What an AML Risk Score Means: 10%, 50% or 90% Risk

You checked your wallet before an exchange and the service said: "Risk Score 47%". Is that a lot or a little? Can you send, or should you wait? And if the exchanger sends its own report showing 90% while yours showed 10%, which one is right?

Let's look at what an AML Risk Score really means, how it is calculated, why different services give different numbers, and what usually stands behind 10%, 50% and 90% risk. At the end we'll explain how to exchange crypto without depending on someone else's percentages.

What an AML Risk Score is

An AML Risk Score is an estimate of how closely a wallet address or a specific transaction is linked to sources that a blockchain analytics service considers risky: sanctioned addresses, the darknet, mixers, scammers, stolen funds.

The score is usually given as a percentage from 0 to 100. Crystal, for example, defines it as a metric that helps estimate the chance that an address is related to illegal activity.

It's important to understand what a risk score is not. It isn't a verdict or proof of a crime. Even AMLBot, one of the most popular checking services, says plainly that high risk does not mean criminal activity is proven, and low risk does not guarantee the funds are clean. It's only a signal that each service interprets its own way.

How the risk score is calculated

The analytics service studies the address's transaction history: where the coins came from, where they went, and which known services and wallets it is linked to. Each known source belongs to a category, and each category has its own "weight".

AMLBot, for example, splits categories into three groups:

• trusted: exchanges, P2P platforms, miners, payment services, merchants;
• suspicious: high-risk exchanges, crypto ATMs, unnamed services;
• dangerous: sanctions, darknet, mixers, scams, stolen coins, ransomware, gambling and others.

The algorithm then boils all of this down to one number. Providers don't publish exact category weights, so the final percentage is not the share of "dirty" money in the wallet, but the output of a particular service's internal method. One percent from a mixer can "weigh" more than ten percent from an unnamed service.

The direction of funds usually counts too: where the money came from (source of funds) and where it was sent (destination). So the score can rise even if you once simply sent coins to a "bad" address.

Why the same number means different things in different services

Check the same address in two or three services and the results will almost certainly differ. And it's not just about different databases.

• Different scales. At Crystal, 0–25% is low risk, 26–74% medium, 75–100% high. GetBlock's scale is inverted: it shows "trust", where 80–100% means low risk and 0–49% means high. Elliptic uses a 0–10 scale, and thresholds are set by the client.
• Different attribution. One service knows an address belongs to an exchange; another treats it as "unnamed".
• Different methodology. AMLBot gives an example: a wallet received $100,000, of which $500 is linked to a mixer through several transfers. One service flags this as meaningful risk; another considers the link too distant.
• Different report modes. Even within one service, an individual and a business can see different pictures. We covered such a case in "How the AML bot helps steal its users' money": the client got a report showing minimal risk, while the exchanger got 96% for the same transaction.

The takeaway is simple: a number without the service name, the scale and the categories means nothing. And the report you got yourself doesn't guarantee the exchanger will see the same.

What 10%, 50% and 90% usually mean

No service publishes an exact "percentage to source" table. But scales like Crystal's and the category descriptions give a typical picture.

10%: low risk

The coins mostly went through large exchanges, P2P platforms and ordinary wallets. Almost any active address has small indirect links to suspicious sources: crypto changes hands dozens of times. As a rule, an exchange with such a score goes through without questions. But "low" doesn't mean "zero": an exchanger with strict rules can find fault even with this.

50%: medium risk

This is the grey zone. Behind such a number may be a noticeable share of funds from suspicious sources (high-risk exchanges, unnamed services, gambling) or a small but noticeable link to dangerous categories through several transfers. Medium risk can also appear simply because there isn't enough data about the sources. With such a score a manual review is likely, and the exchanger may ask you to explain where the funds came from.

90%: high risk

This usually means the coins' history includes a link to the "heaviest" categories: sanctioned addresses, the darknet, mixers, stolen funds. The link is often direct. With such a score an exchanger that runs AML checks will almost certainly stop the exchange, freeze the funds and demand KYC. We described what happens next in "AML vs KYC: what is the difference and why they get your crypto frozen".

Once again: this is a typical picture, not a rule. Look not just at the percentage but at which categories produced it. 5% from a sanctioned source can be worse for an exchanger than 40% from unnamed services.

Direct and indirect exposure: how "clean" coins become "dirty"

A link to a risky address can be direct, when you received coins straight from it, or indirect, when there were intermediate transfers between it and you. Services count both, but differently. According to Chainalysis, companies usually set thresholds for indirect exposure 10 to 20 times more lenient than for direct exposure. But for sanctions, terrorist financing and child abuse material, tolerance is near zero: even a cent can trigger an alert.

