Enhanced due diligence starts when a wallet's on-chain history shows sanctions exposure, mixer use, a high-risk jurisdiction, or a source of funds the exchange cannot verify quickly.
On August 8, 2022, OFAC added Tornado Cash's smart contract addresses to the SDN list, and every wallet that had ever routed funds through the mixer turned into a live enhanced due diligence case at any exchange running sanctions screening. Most explanations of EDD describe it as an internal compliance workflow. What they skip is the exact list of on-chain signals that flip a routine identity check into a document request.
What is enhanced due diligence in crypto?
Enhanced due diligence, or EDD, is the extra verification step an exchange runs once standard KYC isn't enough to clear the risk. Standard KYC checks who you are, once, at signup. EDD checks what your money did before it reached the exchange, and it repeats the check whenever your wallet's risk profile changes.
The step exists because global AML guidance, including FATF's rules for virtual asset service providers, requires a risk-based approach: low-risk customers get light checks, high-risk ones get more. A compliance team decides where you sit on that scale using blockchain analytics, not a form you filled in once.
What on-chain signals trigger EDD on a wallet?
Six patterns show up again and again in how exchanges scope an EDD review. Direct or indirect exposure to a sanctioned address. Transaction history that touches a mixer such as Tornado Cash. Funds sourced from a darknet market or a known scam cluster. Activity concentrated in a jurisdiction the exchange treats as high risk. Deposit patterns that look structured to dodge a reporting threshold. And wallet ownership the exchange cannot confirm, such as a shared custodial address or a wallet that pulls funds from dozens of unrelated sources in a short window.
One flag usually gets you a form. Stack two or three and the review escalates into a full account hold while a human looks at it.
How much of a typical wallet dataset actually carries this exposure?
Plastron's own screening corpus puts a number on how common the underlying exposure is. Of 3,901 labeled addresses in the dataset, 3,478 carry a high or critical risk rating, and a separate 780 addresses sit on the OFAC SDN list for crypto specifically, tracked in data/ofac-sdn.json. That is not a rounding error. Most of the labeled set carries some kind of flag.
Nearly 9 in 10 labeled addresses in Plastron's dataset already carry a high or critical risk flag, and 780 sit directly on the OFAC SDN list.
What happens after an exchange flags your wallet for EDD?
Most EDD workflows follow the same shape. You get a request for a questionnaire and supporting documents, the exchange reviews them, usually within about 24 hours, and it clears or escalates the account. The most common document is a source of funds record: a screenshot from the sending exchange showing both addresses, or a signed statement explaining where the crypto came from.
You can check your own transaction history on a block explorer such as Etherscan before any of this happens, but a raw transaction list won't tell you whether a wallet three hops upstream touched a sanctioned address or a mixer. Plastron runs that same sanctions, mixer, and stolen-funds screening instantly and for free: screen your wallet with Plastron to see the exposure an exchange's EDD queue would find, before it finds it.
How do you avoid triggering EDD before you deposit?
Screen the wallet before you send it, not after support asks for a document. Check both the receiving address and, if you can, the address you're sending from, since indirect exposure through an upstream wallet counts against you the same way direct exposure does. If a screen turns up a mixer hop, don't wait for the exchange to find it; a wallet that touched Tornado Cash years ago still carries that tag today.
A clean pre-screen costs two minutes. An EDD review costs days, sometimes longer if the documents don't satisfy the analyst on the first pass.
FAQ
Does enhanced due diligence mean my wallet is treated as criminal?
No. EDD is a verification step, not an accusation. Most EDD cases clear once the requested documents confirm a legitimate source of funds, and no report gets filed.
How long does an EDD review usually take?
Initial document review often runs about 24 hours once you submit everything requested, though complex cases with multiple exposure signals can take longer while an analyst investigates further.
Does EDD only apply to large transactions?
No. Transaction size is one factor, but sanctions exposure, mixer contact, or unclear ownership can trigger EDD on a deposit of any size, including amounts well under typical reporting thresholds.
Can I trigger EDD by receiving funds from a sanctioned address without knowing it?
Yes. Screening looks at the funds' history, not your intent. A wallet that received crypto that passed through a sanctioned address earlier in its chain can still trip a review even if you had no idea.
Do decentralized exchanges run enhanced due diligence?
It varies. Fully non-custodial protocols often skip identity checks entirely, but many DeFi front ends now screen wallets against sanctions lists before allowing a connection, which functions as a lighter version of the same control.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.