10 AML screening traps: when the risk score does not reflect the real picture

An AML report helps assess the risks associated with a crypto address or transactions involving it. However, the final risk score does not show the full picture. A proper analysis has to take into account the sources the assessment is based on, the nature and degree of the link to them, the transaction amounts and how the identified risks relate to the specific deal.

Even the same share of inflows from risky sources may call for different responses: a link to a gambling service and a link to an address with a confirmed connection to terrorist financing are risks of a different nature.

The result of an AML check should serve as the basis for a reasoned decision: go ahead with the transaction, request additional information or suspend the deal until the circumstances are clarified. Several common mistakes in reading and interpreting the report get in the way of this.

Mistake 1. Looking only at the final risk score

The risk score is convenient for an initial assessment, but making a decision based solely on this number is not enough. It is like judging a contract by its title and preamble without reading the terms.

Two addresses can have the same risk score but completely different reasons behind it. In the first case, the report may point to regular inflows from a risky service. In the second, to an old indirect link to a suspicious source. These situations call for different questions to the parties to the deal and may lead to different decisions.

That is why the analysis starts with the reasons behind the score: the risk categories identified, the transactions associated with them and the significance of the links found. This information is also compared against the jurisdiction in which the transaction takes place, the company's internal AML procedures and the requirements of its counterparties.

The final score on its own does not explain which circumstances shaped the assessment or how significant they are for the specific deal. To understand that, you need to study the structure of the report and the information about the sources of funds.

Low, medium, high: how AML risk scoring of crypto wallets worksJul 22, 2026Read more

Mistake 2. Treating low risk as a guarantee of safety and high risk as proof of guilt

A new crypto address may have a short transaction history. The screening service has not yet found any known risky links, but this does not confirm that the owner is acting in good faith. A new address that has only recently started transacting can also be used for illicit purposes, and AML data providers may not yet have the information needed to classify it correctly.

So a low risk score does not remove the need to assess the circumstances of the deal.

The opposite situation arises when an address receives a transfer from a suspicious source. The fact of such an inflow does not, by itself, prove that the recipient took part in a crime. The transfer may have been unwanted by the recipient or may relate to a transaction whose circumstances have not yet been established.

To reach a reasoned conclusion, you need to find out what exactly happened, what role the address owner played and what data supports the alleged link to the risky source. A label in the report points to a circumstance that needs to be assessed, but it does not replace an investigation.

Mistake 3. Drawing conclusions from the name of the risk category alone

The «fraud» category may refer either to the screened address itself or to a source that address is linked to. These are two different statements that cannot automatically be treated as the same.

In the analysis, it is important to establish which object the label applies to and in which direction the funds moved. Did the address receive crypto from a fraudulent service or, on the contrary, send assets to it? In the second case, the address owner may have been a victim. The category name alone does not reveal the role of a party to the transaction.

Shared wallets of crypto exchanges require particular care. Transactions of many customers pass through such addresses, so a link to an exchange wallet does not mean that all its transactions belong to one user. If a counterparty received a payout from a shared exchange address, the entire history of that address cannot automatically be attributed to them.

At the same time, using a major exchange does not guarantee that a specific transfer is safe either. Exchange infrastructure can serve different categories of customers, and the assessment of an individual transaction depends on its circumstances and the links established.

So it is necessary to distinguish between information about the counterparty itself and information about the infrastructure through which it carried out transactions.

Mistake 4. Treating all links to risky sources as equally significant

A direct inflow from a risky source and an indirect link through several intermediate addresses call for different analysis. However, the rule that more hops automatically reduce risk can also lead to wrong conclusions.

For example, funds pass in sequence through three addresses with almost no change in amount. The intermediate addresses show signs of transit use, and the sequence of transactions repeats the same distinctive pattern. In such a situation, several hops do not necessarily weaken the link to the original source significantly.

Additional intermediate addresses, long pauses in the movement of funds and differences in the behavior of participants can affect the assessment of the link, but they do not, by themselves, prove that the funds are of legitimate origin. On the other hand, finding a risky source 10–20 hops away does not automatically mean that the screened address should be considered high-risk. A conclusion has to take into account the nature of the route, the specifics of the network and the available evidence, and there may be exceptions.

A separate difficulty arises when funds pass through a shared exchange wallet. Because the exchange pools inflows from many customers and processes payouts separately, any incoming transfer cannot automatically be linked to any outgoing transfer from the same address.

So when analyzing a chain of transactions, you need to take into account the role of the intermediate addresses, the amounts and the sequence of transactions. If the report shows a link to a risky source but does not make it clear how that link arose, additional analysis of the route the funds took may be needed.

Mistake 5. Ignoring the amount and the nature of the risky source

The share of inflows from a risky source does not show the scale of the possible consequences unless the total transaction amount is taken into account.

The category of the source matters just as much. One percent of inflows from a gambling service and one percent of inflows from an address with a confirmed link to terrorist financing are risks of a different nature and may call for different response procedures.

In the first case, you need to establish what the operator is, which jurisdiction it operates in and which restrictions apply to the specific deal. In the second, even a small share of inflows should not automatically be considered insignificant. The grounds for the label and the nature of the link found should be checked, and if there are serious grounds for suspicion, the planned transaction should be suspended until the circumstances are clarified and a compliance specialist should be brought in. Depending on the facts established and the applicable requirements, it may be necessary to contact the competent authorities.

