RISK OFAC fines start at $356,000 per violation

Your agent paid a sanctioned wallet at 3 AM.
Monday morning the OFAC notice lands on your desk — $356,000.

“I almost found out the hard way on test #47. Here is the 1 curl call that saved me — and will save you.”— Maryan, founder

You are shipping your first x402 payment agent this month. It pays invoices in USDC while you sleep. If it touches one of 947 OFAC-listed wallets, the fine is yours — not the protocol's, not the wallet's. Screen every counterparty before money moves. One curl call. Under 100 ms.

947 crypto wallets 19,218 SDN names 16 jurisdictions $0 to start

TL;DR: agentmail is an OFAC sanctions screening API for AI agents. One HTTP call before every payment: clean = proceed, flagged = halt. Covers 947 crypto wallets, 19,218 names, and 16 jurisdictions in under 100 ms. Free tier (5 checks/day, no key), paid from $19/mo, or $0.05/check via x402. MIT-licensed and self-hostable.

Try it free →
↓ How it works No signup · 5 checks/day free · runs in 30 seconds
screen before payment — 92ms
$ curl "https://agentmail-api.fly.dev/sanctions?wallet=0x742d35Cc6634C0532925a3b844Bc9e7595f0bEbb"
{
  "clean": true,
  "action": "ALLOW",
  "checked_against": { "wallets": 947, "names": 19218 },
  "latency_ms": 92
}
⚠

Every day, more agents get the ability to send money autonomously. The payment rails (x402, AP2, ACP) do not check OFAC. If your agent pays a sanctioned wallet, you are liable — not the protocol, not the wallet. We are building the compliance layer before the first massive fine makes agent payments illegal. Check your first wallet now →

Works with ● x402 ● MCP ● Base / USDC ● Claude Code ● Cursor ● LangChain
Research ★ 2026 SEI Report ★ SEI Calculator
In the conversation with ◆ x402 working group ◆ Anthropic agent docs ◆ Base / Coinbase AgentKit ◆ LangChain ecosystem ◆ OFAC SDN list (live mirror) ◆ Model Context Protocol

agentmail is built alongside the protocols that move agent money. We are not waiting for the first enforcement to make this mandatory.

The story

I was building an agent that pays invoices. Then test #47 sent USDC to a wallet I did not recognize.

“
“I checked the wallet against the OFAC SDN list. It was there. If that had been production, I would be looking at a $356,000 fine right now. The agent did not know what OFAC was. It just saw ‘pay invoice #4021’ and sent USDC — and it would have done it at 3 AM, repeatedly, until someone noticed.”

Maryan — founder, agentmail

I sat there staring at the screen thinking: if I had deployed this to production, I would be looking for a new job right now.

The problem was not the agent. The problem was that nobody was checking. The big payment rails handle moving money — they do not screen recipients. That gap is why I built agentmail.

The first question developers ask me: “Doesn’t my payment provider handle this?” No. x402, AP2, ACP, Coinbase AgentKit — none of them check OFAC. They move money. They do not screen recipients. That is your responsibility — and ours.

Your agent needs this check. Not next quarter. Not after the compliance notice. Before you deploy.
Why this, not them

Chainalysis and Elliptic exist. They are not for you.

The big compliance vendors built for banks — six-figure annual contracts, a sales call, a private API key, and a dashboard a human logs into. That works when a compliance officer reviews transactions over coffee. It does not work when an agent pays an invoice at 3 AM in 200 milliseconds.

I looked at wiring one into test #47. The SDK wanted a key. The key wanted a procurement cycle. The cycle wanted a budget that didn't exist yet. So I built the other thing: compliance that speaks the agent's protocol, pays its own way, and costs less than a coffee. No key to leak. No contract to sign. One curl before money moves.

The compliance layer for the agent economy. Every agent that can pay needs a screen before it pays. The first massive fine will not kill autonomous payments — it will make this layer mandatory. We are building it now, in the open, at five cents a check. Join before that day →
Live data, not a testimonial

No invented quotes. These numbers are live right now.

947 OFAC wallets 19,218 SDN names 16 jurisdictions hourly sync <100 ms per check
real response — sanctioned wallet detected
$ curl "https://agentmail-api.fly.dev/sanctions?wallet=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
{
  "matches": [{ "list": "OFAC_SDN",
                 "match_type": "wallet_exact",
                 "confidence": 1.0 }],
  "clean": false,
  "action": "BLOCK"
}

That wallet is on the real OFAC list — run the curl and confirm it yourself. When real customers tell us what agentmail did for them, their words go right here. Not before.

