What Is AML Crypto: How Wallet Risk Scoring Works

AML stands for Anti-Money Laundering, a set of compliance practices designed to prevent the use of financial systems for illegal purposes. In traditional finance, banks and payment processors conduct AML checks on customers and transactions. In crypto, AML applies to blockchain addresses and transactions, where the immutable ledger allows analysts to trace fund flows and identify patterns linked to crime. Crypto AML checks use blockchain analytics to examine wallet history, transaction patterns, and known associations with illicit entities. Unlike traditional banking, where identity is tied to accounts, crypto AML must infer risk from on-chain behavior alone. This makes it both more transparent—all transactions are public—and more challenging, since addresses are pseudonymous. An AML crypto check examines whether funds have passed through high-risk sources or destinations, flagging wallets that pose compliance or legal risk to exchanges and users.

An AML risk score is a numerical rating (often 0–100 or 0–10) assigned to a wallet based on its transaction history and associations. The score reflects the probability that a wallet is connected to illicit activity. Risk scoring algorithms analyze several factors: (1) Direct exposure—whether the wallet has received funds directly from known darknet markets, theft addresses, or sanctioned entities; (2) Indirect exposure—whether funds passed through mixers, tumblers, or other obfuscation services; (3) Transaction patterns—rapid consolidation of small amounts into large transfers, or unusual timing and frequency; (4) Counterparty risk—whether the wallet has interacted with high-risk addresses or services; (5) Time decay—older illicit activity may carry less weight than recent exposure. A wallet that has never touched illicit sources typically scores low (green). One that received stolen funds or darknet proceeds scores high (red). Mid-range scores (yellow) indicate ambiguous or aged exposure. The exact methodology varies by service, but all reputable AML check services use blockchain data and known blacklists to inform their scoring.

Red flags in AML crypto are warning signs that a wallet or transaction carries elevated compliance risk. Common red flags include: (1) Darknet market exposure—funds originating from or sent to known darknet marketplaces; (2) Mixer or tumbler use—deliberate obfuscation of fund origins, which suggests intent to hide transaction trails; (3) Theft or ransomware—coins stolen from exchanges, users, or obtained through extortion; (4) Sanctioned entity involvement—wallets linked to individuals, organizations, or countries under financial sanctions; (5) Gambling or high-risk services—funds flowing to or from unregulated gambling platforms; (6) Rapid consolidation—many small deposits combined into one large transfer, a common money-laundering pattern; (7) Unusual transaction velocity—abnormally frequent or large transfers inconsistent with normal use. A single red flag does not automatically make a wallet unusable, but multiple flags or high-confidence exposure to darknet sources warrant caution. Exchanges and custodians use red flag detection to decide whether to accept deposits or freeze accounts. Understanding what triggers a red flag helps users avoid receiving tainted coins and protects them from regulatory complications.

Checking a wallet before receiving funds is straightforward. Follow these steps: (1) Obtain the wallet address—ask the sender for their full public address (e.g., a TRX address, USDT address, or BTC address). (2) Use an AML check service—visit a trusted blockchain analytics or wallet screening platform. Our curated list of verified AML services on this site includes tools that support multiple blockchains and address types. (3) Enter the address—paste the address into the screening tool and initiate the scan. (4) Review the risk score—the service will return a score and a summary of any detected exposure. (5) Examine the details—look at the specific risk factors flagged: darknet exposure, mixer use, theft history, or sanctions links. (6) Make a decision—low scores (green) are safe to receive; yellow scores warrant investigation; red scores should be rejected unless you have strong reason to trust the sender. The entire process takes seconds to minutes. Performing an AML check before accepting a large USDT or TRX transfer is a simple way to avoid frozen funds and compliance headaches.

Most AML services use a tiered risk classification: Low Risk (0–20): No detected exposure to illicit activity. Safe to receive and transact. Medium Risk (21–60): Some exposure to high-risk services or aged illicit activity. Acceptable for many users, but warrants awareness. High Risk (61–100): Strong indicators of recent or direct exposure to darknet markets, theft, sanctions, or mixers. Most exchanges will freeze or reject deposits from high-risk addresses. Acceptable thresholds depend on your use case. If you are an individual user receiving personal payments, a score below 30 is generally safe. If you operate an exchange or custodian, your compliance team may require scores below 10 or 20. Regulatory guidance varies by jurisdiction, but most financial institutions treat scores above 60 as unacceptable. Some services also flag specific risk categories separately—for example, a wallet might have a moderate overall score but high darknet exposure, which is a more serious concern. Always review the breakdown, not just the number.

When a wallet or transaction is flagged as tainted (connected to illicit activity), several consequences can follow. First, exchanges may refuse deposits—if you try to deposit flagged USDT or TRX to a regulated exchange, the deposit may be rejected or held pending review. Second, accounts may be frozen—if you already hold flagged coins in an exchange account, the exchange may freeze your balance pending investigation or compliance review. Third, regulatory scrutiny increases—your identity and transaction history may be reported to financial authorities, especially if the coins are linked to theft or sanctions violations. Fourth, liquidity suffers—even if you move flagged coins to a peer-to-peer platform, many users will reject them, making them harder to sell. Fifth, legal liability may arise—in some jurisdictions, knowingly receiving stolen or sanctioned funds can expose you to civil or criminal liability. The key takeaway: receiving tainted coins creates friction and risk. Checking wallets before accepting transfers is the simplest way to avoid these problems. If you do receive flagged coins, most compliance experts recommend not moving them and disclosing the situation to your exchange or custodian.

AML checks work across all major blockchains, but the process and available data vary slightly. USDT (Tether) exists on multiple blockchains—Ethereum, Tron, Polygon, and others—so a USDT address must be screened on its specific blockchain. Tron (TRX) addresses are screened using Tron blockchain data; a TRX address check examines the wallet's transaction history on the Tron network. Bitcoin (BTC) addresses are screened using the Bitcoin ledger, which has the longest history of public transaction data. Ethereum (ETH) addresses are screened using Ethereum blockchain data and smart contract interactions. Each blockchain has its own analytics infrastructure, but the principles are the same: trace fund flows, identify high-risk sources, and assign a score. When checking a wallet, ensure you are screening the correct blockchain. A TRX address on Tron will have different history than a USDT address on Ethereum, even if they belong to the same entity. Most reputable AML services support multiple blockchains and will auto-detect or allow you to specify which chain to scan. This multi-chain capability is important because funds often move between blockchains via bridges or exchanges.