Crypto AML Check: How Wallet Address Screening Works and Why Platforms Do It

A crypto AML check is a risk assessment of a wallet address or a blockchain transaction. It looks at where the funds have been and flags links to sanctioned parties, fraud, darknet markets or mixing services. Regulated crypto platforms run these checks on deposits and withdrawals as a matter of course, and anyone can understand the basics before sending or accepting crypto.

This guide explains what wallet screening is, the rules that drive it in the EU, what a risk score can and cannot tell you, and why a transfer you thought was routine can end up under review.

Key takeaways

• "AML check", "wallet screening" and "KYT" (know your transaction) are industry terms for the same idea: assessing the risk attached to an address or transaction.
• In the EU, crypto-asset service providers must monitor transactions, and EBA guidelines say they should use advanced analytics tools on a risk-sensitive basis, particularly for self-hosted addresses.
• The EU Travel Rule (Regulation (EU) 2023/1113) has applied since 30 December 2024 and requires sender and recipient information to travel with crypto transfers, whatever the amount.
• A clean result does not make an address safe or a counterparty trustworthy. A flagged result does not prove wrongdoing.
• Stablecoin issuers can block addresses, so for USDT and USDC an address's history can matter as much as the asset.

What is a crypto AML check?

Public blockchains record every transfer between addresses. That makes it possible to trace a coin's history backwards and see whether it passed through addresses already linked to illicit activity. A crypto AML check takes an address or a transaction hash, follows those links, and returns some form of risk rating, usually with the categories behind it.

Typical risk signals include:

• direct or indirect exposure to addresses on a sanctions list;
• funds that passed through a mixer, tumbler or other service designed to obscure the trail;
• links to darknet markets, scams, ransomware or stolen funds;
• transfers via unregulated exchanges or platforms with weak controls;
• patterns that do not fit the customer's expected activity.

Since addresses are pseudonymous, screening says nothing about who owns an address. It reports what the address has been connected to.

Wallet screening vs KYT

The terms overlap, but they are used for two jobs.

Wallet screening checks an address before a relationship or a transfer: is this destination, or this source, linked to known risk?

KYT (know your transaction) is ongoing transaction monitoring. Each incoming and outgoing transfer is scored as it happens, and alerts go to a compliance team for review.

Neither term is defined in EU law. The legal duties are expressed as customer due diligence, transaction monitoring and the Travel Rule. The tools are how platforms meet them.

Why platforms check wallet addresses

Transaction monitoring under EU guidelines

The European Banking Authority extended its Guidelines on money laundering and terrorist financing risk factors to crypto-asset service providers. They apply from 30 December 2024. Among the risk factors they list are transfers to or from mixer and tumbler platforms, crypto-assets associated with the darknet or illegal activities, and results from advanced analytics tools that indicate an increased level of risk.

The guidelines say providers should apply advanced analytics tools to transactions on a risk-sensitive basis, as a supplement to standard monitoring, and particularly for transactions involving self-hosted addresses, because those tools let the provider trace transaction history and identify potential links with criminal activity. That is the regulatory basis for the wallet screening you meet in practice.

The Travel Rule

Regulation (EU) 2023/1113, the recast transfer of funds regulation, has applied since 30 December 2024. It requires the provider of the person sending crypto to make sure the transfer carries the sender's name, wallet address and account number, postal address with an official document or customer number (or date and place of birth), plus the recipient's name and wallet address. Its recitals say crypto transfers should be subject to the same requirements regardless of amount, because crypto can easily be split across many addresses.

If the information is missing, the receiving provider must, on a risk-sensitive basis and without undue delay, either reject or return the transfer, or ask for the information before making the crypto available. Providers that repeatedly fail to send the required data can face warnings, deadlines and ultimately restriction or termination of the relationship.

For self-hosted wallets the rules add a threshold. When more than EUR 1,000 is sent to or received from a self-hosted address on behalf of a client, the provider should verify that the address is actually owned or controlled by that client. Our Travel Rule explainer goes into more detail.

Sanctions

Sanctions apply to crypto as they do to money. In the United States, the Treasury's Office of Foreign Assets Control (OFAC) may add digital currency addresses to its sanctions list to alert the public, though it says those listings are not likely to be exhaustive. Screening tools draw on such lists and then extend the picture to addresses connected to them.

How to check a crypto wallet address yourself

A quick wallet address risk check before you send or accept crypto does not need a commercial tool. A few habits catch most problems.

1. Look it up on a block explorer. Check whether the address has history, how old it is, and whether the transfer you were told about actually exists.
2. Ask where the funds came from. If someone wants to pay you in crypto, a regulated exchange or a wallet with a plain history is a better sign than an address funded through a chain of fresh hops.
3. Watch for mixers and bridges. Funds that recently passed through obfuscation services are the classic trigger for a review.
4. Use a screening service where available, and read the categories, not just the score.
5. Do not forward unexpected deposits. Unknown incoming crypto can be a scam set-up or a mistaken transfer; ask the provider's support before moving it.

A risk check is a snapshot. Addresses can be linked to new incidents after you check, and tools from different vendors can disagree.

AML checks for Bitcoin and USDT

A Bitcoin AML check works on the same principle as any other: trace inputs and outputs and score the exposure. Bitcoin's transaction model, where one transaction can combine many inputs, means a payment can carry a small share of risky history from an earlier hop.

Stablecoins add a second layer. Tether's terms allow it to blacklist addresses holding its tokens where it suspects prohibited use or is directed by a government, and Circle's USDC terms reserve the right to block certain USDC addresses. So a USDT AML check is about more than compliance: tokens at an address the issuer has blocked may become unusable. Note too that the same token can exist on several networks; screen the address on the network the payment will actually use.

What a crypto AML check cannot tell you

• That an address is safe. Quppy's own wording is a good summary: an AML check is a risk assessment and does not guarantee that an address, transaction or asset is safe, lawful or risk-free.
• Who owns the address. Screening describes connections, not identity.
• That a transfer will be accepted. The receiving provider applies its own policy, and the Travel Rule data must also be complete.
• That a high score means wrongdoing. Innocent users receive tainted funds. A review is a question, not an accusation.

Wallet checks and reviews in Quppy

Quppy offers AML Quppy Bot, a separate risk-assessment service for supported wallet addresses and blockchain transactions that you can use before sending or accepting crypto. Like any such tool, its result is a risk assessment, not a guarantee.

On transfers themselves, Quppy or the applicable crypto-service provider may ask about an external wallet: whether it is yours or someone else's, the sender's or recipient's legal name, the external platform, the purpose of the transfer and, in some cases, evidence of ownership or control. The reasons given in Quppy's compliance pages are the Travel Rule, sanctions and AML/CFT risk, and confirming that the asset and network are supported.

An incoming deposit can be reviewed when, for example, Travel Rule information is missing, the address has risk indicators, or the transfer comes from a mixer, privacy-enhancing service, sanctioned source or high-risk platform. A blockchain confirmation does not remove these checks, and a transaction can be delayed, returned or rejected as a result. Quppy does not publish a guaranteed review time and may be unable to disclose every risk indicator. Read why a transaction can be delayed or rejected and why you may be asked about an external wallet for the full picture.

No legitimate check needs your private key or seed phrase. Never share them.