AML Wallet Check Methodology: How the Risk Score Works

01What we analyse

A check starts from a single input: a public wallet address on a supported network — Bitcoin, Ethereum, TRON, BNB Chain or Solana. We never ask for a private key, a seed phrase or a wallet connection, and a check never signs or sends anything.

Transaction history

Incoming and outgoing transfers of the address — native coins and tokens such as USDT — with counterparties, amounts and timing.

Counterparties

Who the address dealt with: exchanges, services, mixers, gambling platforms and other wallets, recognised through the provider's address labels and clustering.

The path of funds

Where the money came from before it reached the address — several transfers upstream, not only the last sender.

Known events

Whether the address is itself a labelled entity, or is tied to a known hack or exploit.

What a check does not look at: the person behind the address, off-chain information, or the intent of a transaction. For the practical walkthrough, see how to do an AML check on a wallet.

02How the Risk Score is formed

The Risk Score is a number from 0 to 100: the higher it is, the more of the address's traced funds touch risky entities, and the closer those entities are. It is produced by the data provider's scoring model. AML Check Hub shows the score as returned — we do not adjust or re-weight it.

1. Trace

The address's history is traced upstream and downstream through the transaction graph.

2. Match

Counterparties and intermediate addresses are matched against labelled entities and assigned to risk categories.

3. Measure

For each category the model weighs how much of the traced value is involved, how many hops away it is, and whether the link is direct.

4. Score

These signals are combined into one 0–100 number, which maps to a risk level.

The exact weights belong to the provider and are not public. What you can rely on is the direction: more traced value, a shorter distance and a more serious category all push the score up.

03Which factors are taken into account

Share of traced value

How much of the address's traced funds is linked to a risk category. The full report shows it as a percentage per category.

Distance (hops)

Exposure one transfer away is a stronger signal than exposure many transfers away.

Directness

Dealing with a risky entity itself versus receiving funds that passed through intermediaries.

Category severity

Categories are not equal: exposure to sanctions or illicit activity is a far stronger warning than gambling or a high-risk exchange.

Entity identity

Whether a counterparty is a named entity — a sanctioned service, a mixer, an exchange — or just an unlabelled address.

Known events

A tie to a recorded hack or exploit adds a specific flag to the report.

04Risk categories

Every report is built around the same six categories. Each one ends up in one of three states: exposure detected, no exposure detected, or data unavailable — missing data is never shown as “clean”.

Sanctions

Entities or addresses linked to sanctioned parties or jurisdictions, directly or through the transaction path.

Illicit activity

History linked to theft and hacks, scams and fraud, darknet services, or an address blacklisted by Tether.

Mixer

Funds routed through a mixing service that obscures their origin.

Gambling

Exposure to gambling platforms — relevant under some jurisdictions' compliance rules.

High-risk exchange

Movement through an exchange with weak KYC or a poor compliance record.

Bridge

Funds that crossed chains through a bridge — a common step in laundering flows, but also an everyday DeFi tool.

A plain-language introduction to each category is in what a crypto wallet AML check is; the short version is on the What we check page.

05Direct vs indirect exposure

Exposure is direct when the address dealt with the risky entity itself, and indirect when the funds reached it through one or more intermediate addresses. The report counts the hops between the two.

Direct

A strong signal: the counterparty is the risky entity. Take it seriously, especially when the share is large.

A few hops

Worth a closer look: open the path and ask the counterparty where the funds came from.

Many hops

A weak signal on its own, particularly with a small share — funds mix over time and distance dilutes the link.

This is why a wallet's owner can have done nothing wrong and still see a non-zero exposure: the link can sit several transfers upstream. The signal is real, but it is not an accusation. A worked example is in how to check a TRON address before sending.

06What the risk levels mean

The score maps to one of four levels. The level is assigned by the provider by the bands below; each one has a sensible default action.

Low (0–30)

No significant risk signals found. Go ahead, and repeat the check before large or recurring transfers.

Medium (31–70)

Some exposure. Open the categories and the path; for a larger amount, ask the counterparty about the source of funds.

High (71–90)

Significant exposure. Do not send — ask for a different address.

Critical (91–100)

Severe exposure, typically sanctions or illicit activity. Do not send, and keep the report.

The free first check shows the score and the level; the category breakdown and the PDF report open with a paid check — see pricing.

07Where the data comes from

We do not run our own blockchain database. Every check queries a third-party blockchain-intelligence provider: public on-chain transactions for the supported networks, plus the provider's database of labelled addresses and entities — exchanges, services, mixers, gambling platforms, and addresses tied to sanctions or illicit activity.

On-chain data

Public transactions on Bitcoin, Ethereum, TRON, BNB Chain and Solana.

Labels and risk intelligence

Supplied by the third-party provider. We do not edit them.

What AML Check Hub adds

Address and network validation (including checksums), one uniform result format, the category breakdown, the PDF report and a stored copy of each result in your history.

Why a check has a price at all — and how it compares across providers — is covered in what an AML check costs.

08How often the data is updated

Every check is a fresh request: the answer reflects the provider's data at the moment of the request, including transactions confirmed up to that point. We do not keep a score database in between. The one exception is a repeat of the same address within about three minutes, which returns the stored result — so a double click does not cost a second check.

Labels and risk intelligence are refreshed by the provider on its own schedule, and new transactions keep changing an address's picture — so a clean result today is not a promise for next month. For addresses you deal with regularly, repeat the check before each significant transfer.

09Limitations of the methodology

• A score is a signal, not a verdict. It is not a legal determination and not a statement about the owner. High risk is a strong warning; a clean result is not a guarantee.
• Unlabelled does not mean safe. A new address with no history can score low and still be used for something risky later.
• Coverage is only as good as the provider's data. A recent event may not be labelled yet, and coverage differs between networks.
• Indirect exposure can be real but not meaningful. A small share far upstream often reflects how funds mix, not how the address behaves.
• We only see the chain. Off-chain facts — who the person is, why they transacted — are outside the check.
• Different services can score differently. Models and databases differ, so compare the categories, not just the number.
• Information, not advice. This is not legal, tax or compliance advice; for regulated use, follow your own compliance procedures.

10Example AML report

An illustrative report is below. The numbers are made up to show the structure; a real report appears on the result screen and in the PDF.

Score and level

The headline: how risky the address looks overall, and what to do first.

Categories

Where the risk comes from, with the status of each of the six categories.

Entities and share

Which entity is behind a category and how much of the traced value it accounts for.

Direct or indirect

Whether the link is direct, and how many hops away it sits.

Path

The chain of addresses between the risky entity and the checked wallet — in the PDF.

Known entity and events

A label if the address is itself a known service, and a flag for a recorded hack.

AML Check Hub screens addresses against available third-party blockchain intelligence and reports the result as-is. It is an informational service, not legal or compliance advice: a high-risk result is a strong warning sign, not a final legal determination, and a clean result is information, not a lifetime guarantee. The illustrative report on this page uses made-up numbers.