Home › AML risk score explained

AML risk score explained: what low, medium and high mean

Updated November 6, 2026 · for USDT (TRC-20) and other TRON addresses

Short answer: an AML risk score is a provider's estimate of how much of an address's funds are linked to risky sources, such as sanctions, scams or stolen funds. Low usually means no strong risky links were found, so proceed with normal care. Medium means something needs a closer look: ask questions and consider a smaller test payment. High means strong links to risky sources: don't accept USDT from it or pay it, and keep records. Cut-offs differ between providers and exchanges.

You ran an AML check on a USDT TRC-20 address, or someone showed you one, and got a score and a label. This guide explains what that result measures, what it does not measure, and what people usually do with each level.

What an AML risk score is

Every transaction on TRON is public. AML (anti-money-laundering) providers such as Elliptic, Chainalysis, Crystal, BitOK and AMLBot collect labels for addresses they can identify: exchanges, payment services, scam wallets, sanctioned addresses, mixers and so on. Then they look at where an address's funds came from and where they went.

The risk score sums this up in one number. Roughly, it answers: how much of this address's money is connected to sources the provider considers risky, and how closely? AMLBot calls it a risk signal, not a legal verdict. Chainalysis describes screening as a check at a point in time.

The scale depends on the provider. Crystal uses 0–100% and, in its documentation, calls 0–25% low, 26–74% medium and 75–100% high. Elliptic lets its customers set alert thresholds on a 0 to 10 scale. Other tools show a number from 0 to 1, or only a label. So a number from one tool can't be read with another tool's bands.

The risk categories behind the score

A score is built from categories. Which categories count as severe, and how much each one weighs, differs between providers. Many providers also let their business customers change the weights. The table shows how these categories are commonly treated, not a fixed rule.

Category	Commonly treated as	What it means
Sanctions	Severe	Address or entity on a sanctions list. Many businesses must not deal with it at all.
Scams and fraud	Severe	Addresses reported or identified as scams, fraud or phishing.
Stolen funds	Severe	Money from hacks or thefts.
Darknet markets	Severe	Markets selling illegal goods.
Mixers	Usually severe	Services that blend funds to hide where they came from.
High-risk exchanges	Varies: severe at some providers, moderate at others	Exchanges with weak checks or known for fraud.
Gambling	Often moderate; depends on provider and country	Online gambling services. Legal in some places, not in others.
Unidentified services, some DeFi contracts	Moderate (worth a look)	Activity the provider can't fully identify.
Regulated exchanges, payment services	Low / trusted	Known businesses that run their own checks.

AMLBot, for example, groups links into trusted, suspicious and danger. Its danger group includes sanctions, scams, stolen funds, mixers, darknet services, fraudulent exchanges, ransomware and terrorism financing.

Direct vs indirect exposure, and “hops”

Direct exposure means the address itself sent USDT to, or received USDT from, a risky source. Indirect exposure means the money passed through one or more other addresses on the way.

Each address in between is called a hop (some reports say “steps”). For example: a scam wallet sends USDT to address B, and B sends it to the address you checked. The scam is 2 hops away from your address. One hop away is direct exposure.

In general, the closer the risky source and the bigger its share of the funds, the more it counts. A scam wallet one hop away matters much more than a small amount that touched a scam five hops back. Chainalysis's 2026 compliance benchmark found that businesses usually set much higher alert thresholds for indirect exposure than for direct exposure, and that there is no single industry rule for how many hops back to look.

Hop counts can also mislead. Chainalysis notes that a long chain of addresses may belong to one owner who just moved money between their own addresses.

Why two providers give different scores

It is normal to check the same address with two tools and get two different results. The usual reasons:

Different data. Each provider has its own list of labelled addresses. One may know a wallet is a scam; another may not have it yet.
Different labels. One provider may call a service gambling, another a high-risk exchange, another unidentified.
Different methods. Each one weighs categories, hops and amounts in its own way, and uses its own scale and bands.
Different settings. Business users can often set their own categories and thresholds, so even the same provider can give different outcomes at two companies.
Different time. A check from last month doesn't include labels added since then.

When results differ, compare the details, not only the score: which category was flagged, how much of the funds, and how many hops away.

What each level usually means, and what to do

This is general guidance. Each provider sets its own bands, and each exchange or business sets its own rules for what it accepts.

Level	What it usually means	What to do
Low	No strong links to risky sources were found at the time of the check.	Proceed with normal care. Still check the address characters and the amount.
Medium	Some links need review. It is not proof of a scam.	Look at the flagged category and how many hops away it is. Ask the other person where the funds came from. Check the address history and the amount. Consider a smaller test payment first.
High	Strong links to severe categories, often close to the address.	Don't accept USDT from it and don't pay it. Save the report, the address and any messages.

If you are receiving USDT

Check the sender's address before you release goods, cash or a P2P payment. Once USDT reaches your address, its history becomes part of your address's history. See how to buy USDT P2P safely.

If you are paying someone

A high-risk result on the address you are about to pay is a strong reason to stop. Scam wallets often show up as high risk because other victims already paid them.

If your own address got a medium or high score

Don't panic. Look at which incoming payment caused it, keep records of where the funds came from, and be ready to explain them if an exchange asks. See USDT frozen or held for AML review.

Limits of a risk score

A clean score is not proof of safety. A brand-new scam wallet has no history yet, so it can score low. A low score also says nothing about whether the person will deliver what they promised.
Scores change over time. New transactions and new labels can move a score up or down. Check again before a new payment if time has passed.
A high score is not a court decision. It shows risky links, not what the owner did or knew.
Providers can be wrong or out of date. Labels come from investigations and reports, and no provider knows every address.

This page is general information, not legal or compliance advice.

Checking a TRON address with TronTransfer

TronTransfer offers a paid AML check for TRON addresses: Local (via BitOK) or Worldwide (via Elliptic). You pay in TRX from your own wallet. The result shows a verdict (clean, caution or high risk), a risk score, flagged links with how many steps away they are, and the exchanges and services the address is connected to.

The AML check page has two sample reports, one clean and one high risk, so you can see what each looks like.

Check a TRON address

Frequently asked questions

What is a good AML risk score for a USDT address?

A result in the provider's low band, with no sanctions match and no flagged links close to the address. Each provider uses its own scale and its own cut-offs, and each exchange decides for itself what it accepts, so there is no single number that is good everywhere.

Does a high risk score mean the owner is a criminal?

No. A high score means a large share of the address's funds is linked to risky sources, directly or through other addresses. It is a warning to stop and check, not proof of what the owner did or knew.

Why did my own wallet get a medium or high score?

Usually because USDT you received came, directly or a few steps back, from an address the provider links to a risky source. Look at which category and how many steps away it is, keep a record of where the funds came from, and ask the sender or the exchange you received from if something is unclear.

Why do two AML checkers show different scores for the same address?

Each provider has its own labelled addresses, its own way of weighting categories and steps, its own score scale, and it ran the check at a different time. Different numbers are normal. Compare the categories and how close the risky links are, not only the score.

Can an AML risk score change?

Yes. A score describes the address at the time of the check. New transactions, or a provider labelling an older address as a scam later, can move it up or down. Check again before a new payment if time has passed.

Can a high-risk result cause problems with my USDT?

It can. An exchange may hold, review or refuse a deposit linked to high-risk sources, and the rules differ from exchange to exchange. The safest step is not to accept USDT from an address that comes back high risk, and to keep records of any payment you already received.