How to check a Bitcoin address for AML risk

To check a Bitcoin address for AML risk, run it through a screening tool that maps the address against sanctions lists, darknet and ransomware clusters, and exchange attribution. Three steps: copy the address, paste it into the free check in the Sanctuary Telegram bot, then read the verdict and the labels behind it. Bitcoin is the largest chain row we hold — 13,644,442 entity labels in Sanctuary's label set as of August 2026 — which is why a BTC address usually comes back with something attached to it, and why knowing how to read the result matters as much as running the check. The check itself is free in the Sanctuary Telegram bot — 3 free checks a day, no registration, an answer in about 60 seconds.

What does an AML check on a Bitcoin address actually show?

It shows connections and labels: sanctions designations, darknet market wallets, ransomware payment addresses, scam and phishing reports, exchange and deposit-address attribution, mixing services, mining pools. It names what the money is tied to — a named venue, a cluster, a category of service — rather than a person.

Most people arrive at this with a blunt version of the question — check if bitcoin address is flagged, yes or no. The yes or no is the least useful part of the answer. What decides your next move is which class of label came back, how close it sits to the address you typed, and whether the address is attributed to a known entity at all. An address one hop from a seized marketplace and an address five hops from a gambling site are both "flagged", and they are not the same problem.

Sanctuary screens against 20+ intelligence sources, with full AML coverage on 10 chains. Bitcoin carries more attribution than any other chain in the set: 13,644,442 entity labels in Sanctuary's label set as of August 2026, against 14,488,795 across every chain we hold. Read those as label rows, not addresses — one address can carry several labels, and a label can describe an entity rather than a single wallet. Bitcoin leads because its public clustering surface is the largest, not because the other chains are unwatched.

A result gives you grounds for a decision: what the public record ties to that money, and how close the tie sits. Accepting it, refusing it, or asking the counterparty for documentation stays your call — and on a P2P deal it is usually the only call you get to make while the money is still yours.

How do I run a btc wallet risk check for free?

Free, about a minute, no registration:

Copy the address in full, then compare the first and last four characters against the source you got it from. Clipboard-swapping malware lives on exactly this step, and a check on the wrong address tells you nothing about your deal.

Open the Sanctuary Telegram bot at @sanctuaryapp_bot. It runs on buttons rather than commands — press the check button.

Paste the address and read what comes back: the risk verdict, the labels behind it, and the exposure those labels describe.

You never sign anything and nothing touches your keys. An address is public information; pasting it into a checker moves no funds and grants no access to the wallet it belongs to.

What do the labels on a Bitcoin address mean?

Each class means something different for the decision in front of you. This is the part of the result worth reading slowly.

| Label class | What it means | What it usually means for your decision |

|---|---|---|

| Sanctions | the address is tied to an entity or wallet on a sanctions list | Stop. This is a legal exposure rather than a risk-appetite question, and it does not fade with time. |

| Darknet market | funds moved through a marketplace wallet | Refuse or escalate. Expect any regulated venue to ask about it later, including years later. |

| Ransomware | payments into an extortion wallet | Handle as you would darknet exposure. This coin stays traceable and stays interesting to investigators. |

| Scam or phishing | reported by victims or investigators | Weigh how direct the link is. A direct hit on a P2P counterparty ends the deal. |

| Fraudulent or high-risk exchange | a venue with no controls, or one built to move stolen funds | Ask where the coin was before it reached them. The venue is the question, not the answer. |

| Exchange or deposit address | attributed to a custodial service | Often reassuring context rather than a warning. A named venue is the opposite of an unknown one. |

| Mixer or privacy service | the history runs through a service that breaks the visible trail | Not proof of wrongdoing on its own, but expect questions from any exchange the coin later reaches. |

| Mining pool | a payout address | Not automatically clean, but a plausible origin that a counterparty can document. |

| Unattributed | no public record ties this address to anything | The honest answer, not a clean bill. Most addresses on any chain sit here. |

Check the address before you act — free

Everything in that table comes back from one paste, which is all that checking a Bitcoin address for AML risk actually takes. @sanctuaryapp_bot gives you 3 free checks a day: no registration, buttons instead of commands, address in and verdict out in seconds, with the labels and the exposure behind it — sanctions designations, darknet and ransomware clusters, scam reports, exchange and deposit-address attribution, read across 20+ intelligence sources. Run it on the counterparty's address while the coin is still theirs, and on your own receiving address before an exchange reads it for you. If screening is part of your job rather than a one-off deal, the same data sits behind the web workspace: a check exports as a PDF report for a case file, monitoring watches the addresses you save, bulk checks take a whole list, and the API screens deposits inside your own stack — $199 a month for 1,000 checks, $499 a month for 5,000. Start free in the Telegram bot.

