Crypto Wallet AML Check: A Step-by-Step Guide

A crypto wallet AML check looks at an address's transaction history and tells you whether its funds are linked to sanctions, scams, darknet markets, mixers, hacks or other illicit sources. To run one, you need the exact address and network, a tool that combines on-chain tracing with address attribution and sanctions data, and a clear rule for what you will do with the result.

This guide is for both sides of the problem: P2P traders who want to know whether the USDT they are about to accept is clean, and exchanges, OTC desks and payment companies that screen counterparties as part of their AML program.

Why check a wallet before you accept funds

On a public blockchain you can receive tainted funds without doing anything wrong. The consequences still land on you:

• Frozen balances. Exchanges can hold deposits that screen as high risk, and stablecoin issuers can act too. Tether can freeze USDT at specific addresses.
• Bank and exchange questions. P2P traders regularly get asked to explain where a deposit came from. "I didn't know" is a weak answer without records.
• Regulatory exposure for businesses. FATF Recommendation 15 applies AML/CFT obligations, including ongoing monitoring, to virtual asset service providers. Accepting funds from a sanctioned address can also create sanctions liability, which is a separate and stricter problem.

A check before the trade costs minutes. Unwinding a frozen account can take months.

How to check a crypto wallet for AML risk, step by step

Step 1. Get the exact address and network

Copy the address from the counterparty, never retype it. Confirm the network. USDT exists on several chains: an address starting with T is usually Tron (TRC-20), one starting with 0x is an EVM chain such as Ethereum or BNB Chain. The same 0x address can have completely different histories on different chains, so make sure you are checking the one the funds will actually come from.

Step 2. Look at the basic history in a block explorer

Before any scoring, a quick look tells you a lot:

• How old is the wallet? A wallet created yesterday and funded once is a different case from one with two years of normal activity.
• Where did the balance come from? One large inbound transfer from a fresh address deserves more attention.
• How fast do funds move? Money that arrives and leaves within minutes, repeatedly, is a pass-through pattern.

Step 3. Screen against sanctions

Check the address against the OFAC SDN list, which includes crypto addresses for some designated persons. A direct match is a hard stop. Remember that sanctions status can change: Tornado Cash, for example, was designated by OFAC in 2022 and later removed after litigation. Use a tool that tracks current data rather than an old list you saved.

Step 4. Trace exposure, direct and indirect

This is where manual checking stops scaling. You need to know whether the wallet received funds from risky sources directly, or a few hops back, and how much. Professional tools combine tracing with attribution databases that label addresses as exchanges, mixers, scams, ransomware, darknet markets and so on.

Step 5. Look at behavior

Some red flags are visible without any label:

• Transfers at evenly spaced intervals, which suggest automation.
• Amounts just under common thresholds such as $10,000, $5,000, $3,000 or $1,000 (structuring).
• An unusually high share of round amounts.
• Activity concentrated in narrow hours that don't fit the stated profile of the customer.

Step 6. Read the score and decide

Write down the result, the date and what you decided. That record is what protects you later.

How to read a wallet risk score

A score is only useful if you can see why it came out that way. Before trusting any number, check:

Question	Why it matters
Which transactions caused the risk?	You need the hash, amount and date to explain the decision.
Is the exposure direct or indirect?	Direct contact with a sanctioned or illicit address weighs far more than a distant hop.
How much money is involved?	A few dollars of unsolicited dust should not condemn a wallet.
How recent is it?	Fresh exposure is more relevant than an old, small touch.
Is the score reproducible?	If the same wallet gets a different score each time, you cannot defend it.

In Cryptic AI, an AI agent investigates the wallet: it follows the money across hops and cross-checks several blockchain data providers (Chainalysis, Global Ledger, Breadcrumbs), its own attribution database, BTC clustering, OFAC sanctions data and OSINT. Every risk factor must have evidence (transaction, source, timestamp), and factors without it are rejected. The 0 to 100 score is then calculated by a deterministic engine, not the language model, so the same data always gives the same score. Some of the rules:

• A sanctioned address itself scores no lower than 90.
• Direct contact with a sanctioned entity of $1,000 or more within 30 days: no lower than 90.
• Dust under $10 does not inflate the score.
• For exchanges, the level depends on the share of risky flow, not one touch.

What to do if the risk is high

If you are an individual or P2P trader

1. Don't accept the trade if you haven't yet. No price discount is worth it.
2. If the funds already arrived, don't move them around to "clean" them. Splitting, routing through other wallets or mixers makes your position worse and can look like laundering.
3. Keep everything: chat logs with the counterparty, the trade record, payment confirmations, transaction hashes and the AML report.
4. Talk to the exchange or platform before depositing, or answer their questions with those records if they have already flagged the deposit.
5. If you think you were scammed, report it to the platform and to the police in your country.

If you are a business

1. Hold, don't credit. Keep the funds out of the customer's spendable balance while you review.
2. Request information. Ask for source of funds and the context of the transfer.
3. Escalate to the MLRO with the evidence: hashes, sources, amounts, dates.
4. Decide on reporting. Cryptic AI's reporting module recommends whether to file a suspicious transaction report: a score under 40 with no sanctions points to no filing; 70 or above, any sanctions exposure, or direct darknet or ransomware contact points to filing. It drafts the report from case evidence, with full hashes and confirmed facts only. The compliance officer makes the decision and signs.
5. Monitor the wallet if the relationship continues, since exposure can appear after the first check.

For any direct sanctions match, follow your sanctions procedure and local legal advice. Do not return the funds on your own initiative without checking what the law requires.

FAQ

How do I know if my USDT is clean?

Run an AML check on the address you received it from, and on your own address if it has received funds from several counterparties. Look for direct exposure to sanctioned or illicit addresses and check the amounts and dates behind each factor.

Can I check a wallet address for illicit funds for free?

Yes. Block explorers show the raw history for free, and Cryptic AI offers a free AML wallet check where an AI agent and an analyst prepare a report with the evidence.

Does a low score guarantee the funds are safe?

No tool can guarantee that. A low score means no evidenced exposure was found with current data. Attribution changes, which is why businesses monitor wallets over time.

Is a high score proof of a crime?

No. Scam victims and users of risky services can show high exposure too. It means the funds need review before you accept them.

Want to know where a specific wallet stands? Leave the address and your email on our free AML wallet check, and you'll get a report by email with the evidence behind every risk factor. For screening at volume with ongoing monitoring, see Cryptic AI KYT.