Where the Risk Score Comes From
The score is not a gut feeling or a simple list lookup. It is a weighted calculation based on the full transaction history of an address.
AML analytics engines trace the flow of funds across the blockchain. They look at direct inputs and outputs but also at funds received two, three, or more hops back in the transaction chain. An address that received money from a darknet market three transactions ago carries different risk than one that received it directly, but both can affect the score.
The data sources include sanctions lists (OFAC SDN, EU, UN, UK), blockchain forensics databases covering darknet markets, mixers and tumblers, ransomware payment addresses, exchange hacks, and FATF typology patterns.
Each category contributes differently to the final number. A direct sanctions hit pushes the score to 100. Indirect darknet exposure a few hops away might add 10 to 20 points. The engine weighs proximity and severity together.
How to Get a Risk Score in 8 Seconds
Open @cryptoamlscan_bot in Telegram. Paste the crypto address you want to evaluate. The report comes back in about 8 seconds with the risk score and the specific flags that contributed to it.
You get 3 free checks per address per day with no registration required. The tool covers 30+ blockchains including BTC, ETH, TRX, SOL, BNB, and USDT on both TRC-20 and ERC-20.
The web version at cryptoaml.ai shows the same results in a browser interface. For businesses that need timestamped PDF documentation of each check, that is available starting at $0.99 per check.
The bot detects the blockchain automatically from the address format in most cases, so you just paste and wait.
What Each Risk Level Means in Practice
Score 0 to 24: low risk. The address has no known connections to flagged entities or activity. Safe to accept in normal circumstances.
Score 25 to 49: moderate attention. Something in the transaction history warrants a look. This might be a small indirect exposure or a transaction pattern that fits a FATF typology without being definitive. Ask questions before proceeding.
Score 50 to 74: elevated risk. Meaningful exposure to flagged activity. The specific flags in the report matter here. Direct connections to mixers or darknet markets at this level are a serious concern.
Score 75 to 99: high risk. Decline or require extensive documentation. Close association with sanctioned entities, direct darknet links, or ransomware payment history puts this address firmly in the avoid category for most situations.
Score 100: sanctioned. The address appears directly on OFAC SDN, EU, UN, or UK lists. Transacting is not just risky, it may be illegal depending on your jurisdiction.
Frequently Asked Questions
Does a low risk score guarantee the address is safe?
A low score (0-24) means no known AML flags exist at the time of the check. It does not guarantee the address is safe forever. Transaction history grows over time and new sanctions are added regularly. For ongoing business relationships, check each significant incoming transaction rather than checking once.
What is the difference between a score of 50 and a score of 76?
A score of 50 suggests meaningful exposure, often through indirect transactions or behavioral patterns that match suspicious typologies. A score of 76 puts the address in the high-risk category, typically meaning direct connections to darknet markets, mixers, or very close links to sanctioned entities. The 75 threshold is where most compliance professionals consider a payment refusal justified.
Can a legitimate address have a high risk score by mistake?
It is possible. A wallet that received funds from a compromised exchange or was briefly used as a hop in a fraud chain can show elevated scores without the current owner being aware. If you receive an unexpected high score on your own wallet, review your transaction history for unusual incoming funds. The flag categories in the report will point to the source.
Get a free risk score for any crypto address in 8 seconds via @cryptoamlscan_bot on Telegram.
Open @cryptoamlscan_bot in Telegram →