OTC Mid-Settlement USDT Blacklist: Incident Playbook After the Wire Is Moving

OTC desks already screen before settle. The failure mode this playbook covers is rarer and uglier: fiat is already moving - or crypto is already partially delivered - when an addBlackList / equivalent hits a settlement address mid-flow. Pre-settle checklists (OTC USDT pre-settle screening, pre-P2P freeze checklist) try to prevent that moment. This article is incident response after the wire is live: halt legs, preserve evidence, branch issuer vs venue, and refuse improvisation that creates ToS or sanctions risk.

Educational only. Not legal advice. Not an evasion manual. FreezeRadar does not settle OTC trades for you.

Direct answer

When USDT is frozen mid OTC settlement, the desk’s first controls are operational: stop the fiat leg, freeze internal credit, snapshot blacklist reads with timestamps, and open a single IR channel (compliance + treasury + counsel). Then branch: if the blacklisted address is yours, treat it as received frozen USDT desk IR; if you sent into a blacklisted counterparty address, treat it as a sending-to-blacklisted trap plus contractual dispute. Issuer vs AML screening differences matter for tooling - see blacklist check vs AML screening - but mid-flow you need halt discipline more than a new vendor.

Academy context: OTC. Guide: Tether blacklist check.

When this playbook triggers

Any of:

• Settlement address flips isBlackListed / Circle blacklist true after trade affirmation
• Partial USDT delivered; remainder cannot send
• Fiat PSP / bank wire already irrevocable or in flight
• Counterparty claims “temporary Energy issue” but explorer shows blacklist true
• Internal monitor / FreezeRadar alert fires during the settle window

If nothing has moved yet, abort and return to pre-settle checklists - do not invent drama.

Minute-zero halt card (print this)

1. Freeze fiat instructions - cancel unsent wires; call PSP if cut-off allows; document attempts.
2. Freeze crypto sends - disable hot-wallet scripts for that deal ID.
3. Freeze internal ledger credit - do not mark the client “paid” in the books.
4. Capture state - explorer screenshots, FreezeRadar/API outputs, bank confirmation numbers, chat logs.
5. Open IR ticket - one deal ID; assign incident lead.
6. No freelance messaging - sales must not promise “we’ll just use another wallet” without compliance.

Speed beats eloquence. A perfect memo after the wire lands is weaker than an ugly halt call on time.

Branching tree

Branch A - Your receive address is newly blacklisted

• Stop advertising that address.
• Inventory balances stuck vs still movable on other assets.
• Follow received-frozen IR: LE/counsel, issuer channels under lawful process, customer notices.
• Do not ask clients to “send around” the freeze.

Branch B - Counterparty address blacklisted after you sent

• Preserve send tx evidence.
• Contractual remedies depend on your MSA/term sheet - escalate to counsel.
• Parallel LE if theft/fraud suspected.
• Do not send a second payment “to unlock.”

Branch C - Exchange deposit leg mid-credit

• Venue may hold credit under its AML/LE rules (exchange hold vs issuer).
• Taxonomy for account freezes: KYC/AML/LE taxonomy.
• Coordinate with venue support using one packet.

Branch D - False alarm (Energy / permission / UI)

• Confirm with isBlackListed and permissions tab (TRON permission phishing).
• If false alarm, document all-clear and resume only after dual control sign-off.

Evidence folder (mid-settle specific)

• Deal ticket / blotter ID; notional; asset; chain; contract
• Affirmation timestamps (UTC)
• Fiat payment instructions + bank MT references if any
• All settlement addresses used (yours and theirs)
• Blacklist read logs with wall-clock times (before/after)
• Partial tx hashes
• Chat exports where counterparty explained the failure
• Names of staff who authorized halt / resume

Reuse structures from the stolen-funds evidence packet where theft is alleged, but label the folder as OTC-IR so counsel sees commercial context.

Communications templates (tone)

To counterparty (neutral): “We observe issuer blacklist status true on address X as of TIMESTAMP. We have halted unsettled legs pending compliance review. Please confirm your status in writing.”

To client (if you are agent): “Settlement paused due to an on-chain freeze indicator. We are not asking you for seed phrases or unlock fees. Next update by TIME.”

Never: “Send USDT to this new address to clear Tether,” “use a mixer to finish,” “backdate the invoice.”

