A false positive is a screening flag on an address that turns out to be legitimate — most often an address that shares a history with a service rather than with a bad actor. In crypto the usual cause is aggregation: exchange, processor and merchant addresses handle funds from thousands of unrelated users, so a connection to a flagged party exists without the address owner having had anything to do with it. Resolving one is an attribution question, not an argument about the verdict.
The two ways a screening programme fails are not symmetrical, but both are expensive. A false negative can cost a licence. A false positive costs a customer, and it costs them quietly — they do not appeal, they open an account somewhere else, and the desk never learns what it lost.
Both come from the same place: what is known about the address. When a result can name the service behind it, most apparent problems explain themselves. When it cannot, the reviewer is left reasoning about what the funds have touched, and honest caution starts blocking honest customers.
Where an address is attributed, the result names the entity — a deposit address at a named exchange, a payment processor, a merchant settlement wallet — alongside the verdict and the drivers. That name is usually the entire explanation for a flag that looked alarming a moment earlier.
In the workspace a resolved case stays resolved: the decision, the reviewer and the evidence are attached to the counterparty, so the same customer does not come back through triage cold next week. The signed report is what you send the customer's bank when they ask why the payment was held.
Because they pool funds from many unrelated users. A connection to a flagged party can exist on a service address without any customer of that service having done anything, which is why the entity name matters more than the verdict word alone.
Sometimes it is missing attribution, and sometimes it is a real connection your policy does not care about. Those are handled differently, which is why reading the named drivers comes before disputing the result.
Keep your own known counterparties on record so a familiar address is recognised, read the entity name before escalating, and put your override reasons in writing so the same case is not re-litigated each time.
Also available in: · · ·
The opposite failure: funds that should have been flagged and were not. It is the more expensive one, because the consequence arrives from a regulator or a bank rather than from a customer.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.