[rodonn]

OFAC which manages US sanctions maintains a list of addresses that any entity complying with US regulations needs to block e.g. https://home.treasury.gov/policy-issues/financial-sanctions/...

Most exchanges also use a service like Chainalysis to help identify which addresses need to be blocked or are high risk and need additional due diligence.

[smeej]

Coinbase even does their chain analytics in-house (and also on a contract basis for the U.S. government).

They take compliance incredibly seriously.