Address AML Risk: What It Is and How to Check It

What AML is in plain words

AML (anti-money laundering) is a set of rules and procedures meant to make it harder to use the financial system for laundering money and financing crime. For an ordinary person it looks like a bank's questions about the origin of funds, document checks and, sometimes, a blocked transfer.

In cryptocurrencies the same ideas are applied to addresses and transactions. Since the history of operations is public, companies can trace where funds came from and assess whether they are linked to prohibited sources. The main terms are explained nearby in the crypto exchange glossary.

What KYT is and how it differs from KYC

KYC (know your customer) is a check of the customer's identity: documents, data, sometimes a photo. KYT (know your transaction) is an analysis of the operations themselves: where the funds came from, which addresses they passed through, and whether there is a link to known risky sources.

These checks are independent. You can pass KYC and still receive a warning about a specific payment if suspicious addresses are linked to it. And conversely, a service without full identity verification can analyze incoming transactions. Which checks a particular service applies is stated in its rules; in this article we claim nothing about BITWHITE beyond what is described in the last section.

Why services and exchanges assess addresses

There are several reasons.

Legal requirements. In many countries, organizations working with crypto assets must apply anti-money-laundering procedures and comply with sanctions regimes.
Risk of blocking. Partners, banks and payment providers may end cooperation with a service that accepts funds from risky sources.
Customer protection. A payment from a scammer may be disputed by its victims, and the recipient ends up drawn into proceedings.

So checking an address is an ordinary part of the work of a mature service, not a personal accusation against a customer.

For the user, a simple thing follows: questions about the origin of funds do not in themselves mean suspicion. It is a standard procedure, and a calm, documented answer usually speeds up the review.

What dirty coins mean in terms of risk

In a blockchain there are no clean and dirty coins in the physical sense: coins are identical. In everyday speech, dirty refers to funds whose history has a link to a problematic source. This is precisely a risk assessment, not a property of the coin.

Typical categories that analysts take into account:

Sanctions: addresses that have appeared on regulators' sanctions lists.
Fraud and phishing: addresses linked to deceiving users, fake projects, extortion.
Darknet markets: trade in prohibited goods.
Stolen funds: hacks of exchanges and wallets.
Higher-risk services: for example, a number of mixers, discussed in the article on types of crypto mixers.

Important: the link can be direct or indirect, and it is its degree that determines the assessment.

How risk scoring is usually built

Each company has its own algorithms and does not disclose them fully, but the general scheme is similar:

The operation history and linked addresses are collected for the address.
Addresses and services known to analysts are tagged with categories: exchange, gambling service, sanctions list, fraud and so on.
The distance is assessed: how many hops separate your address from a risky source, and what share of funds is linked to it.
The output is an assessment, most often as a level (low, medium, high, critical) or a number, and a list of reasons.

Context matters: a direct payment from an address on a sanctions list is treated more strictly than a distant link of small share through a large service. The assessment remains probabilistic and can be wrong.

Also remember that different providers may give different assessments for the same address, because their tagging databases and thresholds differ. One assessment is not equal to the service's final decision.

Why an address can get a high risk without the owner's fault

It happens that a person receives a payment from an honest counterparty, but in the history of those funds there was once a bad address. Or someone sends you a small amount from a risky address without your consent. Such situations are objectively possible, and different services react to them differently.

So do not treat an assessment as a verdict, but do not ignore it either. If you receive a large payment from a stranger, it is sensible first to find out where the funds came from and to record it: a contract, correspondence, confirmation of the source. By accepting funds you are responsible for your own actions, not for the coins' past.

How an ordinary user can check incoming funds before crediting

The check needs no special knowledge if you proceed in order:

Ask the sender for the address and the txid as soon as they have sent the payment. What a txid is, read in the article about txid and the blockchain explorer.
Open the transaction in a blockchain explorer and see which address the funds came from, in what amount, and how many confirmations have been received.
If you have access to a risk assessment service (free or paid, from a reliable provider), enter the sender's address and the txid and look at the category and the reasons for the assessment.
Compare the result with common sense: do you know the sender, does the amount match what was agreed.
Do not credit or pass the funds on until you have figured it out, if the assessment is high or there are doubts.

Remember that such services give an assessment, not a legal opinion.

What to check before giving out your address

The risk starts even before the payment. Before giving an address to another person or service:

make sure the address and network are correct: see how to check a wallet address;
do not use the address holding your main funds for a one-off deal with a stranger;
write down the terms of the deal: amount, coin, network, date, purpose;
do not agree to strange schemes: payment by third parties, unfamiliar intermediaries, a request to urgently send funds on.

Such requests often accompany fraud, and it is exactly such chains that later end up in risk assessments.

