A crypto AML risk score is a screening result produced from particular data and rules, not a court verdict about the wallet holder. It is also not a promise that a receiving service will accept a transfer. Before interpreting the number, establish what was screened, which exposure the report describes and how the provider’s scale and thresholds work.
Read the object of the report before its colour
Check the network, address or transaction, date of the screening and the report’s scope. An assessment of an address, an attributed service or a particular transaction can answer different questions. A score shown beside an exchange’s operational wallet is not automatically an assessment of the person who withdrew from that exchange. Likewise, a report on one address does not necessarily cover every asset or account you use.
Keep the original report and the identifier of the screening. If a screenshot omits the network, provider, date or category breakdown, ask for the missing context rather than interpreting the colour alone. A number without its scale is particularly easy to misread. Do not turn a score displayed as a percentage into a probability of criminal conduct unless the methodology actually defines and supports that interpretation.
For a fictional example, Daria receives an amber screening screenshot for an old wallet address. It does not identify which transaction caused the label or when the check was performed. Her first task is to obtain the report’s scope and explanation, not to decide that an amber colour proves misconduct or that a different website’s green colour settles the question.
Separate attribution, exposure and the action threshold
| Report field | Question to ask | What the answer can clarify | What it does not establish alone |
|---|---|---|---|
| Address and network | Was the intended object screened? | Whether the report concerns this transfer context | The holder’s complete identity or all wallets |
| Attributed category | What evidence supports this classification? | The provider’s description of an entity or activity | That every counterparty has the same role |
| Direct or indirect exposure | Which connection is being described? | How the report relates the screened object to another entity | A universal rule about ownership or innocence |
| Sent or received direction | Which side of the flow does the figure describe? | Whether the report concerns incoming or outgoing activity | That the same amount has the same meaning in both views |
| Period and screening date | What history and data version were considered? | The time covered by the result | A permanent assessment of future transactions |
| Scale, denominator and policy threshold | How are the score and category shares defined? | The model and policy behind the displayed result | A standard percentage accepted by every service |
A category share and an overall risk score need not be the same measure. The share may describe part of a provider-defined flow, while a score combines categories or rules. Read the denominator, period and method before comparing them. Two dashboards can use similar colours for different calculations, so agreement in appearance is weaker evidence than agreement about the underlying transaction and classification.
TRM’s wallet-screening explanation describes configurable risk tolerance and different exposure categories. That supports a limited conclusion: screening settings matter. It does not tell you the settings used by your receiving service or establish a numerical cutoff below which a transfer must be accepted. Ask that service about the specific concern it can disclose.
A chain connection is not automatically control of the connected entity
Direct and indirect exposure describe relationships in an analysis, not interchangeable claims that you control another address. Chainalysis’s exposure discussion explains its distinction between direct counterparties and paths through other addresses. Its treatment of service boundaries also illustrates why activity inside a custodial platform cannot simply be interpreted as a customer personally controlling every operational address.
This does not mean that indirect exposure is irrelevant. The point is to read what the report says and what evidence connects it to the question under review. Do not dismiss a connection solely because another address is involved, or turn the connection into proof of personal participation without further context. Ownership attribution, movement of value and a model’s policy decision are different claims.
Chainalysis’s current VASP Risking description discusses configurable exposure thresholds, direction and time-based views for assessing services. This is a product-specific example of how context changes an assessment. It is not a specification for every address checker, and the service-level score described there should not be silently substituted for a report on a single personal deposit.
False positives require review, not a declaration from either side
An alert can need clarification without being meaningless. Elliptic’s false-positive discussion describes how incomplete context, data coverage and poorly calibrated rules can flag legitimate activity. The fact that such errors occur does not establish that your particular alert is one of them. That conclusion requires examination of the relevant records and the reason for the flag.
Prepare a focused explanation of the discrepancy you can substantiate: an incorrect address, a wrong network, a custodial withdrawal mistaken for your personal address, an omitted conversion record or an unclear period. Attach genuine evidence through the intended service’s established process. Ask which fact remains unresolved instead of merely requesting a more favourable score or insisting that a statement of ownership ends the review.
A low result has limits too. It is a result for a stated object, time and data coverage, not proof that every relevant risk was found. An unavailable, incomplete or unscored result should not be casually described as a clean assessment. Read its status as well as its number, and do not use a checker’s green screen to override information the receiving service has requested.
Use the report to frame the next question
- Confirm the network, address or transaction and screening date.
- Read the category breakdown, direction, history period and definitions.
- Distinguish direct exposure, indirect exposure and any ownership attribution.
- Check what the scale and threshold mean for that provider and report type.
- Identify the specific fact you dispute and preserve supporting records.
- Ask the receiving service what further information is needed through its verified review route.
Do not create new transfers merely to make a dashboard look different. Moving assets changes the record but does not explain the disputed event. Nor does buying a certificate from an unrelated seller oblige the receiving service to complete a transaction. A useful response addresses the underlying question honestly; it does not replace the history with a presentation designed to produce a preferred label.
Before using a checker, consider the information it receives. A public address can still reveal financial activity or become associated with the person submitting it. Never provide a recovery phrase or private key for a public-address screening request. If a report is needed for support, use the relevant service’s own channel rather than posting your full transaction history in a public discussion.
KOT.CASH’s AML policy describes automated assessment and manual review, with possible requests for identity or source-of-funds information. Read how the service works before a simple swap. No-account exchange does not remove these checks, and suspicious activity can cause a pause. A third-party report does not establish KOT.CASH’s internal score, acceptance threshold or final decision; none is promised here.
FAQ
Is an AML risk score a probability that crypto is criminal?
Do not assume that interpretation from a number or percentage alone. Read the provider’s definition, scale, scope and denominator; an analytical score is different from a finding about a person’s conduct.
Can a crypto AML risk assessment produce a false positive?
Yes, providers describe false positives caused by issues such as incomplete context and rule calibration. That possibility does not prove a particular alert is wrong; relevant records and the actual reason need review.
Does a low AML risk score guarantee a crypto deposit will be accepted?
No: the receiving service can have different information, review criteria and requirements. An external score does not replace that service’s decision or its request for documents.