What AML screening is and why clean addresses get flagged
To stop fearing a freeze, you have to understand how an exchange makes the decision in the first place. People imagine an officer who suspects them personally. In reality an automated risk engine is at work, and it evaluates not you but the transaction graph around your address. It is an impersonal process, and that is exactly why it can be reasoned with: not by persuasion, but by data. This lesson gives you the four concepts everything else in the track builds on.
What AML screening is
AML stands for anti-money-laundering. In crypto practice it means the exchange and any serious service run every address through transaction analysis, called KYT, know your transaction. The question the screening answers is: how connected are the funds on this address to risky sources, and at what distance. The answer is expressed as a risk score. The scale of this machinery is easy to underestimate. Our own corpus of events collected straight from the USDT smart contracts holds more than 2,312 issuer freezes, and on the first of July 2026, the day of the MiCA deadline, we recorded 175 freezes in a single day, 131 of them in one batch at 08:00 UTC. Screening is not a theory; it is infrastructure that acts in bulk.
A risk score is not a verdict
A risk score is a weighted estimate of how contaminated a flow is across the transaction graph. It is a risk estimate for the institution, not an accusation against you. A high score means the engine saw a link to a risky category, and pausing the operation is cheaper for the exchange than investigating it. This reframing matters practically: your task is not to "prove innocence" as if you were on trial, but to supply the data that lowers the estimate in the eyes of compliance. Documents beat indignation every time.
Hops: why risk reaches you
A hop is one transfer in a chain. The key idea most people miss: risk propagates along the chain even across several hops. If funds left a mixer, passed through two intermediate addresses and reached you, the engine still sees the link. Cheap checkers look one or two hops out. Serious engines look five and more. That is why an address you consider clean, because you personally did nothing wrong, can be flagged: the contamination came from far away, from the counterparty side. Distance matters, though. A mixer touch at zero or one hop is nearly a verdict; the same category five hops out, at a small share, is a question you can answer with documents.
Exposure: not just clean or dirty
Professional analysis operates not with a binary "clean or dirty" but with exposure, categorized influence. It answers two questions at once: what share of the funds is linked to risky categories, and at what distance. Compare two addresses. On the first, five percent of turnover touched a gambling service five hops away. On the second, half the inflow came one hop from a sanctioned cluster. A naive checker might paint both "medium risk". Compliance reads them as entirely different cases, and it is right. This is why our forensic report breaks counterparties down by category, sanctioned, blacklisted, scam-linked, exchange-attributed, fresh transit, unknown, with shares of turnover, rather than issuing one averaged percentage that hides the structure.
The four terms, fixed
| Term | What it is | What it is not |
|---|---|---|
| KYT screening | Automated analysis of the graph around an address | A human investigation of you personally |
| Risk score | A weighted estimate of flow contamination | A verdict or an accusation |
| Hop | One transfer step in a chain | A boundary that stops risk; it does not |
| Exposure | Share of funds linked to each risky category, with distance | A single percentage of "dirtiness" |
Why a clean address gets flagged: the mechanics
Put it together. You sold USDT to a buyer who looked conscientious; his money was part of someone else's fraud. Or you bought USDT that touched a mixer three hops before reaching you. In neither case did you do anything illegal, but the graph around your address now carries a risky trace, and the engine judges links, not intent. One more number from our checker practice: 57 percent of the addresses users brought to us to verify turned out to be blacklisted. The lesson in that number is not "most addresses are dirty". It is that people look at the graph only after it has already bitten them.
How to see your own exposure
- Run your address through the checker: blacklist, sanctions, scam bases, community reports.
- Read the address passport underneath: age, balance, transfer window, behavioral flags.
- For a real case, order the full forensic report: it categorizes your counterparties, shows the shares of turnover per category, and traces the key flows two hops out. That is the same kind of picture compliance sees, and reading it first means never being surprised in a dispute.
Mistakes at the level of thinking
- Arguing intent instead of the graph. "I did nothing wrong" is not data. The engine flagged a link; answer about the link.
- Treating the score as an insult. It is a screening estimate, and it moves when you supply documents.
- Ignoring the counterparty side. Most contamination arrives, it is not created. Screening who you deal with is the only lever that works before the fact.
Check yourself
- Task. In two sentences, explain to an imaginary friend why his exchange flagged a deposit even though he "only received money from a buyer".
- How to know you got it right. Your explanation uses the words hop and link, and does not use the word guilt. The flag is about where the buyer's money had been, not about what your friend did.
- Task. Run your own address through the checker and passport, and state its exposure picture in one sentence: what categories touch it and how strongly.
- How to know you got it right. Your sentence names categories and shares, for example "no direct hits, moderate fan-in from many small senders", instead of a bare "it is clean". Thinking in exposure instead of verdicts is the whole point of this lesson.
Free preliminary case assessment
Describe your situation and we will give you an honest assessment: what is realistically possible, how long it takes and what it costs. No "guaranteed unlocks": they do not exist, because the decision sits with compliance.