How should an AI agent check an address before it pays?

Before every payment, check the destination against the OFAC sanctions list, a list of known drainer and scam addresses, and the stablecoin issuers' freeze lists, and refuse to pay unless every check actually answered. A check that could not run must block the payment, never pass it.

An agent with a wallet pays addresses it found a moment ago: in an API response, a 402 payment challenge, a tool result or a message from a user. It has no instinct for a lookalike address and no memory of last week's scam. Whatever checking happens has to be explicit, cheap enough to run on every payment, and built so that a failure stops the money rather than waving it through.

Veriql · October 27, 2026

Risk API and payee check Watch 24/7 on Telegram

Public address only. No wallet connection. Nothing to sign.

The three questions worth asking before any payment

First, is the address sanctioned? A payment to an address on the US Treasury SDN list is a sanctions violation for a US person or business, and an agent acting for one carries that exposure. Second, is it a known bad address? Drainer collection wallets, phishing payouts and fake support desks reuse addresses, and lists of them exist. Third, is it frozen? Tether and Circle can blacklist an address on their own token contracts, and USDT or USDC sent there can never be moved again, so the payment is lost even though nobody stole it. All three are lookups against public data, so they cost milliseconds, not judgement.

Fail closed: an unanswered check is a no

The rule that matters most is what happens when a check cannot answer. A provider times out, a list is unreachable, a chain does not respond. A human would pause. An agent will do whatever its code does by default, and the common default, treating no answer as no problem, turns every outage into a free pass. Our payee check returns one of three verdicts, do_not_pay, no_known_risk or incomplete, and incomplete means a check did not answer. An agent should treat incomplete exactly like do_not_pay: stop, and retry or ask a human.

A free option for the common case

For agents that only need the sanctions and known bad address lists, we publish them as a free feed, one list per address family: EVM, Solana, Tron and Bitcoin. An agent can load it once, cache it, and check every destination locally with no request per payment. It is also available as a Coinbase CDP Policy Engine policy, so the wallet itself refuses a listed destination even if the agent's own code would have paid it. An empty or unreachable feed must be treated as an outage, not as an empty list, for the same fail closed reason.

The full check, per payment

The paid payee endpoint adds the issuer freeze check, which has to be read live from the token contracts and cannot be cached safely, and returns all three answers with the date the lists were last refreshed. It is payable per call over x402 in USDC on Base or Solana, with no account and no API key, or with a prepaid key. Every check is named in the response with its own state, so an agent can explain why it refused a payment rather than just refusing.

Ready-made integrations

The same checks ship as drop-in tools for the common agent frameworks: an MCP server for Claude, Cursor and any MCP client, a Coinbase AgentKit action provider, a GOAT SDK plugin and an ElizaOS plugin, all published on npm under the veriql name. The ones that pay over x402 check the price against a cap before signing anything, and none of them reports a check that could not run as a clean answer. Using one of them saves writing the refusal logic, which is the part most often written wrong.

What a clean answer does not mean

no_known_risk means the address is not sanctioned, not on our list and not frozen by an issuer, as of the date given. It does not mean the recipient is honest, that the service will deliver, or that the price is fair. A brand new address is on no list. The check catches known bad destinations cheaply and reliably; the decision to pay is still the agent's, and its limits on amount, frequency and counterparty matter as much as any lookup.

Related