How to Check a Crypto Wallet for AML Risk

An AML check scores where coins came from by walking back through the chain of transfers. It says nothing about you as a person: what gets analysed is an address and its history, not the identity behind it. Here is what such a report actually shows, which tools produce one for free, and how to read the result.

What an AML check on an address shows

The service takes an address or a transaction and unwinds its transfer history backwards, matching every address it meets against a label database. Those labels are built up over years: exchange addresses, sanctions lists, known fraud schemes, darknet markets, mixers, payment processors.

The output is a breakdown of sources — what share of the funds arrived from categories treated as risky, and how many hops away. A headline score is calculated on top of that, and it is this number people call the risk level.

The part most often misread: the check scores the origin of funds, not whether you were in the right. A coin may have reached you entirely in good faith — bought on an exchange, received for work — and still carry a trace from its earlier life. The score knows nothing about that: it sees a chain, not intentions.

Why the same coin scores differently in different tools

This is the first thing that surprises anyone who checks the same address twice. There are two reasons, and both are structural.

The label databases differ. Nobody holds a complete map of addresses; each service labels what it managed to identify itself. One knows a particular exchange, another does not, and the same chain gets read differently.

The scales differ. AMLBot treats 0–25 % as low risk, 25–75 % as medium and above 75 % as high. MistTrack runs a score from 3 to 100. Others have their own bands and their own meaning behind the numbers. Comparing "55 here" with "55 there" is meaningless — they are different quantities.

The practical takeaway: two reports disagreeing is normal, not a sign that one of them is broken. When the result matters, check in two or three services and read the composition of sources rather than the headline number.

Which tools check for free

All of the following offer a free address check in some form. Terms and limits change, so confirm the current ones on each site — what follows is how they differ in substance.

MistTrack — built by the SlowMist team. Covers more than 19 networks and around a hundred assets, checks an address for free, and shows both labels and the chain. Probably the most generous free tier of the group.

AMLBot — one of the oldest services on the market, running since 2019. Checking through the web interface is free; there is a Telegram bot and paid packages with a PDF report. Gives a category breakdown and a clear scale.

Scorechain — a European compliance provider covering more than 20 networks, with a free Telegram bot for one-off checks and no card required.

BitOK — checks through a Telegram bot.

Btrace — basic checks with no cap on how many, which helps when you have a lot of addresses to go through.

Worth knowing separately: large exchanges sometimes build this in — Bybit, for instance, launched a free screening service together with MistTrack. If you use one platform regularly, check whether it already offers the tool.

How to read the report without panicking early

Three things in the report matter more than the number.

Direct or indirect exposure. Funds that arrived straight from a flagged address and funds that passed five hops from one are different situations. Most services show the depth; the further away the source, the less weight it carries.

Share, not presence. "2 % from a high-risk category" and "60 % from the same one" are completely different pictures, even though both appear in the report.

Which category. A "no-verification exchange" label and a "sanctioned address" label sit side by side in the report and mean entirely different things. Read the wording, not just the colour of the indicator.

A small percentage from an old indirect link is ordinary for coins that have been circulating for a while. The time to worry is when the share is large and the link is direct.

What to do if the risk level is high

There is no universal fix, but there is an order of steps that usually helps.

Check in a second service. For the reasons above, the result may differ. If a high score is confirmed everywhere, the picture is real.

Gather proof of origin. Exchange statements, contracts, screenshots of the trade, purchase history. This is exactly what gets requested first if the funds come under review.

Do not send blind to a verified exchange. That is where internal screening fires, and the discussion then happens after the funds have been credited and frozen. Checking first and sending second is the cheaper order.

Contact platform support if funds are already frozen. A release procedure exists, it is built around proving the origin of the funds, and the sooner documents are filed the shorter it runs.

What is definitely not worth trying is "diluting" the history by moving funds between your own addresses. To an analytics engine that is not a break in the chain but an extra pattern it is built to recognise — and the behaviour itself falls into the risky category.

Where a coin's history comes from in the first place

History is not created at the moment of the check; it is created every time a coin moves from one address to another. Which leads to something not always obvious: the same amount carries a different history depending on the route by which it reached you.

Receive a transfer directly from another person and you inherit their chain in full. Receive a coin from an exchange account and the chain starts at the exchange. In a swap through a non-custodial service the outgoing coin is drawn from protocol liquidity rather than forwarded from whoever funded the input — those are different coins on different networks, linked only by the rate of the trade.

That is how it is built, not a claim or a promise: you can check any particular result yourself, with any of the tools above, against the address the payout landed on.

In short

An AML check scores the origin of coins along the chain of transfers and says nothing about the identity of the holder. MistTrack, AMLBot, Scorechain, BitOK and Btrace all check an address for free — each with its own label database and its own scale, which is why results disagree. In the report, read the share of risky sources, the depth of the link and the category, not the headline score. If a high score is confirmed, collect proof of origin and do not move the funds to a verified platform until it is settled.

If all you need is to swap one coin for another, look at current rates and the exchange terms. Coming out of Monero is the case worth reading about first, because the public trail starts again on the receiving side — that route has a page of its own: Monero to bitcoin. What verification is and where the law requires it is covered separately: what is KYC and why exchanges ask for ID. Looking up the address itself — balance, transfers, confirmations — is a different job with different tools: how to check a bitcoin wallet address.