TL;DR - No - a spot Bitcoin ETF custodian screens every incoming coin against sanctions and known-illicit-address data before it is credited to the trust, and a flagged deposit gets rejected or quarantined, never turned into shares.
Spot Bitcoin ETF prospectuses spend pages on expense ratios and creation baskets. They say almost nothing about what happens to a coin in the hour before it counts toward net asset value. Ark 21Shares, Bitwise, and CoinShares each disclose the same control buried in their SEC filings: a custodian runs every inbound bitcoin deposit through sanctions and illicit-activity screening, and anything that fails stays outside the fund.
The SEC approved the first 11 spot Bitcoin ETFs on January 10, 2024. Every issuer that launched one since has had to answer the same custody question before day one: who holds the coins, and what stops a sanctioned one from getting in.
What actually happens when a custodian takes a bitcoin deposit?
A new deposit lands at a fresh address generated by the custodian, and that address gets a full look before anything is credited. The custodian pulls the address's transaction history and runs it against sanctions lists and known-illicit-address databases from vendors like Chainalysis and Elliptic. A clean history clears in minutes. A hit on the OFAC Specially Designated Nationals list, a mixer, or a ransomware wallet does not.
Flagged coins get quarantined, not shares.
A clean deposit clears in minutes. A flagged one never reaches the reserve.
Where do spot Bitcoin ETFs actually keep their coins?
Coinbase Custody holds the bitcoin behind BlackRock's IBIT and Fidelity's FBTC. BitGo backs several smaller issuers, including Bitwise's fund. Gemini and Komainu serve a handful of others. Each one is a qualified custodian under SEC rules, and each one disclosed, in a 10-K, a prospectus, or both, that incoming assets are screened before they are accepted into reserve.
That detail rarely makes it into a press release. It sits in the risk-factors section instead, next to the paragraphs about custody insurance and key management.
SEC filings call it a control, not a suggestion.
Bitwise's 10-K for fiscal year 2025 and CoinShares' equivalent filing, both covering the period ending December 31, 2025, describe sanctions and illicit-activity screening as part of the custodian's standard onboarding process for fund assets, not an optional extra layered on top. That phrasing matters. A control described in a public filing is something regulators can test the issuer against later, and a custody agreement that skipped it would be a problem for the fund's auditors long before it became a problem for an investor.
A missed deposit-level screen is an audit finding waiting to happen.
The same question applies on the way out, not just the way in. Since regulators cleared in-kind creation and redemption for spot Bitcoin ETFs, authorized participants can deliver bitcoin straight to the trust instead of cash. That means the custodian's screening desk isn't just watching retail-adjacent deposits anymore. An AP handing over coins directly goes through the identical check before the trust will take them.
What makes a coin fail that screening?
Direct sanctions hits are the clearest case: an address named on the OFAC SDN list, or one tied to a designated entity like Lazarus Group. The Treasury added dozens of crypto addresses linked to North Korean hacking operations to that list after the 2022 Ronin Bridge theft, and none of those addresses stopped moving funds just because they got listed. Sanctions screening catches the address itself. Counterparty analysis catches the coin that passed through one.
Plastron's own labeled corpus carries 3,907 addresses across scam, fraud, and hack categories, and 780 of those come straight from the OFAC SDN list. That is the same type of list a custodian checks a deposit against, just maintained independently, on its own update schedule.
Most of a screening corpus is high-risk scam and fraud activity, not sanctions hits - sanctions are the minority, and the most consequential one.
Anyone can look up a bitcoin address's balance and transaction history for free on a block explorer, but a plain transaction list will not say whether that address touched a sanctioned entity or a known-illicit wallet. Screen the address with Plastron first, and get a direct sanctions and known-illicit-label check on Bitcoin in seconds, free, before sending anything to an exchange or a custodian.
Retail holders face a thinner version of the same check.
A custodian stands between every ETF share and the coins backing it. A self-custody wallet has no equivalent gatekeeper. Nobody screens a personal wallet before a holder moves funds out of it, converts to cash, or bridges to another chain, unless the holder does that work themselves.
That gap is exactly why a tainted coin is more likely to surface in a self-custody wallet than inside a regulated trust. The custodian's screening happens once, at the door. A holder's screening, if it happens at all, usually happens after an exchange already froze a withdrawal. The same comparison plays out across custodial and non-custodial wallets generally, and it holds whether the asset sitting in the wallet is bitcoin or anything else.
A version of the custodian's own checklist works for a personal wallet too, before any transfer that matters:
Match the address against the OFAC SDN list, the same one custodians check
Cross-reference it against known-illicit labels for scams, mixers, and hacks
Review the address's recent transaction history for contact with a flagged counterparty
None of that requires an account with a custodian. It just requires running the check before the transfer, not after a compliance team asks why it's late.
A spot ETF's reserve-level controls don't tell you anything about the fund's day-to-day proof of solvency, either - that's a separate, and separately limited, kind of check. You can also see how a Bitcoin wallet check compares to the deeper multi-hop analysis available on other chains with a bitcoin wallet check.
FAQ
Which custodians hold spot Bitcoin ETF reserves?
Coinbase Custody holds the coins behind BlackRock's IBIT and Fidelity's FBTC. BitGo, Gemini, and Komainu custody reserves for several smaller issuers. All of them are SEC-qualified custodians.
Does ETF deposit screening use the same sanctions list as exchanges?
Yes. Custodians, exchanges, and tools like Plastron all check against the same OFAC Specially Designated Nationals list, plus additional known-illicit-address data each maintains or buys separately.
Do ETF investors ever see a coin get rejected?
No, not directly. Screening happens at the deposit level, before coins are pooled into the trust's reserve, so a flagged deposit never shows up as a line item an investor would recognize.
Is this the same kind of check used for Ethereum wallet screening?
The mechanics are the same: compare an address and its history against sanctions and illicit-activity data. ETF custodians apply that to bitcoin UTXOs specifically, while exchange and wallet-screening tools apply it across more chains at once.
What happens to a bitcoin after a custodian rejects it?
It is never credited to the trust. The depositor is left holding it, not the fund, which pushes the problem back to whoever sent it in the first place instead of onto ETF shareholders.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.
