Crypto AML Checks: What They Are and How They Work
#security
You don't get to choose the history of the coins someone pays you with. A customer sends you USDT, but before that, the same coins may have passed through a wallet linked to fraud or a sanctioned address. The problem doesn't surface at the moment of payment — it surfaces at withdrawal, when an exchange or service freezes the funds pending review.
That's exactly what an AML check is for. It shows you a cryptocurrency's origin before you accept it onto your balance, not after you've already shipped the product.
Here's how this kind of check works, what signals get coins flagged as risky, what it does for a business, and where its weak points are. Understanding the mechanics helps you avoid panicking over a decline and losing money for no reason.
What AML Is
AML stands for anti-money laundering. It's a set of rules and procedures that keep illegally obtained funds from moving through the legitimate financial system.
AML has three jobs. First, spot operations that resemble money laundering or financing of prohibited activity. Second, establish who's behind an operation and where the money came from. Third, prevent dealings with addresses and individuals under sanctions.
AML almost always comes paired with KYC — know your customer. The difference between them is simple and worth remembering. KYC checks the person — who you are. AML checks the money — where it came from. One answers "who," the other answers "what."
What Makes AML Different in Cryptocurrency
Cryptocurrency draws regulatory attention for three reasons, and all of them stem from how it's built.
Transfers happen with no bank intermediary. In an ordinary system, a bank checks every payment and knows both parties. On the blockchain, there's no such gatekeeper, so checking shifts to the entry and exit points — exchanges, currency-exchange services, payment providers.
Operations cross borders instantly. Funds move to another jurisdiction in minutes, and national rules can't keep up.
Addresses aren't tied to names. A wallet gets created in a minute with no documents, so an address can't be linked to a person directly until it passes a check on a platform.
That said, the scale of the problem is worth understanding clearly. Turnover linked to illegal addresses is estimated at about $154 billion a year — but that's less than 1% of total transaction volume. The rules get written for that one percent, and everyone else has to comply with them.
There's a flip side too, and it works in your favor. The blockchain is public, so the history of any funds can be traced. Banking systems don't have that kind of transparency — here, checking money's origin is technically possible and takes seconds.
What a Crypto AML Check Is
A crypto AML check is an analysis of a wallet address or a specific transaction for links to illegal activity. The result is a risk assessment used to decide whether to process the operation.
Several groups of participants run these checks.
Crypto exchanges and currency-exchange services. They check funds on deposit and withdrawal, because their jurisdictions' rules require it.
Payment services and crypto acquiring. They check incoming payments from customers, so the seller doesn't end up with tainted coins on their balance.
Specialized analytics companies. They maintain address databases and provide checking tools to the rest of the market's participants.
Users and businesses themselves. They can check a wallet or an incoming payment on their own through checking services, to avoid accepting questionable funds.
How an AML Check Works
The check runs in four stages, and each one answers its own question.
Data Collection
The system gathers everything known about the operation and its participants. That includes the sender's and recipient's addresses, the amount and timing of the transfer, and the full transaction history for those addresses.
Separately, it looks at the source of funds — where the coins came to the sender from, how many wallets they passed through, and which services were used along the way. The blockchain stores this history in full and forever, so the depth of analysis is limited only by the tool's capabilities.
Using Blockchain Analytics
Next, the collected data gets matched against databases of known addresses. Analytics companies spend years tagging wallets, linking them to exchanges, services, fraud schemes, hacks, and sanctions lists.
This relies on a few techniques. Clustering groups addresses controlled by a single owner. Tracing follows the movement of funds through a chain of transfers, even if they were split up and shuffled between wallets. Sanctions-list matching checks for direct and indirect links to restricted addresses.
There's an important detail for understanding the result. What matters isn't just a direct link but also distance. Coins that arrived straight from a flagged address, and coins ten transfers removed from it, get different scores.
Risk Assessment
Based on the analysis, an address or transaction gets assigned a risk score — a numerical rating, usually on a scale of 0 to 100. The higher the value, the stronger the link to suspicious activity.
The result then gets sorted into levels.
| Risk level | What it means | What typically happens | |
|---|---|---|---|
| Low | What it meansno links to suspicious activity found | What typically happensthe operation goes through as usual | |
| Medium | What it meansthere are indirect or distant links | What typically happensthe service may request explanations or documents | |
| High | What it meansdirect links to sanctions, hacks, or fraud | What typically happensthe operation is declined, funds are frozen pending review |
Making a Decision
At the final stage, the service decides what to do with the operation. Low risk means the money is credited with no questions asked. Medium risk often leads to a request for additional information about the source of funds, called an SOF request — source of funds. High risk ends in a decline or a freeze pending review.