19,218
SDN names, from US Treasury sdn.csv
hourly
data sync — never stale
MIT
licensed — self-host any time
$10K
legal-fee guarantee on paid plans

Run your first check right now. Free.

No signup, no API key, no credit card. Paste any wallet address and see the result instantly — or drop your email and I'll send you the 5-day agent compliance Soap Opera:

  1. Day 1: The wallet that almost cost me $356,000 (the epiphany)
  2. Day 2: The 3-line curl that screens any wallet in 100 ms
  3. Day 3: Why x402, AgentKit and AP2 will never screen for you
  4. Day 4: Wire it into your agent before production (copy-paste)
  5. Day 5: The deployment checklist + the first real fine prediction

The curl works right now — no waiting. The email series is a bonus, not a gate.

This returns OFAC match data in under 100 ms. Try it with any EVM wallet. 5 checks/day, free forever.

What happens if you do nothing

Nothing changes today. Your agent keeps paying. Maybe nothing happens this week — there are 947 sanctioned wallets and your agent touches a handful of counterparties.

But agents are getting more autonomous every month. More wallets, more chains, higher amounts. The rails they run on — x402, AgentKit, AP2, ACP — do not screen. They never will on their own. The first time your agent pays the wrong wallet, the notice is $356,000. Not a bug report. Not a refund. A fine that lands on whoever deployed the agent.

Six months from now, when the first agent-driven OFAC enforcement makes the news, you'll either have had this screen in place for months — or you'll be explaining why you didn't. The curl above takes 30 seconds. Run it now →

What you get

Four primitives your agent calls before every payment

Drop them into any pipeline that moves money. HTTP, MCP, or CLI. Each returns in under 100 ms.

🔎

sanctions_check

Screen any EVM, Bitcoin, or Tron address against 947 OFAC-listed crypto wallets. Returns match or clean in under 100 ms.

⚠

risk_score

Analyze amount anomalies, rail risk (x402, AP2, ACP), and category exposure. Returns a clear allow, review, or decline.

🦉

kya_verify

Know Your Agent: trust-score counterparties from transaction history and wallet age.

⚖

dispute_open

File disputes when something goes wrong. 7-day auto-escalation with a full audit trail.

🚀

Ship in minutes

One endpoint, one curl, zero infra. MCP server included for Claude Code & Cursor.

The value stackWhat your agent actually gets

1
sanctions_check — 947 OFAC wallets + 19,218 names + 16 jurisdictions, hourly sync, <100 ms
$499/mo
2
risk_score — amount anomalies + rail risk (x402/AP2/ACP) + category exposure
$299/mo
3
kya_verify — Know-Your-Agent trust scoring from wallet age + history
$199/mo
4
dispute_open — file disputes with 7-day auto-escalation + audit trail
$99/mo
Total monthly value$1,096
You pay$19/mo
Get your API key →

Or start free — 5 checks/day, no signup, no credit card. MCP + HTTP + CLI.

Pricing

Free to start. $19 in production.

OFAC penalties start at $356,000 per violation. agentmail starts at $0.

Free

$0 /check

For kicking the tires.

  • ✓ 5 checks / day
  • ✓ sanctions_check
  • ✓ Rate limited
  • ✓ No signup needed
Try it now

5 checks/day, free forever. No credit card. No time limit.

Most popular

Dev

$19 /mo

For agents in production.

  • ✓ 10,000 checks / month
  • ✓ All 4 tools
  • ✓ API key + audit log
  • ✓ Priority support
Get your API key →

First month free. Cancel anytime. First 50 devs locked in at $19/mo forever. If we miss a sanctioned wallet, we cover the first $10K of your legal fees.

Pro

$99 /mo

For teams shipping at scale.

  • ✓ 100,000 checks / month
  • ✓ All 4 tools
  • ✓ API key + audit log
  • ✓ Priority support + SLA
  • ✓ Custom risk rules
Get your API key →

Same $10K guarantee. Priority SLA. Custom risk rules for production teams.

Works with what you already use

Fits the stack your agent runs on

One HTTP call works everywhere. No SDK lock-in — if your agent can make a request, it can screen.

x402

x402 payments

Every x402 round-trip is a funds transfer. Insert a sanctions check between the 402 and the settle — the agent never signs a transfer to a flagged wallet.

🤖

Agent frameworks — LangChain, CrewAI, Eliza, OpenAI Agents SDK

Any agent that speaks HTTP calls the endpoint. Tool-calling agents get native function access via the MCP server.

