AML glossary
Short explainers on the terms crypto businesses meet when screening addresses and transactions: what AML screening is, how to read a risk score and what to do about mixer exposure.
What is AML screening of a crypto address
AML screening of a crypto address estimates the probability that the funds on that address are tied to illicit activity. The service breaks the addres…
ReadHow to check a wallet for mixer exposure
To check a wallet for mixer exposure, run an AML check on the address and look at the mixer signal in the response: it shows the share of funds that c…
ReadWhat is a transaction risk score
A transaction risk score is a numeric estimate of a specific transfer from 0 to 1, reflecting the probability that the funds involved are tied to illi…
ReadSource of funds reference
A check breaks the funds on an address down by source. Each source belongs to one of three danger groups, which determines how much it contributes to the final score.
| Source | Group | What it means |
|---|---|---|
mixer | Danger | Funds passed through a mixer/tumbler to obscure the trail. A primary laundering tool. |
dark_market | Danger | Funds from darknet markets — platforms for illegal trade. |
dark_service | Danger | Services tied to drug trafficking, terrorism financing or child abuse. |
stolen_coins | Danger | Stolen coins (hacks, thefts from wallets and exchanges). |
scam | Danger | Funds obtained by deception — phishing, Ponzi schemes, fraud. |
ransom | Danger | Funds from extortion and ransomware. |
sanctions | Danger | Sanctioned entities (OFAC and other lists). |
illegal_service | Danger | Funds from illegal services and unlawful activity. |
gambling | Danger | Funds from unlicensed gambling services. |
child_exploitation | Danger | Entities associated with child exploitation. |
terrorism_financing | Danger | Entities associated with terrorism financing. |
exchange_fraudulent | Danger | Fraudulent exchanges: exit scams, illegal behavior, confiscated funds. |
enforcement_action | Danger | Entity subject to law-enforcement proceedings. |
malware | Danger | Funds associated with malware distribution. |
risky_exchange | Suspicious | High-risk exchange: no KYC, weak jurisdiction, high darknet exposure. |
p2p_exchange_mlrisk_high | Suspicious | High-risk P2P exchange: no license/KYC, attractive for laundering. |
atm | Suspicious | Funds obtained via a crypto ATM operator. |
unnamed_service | Suspicious | Unidentified service or counterparty with no established reputation. |
exchange | Trusted | Licensed exchange — the main legitimate source of funds. |
p2p_exchange | Trusted | Licensed P2P exchange without an intermediary. |
payment | Trusted | Payment processor / payment service. |
merchant_services | Trusted | Payment gateway (acquiring), business payment acceptance. |
marketplace | Trusted | Legitimate marketplace — payment for lawful goods and services. |
wallet | Trusted | Funds in verified wallets. |
miner | Trusted | Coins mined by miners. |
liquidity_pools | Trusted | DeFi liquidity pools. |
decentralized_exchange_contract | Trusted | Decentralized exchange (DEX) contracts. |
infrastructure_as_a_service | Trusted | Infrastructure-as-a-service providers. |
seized_assets | Trusted | Assets seized by the government. |
other | Trusted | Other sources: airdrops, token sales, etc. |