What is wallet screening?
Wallet screening is the process of checking a cryptocurrency wallet address against blockchain risk data to assess its exposure to illicit activity before or while transacting with it. Also called crypto address screening, it gives compliance teams a risk score for any wallet address—revealing connections to sanctioned entities, scams, darknet markets, mixers, and stolen funds—so they can make informed decisions about whether to process, block, or escalate a transaction.
Wallet screening is a foundational control in crypto anti-money laundering (AML) compliance. Because every transaction on a public blockchain is permanently recorded, blockchain analytics can attribute a wallet address to real-world entities and categories of risk. Crypto exchanges, financial institutions, and other virtual asset service providers (VASPs) use it to evaluate counterparties at onboarding, at the point of a transaction, and on an ongoing basis.
In practice, cryptocurrency wallet screening answers a focused question: how risky is this address? It is the on-chain counterpart to traditional name and sanctions screening—applied to wallet addresses instead of customer names—and a core layer of any crypto compliance program.
Why does wallet screening matter?
Wallet screening is often the first and fastest line of defense against moving illicit funds. A single screen of a wallet address can surface exposure that would be invisible to traditional AML tools, which cannot interpret blockchain data.
The stakes are high. Illicit addresses received tens of billions of dollars in cryptocurrency in recent years, and processing funds tied to sanctioned entities, ransomware, or darknet markets can expose a business to enforcement actions, frozen banking relationships, and reputational damage. Sanctions exposure is especially consequential: transacting with a sanctioned wallet address can violate the law regardless of intent, which makes pre-transaction crypto sanctions screening essential.
Pre-transaction
Wallet screening assesses an address’s risk before funds move—letting compliance teams block or escalate exposure to illicit activity rather than discovering it after the fact.
Beyond risk avoidance, effective screening enables growth. By accurately scoring digital assets and counterparties, regulated institutions can confidently serve crypto customers, meet regulatory compliance obligations, and participate in the digital assets economy without becoming conduits for financial crime.
How does wallet screening work?
Wallet screening combines blockchain analytics, entity attribution, and risk scoring into a fast, repeatable compliance workflow. The process generally follows four steps.
Attribution and risk data
Screening starts with attribution: connecting a wallet address to the real-world entity or category behind it—an exchange, a mixer, a sanctioned wallet, a darknet market, or a scam. The breadth and accuracy of this on-chain attribution data determine how reliable every screening result is.
Risk scoring
Each wallet address is assigned a risk score based on its exposure to known illicit or high-risk entities. Screening measures both direct exposure (funds sent to or received directly from a risky entity) and indirect exposure (funds connected through intermediary hops), so that a wallet laundering proceeds a few steps removed from the source is still flagged.
Risk rules and triage
Compliance teams configure risk rules and thresholds aligned to their risk appetite, risk management priorities, and regulatory requirements—for example, alerting on any sanctions exposure or on a defined proportion of funds tied to high-risk categories. These rules drive triage, helping analysts prioritize the addresses that genuinely warrant review.
Decision and ongoing monitoring
Based on the risk assessment, the team processes, blocks, or escalates the transaction. Screening pairs naturally with real-time transaction monitoring, so that an address cleared at onboarding is re-evaluated as its on-chain behavior and transaction history change.
What does wallet screening detect?
A capable wallet screening solution surfaces a wide range of financial crime risks tied to a cryptocurrency address, including:
- Sanctions exposure — connections to OFAC-, EU-, or UN-sanctioned wallets and sanctions lists.
- Money laundering — funds routed through mixers, bridges, or other obfuscation services.
- Darknet markets — addresses tied to illicit marketplaces.
- Scams and fraud — exposure to investment fraud, pig butchering, and phishing wallets.
- Stolen funds — proceeds of exchange hacks and DeFi exploits.
- Terrorism financing — addresses linked to entities financing terrorism.
Detecting these typologies through blockchain intelligence is what separates a basic check from a comprehensive screening program.
Wallet screening vs. transaction monitoring
Wallet screening and transaction monitoring are complementary controls within crypto compliance, not substitutes.
| Wallet (Address) Screening | Transaction Monitoring (KYT) | |
|---|---|---|
| Core question | How risky is this wallet address? | What is this money doing over time? |
| Focus | Address-level risk assessment | Ongoing transaction-flow monitoring |
| Timing | At onboarding and point of transaction | Continuous, every transaction |
| Output | A risk score for the address | Real-time alerts on suspicious activity |
Wallet screening provides the point-in-time risk score for a specific address; transaction monitoring watches the flow of funds continuously. Together with know your customer (KYC) and due diligence, they form a layered defense against money laundering and other illicit activity.