Post-incident controls

• Shorten settle windows; prefer atomic or escrow patterns your counsel approves
• Continuous monitor on settlement addresses during the window, not only T-0 screen
• Dual-control resume
• Update allowlists / deny lists
• Review whether AML tooling and issuer-blacklist tooling were both in path (desk matrix)

Worked composite

Desk sells 1.2M USDT TRC-20 for EUR. 400k USDT delivered; EUR wire initiated. Mid-window, receive address for the remaining 800k shows isBlackListed=true. Halt card: bank called (wire canceled in time); crypto scripts disabled; screenshots stored; Branch A IR opened; client notified without unlock-fee language; counsel engaged for issuer/LE path; remainder not redirected to a “clean” personal wallet offline. Outcome uncertain on frozen 400k already moved - honest status reporting continues. Wrong path: quietly finishing EUR against a substitute address sales found on Telegram.

Limitations

BlockSec and other vendors publish OTC freeze playbooks aimed at tooling SLAs; this FreezeRadar piece prioritizes halt discipline + plane separation + lawful escalation, not a promise of sub-second webhooks. Contract law varies by seat. FreezeRadar cannot cancel your bank wire.

Key takeaway

Mid-settlement blacklist is an IR event: halt fiat and crypto, snapshot truth, branch correctly, communicate without unlock scams, then harden monitoring. Prevention checklists remain mandatory - this playbook exists for when prevention was not enough.

Next: pre-settle screening, pre-P2P checklist, received frozen IR, blacklist vs AML, Tether blacklist guide, academy/otc.

Role cards

Incident lead: owns halt card, clock, single client narrative. Treasury: executes send freezes; confirms wallet script state. Banking ops: wire cancellation attempts; PSP calls. Compliance: blacklist/AML reads; regulator notifications if required by local rules. Counsel: issuer/LE/venue legal channels; privilege calls. Sales: no settlement promises without lead OK.

Resume criteria (all required)

1. Blacklist reads false on required addresses or counsel signs alternate settlement plan in writing.
2. Fiat leg state known (canceled, returned, or counsel-approved escrow).
3. Dual-control checkbox signed.
4. IR ticket updated with resume rationale.
5. Monitoring still active through final confirmation.

Tabletop exercise (quarterly)

Simulate Branch B mid-wire with a partial crypto send. Time the halt card. Score: wire cancel attempted under 15 minutes; no unlock-fee language in chats; evidence folder complete. Losers buy coffee; winners update the runbook.

Additional operator notes (otc)

Keep this section practical. Re-read the direct answer before customer calls. Prefer primary issuer and venue URLs over screenshots from group chats. Log every contact attempt with UTC timestamps. If a step requires counsel, stop and wait - do not invent process. Cross-check related FreezeRadar guides linked above so you do not paste contradictory advice into the same ticket thread. When in doubt, halt movement of funds and escalate internally before escalating externally.

Legal / commercial overlays (non-advice)

Your MSA may allocate blacklist risk to seller, buyer, or shared escrow. Mid-incident is the wrong time to discover silence in the contract. Counsel should pre-negotiate:

• Definition of “settlement address”
• What happens if issuer freeze hits mid-wire
• Governing law and dispute venue
• Whether partial delivery triggers pro-rata fiat unwind

Operational playbooks cannot rewrite bad paper. Flag missing clauses in the post-mortem.

Tooling stack (example, not endorsement)

• Issuer blacklist monitor on settlement addresses during T-settle window
• AML screening on counterparties at onboarding and pre-settle
• Bank wire dual release
• Chat export automation for IR

FreezeRadar covers issuer-plane checks; pair it with whatever AML provider your compliance team already selected (blacklist vs AML matrix).

Post-mortem template headings

1. Timeline (UTC)
2. Branch taken (A/B/C/D)
3. Halt effectiveness (fiat/crypto)
4. Evidence completeness
5. Client communication quality
6. Contract gaps
7. Monitoring gaps
8. Action items with owners/dates

Staff drill note

Run a 20-minute tabletop on this failure mode each quarter. Capture gaps in the runbook. Do not grade people on memorizing UI paths that change - grade them on plane separation and halt discipline.

Closing operational reminder

Halt first when unsure. Prefer primary sources. Document UTC times. Escalate to counsel for legal process. Refuse seed/unlock-fee solicitors. Re-read the direct answer section before external emails.

References

1. Tether - Legal / Law Enforcement Requests - https://tether.to/en/legal/?tab=law-enforcement-requests
2. FreezeRadar - OTC USDT pre-settle screening checklist - https://freezeradar.com/blog/otc-usdt-pre-settle-screening-checklist
3. FreezeRadar - Sending USDT to a blacklisted address trap - https://freezeradar.com/blog/sending-usdt-to-blacklisted-address-trap
4. FreezeRadar - USDT blacklist check vs AML screening - https://freezeradar.com/blog/usdt-blacklist-check-vs-aml-screening-desk
5. Tronscan - TRC-20 USDT - https://tronscan.org/#/token20/TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t