🔌

MCP — Claude Code, Cursor, Windsurf

pip install sanctions-mcp — all four tools become native functions in your coding agent.

⚙

Coinbase AgentKit, AP2, ACP

These rails authorize payments — they do not screen. Wire the check into your payment path before any transfer is signed.

The Framework

Every compliant agent payment passes through four gates.

Not a checklist. Not a dashboard. A protocol — the same way TLS is a protocol. We call it The 4-Gate Agent Payment Protocol™. Your agent runs every payment through it in under 100 milliseconds. No gate is optional. No gate can be skipped.

01 Gate One

SCREEN

Every counterparty checked against 947 sanctioned crypto wallets + 19,218 names before the payment moves. Not after. Before.

02 Gate Two

SCORE

Real-time risk scoring in under 100 ms. The agent doesn't wait. The agent doesn't skip. The score comes back before the transaction is signed.

03 Gate Three

STOP

Sanctioned wallets blocked automatically. No override, no “are you sure”, no $356,000 OFAC fine.

04 Gate Four

STAMP

Every approved payment gets a compliance receipt. Audit-ready. Regulator-ready. If OFAC ever asks, you already have the answer.

SCREEN → SCORE → STOP → STAMP. Four gates, four milliseconds of agent time, zero exceptions. That is the protocol.

The Bigger Fight

We're not building a sanctions API. We're building the compliance layer for autonomous commerce.

The next million payment decisions won't be made by humans. They'll be made by software — at 3 AM, at scale, without supervision. Every single one of them should be screened the same way a bank screens a wire transfer: automatically, instantly, and with a paper trail.

We're not building a sanctions API. We're building the compliance layer for autonomous commerce. If your agent can spend your money, it should answer to the same rules your bank does.

— The agentmail team

Screen your first agent payment Re-read the 4-Gate Protocol
The case for screening

One idea changes everything: screen before you sign.

Every agent-payment sanctions violation on record would have been prevented by a single check placed before the transaction was signed. That is the whole product.

In Test #47 the agent sent USDC to a wallet on the OFAC SDN list. The tx confirmed in 12 seconds. The liability attached the moment it did — up to $377,700 per violation, strictly enforced, regardless of intent. The fix was not a bigger compliance team. It was a single HTTP call placed before the signing step, returning ALLOW or BLOCK in under 100 milliseconds.

That call is what agentmail is. Nothing more, nothing less — and that is the point.

Three things you might be telling yourself — and why they are wrong

FALSE BELIEF 1 — “My payment provider already handles OFAC.”

They do not. x402, AP2, ACP, and Coinbase AgentKit move money — none of them screen the recipient against the SDN list. Their terms say so explicitly. Screening is a separate layer, and it is legally yours.

FALSE BELIEF 2 — “Compliance is too hard for me to wire in.”

It is one curl line. sanctions_check before you sign the tx. If you can call your payment API, you can call this — it is the same shape, returns in under 100ms, and there is a copy-paste snippet for Python, JS, and curl.

FALSE BELIEF 3 — “I will add it later, when it matters.”

OFAC enforcement is strict liability — intent does not matter, timing does not matter, “I was going to add it” does not matter. The first violation is the one that lands. Later is the most expensive word in compliance.

So here is the offer.

947 wallets. 19,218 names. 16 jurisdictions. Four tools. One 100ms call.

$1,096/mo   $19/mo

Get your API key →

If we miss a sanctioned wallet, we cover the first $10,000 of your legal fees.
First 50 devs locked in at $19/mo forever. Cancel anytime. No credit card to start free.

FAQ

Agent questions, answered

No. x402, AP2, ACP, and Coinbase AgentKit move money — none of them screen recipients against the SDN list. Compliance is a separate layer and it is your responsibility. agentmail is that layer.
Synced hourly from the official US Treasury SDN list. Every check runs against the freshest data.
EVM chains (Ethereum, Base, Arbitrum, Optimism and more), Bitcoin, and Tron addresses — 947 OFAC-listed wallets across all of them, plus 19,218 names and 16 jurisdictions.
Yes — anything that speaks HTTP works. We also ship an MCP server for Claude Code, Cursor, and Windsurf, plus a CLI and a Python package (pip install sanctions-mcp).
Yes. agentmail is MIT licensed and open source. The hosted API is the fast path; the self-hosted path is always free.

Your agent is one curl call away from being safe.

5 checks/day. No credit card. No signup. Just results.

Try it free →