How to check a crypto address before sending funds: 5-minute AML hygiene
On-chain, you inherit the risk of the funds' path — even if you knew nothing about it. Five minutes of checking before a transfer cost less than weeks of correspondence with compliance after a freeze. Here are the three levels of checking: what each shows, what it costs, and where its limits are.
Why check if I'm not doing anything wrong
Exchange AML engines don't assess your person — they assess the transaction graph: where the tokens came from, through how many hops, and which clusters the path addresses are linked to. Accept a transfer from an address two steps away from a mixer, and a share of its risk is now in your score. Checking a counterparty's address before a deal is not paranoia — it is the same hygiene as vetting a counterparty in ordinary business. How it works under the hood — our breakdown of exchange AML screening.
Level 1: Tether's contract blacklist — free, seconds
If you deal in USDT, start with the hardest and most honest signal: whether the address is blacklisted by the issuer itself. Tether freezes addresses at the smart-contract level — the isBlackListed function in the USDT contracts on Ethereum and TRON. This is not a "risk estimate"; it is a binary fact: a blacklisted address cannot move USDT at all.
You can check with our free checker — it reads the contract state directly, no registration. Know the limits: the blacklist catches only the heaviest cases (sanctions, major thefts, authority requests). Not blacklisted ≠ clean — it only means the issuer hasn't frozen it.
Level 2: commercial risk scoring
Risk-scoring services (from AMLBot to exchangers' built-in checkers) sell a "contamination" estimate — a risk percentage across categories: mixers, darknet, scams, sanctions. Under the hood are the same cluster-attribution databases the exchanges use.
What to know about the limits of these scores:
A score is a probability, not a verdict
Different providers give different numbers for the same address, because attribution databases and category weights differ. "15% risk" at one service can be "45%" at another.
A score is as-of-now
Attribution updates retroactively: an address clean today may get linked to a hack six months later — and the exchange will re-score your old transaction. A saved report with a check date is your good-faith evidence for that scenario.
Every exchange has its own threshold
No external score guarantees a deposit will pass a specific exchange: engine settings are not public.
Level 3: five minutes in an explorer — free and underrated
A basic manual check on Etherscan/Tronscan catches a large share of problem counterparties:
- Address age and history: created yesterday but already moved millions — a typical transit wallet for someone else's flows.
- Transit pattern: funds enter and leave within minutes, balance always near zero — a pass-through address.
- A fan of small incoming transfers from dozens of addresses quickly swept into one — a collection pattern typical of scam projects and mule networks.
- Explorer labels: major services and known incidents are often tagged right on the address page.
- For P2P deals: save a dated screenshot of the check — together with the rest of the deal evidence, it is your line of defence against a possible complaint.
The address is dirty: now what
If the counterparty is on Tether's blacklist, there is no deal: their USDT technically cannot arrive. If scoring shows high risk — ask for a different address; a counterparty's refusal to provide a clean one is an answer in itself. If the transfer has already landed and the exchange is asking questions — don't panic and don't "shuffle" the funds onward: that only extends the dirty trail. The route is the same as in every AML case: preserve evidence, build Source of Funds, send one measured compliance response. First moves — our first-24-hours breakdown.
Checklist before a large transfer
- USDT? — contract blacklist check on sender/recipient: free checker.
- Significant amount? — commercial scoring of the counterparty address; save the report with its date.
- Five minutes in an explorer: age, patterns, labels.
- P2P? — evidence per the checklist: who the counterparty is, how they pay, the chat log.
- Doubt = different address or different deal. Missed profit is smaller than a frozen deposit.
Bottom line
Address checking is the cheapest AML self-defence there is: the blacklist check is free, the explorer is free, commercial scoring costs less than a coffee. If the flag has already happened and the exchange is asking questions — that is a different discipline: assess your case or request a free assessment.