A risk level is the verdict word a screening result puts on an address: CLEAN, LOW, MEDIUM, HIGH or CRITICAL, each paired with a recommendation to proceed, take care, review or reject. The level summarises what the address is connected to so an operator can act without reading the analysis underneath it. The words are a shared language for a queue, not a legal classification.
Levels exist so that a decision can be made quickly and made the same way twice. An operator clearing deposits needs a word that means one thing, and a supervisor reading the file six months later needs that word to still mean it.
They are also where inconsistency hides. If MEDIUM means "hold" on Monday and "release" on Friday because a different person was on shift, the level has stopped doing its job and the file no longer shows a policy. That is a policy problem, not a tooling one, and it is fixed in writing.
The result gives the level, the recommendation and the drivers in plain words — sanctions, mixer, darknet market, ransomware, scam, drainer, stolen funds, high-risk exchange, issuer freeze — plus the entity name where the address is attributed and the network the check read.
In the Telegram bot the level arrives in seconds, free, three checks a day. In the workspace it is a filter on your queue, a threshold you can build a rule around, a case with an owner, and a signed report carrying the same word to whoever asked.
A level is an input to that policy, never a substitute for it. The tool tells you what an address is connected to; the policy tells your team what your business does about it.
CLEAN: nothing known against the address. LOW: something minor and distant. MEDIUM: something a person should look at before releasing. HIGH: a connection serious enough to hold the transfer and escalate. CRITICAL: do not transact, preserve the record, follow your reporting policy.
MEDIUM means something was found that deserves a human look. Whether it stops your transfer is your policy's decision, and the drivers named in the result are what that decision should turn on.
Yes. Designations are published, thefts get attributed and services get identified after the fact. Re-check before large settlements rather than relying on a result from last month.
Also available in: · · ·
No. Vocabularies differ between vendors. What matters is that yours is consistent and that your written policy is phrased in the same words your operators see on screen.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.