What Is an AML Check and Why It Matters for Crypto
An AML (Anti-Money Laundering) check is a compliance screening that examines a blockchain address to detect illicit activity or high-risk associations. Unlike traditional banking, where AML is enforced by regulators, crypto AML checks are performed by blockchain analytics firms, exchanges, and wallet providers to flag suspicious transactions before they settle.
Why it matters: Exchanges freeze accounts and lock USDT if they detect tainted coins. If you receive stolen crypto or funds from a sanctioned entity, your wallet can be blacklisted, making it impossible to deposit or withdraw on regulated platforms. An AML check cost is typically low or free for basic screening, but the cost of ignoring one can be account suspension or seized funds. Crypto risk scores range from low (green) to critical (red), and most exchanges reject deposits above a certain threshold.
How AML Risk Scoring Works
AML risk scoring assigns a numerical or categorical rating to a wallet based on transaction history, source of funds, and behavioral patterns. Here's how the process works:
1. Address tracing: The system traces the wallet's incoming and outgoing transactions back through the blockchain to identify the original source.
2. Database matching: The address is cross-referenced against known lists: OFAC sanctions, stolen fund databases, darknet market addresses, and mixer services.
3. Pattern analysis: Algorithms detect suspicious behavior such as rapid fund movement, layering through multiple wallets, or interaction with high-risk services.
4. Risk assignment: The wallet receives a score—typically 0–100, where 0–20 is low risk, 21–50 is medium, 51–80 is high, and 81–100 is critical.
Risk categories include: stolen funds, ransomware proceeds, mixer usage, darknet market links, gambling platform interaction, and sanctioned entity involvement. Each category carries different weight; stolen crypto typically triggers immediate rejection, while mixer usage may be flagged but not always blocked.
How to Do AML Checks: Step-by-Step Process
Checking a wallet before receiving or sending crypto involves these steps:
1. Collect the address: Copy the full wallet address (TRX, USDT TRC20, BTC, or ETH).
2. Choose a screening tool: Use a verified AML service from our curated AML Services list on this site—these are trusted providers that offer wallet screening with transparent methodology.
3. Enter the address: Paste the address into the screening tool's search field.
4. Review the report: The tool returns a risk score, transaction history, and flagged associations (if any).
5. Interpret the result: A low-risk score means the wallet is clean. A medium or high score requires further investigation—contact the sender or decline the transaction.
6. Document the check: Keep records of your screening for compliance purposes.
An AML check fee varies by service and depth: basic checks are often free, while detailed reports with historical analysis may cost a small fee. For high-value transfers, paying for a thorough check is standard practice.
What Risk Score Levels Mean and When to Accept or Reject
Risk scores guide your decision to accept or reject a transaction. Here's what each level typically means:
Low risk (0–20): Clean wallet history, no known illicit associations. Safe to accept.
Medium risk (21–50): Minor red flags such as mixer interaction or unconfirmed associations. Acceptable for small amounts if you trust the sender; higher amounts warrant caution.
High risk (51–80): Significant concerns such as darknet market links, multiple mixer hops, or stolen fund traces. Reject unless you have strong reason to proceed and can verify legitimacy with the sender.
Critical risk (81–100): Confirmed stolen funds, ransomware proceeds, or sanctioned entity involvement. Reject immediately.
Most exchanges set automatic rejection thresholds at 50 or 75, meaning deposits above those scores are blocked. If you receive flagged crypto, your exchange account may be frozen pending investigation. The safest practice is to reject any address scoring above 30 unless you have direct, verified communication with the sender explaining the risk factors.
Common Risk Factors: Mixers, Darknet, Theft, and Sanctions
AML checks flag specific risk categories that indicate illicit or high-risk activity:
Mixers and tumblers: Services that obscure transaction trails by combining and splitting funds. Mixer usage alone doesn't prove crime but signals intent to hide the source.
Darknet market exposure: Addresses linked to known darknet marketplaces for drugs, weapons, or stolen data. These carry the highest risk.
Stolen funds: Crypto traced back to theft, hacking, or fraud. Exchanges will freeze these immediately.