Wallet screening across assets and blockchains
Illicit funds rarely stay on a single chain, so coverage is critical. Effective cryptocurrency wallet screening spans the assets and networks where value actually moves—Bitcoin (BTC) and Ethereum (ETH), stablecoins such as Tether (USDT), and a long tail of altcoins including Litecoin, XRP, and Polkadot, as well as networks like Polygon. Because users hold these digital assets in wallets secured by private keys, and because funds can hop across assets and chains, gaps in asset coverage become gaps in monitoring. Screening that follows funds across cryptocurrency transactions and chains—including activity touching decentralized finance (DeFi)—is what keeps a compliance program from missing laundering that simply moves to an unsupported asset.
Wallet screening and regulatory compliance
Wallet screening helps regulated entities satisfy multiple AML/CFT obligations:
- Sanctions compliance: Screening addresses against sanctions lists is how crypto businesses avoid processing transactions with sanctioned entities.
- AML programs: Wallet screening feeds suspicious activity detection and supports the filing of suspicious activity reports (SARs) when warranted.
- Travel Rule compliance: Screening counterparty VASPs and their addresses supports Travel Rule obligations to assess who is on the other side of a transfer.
Across jurisdictions, regulators expect a risk-based approach. It operationalizes that expectation at the address level, complementing the customer-level controls that virtual asset service providers already maintain.
How Chainalysis helps with wallet screening
Chainalysis Address Screening gives compliance teams instant, automated risk assessment for any cryptocurrency wallet address. It is the wallet-level layer of a crypto compliance program—built on the industry’s most comprehensive attribution data.
- Comprehensive coverage: Screen wallet addresses across 1,000+ assets and protocols, closing the asset-coverage gaps that create blind spots.
- Direct and indirect exposure: Risk scoring measures exposure to sanctioned entities and illicit activity directly and through intermediary hops.
- Configurable risk rules: Set thresholds and risk rules that match your regulatory requirements and risk appetite, with screening built into your compliance workflows via API.
- Court-tested intelligence: Chainalysis attribution is validated under the Daubert standard in U.S. courts—a credibility advantage no other provider offers.
For continuous oversight, Address Screening pairs with Chainalysis KYT for real-time transaction monitoring, and flagged addresses can be investigated in depth with Chainalysis Reactor.
Frequently asked questions about wallet screening
Q: What is wallet screening?
A: Wallet screening is the process of checking a cryptocurrency wallet address against blockchain risk data to assess its exposure to illicit activity. Also called address screening, it produces a risk score that reveals connections to sanctioned entities, scams, darknet markets, mixers, and stolen funds, helping compliance teams decide whether to process, block, or escalate a transaction.
Q: What is the difference between wallet screening and transaction monitoring?
A: Wallet screening assesses the risk of a specific wallet address at a point in time, producing a risk score. Transaction monitoring (KYT) continuously watches the flow of funds across transactions and generates real-time alerts. Screening answers “how risky is this address?”; transaction monitoring answers “what is this money doing over time?” Both are essential layers of crypto compliance.
Q: What does wallet screening detect?
A: Wallet screening detects sanctions exposure, money laundering through mixers and bridges, darknet market activity, scams and fraud, stolen funds from hacks and exploits, and terrorism financing—by analyzing the on-chain connections of a wallet address.
Q: Is wallet screening required for compliance?
A: Wallet screening is not a single law, but it is how crypto businesses meet AML and sanctions obligations under regulators including FinCEN and the FATF. Screening addresses against sanctions lists and known illicit entities is a standard, risk-based control for VASPs and financial institutions handling digital assets.
Q: Which assets can be screened?
A: Comprehensive wallet screening covers major assets and networks—including Bitcoin (BTC), Ethereum (ETH), stablecoins such as Tether (USDT), and altcoins like Litecoin and XRP—across 1,000+ assets and protocols. Broad coverage matters because illicit funds often move to less-monitored assets and chains.
See how Chainalysis helps you stay compliant and secure.
Chainalysis enables wallet screening by scoring any cryptocurrency address for direct and indirect exposure to sanctioned entities and illicit activity across 1,000+ assets and protocols—so compliance teams can assess risk before funds move.