Why does a bitcoin address checker show links I never made?

Because a Bitcoin address is one window onto a wallet, not the wallet itself. Bitcoin spends outputs whole: if you hold 0.5 BTC in a single piece and send 0.1, the remaining 0.4 comes back to a fresh change address your wallet created for you, one you may never see in the interface. Most wallets also hand out a new receiving address every time somebody pays you. So one person's wallet is routinely dozens or thousands of addresses, and the one you pasted is whichever of them happened to be used.

Screening reads that neighbourhood rather than the single string, which is why a first-time address can still return history. In our set, 82,805,808 addresses are mapped into 15,235,791 clusters — groups of addresses that look like they belong to one entity.

The word "look" is doing real work in that sentence: a cluster is an estimated boundary rather than proof of ownership. That is why a result names the labels and the connections behind the verdict instead of handing you a number to trust blindly — you can see what the conclusion rests on, show it to a counterparty, and argue with it. The same reading applies on account-based chains, where an address is an account rather than a window — crypto wallet screening covers how that changes the picture.

What the check settles, and what stays with the exchange

• What the money is tied to. Attribution reaches an entity or a cluster — a deposit address at a named exchange, a darknet cluster, a mining pool — and names it. Anyone selling you a human name derived from an address alone is selling you a guess.
• What the record holds today. No labels means no public record, which is the ordinary state of ordinary money. A marketplace seized next month re-labels everything that touched it, including coin you accepted while it was quiet, which is why the date on your saved check does work for you later.
• Whether an exchange will accept the deposit. Every venue sets its own thresholds and its own appetite. A check tells you what they are likely to see, not what they will decide — which is still the difference between walking in prepared and finding out three days later.

The address came back flagged. What should I do?

Do not send, and do not accept, until you know which label fired and how close it sits.

Ask the counterparty where the coin came from: an exchange withdrawal, a mining payout, a purchase from years ago. A straight answer with a record behind it is worth more than a clean-looking screen.

Save the check result with its timestamp before anything moves. If a bank or an exchange asks in six months, the record you made at the time is your answer.

If the coin already arrived, document its origin as fully as you can and be ready to show it. Nothing done on-chain removes history — a swap, a bridge or a move to another wallet does not clear the record, it adds a step to it.

If it is your own address and the link is old or indirect, keep your purchase records together. Most of these end in an explanation rather than a loss.

For a P2P trade the address check is one item on a short list; what to check before a P2P crypto deal covers the rest of it.

Do I need to check the same address again?

Yes, once time has passed. Labels arrive after the fact: an address is designated, a marketplace is seized, victims file reports, and a history that read quiet in March reads differently in September. A check is a snapshot of a record that keeps moving.

For a one-off deal, check on the day of the deal. For an address you deal with repeatedly — a regular counterparty, a settlement wallet, a deposit address you credit — monitoring watches it and tells you when the picture changes, so nobody has to remember to re-run anything by hand.

Check before you send

Open @sanctuaryapp_bot, press the check button, paste the address. In about 60 seconds you have the verdict, the labels behind it and any sanctions exposure — on the one step of a Bitcoin deal you can still take while the money is yours. Three free checks a day, no registration, nothing to install: that is how to check a Bitcoin address for AML risk before it stops being your decision.

FAQ

Is checking a Bitcoin address free?

The check in the Sanctuary Telegram bot is free and needs no registration: open @sanctuaryapp_bot, press the check button, paste the address. Paid plans exist for people screening at volume ($199 a month for 1,000 checks, $499 for 5,000) and add the web workspace, PDF reports, monitoring and the API, but a single pre-deal check on one address needs none of that.

Can a bitcoin address checker tell me who owns the wallet?

It names the entity or the cluster — a deposit address at a named exchange, a darknet cluster, a mining pool — which is what a P2P decision actually turns on. The identity behind a custodial address lives in that venue's own records and is reachable only through a lawful request to them. A tool that offers you a person's name from an address alone is guessing.

Does receiving bitcoin from a flagged address make my address flagged?

Not automatically. Your address picks up exposure to that history rather than the label itself, and how much it matters depends on how direct the link is, how much came through, and whether you can show where it came from. This is why saving the check result and the counterparty's explanation at the time of the deal is worth more than anything you can do afterwards.

How long does the check take, and does a clean result stay clean?

The check returns in seconds. Clean is a snapshot, not a permanent state: an address is designated, a marketplace is seized, victims file reports, and history that read quiet last month reads differently now. Re-check before each deal, and put monitoring on any address you deal with repeatedly so a change reaches you without a manual re-run.