How the score is computed
The score is not based on a single flag. It is built from the shares of each source of funds, weighted by how dangerous that source is. Every source belongs to one of three groups: danger, suspicious or trusted. Danger sources contribute the most.
Heavy sources — mixers, darknet markets, stolen coins, sanctioned addresses — raise the score even at a small share. An address that received a small amount from the darknet gets a high score rather than a proportionally small one.
Level thresholds: below 25% is low risk, 25–49% is medium, 50% and above is high (the risk zone). The methodology follows AMLBot reports.
What the signals show
The signals field in the API response holds the shares (0 to 1) of funds from each source. Together they describe what the address balance is actually made of.
The full reference of sources with descriptions and danger groups is in the API documentation, which also marks which of them count as danger and which as trusted.
How to screen an address
A check can be started in the dashboard or via the REST API. Checks are asynchronous: you immediately get an id with status pending, then fetch the result by polling or receive it via webhook.
One check is debited from your balance. If the provider returns an error or is unavailable, the check is automatically refunded — you only pay for successful verdicts.
FAQ
How is AML screening different from KYC?
KYC establishes who the owner is; AML screening evaluates where the funds on the address came from. They are independent: a verified customer can still hold funds from a risky source.
How fast is the result?
A verdict is usually ready within seconds. For networks with limited support it takes longer, because it requires an additional request to the provider.
How much does one check cost?
It depends on the package: from 1.00 USDT per check in the 50-check package down to 0.50 USDT in the 10,000-check package. Purchased checks never expire.