AML screening methodology

The first-party pipeline checks a wallet address against the downloaded OFAC SDN cryptocurrency-address set.

Scope note: Say address screening, not entity KYC or legal clearance.

The first-party pipeline fetches chain data through chain-specific handlers selected by the detected or trusted chain, and refuses to score a supported chain when its provider failed outright.

Scope note: Do not turn the handler inventory into a broader network-support claim without reconciling product_facts.json.

The blacklist layer uses Ransomwhere for BTC ransomware addresses, 0xB10C's curated OFAC address files for BTC/ETH/TRX, and the MyEtherWallet darklist for ETH scam or phishing addresses.

Scope note: These are code-configured sources; this registry does not assert their current remote availability or list size.

For Ethereum and TRON, the blacklist layer also makes read-only Tether contract calls to test whether an address is frozen.

Scope note: This is issuer-freeze status, not recovery, unfreezing, or return of funds.

First-party blacklist checks are dispatched only for BTC, ETH, and TRX, then their hit tokens are merged into chain risk signals before scoring.

Scope note: Do not imply that every supported chain receives every blacklist source.

The extended sanctions layer downloads UN, UK OFSI, Australian DFAT, and Swiss SECO datasets and matches entity labels against their normalized names and aliases.

Scope note: AU and CH data are fetched through OpenSanctions. Matching is label-to-entity-name matching, not direct address lookup.

A confirmed UN, UK, AU, or CH label match raises the combined score to at least 95 and adds a source-specific sanctions flag.

Scope note: A non-match is not proof that a wallet or owner is sanctions-free.

The first-party score gives a direct OFAC hit 95 points, applies fixed floors for known blacklist hits, adds a no-history heuristic, caps the result at 100, and maps it to LOW/MEDIUM/HIGH/CRITICAL thresholds.

Scope note: Describe this as a deterministic code heuristic, not a regulator-issued rating.

OnChainRisk is the documented external enrichment provider: the client authenticates with a bearer key, submits an address and network, and normalizes risk score, risk level, labels, pattern flags, sandbox state, and raw response data.

Scope note: The provider is optional and may return unavailable; never describe it as guaranteed.

The engine labels a result full only when OnChainRisk supplies a real score, and OnChainRisk cannot reduce an OFAC or first-party blacklist score floor.

Scope note: Full means completed enrichment in this result contract; it is not a guarantee that every upstream field is populated.

The anonymous free website check passes use_onchain_risk=False, returns onchain_risk_included=false, and the engine omits the OnChainRisk coroutine from that branch.

Scope note: Free still uses OFAC, chain fetch, and the applicable BTC/ETH/TRX blacklist function.

In the paid website checkout, OnChainRisk is attempted twice with use_onchain_risk=True and is accepted as complete only after a real non-sandbox score; a follow-up call with use_onchain_risk=False runs only if both attempts return no result object.

Scope note: Scope this statement to the website payment path. The engine default is use_onchain_risk=True, so this is not a universal claim about every Telegram caller.