Crypto Wallet Screening: What It Is and How It Works

What wallet screening checks

A screening tool takes one public address and looks it up in a database of labelled addresses and transactions. Vendors describe the same core idea. TRM Labs says its Wallet Screening assesses the risk of a wallet before a transaction is authorised and returns a list of risks and attribution, with settings for ownership, counterparty and indirect exposure.^[1] Chainalysis says its Address Screening gives severity risk scores and shows direct and indirect exposure to sanctioned entities, scams, darknet markets and more.^[2]

In practice a check covers three things:

• Sanctions. OFAC can list specific crypto addresses on its SDN list as identifiers of blocked persons.^[3] It first did so in November 2018, with bitcoin addresses linked to the SamSam ransomware case.^[4] OFAC says firms dealing in digital currency should build a risk-based compliance program that generally includes sanctions list screening.^[3]
• Exposure to risky entities. How much of the address’s money came from, or went to, scams, mixers, stolen funds, darknet markets or similar sources. AMLBot, for example, sorts its sources into “danger”, “suspicious” and “trusted” groups, with sanctions, scam, mixer and stolen coins in the first.^[5]
• A risk score or level. One number or label that sums up the findings, set by the vendor’s own model.

Who uses it

What a result looks like

Most reports show an overall score or level, a breakdown of exposure by category, and any owner or service the vendor has identified. GetBlock’s documentation, for instance, describes a score from 0 to 100 in four bands (Low 0–24, Medium 25–49, High 50–74, Very high 75–100), an exposure breakdown by category, compliance flags and attribution where available.^[7] A simplified example of how such a report reads:

This example is illustrative, not a real address. Read the categories, not only the number: a share of exchange exposure is normal, while a direct sanctions or stolen-funds finding is a reason to stop. Our guide to AML risk scores goes through each level.

The limits

• No guarantee. A low score means the vendor found nothing alarming in its data, not that the funds are clean. A new address can score low simply because nothing is known about it yet.
• Lists are incomplete. OFAC itself says its digital currency address listings are not likely to be exhaustive.^[3]
• Data differs by vendor. Each company labels addresses with its own data, so two services can return different results for the same address. Even the scales differ: GetBlock uses 0–100,^[7] MetaSleuth uses five levels from 1 to 5.^[8]
• It is a snapshot. An address can be flagged after you checked it. Check close to the time of the transfer.

For large amounts, run a second check with another service. Compare options in our rankings, or start with the free AML checks — PublicAML and MetaSleuth both offer free checks without an account, and USDTBanList has a free basic check with no signup.

Fake “wallet screening” sites

Because people search for wallet screening, scammers copy it. Malwarebytes described fake checker sites, many posing as AMLBot or using generic names like “AML Check”, that show a “checking wallet history” progress bar, ask the visitor to connect a wallet and then send a transaction to approve. Some end with a “Clean, Low Risk” result and a report whether or not any check took place.^[9] It is a form of approval phishing: the signature gives the scammer permission to spend tokens in your wallet.^[10]

The rule is simple. Real screening needs only the address you paste in. Leave any site that asks you to:

• connect your wallet;
• approve, sign or confirm a transaction;
• send a “fee” or small top-up from the wallet being checked;
• enter a seed phrase or private key.

Open checkers from the service’s own website, not from ads or direct messages. We keep a live list of fake AML checkers, and our guide to fake AML checkers explains what to do if you already signed.