Compliance & risk

How to Check a Wallet for Risk

Intermediate Also known as how to check a crypto wallet for risk aml check wallet wallet risk score is this bitcoin address safe

In short

Checking a wallet means tracing where its funds have been and assessing what that history implies. The phrase people use is checking whether an address is clean, and it is worth knowing that clean has no technical definition. What exists is a risk score, produced by tracing transfers backwards and weighting the sources.

What a check shows

What a check actually shows

Three layers, and each is a different question.

Address validity

Does the string parse as a real address on the network you think it belongs to. Free, instant, and it catches the most expensive routine mistake, which is sending to the wrong network.

Transaction history

Balance, first and last activity, every transfer in and out. Any block explorer shows this without an account.

Risk score

Where the funds came from, traced back through recent hops, with each source category weighted. This is KYT, and doing it properly requires licensed data from Chainalysis, TRM Labs or Elliptic.

What free tools can and cannot do

Explorers show the history, and reading it manually tells you something: an address created yesterday receiving a large transfer looks different from one with three years of ordinary activity.

What free tools cannot do is cluster analysis. Identifying that fifty addresses belong to one exchange, or that a particular cluster is a known ransomware operator, requires a labelled dataset built over years. Some explorers display basic risk indicators derived from licensed feeds, and those are worth a glance without being a substitute.

Sanctions lists are the exception. The OFAC list is public, and checking an address against it is something anyone can do, as the entry on sanctions screening describes.

The scams around this

The scam economy around this

Worth stating plainly, because the search term attracts a lot of it.

Sites offering to check your wallet for cleanliness, then asking for a connection to it, a seed phrase or a signature, are stealing. A genuine check needs only the address, which is public information. Anything asking for more is asking for control.

The pattern extends to services claiming they can clear a flagged address for a fee. Nobody can. A risk score reflects transaction history, and history does not change because somebody was paid.

What to do in practice

What to do before receiving a large transfer

Two things, and both take a minute.

Ask the sender where the funds came from. A straightforward answer from an exchange withdrawal is different from a vague one, and asking costs nothing.

Check the sending address in an explorer if you have it in advance. A pattern of small transfers from many unrelated addresses looks different from a single withdrawal from a known venue.

What to do if you received tainted funds

Do not move them immediately. A transfer onward extends the history to your next address and can complicate your own withdrawal to fiat later.

Establish where they came from, keep the correspondence, and if the amount is significant, get advice before converting. A payment gateway screens incoming payments and may hold one, which feels obstructive and is preferable to discovering the problem at the bank months later.

For a merchant, this screening is part of what the provider does rather than something to run yourself, and the setup guide covers where the responsibility sits.

Frequently asked

Not as a technical category. There are risk scores, which are graduated.

Validity and history yes. Proper risk scoring requires licensed data.

Never. Anyone asking for it is attempting theft.

No. Services promising this are fraudulent.

Different clustering and different category weights. Sanctions matches are the same everywhere.

Was this article helpful?

See also