How a crypto wallet AML check actually works
Clustering, labelling, risk scoring and exposure depth: a plain-language walkthrough of what happens when you screen a wallet address.
7 min read
Step 1 — clustering
A wallet is rarely a single address. Analytics engines group addresses that provably belong to the same owner, using heuristics such as common-input ownership in UTXO chains and deposit-address patterns on account-based chains like Ethereum. The result is a cluster: the practical unit of analysis.
Step 2 — labelling
Clusters are then attributed to real-world entities. Labels come from public disclosures, court filings, sanctions lists, dusting and probing transactions, scam reports and commercial intelligence. A mature dataset holds hundreds of millions of labelled addresses across categories such as exchange, miner, gambling, mixer, darknet market, ransomware, sanctioned entity and scam.
Step 3 — tracing exposure
The engine walks the transaction graph backwards from the address you submitted and forwards from it, measuring how much value arrived from or left toward each labelled category.
- Direct exposure — the counterparty is one hop away. Highest weight.
- Indirect exposure — value passed through two, three or more intermediate addresses. Weight decays with distance.
- Attribution by value, not by count — one 40% inflow from a mixer matters far more than fifty dust transactions.
Step 4 — the score
Weighted exposure is compressed into a 0–100 risk score. Roughly: 0–25 is clean, 26–50 warrants a look, 51–75 is elevated and 76–100 means most compliant venues will refuse the deposit. Thresholds are policy choices, so a strict payment processor and a casual P2P trader can read the same report differently.
Screening is probabilistic. Clustering heuristics can over-merge, labels can be stale, and a false positive is always possible. Treat the score as a reason to ask questions, not as a verdict.
What you can check
Two things: an address, which returns the aggregate history of the wallet, and a transaction hash, which returns the risk of one specific incoming payment. Before accepting a large transfer, check the counterparty address first; after receiving it, check the transaction itself and keep the report.
Frequently asked questions
Just the wallet address or a transaction hash on a supported chain. No private keys, no seed phrase and no signature are ever required — the data being analysed is already public.
Usually under ten seconds. The heavy work — clustering addresses and labelling services — is done in advance, so a lookup is mostly a database query plus scoring.
It combines direct exposure (funds received straight from a flagged entity), indirect exposure across several hops, the share of the balance involved and how recent the activity is.
Yes. A score reflects history at the moment of the check. New incoming transactions can change it, which is why recurring counterparties are worth re-screening.