How to Use AML Screening Before Sending or Receiving Crypto

Most mistakes involving AML services are not caused by misreading a risk score. The problem is usually simpler: the user runs the check too late, after the cryptocurrency has already reached their wallet or an exchange has started asking questions.

AML screening is gradually becoming a new standard for working safely with digital assets. For individuals, it is a practical form of due diligence that can save both money and a great deal of stress.

For businesses, it forms part of a broader risk-control framework. In professional compliance processes, addresses are screened before a transaction and monitored afterwards. FATF also recommends that VASPs identify, assess, and mitigate money-laundering and terrorist-financing risks using a risk-based approach.

However, simply clicking “Check” does not solve the problem. You need to understand what exactly should be screened, when the check should take place, and what action should follow the result.

There is no single object that should always be screened. The right choice depends on your role in the transaction.

In a P2P or OTC transaction, it is not always necessary to formally screen “both sides.” Each participant should assess the cryptocurrency address with which they are directly interacting: the address they are sending assets to or the address they expect to receive them from.

It is also important to verify that the address is being screened on the correct blockchain. A result for an address on one network does not automatically apply to another. Not every AML service can screen the same address across all supported networks.

A check performed after receiving risky funds answers the question: “What has already arrived in my wallet?” A pre-transaction check asks a much more useful question: “Should I interact with this address at all?”

When risk is identified in advance, you can request another address, ask for clarification about the source of funds, decline the transaction, or carry out a deeper review. Once the assets have arrived, your options are more limited: the funds are already connected to your wallet, and moving them blindly to your main address or an exchange may create further problems.

This is why Wallet Screening is generally used during onboarding or immediately before a transaction. Its purpose is to assess the address before funds move and support one of three decisions: approve the transaction, block it, or escalate it for further review.

A single transaction shows a particular movement of funds, but it does not always reveal the full picture. A counterparty may have used the same address for years, interacted with numerous services, or regularly switched between different wallets.

In this context, assessing the counterparty does not mean automatically identifying the person behind the wallet. It means reviewing the available on-chain information as a whole, including:

An address, a transaction, and a counterparty should therefore not be treated as interchangeable objects of analysis. They complement one another, but a broader assessment of the counterparty provides more information and supports a more balanced decision about whether to proceed.

A single user may control several wallets, while an exchange, exchanger, or another service may operate thousands of addresses. For deeper analysis, blockchain analytics systems group addresses that appear to be connected into clusters.

However, clustering is an analytical conclusion, not definitive proof of common ownership. Clustering errors are possible and may cause a label or risk category to be assigned to an address that is not actually controlled by the presumed owner.

For a routine transaction, it is reasonable to begin with the address provided by the counterparty. Cluster and graph analysis become appropriate when the amount is significant, the result is ambiguous, or a single address does not provide enough information for a well-founded decision.

Address screening examines the accumulated history of a wallet: the origin of its funds, interactions with counterparties, known labels, age, and behavioral characteristics.

Transaction screening focuses on a specific transfer. It helps determine which funds are involved in that particular operation and where they came from.

The distinction is especially clear in Bitcoin. A single Bitcoin transaction may contain several inputs, each spending a separate output from an earlier transaction. Those inputs may have different histories, which means that one overall address-level score may not fully explain the origin of the particular coins being transferred. The ability to combine multiple inputs is built into the structure of Bitcoin transactions.

Ethereum, Tron, and other account-based networks work differently, but analysis of a specific transfer may still reveal information that is not visible in the address’s overall risk profile.

Sometimes the sender’s address becomes known only after the cryptocurrency arrives. This is common when processing large numbers of payments, working through certain platforms, or receiving one-off transfers from new counterparties.

A reasonable process in this situation is:

A separate address does not “clean” cryptocurrency or alter its history. Its purpose is much simpler: to isolate unknown funds until they have been reviewed and prevent them from being mixed with the rest of the balance.

If the check identifies serious risk, do not try to solve the problem by moving the assets through additional wallets. This does not remove the original connections and may only make the subsequent transaction path more difficult to explain.

The most common mistake is to look at the final risk score and close the report. The overall score is useful for quick orientation, but it does not explain the situation on its own.

The report should also show:

For example, Btrace, the AML solution developed by our company, assesses a combination of factors rather than a single indicator. These include the source of funds, address behavior, counterparties, age, and transaction history. The result is summarized as a risk score that supports one of three decisions: proceed, decline, or escalate the case.

An excerpt from a Btrace address-screening report:

A more detailed explanation of risk scores, source of funds, and direct and indirect connections is available in our article “What a Crypto AML Check Shows, How to Read the Results, and When It Is Not Enough.”

An address that showed a low risk level yesterday does not receive a lifetime certificate of safety. It may carry out new transactions, interact with different counterparties, or become part of a new transaction chain.

The assessment may also change without any new activity from the address itself. This can happen because of retrospective labelling. For example, a previously unknown service or wallet may later be linked to a hack, fraud, sanctions, or another risk category once new information becomes available.

Continuous monitoring services exist precisely because an address’s risk profile—and the analytical data available about it—can change over time.

Exchanges, exchangers, and payment services process large numbers of transactions and do not always know the counterparty’s external address before the funds arrive. Their processes are therefore rarely limited to a single check.

They may include screening the deposit or withdrawal address, assessing a specific incoming or outgoing transaction, and continuously monitoring the customer’s behavior through KYT. Wallet Screening provides a point-in-time assessment of an address, while Transaction Monitoring tracks the movement of funds and generates alerts as new activity occurs. These mechanisms complement one another rather than serve as alternatives.

For businesses, documenting the result is another essential element. FATF identifies risk assessment, customer due diligence, record-keeping, and suspicious transaction reporting as core components of a risk-based AML/CFT framework for VASPs. The exact obligations depend on the relevant jurisdiction.

Btrace, for example, allows users to screen individual crypto addresses or transactions through its interface, automate high-volume screening through the API, and use a Telegram bot for occasional checks.

Before sending or receiving cryptocurrency, follow a few basic steps:

If the transaction path is ambiguous, an automated report may not be enough. In that case, examine associated addresses and the movement of funds on a graph or involve a specialist.

Using AML screening correctly begins not with the final score, but with two questions: what exactly are we screening, and can we do it before the transaction takes place?

Before sending cryptocurrency, assess the recipient’s address. Before receiving it, assess the sender’s address whenever possible. If advance screening is not possible, isolate the funds on a separate address and do not move them until the analysis is complete.

An address shows the broader history of a wallet, a transaction shows the origin of a particular transfer, and examining the counterparty and associated addresses provides a more complete picture. Together, these data points allow you to make an informed decision rather than rely on intuition.

Screen an address in Btrace before sending or receiving cryptocurrency, and review not only the risk score but also the factors behind it.