AML risk categories explained

An AML report sorts the sources of an address’s money into categories. Most checkers group them into three levels. Our names follow the labels most providers publish, so you can match them to your report.

Danger

High risk

SanctionsHighAddresses on government sanctions lists or owned by listed entities.MixerHighServices that pool and reshuffle coins to break the link between sender and receiver.ScamHighMoney taken through fake investments, phishing, impersonation and similar deception.Stolen fundsHighCoins taken in hacks of exchanges, protocols or personal wallets.Darknet marketHighMarketplaces for illegal goods reachable only through anonymity networks.RansomwareHighPayments extorted by locking or threatening to leak a victim’s data.Illegal serviceHighServices that sell unlawful goods or offer unlawful services for crypto.Gambling (unlicensed)HighOnline casinos and betting sites operating without a licence.Fraudulent exchangeHighExchanges that ran off with user funds or were shut down by authorities.Terrorism financingHighAddresses linked by authorities to funding of terrorist groups.Enforcement actionHighEntities under active legal proceedings or seizure orders.

Suspicious

Medium risk

P2P without KYCMediumPeer-to-peer trades where neither side’s identity is checked.High-risk exchangeMediumExchanges with weak or no customer checks.

Trusted

Low risk

Regulated exchangeLowLicensed platforms that verify their customers.DeFi protocolLowEstablished on-chain lending, swaps and liquidity pools.

FAQ

How do categories become a risk score?

Each service weighs categories differently. Typically the share of funds from Danger categories drives the score up most, Suspicious ones less, and Trusted ones lower it. Read the breakdown, not only the number.

Why do two checkers show different categories for the same address?

They use different attribution data and labels. One may know an address belongs to a scam; another may not have labelled it yet. Unknown is not the same as clean.

Does one high-risk category always mean trouble?

Not always — a tiny share several hops away is common. Look at the percentage, how direct the link is, and the category itself. Sanctions exposure should always be taken seriously.