Ransomware proceeds: Funds paid to attackers in ransomware extortion. Typically flagged as critical risk.
Sanctioned entities: Addresses linked to individuals or organizations on OFAC or equivalent lists. Transactions with these are illegal in many jurisdictions.
Gambling and scam platforms: Some AML services flag interaction with unregulated gambling or known scam addresses, though risk levels vary.
Each risk factor is weighted differently; theft and sanctions are near-automatic rejections, while mixer usage may be tolerated depending on context and jurisdiction.
What Happens When Your Coins Are Flagged as Tainted
If you receive or hold crypto flagged as tainted, several outcomes are possible:
Exchange deposit rejection: Most regulated exchanges will refuse to deposit flagged coins. The transaction may be reversed or held pending review.
Account freeze: If you deposit tainted crypto without screening, the exchange may freeze your account and launch an investigation. Unfreezing can take weeks or months.
Funds seizure: In cases of confirmed theft or sanctions violations, exchanges may seize the funds permanently.
Compliance reporting: Exchanges report flagged transactions to financial authorities in their jurisdiction, creating a compliance record.
Wallet blacklisting: The address itself may be added to internal or shared blocklists, making it difficult to use on any regulated platform.
To recover from a flag: Contact the exchange's compliance team with documentation of the transaction source. If the flag is a false positive (e.g., mixer usage for privacy, not crime), provide context. However, recovery is not guaranteed, and prevention through pre-transfer screening is far more effective.
How to Avoid Receiving Tainted Crypto: Best Practices
Protecting yourself starts before you receive funds:
1. Screen before accepting: Ask the sender for their wallet address and run an AML check before agreeing to the transaction. Use verified services from our AML Services directory.
2. Verify the sender: Confirm the sender's identity through a separate, trusted channel (phone, in-person, known contact).
3. Start small: For new counterparties, accept a small amount first and screen it. If clean, proceed with larger transfers.
4. Use reputable exchanges: Deposit only to exchanges with strong AML compliance; they screen outgoing transfers and reduce your risk.
5. Avoid mixing services: Do not send your crypto through mixers unless you have a specific privacy need; this flags your wallet.
6. Keep records: Document all transfers and AML checks for your own compliance and in case of disputes.
7. Educate counterparties: If you're a business, inform clients that you screen all incoming transfers. This deters senders of tainted crypto.
These practices reduce the likelihood of receiving flagged funds and protect your exchange accounts from freezes.
Frequently asked questions
How much does an AML check cost?
Basic AML checks are often free or cost a few dollars per address. Detailed reports with historical transaction analysis may cost $10–50 depending on the service. Exchanges typically absorb the cost for deposits. For businesses handling frequent transfers, subscription plans offer lower per-check rates. Check our AML Services page for pricing details from verified providers.
Can I check a USDT TRC20 address before sending?
Yes. Copy the TRC20 address and paste it into an AML screening tool. The tool will scan the Tron blockchain and return a risk score. Most AML services support TRC20, BTC, ETH, and other major blockchains. Screening before sending is the safest practice to avoid sending to a flagged or high-risk wallet.
What does a low AML risk score mean?
A low risk score (typically 0–20) means the wallet has a clean transaction history with no known links to theft, sanctions, darknet markets, or other illicit activity. Low-risk addresses are safe to accept and deposit on exchanges. However, even low-risk wallets can be involved in legitimate but unusual activity, so context matters.
Will my exchange account be frozen if I deposit tainted crypto?
Possibly. If you deposit crypto flagged as tainted—stolen, from sanctions lists, or linked to crime—the exchange may freeze your account pending investigation. Freezes can last weeks or months. Prevention through AML screening before deposit is far more effective than trying to recover a frozen account.
How do exchanges detect tainted crypto?
Exchanges use blockchain analytics to trace incoming deposits against known theft databases, sanctions lists, and darknet market addresses. When a deposit matches a flagged address or shows high-risk patterns, the exchange flags it automatically. This happens in real-time or during periodic compliance reviews.