What to do if your payment gets flagged for a request: respond promptly and to the point, and attach proof of where the funds came from — an exchange statement, a contract, transaction history. How fast it gets resolved depends mainly on how complete your answers are.
Types of AML Risk in Cryptocurrency
Risks fall into four groups, each representing a different degree of trouble.
Sanctions risk. The most severe category. A link to addresses and jurisdictions under restrictions threatens more than just a decline — it carries legal consequences for the company. Liability here often applies regardless of intent, which is why checking is mandatory.
Criminal origin of funds. Coins obtained from hacks, extortion, trafficking in prohibited goods, or fraud schemes. Analytics systems tag and track these addresses, and funds from them stay flagged throughout the rest of the chain.
Mixer and privacy-technology risk. Mixers pool funds from many users to break the link between sender and recipient. Even if you end up in such a chain by accident, the coins that come out of it are considered risky, and some of these services are under sanctions. Privacy coins like Monero are being gradually delisted by regulated platforms for the same reason.
Fraud and deception schemes. Funds obtained from Ponzi schemes, fake investment projects, and romance scams. The danger here is twofold for a seller — you can end up with tainted coins and become part of a scheme laundering someone else's stolen funds.
Stablecoins are worth knowing about separately. They account for the bulk of illicit crypto volume — about 84% — because they're convenient to move between countries without exchange-rate swings. That doesn't make stablecoins bad, but it does mean checking incoming USDT needs the same attention as any other coin.
The Benefits of AML Checks
What a business gets from checking its incoming funds.
Lower legal risk. Accepting funds from sanctioned addresses creates legal trouble even if you didn't know their origin. A check removes the main argument against you — you took precautions and acted in good faith.
Protection from fraud. Declining at the entry point saves you from returning stolen funds, dealing with victims, and reputational damage. It's cheaper to refuse one payment than to later explain where a victim's money ended up in your account.
Protecting your revenue. This is the most practical point. If tainted coins land on your balance, they get frozen when you try to withdraw them — right when the product's already shipped and you need the cash flowing. Checking at the entry point moves that problem to the moment when you haven't lost anything yet.
Trust with banks and partners. Companies with solid compliance find it easier to open accounts, pass reviews, and work with large counterparties. No checks in place, on the other hand, closes off some of those options.
The Limits and Challenges of AML Checks
Now, honestly, about the weak points, because understanding the method's limits helps you respond to a result correctly.
False positives. A check deals in probabilities, not facts. An honest user can get a high risk score just because their coins once passed through a platform with a bad reputation. A decline doesn't mean an accusation — it means the system found a statistical link.
Different results across services. The same wallet often gets different scores from different systems, and that's normal. Every analytics company has its own database of tagged addresses, its own data sources, and its own scoring method. A check on one service, therefore, doesn't guarantee the same result from your provider.
Inconsistent standards across countries. There's no single set of international rules. The international standard for sharing sender and recipient information recommends a threshold of $1,000 or €1,000, but countries apply it differently — the US uses a $3,000 threshold, and other jurisdictions have their own figures and requirements. As a result, an operation that's legal in one country requires extra procedures in another.
How This Works in Crypto Acquiring
For an ordinary business, the main risk isn't that it launders money itself. It's that a customer paid in coins with someone else's history, and the recipient is the one who has to deal with it.
Heleket builds AML checking directly into the payment acceptance process and checks the origin of incoming funds before they're credited. That's the key point. A problematic payment gets caught at the entry point, while you haven't yet handed over the product or delivered the service, not at the point of withdrawing accumulated revenue.
Here's what that looks like in practice. The service accepts 17 cryptocurrencies across 8 networks, and every incoming payment goes through a check following the same principles described above. If the system requests documentation on the source of funds, you get a notification and know exactly what to provide. On top of that, the auto-converter converts incoming payments to USDT right away, and auto-withdrawal sends money to your wallet based on a rule you set, so amounts don't pile up on the service's balance where they'd be frozen in full if a question came up.
A practical tip for working with any provider: don't accept large payments from unfamiliar counterparties without checking them, keep proof of the origin of funds for your own operations, and don't use mixers or trace-hiding services — even a one-time interaction with them leaves a mark on the coins for a long time.
Conclusion
An AML check answers one question — where the money came from. The system gathers an address's history, matches it against databases of known wallets, assigns a risk score, and uses it to approve or decline the operation.
For a business, this isn't bureaucracy — it's protecting your revenue. You don't get to choose which coins a customer sends you, but you do get to choose whether to check them before crediting or deal with a freeze later.
Keep the method's limits in mind too. A check deals in probabilities, different services give different results, and the rules vary from country to country. So a sensible strategy is simple: work with a provider that checks funds at the entry point, keep documentation for your own operations, and don't move money through questionable channels.