There are other reasons your coins can suddenly become "dirty":

• Databases are updated retroactively. Analysts constantly label new addresses and re-examine old transactions. Coins that were clean yesterday can get a high score today if a sanctioned service's address is found in their history, as Forklog notes.
• Dust attacks. Someone can send a tiny amount to your address from a "dirty" wallet. In August 2026, Kraken customer addresses received about 12,000 small transfers from wallets that analysts linked to the sanctioned HTX exchange. Kraken temporarily restricted some accounts.
• Issuer freezes. Tether can freeze USDT at any address. According to BlockSec, in 2025 alone it blacklisted 4,163 addresses and froze $1.26 billion. More in "What the USDT and USDC blacklist is".

How exchangers use the risk score

Analytics services only calculate the risk. The decision is made by whoever receives the money: the exchange or the exchanger. It picks the AML provider, sets the threshold and decides what to do with the transaction. Elliptic, for example, lets clients configure the rules themselves.

Typical outcomes are: the funds are credited, sent for manual review, a source-of-funds document is requested, or the funds are frozen or returned. AMLBot openly admits that the same transfer to two different exchanges can end differently.

Even legitimate funds get blocked. Forklog described a case where a major exchange froze a deposit of more than 100,000 USDT from another well-known exchange: the client had never made large transactions before and had only basic verification.

For an exchanger's client the main problem is that the exchanger usually discloses neither its threshold nor its AML service. You find out about them after the money has already been sent. That's exactly why AML is such a convenient pretext for holding funds.

How to check a wallet and not get caught out

• Check before sending. You can check an address with services such as AMLBot, Crystal or Scorechain. But remember: your report may not match what the exchanger sees.
• Look at categories, not just the percentage. If the risk comes from sanctions or the darknet, even a small number is dangerous.
• Never connect your wallet to an "AML check". Malwarebytes described fake sites that impersonate AMLBot and drain wallets. A real check only needs the public address, not a wallet connection or transaction signatures.
• A new address showing 0% isn't "clean", it's "no data". A risk score appears once the address has a history.
• Keep evidence. Purchase receipts, TxIDs, chats and the order confirmation email will help if you have to explain where the funds came from.
• Don't "clean" coins through mixers or wallet chains. That only raises the risk: regulators explicitly treat mixers as a red flag.
• Check USDT against the blacklist with our free Blacklist Check.

But the most reliable way is not to depend on someone else's percentages at all. The AntiSwap catalog has exchangers with the "★ No AML/KYC" badge: they commit not to block money on AML pretexts and have posted an insurance deposit of at least $1,000. If the exchanger doesn't fulfil its side of the deal, the client can be compensated from the deposit. Turn on the "Only without AML/KYC" filter on a direction page, for example USDT TRC20 → Sberbank RUB, and keep the exchange amount within the deposit. More tips are on the "Recommendations for users" page.

What to do if a check shows high risk is covered in detail in "Dirty crypto: what it is, how to check it and what to do".

FAQ

What AML risk score is considered normal?

There's no single standard. On Crystal's scale, up to 25% is low risk, 26% to 74% medium, and 75% and above high. But other services have their own scales and thresholds, and GetBlock's scale is inverted.

A risk score is "normal" when a particular exchanger accepts it, and you usually don't know that threshold. So it's safer to choose an exchanger that commits in advance not to block funds over AML.

Why does my report show 10% while the exchanger shows 90%?

The exchanger may have used a different analytics service, a different scale or a different report mode. Databases are also updated, so the address's risk may have changed between the two checks.

Ask the exchanger in writing to name the service, the score it got and the categories behind it. Keep both reports and all correspondence: you'll need them if you leave a review or file a claim.

Can I lower my wallet's risk score?

Coins you've already received can't be "cleaned": their history is written into the blockchain forever. Trying to run them through mixers or long wallet chains will only raise the risk.

What you can do is avoid making things worse: receive new funds to a new address, don't mix "risky" coins with the rest, and don't accept crypto from dubious senders.

An exchanger froze my funds over a risk score. What should I do?

Don't rush to send documents and don't pay any "unlock deposits": real services don't ask for them. Keep the chat, the order email and the transaction hash.

Ask the exchanger in writing to name the AML service and the score, and offer to have the funds returned to the original address. Leave a review about the situation on AntiSwap. If the exchanger has a deposit on AntiSwap, you can file a compensation claim.

Should I check the address I receive crypto to?

Yes, especially if you receive coins from a stranger or via P2P. Your address's risk score depends on what comes into it.

Ideally, use a new address in your own wallet for each exchange rather than an exchange account: that way the address history has fewer unnecessary links.

Bottom line

An AML Risk Score isn't a verdict but an estimate that each service calculates with its own method and on its own scale. 10% usually means the coins went through ordinary exchanges and P2P, 50% a noticeable share of suspicious sources, 90% a link to sanctions, the darknet or mixers. But it's not the number that decides, it's the exchanger's threshold, which you can't see. So the most reliable protection is to choose exchangers with the "★ No AML/KYC" badge and a deposit in the AntiSwap catalog. And share this article with anyone else who checks wallets before an exchange.