How to Do AML Checks on Crypto Wallets

AML checks are compliance screenings that analyze blockchain transactions to identify risk. They examine whether funds have touched high-risk sources: mixers, darknet markets, scams, stolen wallets, or sanctioned entities. When you receive cryptocurrency, you inherit the transaction history attached to those coins. If that history includes illicit activity, exchanges may flag your account, freeze your balance, or reject deposits entirely. AML checks work by tracing the on-chain movement of funds backward through the blockchain, then scoring the risk based on exposure to known bad actors. This process is called Know Your Transaction (KYT) in compliance terminology. For businesses and traders, running AML checks before accepting deposits is now standard practice to avoid regulatory penalties and account freezes.

AML checks work in three main steps. First, the screening service indexes the blockchain and maintains databases of known risk sources: sanctioned addresses, darknet market wallets, mixer outputs, and reported theft addresses. Second, when you submit a wallet or transaction for screening, the service traces the fund flow backward through the blockchain, identifying every address the coins have touched. Third, it compares those addresses against the risk database and assigns a risk score. The score reflects the probability that the wallet or transaction is connected to illicit activity. Most services use a numerical scale (0–100 or similar) where higher scores indicate higher risk. Some also flag specific risk categories: sanctions exposure, mixer involvement, darknet connection, or scam association. The entire process happens on-chain and is deterministic—the same wallet will produce the same result each time it's checked.

Follow these steps to screen a wallet address before accepting a deposit:

1. Copy the wallet address you plan to receive funds from (TRX, USDT, BTC, or ETH).
2. Choose a verified AML check service. Our curated list of trusted AML services on this site includes options for different blockchains and risk thresholds.
3. Paste the address into the screening tool and run the check.
4. Review the risk score and any flagged categories (mixer, darknet, sanctions, scam, theft).
5. Check the transaction history summary to see which addresses the funds have touched.
6. Decide whether the risk level is acceptable for your use case. For most businesses, scores above 50–70 warrant caution or rejection.
7. Document the result for compliance records.

The entire process takes seconds to minutes depending on the service and wallet age. Most services provide a downloadable report you can store for audit purposes.

AML risk scores are numerical ratings that indicate the likelihood a wallet or transaction is connected to illicit activity. Scores typically range from 0 (clean) to 100 (high risk). Interpretation depends on your business model and regulatory environment, but general guidelines are:

• 0–20: Low risk. Funds appear clean with minimal or no exposure to known bad actors.
• 21–50: Medium risk. Some exposure to mixers, gambling, or other gray-area activity, but no direct sanctions or darknet links.
• 51–75: High risk. Clear exposure to mixers, darknet markets, or theft reports. Most exchanges reject these.
• 76–100: Critical risk. Direct sanctions exposure, active darknet connection, or confirmed stolen funds.

For retail users, accepting scores above 50 is generally not recommended. For institutional traders and exchanges, thresholds are often stricter (30–40). Your acceptable threshold depends on your compliance policy and the regulatory jurisdiction you operate in. Document your threshold decision in your AML policy.

If an AML check flags a wallet or transaction as high-risk, you have several options. First, do not accept the deposit if you are uncomfortable with the risk level. Rejecting tainted coins is always safer than accepting them and facing a freeze later. If you have already received flagged coins, contact your exchange or custodian immediately to understand their policy. Some exchanges will freeze accounts holding tainted coins, while others may allow them but flag your account for monitoring. You cannot "clean" tainted coins through mixing or re-sending them—the transaction history is permanent on the blockchain. If the coins are confirmed stolen or sanctioned, holding them may expose you to legal liability. For legitimate disputes (e.g., a wallet was incorrectly flagged), you can request a manual review from the screening service or provide documentation of the fund source to your exchange. Most compliance teams will not reverse a flag without clear evidence of legitimate origin.

AML check pricing varies widely depending on the service, volume, and features. Most services offer a tiered model:

• Single wallet check: Free to $5 per check (often included in free trials).
• Batch screening: $0.10–$1 per address when screening multiple wallets.
• Subscription plans: $50–$500+ per month for unlimited checks, real-time monitoring, and API access.
• Enterprise solutions: Custom pricing for high-volume screening and dedicated support.

Free AML checks are available but often limited to one or two checks per day or provide basic risk scoring without detailed reports. Paid services typically include transaction history, specific risk category flags, and downloadable compliance reports. For businesses processing regular deposits, a subscription plan is more cost-effective than per-check fees. Our verified AML services list includes options at different price points so you can compare AML check costs and find a service that fits your budget and compliance needs.

When you run an AML check, the results may flag specific risk categories. Understanding what each means helps you assess whether to accept the wallet:

• Mixer exposure: Funds have passed through a coin mixer or tumbler. Mixers are used to obscure transaction trails, which raises compliance concerns even if the original source was legitimate.
• Darknet market: Wallet is associated with a known darknet marketplace or has received funds from one. This is a critical red flag for most businesses.
• Sanctions: Address matches a sanctioned entity list (OFAC, EU, UN, etc.). Holding or transacting with sanctioned addresses is illegal in most jurisdictions.
• Scam or fraud: Wallet is linked to a reported scam, Ponzi scheme, or phishing attack.
• Theft: Funds were stolen from an exchange, user wallet, or other victim and reported to blockchain analytics firms.
• Gambling: Wallet has received funds from or sent to gambling platforms. Some businesses accept this; others do not.

Each category carries different compliance weight. Sanctions and theft are hard stops for most regulated entities. Mixer and gambling exposure require case-by-case judgment.