AML Risk Score for a Crypto Wallet

A crypto wallet Risk Score is a summary assessment of an address’s AML risk based on its available transaction history and known links. It helps you prioritise quickly, but it should not be read apart from the source categories and the context of the check.

An AMLKYC report splits the scale into three levels. The colour and the label of the score change at these boundaries:

These are the report’s own boundaries. A business sets its own thresholds for decisions — when to let an operation through and when to ask for documents — in its internal policy, and they do not have to match the scale.

AML risk is the resulting estimate of how likely an address is to have dangerous links. An AML check is the analysis itself — the process that examines the source of funds and the categories of links, and produces the Risk Score. For a full report, use the wallet AML check page.

The model weighs the type and share of risky sources, whether the link is direct or indirect, how deep the chain runs, how recent the data is and other signals. Methodologies differ between providers, so the same number can mean different things on different platforms.

• sanctioned addresses and prohibited services;
• darknet markets and mixers;
• scam, fraud and stolen funds;
• high-risk exchanges and unlicensed exchangers;
• extortion, malware and other criminal categories.

An indirect link normally calls for a different assessment than receiving funds straight from a flagged address.

The report shows two flows separately: where funds came into the address from, and where they went next. The incoming flow answers “was the money that arrived clean”; the outgoing one answers “who does this address deal with”. A wallet that receives funds from an ordinary exchange but regularly sends them to a mixer deserves as much attention as one with a dirty deposit.

Within each flow you see the share of each category: transfers, exchanges, mixers. A large share of one risky category weighs more than a single small transaction.

Low risk usually allows standard processing when no other signals are present. Medium risk may require documents on the source of funds or a manual review. High risk implies escalation under your internal policy. There is no universal threshold: it is set with the product, the customer and the requirements of the jurisdiction in mind.

Start with the network and the address itself, then the overall score, the categories, the share of each source, the depth of the link and the date of analysis. After that, match the result against the customer profile and the purpose of the operation. Keep not only the final number but also the grounds for the decision you made.

Do not draw a conclusion from the colour of an indicator alone. Pause the automated decision, examine the categories and the path of the funds, request supporting documents and hand the case to the responsible specialist. What happens next — proceed, restrict or decline — is determined by your internal policy and applicable law.

A Risk Score reflects the state of things at the time of the check. Later the address gets new transactions, and labelling databases get new information: a wallet that was unknown yesterday may turn out to belong to a scammer today. An old report therefore does not confirm that an address is safe now.

You can re-run a check — the score and the report data will be recalculated on the current blockchain history. With counterparties you work with regularly, it makes sense to repeat the check before large operations.

Check the address in your account, in the Telegram bot or in the RiskScanner app; for a stream of checks there is the AML API. One report from $1. How the check itself works is described on the wallet AML check page.