You sold USDT over P2P — and a day later the exchange froze your account. Or you were about to put money into a new token that turned out to be a honeypot. In both cases, one thing saves you: screening the address before you transfer. But there's a lot of myth and pure marketing around "AML checks." Let's break it down honestly — how it works inside, what's actually visible, and what isn't.
01What "screening an address" even means
An AML check (Anti-Money Laundering) is not "scanning a coin for viruses." It answers two questions:
- Is the address sanctioned? Is it on the OFAC, EU, or UN lists — a direct legal restriction.
- How "dirty" is the address? Is it connected to scams, mixers, the darknet, drainers — and how closely.
The first question is binary (yes/no against lists). The second is probabilistic: it's a risk assessment, not a verdict. A good service answers both and shows you where the verdict came from. A bad one just paints "100% clean" with no explanation (and that's the first red flag — see section 05).
02The sources: what each one sees and where it ends
A serious check is a consensus of several independent sources, not a single database. No single source covers everything, so they're combined. Here's what actually sits behind the word "screening":
of sources
| Source | What it catches | Limit / caveat | Access |
|---|---|---|---|
| OFAC SDN | US-sanctioned addresses (mixers, sanctioned wallets) | Only formally listed ones; new addresses appear with a lag | public |
| Chainalysis oracle (on-chain) | OFAC/EU/UN sanctions — right inside a smart contract on-chain | Sanctions only, NOT the full Chainalysis analytics; readable on EVM | public |
| TRM public | Sanctions screening of an address | Public layer is sanctions; TRM's deep analytics is paid | public |
| Risk score (MistTrack et al.) | Risk categories: darknet, scam, mixer, gambling, phishing | Assessed from on-chain behavior and labels; paid, with quotas | paid |
| Label blacklists (~30k+) | Known drainers, scam contracts, phishing, exchange attribution | Works only for already-known addresses | aggregator |
| Freezes USDT / USDC | Whether the address is blocked by the stablecoin issuer | Shows the fact of a block, not its reason | on-chain |
| Exposure / taint | Connection through N transfers to a dirty cluster, exposure % | The longer the chain, the weaker the signal; needs interpretation | on-chain |
The key idea: "consensus" beats a single database. If an address is clear on OFAC but has 60% exposure to a mixer and a drainer label — the verdict is "red," even though there's formally no sanction. And vice versa: one false label shouldn't sink an address if every other source is silent.
03Consumer tools vs. enterprise
Here it's important not to be fooled by marketing — neither someone else's nor your own. The big vendors (Chainalysis, TRM, Elliptic) are powerful but expensive infrastructure for exchanges, banks, and regulators. Their full products cost tens of thousands of dollars a year and aren't built for retail.
So if a service promises "the full Chainalysis for free" — it's either untrue or a bait-and-switch of terms. The honest framing is: "we combine free sanctions sources + labels + a score into one verdict." That's exactly how AMLConsensus works.
04How to read a risk score without panicking
A 0–100 score is not "the probability you'll go to jail." It's the concentration of risk signals. How to read it:
- 0–20 — green. No clear links to anything dirty. Not a guarantee, but usually fine.
- 20–60 — yellow. There's indirect exposure or a questionable label. Look at the details: how many hops, and to what.
- 60–100 — red. Direct labels (sanctions, drainer, mixer) or high exposure. Don't touch it.
05The pitfalls nobody writes about
A fresh address is flagged by NO tool
The single most important limit of the whole industry: labels are retroactive. An attacker's address, or an exchange deposit address, is clean at the moment it's created. Attribution appears after it "leaves traces" (a first withdrawal, a link to a known cluster). That's why a "100% check" is physically impossible — anyone who promises it is selling air. What actually helps with a fresh address are behavioral signals: zero history, anomalous amounts, a contract created moments ago.
The "AML certificate" scam and "certificate of cleanliness"
"Fund recovery" — a second scam on top of the first
The moment someone posts publicly that they got drained, "recovery specialists" slide into their DMs asking for an upfront fee. They take the deposit and vanish. A real specialist doesn't take an advance for a "guaranteed recovery." You can trace the path of the stolen funds yourself — for free, on-chain.
The "clean coin" myth
You can't "wash" a history by running it through a swap or a bridge — the exposure follows the funds. And the reverse: you can receive "dirty" inbound funds by accident (change from a P2P deal, an airdrop). That's why you screen the counterparty before the deal, not "the coin after."
06Playbook: 7 steps to stay safe
Screen an address in 10 seconds
OFAC sanctions, drainers, exposure — free, no wallet connection.
Open @amlconsensus_botAMLConsensus is a risk-reduction tool, not a guarantee. A freshly created address with no history is flagged by no AML tool; the final decision is always yours. Service names (Chainalysis, TRM, Elliptic, MistTrack) are trademarks of their respective owners; AMLConsensus is not affiliated with them and describes them for comparison.