What to do if an exchange or service has frozen a payment

A freeze most often means the operation has gone for additional review. There is no need to panic, but you should act calmly and consistently:

Do not send the payment again and do not create duplicates.
Save the data: the order or operation number, txid, sender and recipient addresses, amount, coin, network, time, screenshots of the status.
Contact the support of the service itself through official channels and ask which documents or explanations are needed.
Provide only truthful information and supporting documents relevant to the case. Do not try to confuse matters or split the funds: it will make the situation worse.
If the amount is significant or the situation is unclear, consult a lawyer who works with cryptocurrency law in your country.

The timing and procedure of the review are determined by the service itself and by applicable legislation.

Keep a short log: when you wrote, what you were answered, which documents you sent. Such a log will be useful to you and to a lawyer if the matter drags on. Do not take advice from strangers in chats and forums who offer to resolve the issue for a percentage: that is exactly what scammers exploit.

Why nobody can clean coins

The history of operations in a public blockchain cannot be erased, and no service can lawfully zero out a link to sanctions or a crime. So offers such as we will clean your coins, we will remove the risk from your address or we will make the funds clean should be treated as a red flag.

Such services often turn out to be fraudulent: you send money and receive nothing. In the worst case they are illegal in themselves, and taking part in them can create additional legal problems for you. If you have a real problem with blocked funds, there is one path: official requests to the service and a consultation with a lawyer. Signs of deception are also described in the article about fake exchange services.

How to document the origin of funds

If a service asks for explanations, it is better to know in advance what is usually considered convincing. It depends on the situation, but the general principle is one: you show the real history, you do not construct one.

A contract, invoice or act under which you received a payment.
Correspondence with the counterparty showing the amount, date and purpose.
A statement from the exchange or other service from which you withdrew the funds, and the withdrawal txid.
Tax or other income documents, if the funds were received as payment for work.

Keep these documents together with the txid. If you are unsure what data needs to be provided and how it will be used, ask the service and a lawyer, rather than sending everything indiscriminately.

How to tell a real check from a scam

Scammers often masquerade as a security service or an AML department. A real check does not require payments or secrets from you. Warning signs:

they ask you to pay a fine for unblocking, insurance or a deposit;
they ask for a seed phrase, private keys or access to the wallet;
they write in private messages in a messenger from an unofficial account;
they rush you and threaten irreversible consequences within an hour;
they refer to a domain that differs from the official one.

If you notice this, stop communicating and contact the service through official channels. General protection principles are collected in the article about wallet security. To compare the working models of platforms that approach checks differently, see the material exchange service, exchange or P2P.

Typical mistakes

Accepting payments from strangers without finding out the source and without recording the terms of the deal.
Trying to get around a freeze: splitting amounts, running coins through different addresses and services.
Paying intermediaries who promise to unfreeze or clean funds.
Not saving the txid and the correspondence with support.
Sending the payment a second time without waiting for support's reply.
Hiding material circumstances from the service or giving incorrect explanations.
Treating a risk assessment as a final verdict and not asking for explanations.

User checklist

Know the sender and the reason for the payment before receiving funds.
Get the txid and open the transaction in an explorer.
If in doubt, check the sender's address in a reliable risk assessment service.
Do not use your main wallet for deals with strangers.
Save the txid, order numbers, correspondence and screenshots.
If frozen, write to official support and do not send the payment again.
Do not pay those who promise to clean coins.
For large amounts and an unclear situation, consult a lawyer.

Link to stuck and disputed payments

Not every delay is an AML check. Often the reason is simpler: too few confirmations, a wrong amount or a wrong network. First rule out technical causes: compare the number of confirmations with the expected one (how long to wait for confirmations) and check that the amount and network are correct. If the payment is stuck in the network, see also the stuck transaction article.

If the service states directly that a check is under way, follow the algorithm from the section on freezes. In any case, your data is the guide: txid, amount, time and operation number.

How this relates to exchanging on BITWHITE

In an exchange on BITWHITE you send the payment to the address issued for the order (it is valid for up to 2 hours), in the selected network and in the exact amount. If a payment arrived after the deadline, for a different amount or in a different network, an operator processes it manually through support; there is no need to send the payment again. The order status is viewed by number or link, and the txid is shown in the order. More about exchanging: how to exchange cryptocurrency.

For questions related to checking a specific payment, write to support through the official channels on the Contacts page and give the order number (BW-...), coin, amount and txid. We do not give detailed information here about internal address-check procedures and refund conditions in such cases. The service does not ask for a seed phrase or private keys and does not offer exchanges in private messages.

Address AML Risk: What It Is, How It Is Assessed and How to Check Incoming Funds