# Nobody Can Refuse an Incoming Transfer: How zScreen Handles Sanctioned Contact *Almost half of wallet contact with sanctioned addresses is money the wallet owner received and never chose. Here is how Zeru's zScreen wallet screening treats incoming transfers, and why.* By [ZeruAI - zScore, Zaps and Zapperboard News](https://blog.zeruai.org) ยท 2026-10-21 --- [zScreen](https://zscreen.zeruai.org/) is [Zeru](https://zeruai.org/)'s wallet screening and on-chain risk tool. You submit an address and get a Clear, Review or Flagged verdict with the transaction trail behind it. This post explains one design decision that shapes a lot of those verdicts: zScreen remembers what a wallet sends, and it does not hold what a wallet receives against it. The arrow is the hard part Run a screening service for long enough and it starts catching things nobody has labelled yet. A wallet turns up moving several hundred million dollars into an address on a sanctions list, such as the [OFAC SDN list](https://ofac.treasury.gov/). The address was already known. The wallet was not. A week later someone screens a third wallet that had sent money to the first one, and the real question arrives: does that count? Most people assume the hard part is choosing the numbers. How much money, how far back, how many hops. For us the hard part was direction. Almost half of it is not a choice --------------------------------- We went back over the 51,217 screened wallets and asked a simpler question than the usual one. Of the wallets with any recorded contact with a sanctioned address, which way was the money going? **47.5%** of that contact was money arriving, and nothing else. On most chains there is no way to decline an incoming transfer. There is no inbox and no accept button, and nothing to hand it back with. Someone types your address and presses send. From that moment your wallet has touched a sanctioned address, permanently and in public, with a timestamp. The $30 attack -------------- This is unfair to the recipient, and it is also cheap. An attacker holding one address that is already listed can send a worthless sliver of a token to ten thousand strangers for roughly $30 in fees. If a screening system counts contact in either direction, one afternoon of that work marks ten thousand wallets. None of the owners did anything, and none of them could have stopped it. Point it at the customers of a business you dislike and a compliance tool becomes a weapon against them. Any rule that strangers can trigger will eventually be triggered by strangers on purpose. So the rule is about direction and not about size. zScreen remembers what a wallet sent. Addresses that send to everyone ------------------------------- Direction alone is not enough, because some addresses deal with the whole market as routine. An exchange wallet, a bridge, a payment processor. If inference is allowed to run through one of those, a single sanctioned deposit into a large exchange puts every customer of that exchange one step from a sanctions hit. The screen would light up like a switchboard and tell you nothing, because everything would be connected to everything. So an address that deals with a very large number of distinct counterparties is recorded and then stops. It is a boundary. What arrives there does not travel onward. What survives both rules ------------------------ Together the two rules are strict, and they are meant to be. Figures from one replay over previously screened wallets: * **6.9%** of the screened corpus qualified at all. * **1,640** addresses pass the inference onward. * **121** are recorded as boundaries, where it stops. * **$424,528,620** is the largest single qualifying transfer. Review is not Flagged --------------------- The second half of the design matters as much as the first. Something zScreen caught by itself is not the same class of evidence as something a government published, and it is not allowed to act like it. A wallet one step from an address zScreen identified itself can be raised to Review. It can never be Flagged outright. The two bars are different on purpose, because errors here do not stay the same size. One wrong call in the first generation becomes a hundred wrong calls in the second, and they look exactly as confident as the real ones. A few rules follow from that: * **Receiving alone never gets written down.** Five million dollars arriving from a sanctioned address records nothing about the recipient, who did nothing. * **Dust is not a memory.** A cent moved on purpose is not evidence of a relationship. It is evidence that somebody paid a fee. * **Inference can review, never convict.** No amount of second-hand contact produces a flag, at any sum, on any chain, however many times it recurs. * **Unreachable means fewer answers, not softer ones.** When the record of what zScreen caught cannot be read, the result is fewer escalations and never a false one. Argue from the sending end -------------------------- The industry argument about tainted money is almost always conducted from the receiving end. Does what landed in your wallet make you dirty, how many hops does taint survive, does it fade. That is the wrong end to argue from, because receiving is not an act. Half the contact we measured was incoming, and for $30 anybody can manufacture more of it. A rule that counts it is a rule that can be aimed at you. You can screen any address at [zscreen.zeruai.org](http://zscreen.zeruai.org). zScreen is built by [Zeru AI](https://zeruai.org/), the team behind zScore. --- *Originally published on [ZeruAI - zScore, Zaps and Zapperboard News](https://blog.zeruai.org/nobody-can-refuse-an-incoming-transfer-how-zscreen-handles)*