At the same time, a percentage only makes sense if the correct calculation base is used: for example, inflows over a certain period, the volume of a specific asset or another value stated in the report.

Mistake 6. Taking unlabeled sources for safe ones

For example, 20% of the inflows to an address may be linked to a well-known crypto exchange, while the remaining 80% have no established labels. Concluding that there are no problematic sources because the report contains no other risk categories would be unfounded. In that case, the origin of most of the inflows remains insufficiently examined.

For a significant deal, it may be necessary to establish the source of funds and obtain supporting documents or data. If a counterparty says they withdrew the crypto from an exchange, this claim can be compared with the withdrawal record, the actual transaction, the amount and the receiving address.

The supporting materials must relate specifically to the inflow being analyzed. A contract for a similar amount or a screenshot of a balance that does not allow a link to a specific transaction to be established does not solve the task of confirming the origin of funds.

Mistake 7. Substituting an address assessment for the analysis of a specific transaction

The overall history of a crypto address may look relatively clean, even though a single inflow raises reasonable questions.

For example, a Bitcoin address may receive funds mainly from ordinary counterparties, but one of the transactions is linked to a theft. If the funds from that particular transaction are used for a later payment, the address's overall risk score may not fully reflect the risks of the specific transfer.

When analyzing tokens on Ethereum and Tron, the origin of funds also cannot be established solely by matching amounts. If an address received a suspicious transfer of 1,000 USDT and later sent the same 1,000 USDT to another party, this match alone is not enough to claim that both cases involve the same units of value or a direct transfer of the specific funds received.

So it is necessary to distinguish between two tasks: assessing a crypto address before interacting with it and analyzing a specific transaction. The second requires data on the transaction itself:

• the transaction ID (TXID);
• the network;
• the asset;
• the amount;
• the addresses involved.

A general report on the address can complement such an analysis, but cannot always replace it.

Mistake 8. Relying on someone else's screenshot instead of checking yourself

A counterparty may provide an AML report with a low risk score. Even if the document is genuine, it may relate to a past date, a different network or an address that is not involved in the planned deal.

So the results need to be checked yourself. The address should be compared in full: matching the first and last characters does not yet confirm that it is the same address. The network also matters. The same address format can be used on different networks, for example Ethereum and BNB Chain, but the transaction history and screening results on them may differ.

When analyzing USDT, it is important to make sure that you are screening the address of the party to the deal and not the address of the token's smart contract. Choosing the wrong object to screen makes the results inapplicable to the actual transaction.

If a counterparty has changed their address, the previous report cannot automatically be used to assess the new details. If a payout comes from an exchange, the actual transaction should be compared with the withdrawal confirmation: the customer's personal wallet and the address from which the exchange sent the payout may not match.

The reliability of a check depends not only on the quality of the report itself, but also on whether it matches the real address, network and transaction.

Mistake 9. Keeping only the risk score and relying on an old check for months

A risk assessment reflects the information available to the service at the time of the check. Later, the address may receive new inflows, and the AML data provider may identify a previously unknown link to a risky source.

The risk score can change even without any new transactions on the screened address. For example, one of the earlier senders may later be linked to a hack or theft of funds. The transaction history stays the same, but new information appears that affects the interpretation of transactions already made.

So for later analysis, it is important to keep the full report with the date of the check, the address, the network and the details of the relevant deal. Before a new significant transaction, the check should be updated. In corporate procedures, it is also useful to record who made the decision based on the analysis and on what grounds.

If the risk score has changed, you need to compare the reasons for the change, not just the final values. A new assessment does not necessarily mean the previous check was wrong: the available data, the classification of sources or the information about earlier transactions may have changed.

Mistake 10. Getting an AML report without deciding on next steps

Running an AML check does not, by itself, mean that the risk has been assessed and a decision on the deal has been made. The result of the analysis must be tied to a specific next action:

• if no significant inconsistencies are found, the deal can go ahead, taking into account the applicable requirements and internal procedures;
• if the origin of funds is not explained, it may be necessary to request supporting information;
• if a serious risky link is found, the planned transaction should be suspended pending further assessment, if the circumstances and applicable rules require it.

If the funds have already arrived, trying to move them through a new wallet does not erase the history of earlier transactions. First, you need to establish the reason for the identified risk and decide on further action based on the nature of the transaction.

It is advisable to document the outcome of the review briefly and to the point. For example:

Such a record allows other employees to understand why the decision was made, which information has already been checked and which actions remain outstanding. It also reduces the risk that, after some time, the company will have to reconstruct the course of the analysis and the grounds for approving or suspending the payment from scratch.

Conclusion: an AML report should explain the risk, not just show a score

A small share of inflows does not make any source acceptable. A large number of intermediate hops does not necessarily remove the link to the original source. A low risk score also does not replace checking the circumstances of the deal and the counterparty's explanations.

An AML service helps identify risk factors and structure the available information, but its report does not guarantee that the funds are safe and does not replace a specialist's final assessment. The decision should take into account the nature of the source, how well the link is confirmed, the volume of funds, the specifics of the transaction and the requirements that apply to the specific organization.