitions aren't clear enough.
Get legal sign-off on your action thresholds. Your outside counsel should review the "freeze immediately" threshold to confirm it aligns with your regulatory obligations and doesn't expose you to unnecessary liability from false positives.
Document your validation. Regulators will want to see that you didn't just copy a template from the internet. Keep notes from your tabletop exercises, your legal review, and your threshold calibration process. This documentation proves you've tailored the matrix to your specific risk profile.
Review quarterly. Regulatory expectations shift. New enforcement actions create precedent. Blockchain analytics tools improve. Set a recurring calendar reminder to revisit your scoring criteria and action thresholds every 90 days.
The freeze decision will never be easy. But with a documented framework, you can at least make it defensible.
