AML screening methodology

The first-party pipeline checks a wallet address against the downloaded OFAC SDN cryptocurrency-address set.

Scope note: Say address screening, not entity KYC or legal clearance.

The first-party pipeline fetches chain data through chain-specific handlers selected by the detected or trusted chain, and refuses to score a supported chain when its provider failed outright.

Scope note: Do not turn the handler inventory into a broader network-support claim without reconciling product_facts.json.

The blacklist layer uses Ransomwhere for BTC ransomware addresses, 0xB10C's curated OFAC address files for BTC/ETH/TRX, and the MyEtherWallet darklist for ETH scam or phishing addresses.

Scope note: These are code-configured sources; this registry does not assert their current remote availability or list size.

For Ethereum and TRON, the blacklist layer also makes read-only Tether contract calls to test whether an address is frozen.

Scope note: This is issuer-freeze status, not recovery, unfreezing, or return of funds.

First-party blacklist checks are dispatched only for BTC, ETH, and TRX, then their hit tokens are merged into chain risk signals before scoring.

Scope note: Do not imply that every supported chain receives every blacklist source.

The extended sanctions layer downloads UN, UK OFSI, Australian DFAT, and Swiss SECO datasets and matches entity labels against their normalized names and aliases.

Scope note: AU DFAT and CH SECO are fetched from official government sources. Matching is label-to-entity-name matching, not direct address lookup.

A confirmed UN, UK, AU, or CH label match raises the combined score to at least 95 and adds a source-specific sanctions flag.

Scope note: A non-match is not proof that a wallet or owner is sanctions-free.

The first-party score gives a direct OFAC hit 95 points, applies fixed floors for known blacklist hits, adds a no-history heuristic, caps the result at 100, and maps it to LOW/MEDIUM/HIGH/CRITICAL thresholds.

Scope note: Describe this as a deterministic code heuristic, not a regulator-issued rating.

Merkle Science is the optional external enrichment provider: the engine submits an address and network to it through a provider client that returns a status and an enrichment payload, or no payload when the provider is unavailable.

Scope note: The provider is optional and may return unavailable; never describe it as guaranteed.

The engine labels a result full only when Merkle Science supplies a real score, and Merkle Science cannot reduce an OFAC or first-party blacklist score floor.

Scope note: Full means completed enrichment in this result contract; it is not a guarantee that every upstream field is populated.

The anonymous free website check switches the deep-analysis layer off, reports that it was not included, and the engine omits the Merkle Science coroutine from that branch.

Scope note: Free still uses OFAC, chain fetch, and the applicable BTC/ETH/TRX blacklist function.

In the paid website checkout, Merkle Science is attempted twice with the deep-analysis layer enabled and is accepted as complete only after a real non-sandbox score; a follow-up call with that layer disabled runs only if both attempts return no result object.

Scope note: Scope this statement to the website payment path. The engine enables the deep-analysis layer by default, so this is not a universal claim about every Telegram caller.