Cluster
Addresses that belong to one owner. Our engine groups them by transaction patterns that show common control.
AML analysis · Business & Personal
How AMLBot Calculates AML Risk Scores for Crypto Wallets and Transactions
Learn how AMLBot analyzes crypto wallets and transactions using blockchain clustering, connection tracing, and risk exposure scoring to calculate an AML risk score from 0 to 100%.
- Risk level
- Risk breakdown
- Sanctions screening
- Entities and events
How Crypto Wallet Analysis Works in AMLBot
Clustering
Addresses of one owner are grouped into a cluster.
Entity attribution
Known clusters get a type and a Risk Score.
Connection tracing
Funds are traced until they reach a known entity.
Risk scoring
Weighted exposure becomes one score from 0 to 100%.
Clusters and entities
Known owner: the address takes the entity’s Risk Score. Unknown owner: the score comes from its connections.
Entity
A cluster with a known owner: an exchange, mixer, wallet or payment service. Analysts assign its type and Risk Score from open data, reports and investigations.
Crypto Wallet Risk Assessment: What AMLBot Checks
Basic information
- Total received and sent
- Owner or entity
- Sanctions and blocklists
Direct connections
Counterparties in the same transaction. The most precise data: amounts, transaction count, dates.
Indirect connections
Traced through unnamed addresses until funds reach a known entity or the depth limit. Shows where the money came from and where it went.
How tracing follows the money
- Checked address0x3bEb…66D5
- directUnnamed address0x71C7…9A2f
- indirectUnnamed cluster0xA4b2…e31C
- indirectKnown entityMixerHigh risk
Crypto Transaction Screening Across Blockchain Models
UTXO model
Bitcoin and similarEvery input and output is checked.
Account-based model
Ethereum and similar- Native ETH transfer
- ERC-20 tokens: USDT, USDC…
- Contract calls and DEX swaps
Every layer is checked.
AML risk score calculation
AML risk score calculation in AMLBot combines the share of funds linked to an entity type, its impact coefficient, and its base risk level.
Share
Portion of funds linked to this type
Impact coefficient
How much this type moves the score
Base risk level
Baseline risk of this type
One number from 0 to 100%
- Low risk
- 0–25%
- Medium risk
- 26–74%
- High risk
- 75–100%
Consistent everywhere
The same score in the web app, API, Telegram bot and automated monitoring.
When the score is n/a
A new address, no history yet, or limited blockchain support. n/a doesn’t mean safe, just not enough data.
Time-based attribution
Risk at the moment of the transaction
Entities change status: an exchange may be sanctioned later. Past transactions keep the status the entity had at that time.
Exchange
- March · client transactionTrusted
- August · sanctionsSanctions
What do we analyze? 20+ sources of risk
AMLBot classifies blockchain entities into crypto AML risk categories, including high-risk sources such as sanctioned addresses, mixers, scams, and darknet markets.
Child Exploitation
Entities associated with child exploitation.
Dark Market
Coins associated with illegal activities.
Dark Service
Coins related to child abuse, terrorist financing or drug trafficking.
Enforcement action
The entity is subject to legal proceedings with the judicial authorities.
Fraudulent Exchange
Exchanges involved in exit scams, illegal behavior, or whose funds have been confiscated by government authorities.
Gambling
Coins associated with unlicensed online games
Illegal Service
Coins associated with illegal activities.
Malware
Addresses linked to malware, including cryptojackers, clippers, botnets, trojans and DDoS campaigns.
Mixer
Coins that passed via a mixer to make tracking difficult or impossible. Mixers are mainly used for money laundering.
Ransom
Coins obtained by extortion or blackmail.
Sanctions
Entities subject to sanctions.
Scam
Coins that were obtained by deception.
Stolen Coins
Coins obtained by stealing someone else's cryptocurrency.
Terrorism Financing
Entities associated with terrorism financing.
Be careful
Any Danger category, Sanctions included, can lead to blocked funds, depending on the service’s policies. Check before you transact.
ATM
Coins obtained via cryptocurrency ATM operator.
Decentralized Exchange Contract
Smart contracts of blockchain applications that execute cryptocurrency and token trades automatically, without a central operator.
Exchange | High Risk
An entity becomes high-risk based on the following criteria:
No KYC: does not require any customer information before allowing any level of deposit/withdrawal, or makes no attempt to verify that information.
Criminal Ties: Criminal charges against the legal entity in connection with AML/CFT violations.
Impact: High exposure to risky services such as darknet markets, other high-risk exchanges, or mixing is defined as a service whose direct high-risk exposure differs by one standard deviation from the average of all identified exchanges over a 12-month period.
Jurisdiction: based in a jurisdiction with weak AML/CFT measures.
Unlicensed: does not have any specific license to trade cryptocurrencies.Infrastructure as a Service
Entities that provide computing and information services, including VPN, VPS hosting and domain registration.
Liquidity Pools
The smart contracts where tokens are locked for the purpose of providing liquidity.
P2P Exchange | High Risk
The entity does not have any special license to conduct and provide cryptocurrency exchange services, when participants exchange directly with each other, without intermediaries.
It also includes entities that are licensed but located in listed jurisdictions, are listed as non-cooperating companies by the FATF, or do not provide KYC for large-value transactions, making them attractive for money laundering.Unnamed Service
The category refers to currently unidentified clusters that exhibit the behavior expected of a service, by a large number of addresses and transactions.
Exchange
The organization allows users to buy, sell and trade cryptocurrencies with trading licenses that include the following aspects of services:
—Depository, brokerage or other related financial services that provide exchange services where participants interact with a central party.
And it does not include:
— Licenses for non-specific financial services and jurisdictions included in the FATF non-cooperative list.
They represent the most important and most used category of entities in the cryptocurrency industry, accounting for 90% of all funds sent via these services.Marketplace
Coins that were used to pay for legal activities
Merchant Services
The entity that allows businesses to accept payments from their customers, also known as payment gateways or payment processors.
It often faciliates conversions to local fiat currency and transferring the funds into the merchant's bank account.Miner
Coins mined by miners and not forwarded yet.
Other
Coins obtained through airdrops, token sales or other means.
P2P Exchange
The entity is licensed to conduct a business that is specific to providing cryptocurrency exchange services where participants exchange directly with each other, without intermediaries.
It does not include non-specific financial services licenses and jurisdictions that are on the non-cooperative FATF list.Payment Management
Coins related to payment services.
Seized Assets
Crypto assets seized by the government.
Wallet
Online Wallet is a service used for storing and transacting cryptocurrency. Hosted wallets, a type of online wallet, are custodial solutions where the service holds the user's private keys, posing potential risks of scams or insufficient security, though reputable providers may offer better security than non-expert individuals.
Business and Personal: same logic, different depth
Personal
Quick wallet check
- Simplified analysis
- Limited data sources
- Shallower connection tracing
Business
Full AML analysis
- All data sources
- Direct and indirect connections
- Multi-layer transactions: tokens, contracts, DEX
- Time-based attribution
- Web app, API and monitoring
Free Business trial
Try AMLBot in your own workflow
Tell us what your business needs, and we’ll set up a free trial with the AML tools that are most relevant to you.
Build my free trial
Takes a few quick questions
Your Business trial
Example setup- KYT: Screening, Transaction & Address Monitoring
- KYC / KYB
- AI Tracer
- Travel Rule
Full access to Business mode, set up around your answers
Frequently Asked Questions
Your Question Is Not on the List?
Contact us via messenger. We are in touch 24/7, so any issue can be resolved quickly and in a live chat format.
It may take a little longer to respond during the night.