Transaction Risk Controls
Stendly applies a mandatory transaction-risk decision before supported wallet transfers, merchant payment construction, cross-chain routing and gas sponsorship. Incoming Solana payments are also evaluated before Stendly automatically marks them as accepted merchant payments.
The risk engine combines the official OFAC SDN digital-currency address publication, configured sanctions/high-risk data, optional commercial screening providers, and recent on-chain Solana and Ethereum transfer history. It evaluates direct address risk, indirect exposure across multiple hops, unusual fan-in/fan-out activity, repeated small transfers, rapid pass-through behavior and multi-hop layering patterns. Provider failures can fail closed into manual review in production.
A high-risk decision can disable Stendly services for the account. This does not freeze the blockchain wallet. The private key remains locally decryptable and exportable so the owner can use independent wallet software. Transaction-risk screening is a KYT/security control; it is not a substitute for identity verification or any KYC/KYB obligations that may apply to a regulated service.
Sanctions and on-chain providers
Mainnet screening loads digital-currency addresses from OFAC's official SDN XML publication and retains a last-known-good in-memory snapshot across temporary refresh failures. If no usable sanctions snapshot exists, production policy can fail closed into review instead of silently allowing the transaction. Devnet disables the external OFAC download.
The transaction-risk engine is not tied to one commercial vendor. The checked-in configuration keeps the TRM Sanctions API adapter disabled because TRM requires an API credential. Deployments that use TRM must inject TransactionRisk__TrmSanctions__Enabled=true together with TransactionRisk__TrmSanctions__AuthorizationHeaderValue from secret configuration. Do not put the credential in source control or browser code.
Solana historical and exact-transaction verification uses Helius, while Ethereum ERC-20 history and exact-transaction verification uses Blockscout. Cross-chain top-ups are accepted for tracking only after the submitted transaction hash matches the quoted source wallet, token contract or mint, amount, and quote time window. These history sources supplement authoritative sanctions data rather than replacing it.
Restricted access
When Stendly blocks service access, the restriction applies to Stendly processing, routing, gas sponsorship and authenticated merchant operations. It does not freeze the self-custody wallet. The local wallet key remains exportable. Users who believe a restriction is incorrect can contact support@stendly.com. Support must never request a private key. Detailed scoring rules and provider signals are not exposed through the user API.