AML Glossary

Attribution is the link between a blockchain address and a real-world service or actor — a named exchange, a payment processor, a marketplace, a designated entity. An address with attribution can be reasoned about; an unattributed address can only be described by what it has touched. Most of the distance between a confident decision and a stalled review is whether a name is present.

Chain hopping describes value moving across several blockchains in quick succession, typically through bridges or swap services. It is named as a pattern because rapid cross-network movement is one of the shapes that appears when someone is trying to put distance between funds and their origin — and also, routinely, when an ordinary user is chasing a cheaper fee or a supported deposit network. What it does not do is remove history: each leg is public, and screening reports the connection rather than losing it at the boundary.

Clean USDT is tether whose sending address and transaction history carry no known link to sanctions, theft, fraud or a criminal marketplace, and which does not sit on an issuer freeze list. Cleanliness is a statement about a trail at a point in time, not a permanent property of a wallet. Because USDT settles most P2P and OTC volume, it is also the balance most often stopped when the trail is bad.

A cluster is a group of blockchain addresses judged to be under the same control and treated as one party for screening purposes. Services generate addresses constantly — a fresh deposit address per customer, a fresh change address per transaction — so one address is rarely the whole picture. Clustering is what lets a name attach to more than one address at a time.

CoinJoin is a collaborative Bitcoin transaction in which several participants contribute inputs and receive outputs of equal value, so that the mapping between a specific input and a specific output is ambiguous rather than obvious. It is a privacy technique used by people with no criminal purpose, and it is also a category that some regulated venues query on deposit. Both of those statements are true at once, which is why the useful question is not whether CoinJoin is legitimate but what the venue you are depositing to does about it.

Counterparty risk in crypto is the exposure a business takes on from the party on the other side of a transfer: what that party is connected to, and what accepting their funds will cost if the next venue objects. It is assessed from the counterparty's addresses and their on-chain history, because in most crypto deals that is the only verifiable thing about them. The risk is rarely that they fail to pay — it is that they pay you with something you cannot bank.

A bridge is a service that moves value between blockchains by locking or burning an asset on the source chain and issuing a corresponding amount on the destination chain. It is ordinary infrastructure used constantly by ordinary users, and by itself it is not evidence of anything. What screening reports is the pair of legs a bridge creates — where the value came from before it crossed, and where it went after — because a transfer that cannot be connected across the boundary is a gap in a desk's record, not a cleared history.

Phishing in crypto is the theft of keys, seed phrases or token approvals through impersonation — a cloned site, a fake wallet prompt, a support account that messaged first. Unlike bank phishing, there is no chargeback: once the signature is made, the transfer is final, and the proceeds land in collector addresses that screening can attribute. The label on a check therefore serves two audiences: someone about to sign, and someone about to accept a payment that came from one of those collectors.

A darknet market is an illegal marketplace hosted on an anonymity network where payment settles in crypto, and the deposit, withdrawal and vendor addresses it operates are attributable as a cluster. When a check names darknet exposure, it is saying that value at this address is connected to that cluster, either directly or through the path it travelled. Regulated venues treat that connection as proceeds of predicate crime, which is why it usually stops a deposit rather than merely annotating it.

Dirty crypto is coin whose on-chain history connects it to sanctioned entities, stolen funds, ransomware payments, darknet markets or fraud proceeds. The description attaches to the funds and their trail, not to the token type or the wallet software, and it survives every transfer to a new address. Whoever receives it inherits the explaining.

Enhanced due diligence is the deeper set of checks a regulated firm applies when a customer, a transaction or a jurisdiction carries higher risk than the standard case. It goes beyond identity verification to the origin of the money, the purpose of the relationship and closer ongoing monitoring. Whether it applies is a risk judgement the firm makes, and it has to be one the firm can defend afterwards.

An entity label is the name a screening result puts on an address: the exchange, payment processor, marketplace, swap service or designated actor it belongs to. It is the readable half of a result — the category says what kind of thing the address is, the label says which one. Labels are what make a check explainable to a colleague, a bank or an auditor who does not read blockchains.

ERC-20 is the token standard on Ethereum, and it is what USDT, USDC and DAI are issued as when they live on that network. An Ethereum address is 0x followed by 40 hexadecimal characters, with an EIP-55 checksum expressed through the mix of upper and lower case, and the same address holds ETH along with every ERC-20 token sent to it. Two of the largest ERC-20 stablecoins have issuers who reserve contract-level powers over balances, which is the difference that matters most when you are accepting a payment.

EU sanctions, formally restrictive measures, are the prohibitions the European Union adopts against states, entities and individuals, and the consolidated list of persons, groups and entities subject to EU financial sanctions is published as a public dataset. For a desk inside the EU, a counterparty tied to a designated person is a legal question rather than a matter of risk appetite. The same address can be clean under one jurisdiction's list and designated under another, so which list applies to you decides what the result means.

Exposure is the connection between an address and a named risk category — how its funds relate to sanctions, a darknet market, a mixer, stolen funds, a scam or an unlicensed venue. Direct exposure means the funds moved between the address and the flagged party themselves; indirect exposure means they moved through one or more parties in between. Exposure is what a screening result reports; what to do about it belongs to the desk's policy.

A false positive is a screening flag on an address that turns out to be legitimate — most often an address that shares a history with a service rather than with a bad actor. In crypto the usual cause is aggregation: exchange, processor and merchant addresses handle funds from thousands of unrelated users, so a connection to a flagged party exists without the address owner having had anything to do with it. Resolving one is an attribution question, not an argument about the verdict.

FATF, the Financial Action Task Force, is the intergovernmental body that sets the anti-money-laundering and counter-terrorist-financing standards that national regulators then write into their own law. Its virtual-assets work is where the obligations covering virtual asset service providers come from: Recommendation 15 brings virtual assets and VASPs into scope, and Recommendation 16, the Travel Rule, covers the originator and beneficiary information that has to accompany a transfer. FATF does not supervise you directly — your national regulator does, using FATF's standard as the template.

A frozen address is one whose token balance cannot be transferred because the token's issuer applied a control at the contract level. The balance stays visible to anyone reading the chain, which is what makes the situation confusing the first time you meet it: the funds appear to be there because they are, and they still cannot move. This is a different state from an address that is merely flagged in screening data, where transfers work normally and the consequence is that counterparties may decline them.

In screening vocabulary a hack is the theft of funds from an exchange, bridge, protocol or custodian through a technical compromise, as distinct from fraud that persuades a victim to send the money themselves. The attacker's addresses and the route the stolen value takes afterwards are attributable, usually within hours, because incidents of this size are investigated publicly and in real time. A wallet that shows a hack connection is holding, or has held, value from one of those events.

A high-risk exchange label marks a trading venue whose published controls, licensing position or user profile make its deposit and withdrawal addresses a category a desk treats as elevated. It is a statement about counterparty quality rather than an accusation of criminality, and it is one of the most common findings on ordinary wallets. What it changes is the amount of documentation a receiving institution will want before it accepts value that came through that venue.

A hop is a single transfer from one address to another. Counting hops is how analysts describe distance: one hop means funds moved directly between two parties, three hops means they passed through two addresses on the way. Distance changes how a reviewer reads a connection. It does not remove the connection, because every hop is itself a public, permanent transaction.

KYC — know your customer — establishes who a customer is through identity documents, verification and ownership data, normally once at onboarding. KYT — know your transaction — screens what that customer's money is connected to, every time it moves. They answer different questions, and passing one says nothing about the other: a fully verified customer can still deposit funds that came from a ransomware wallet.

KYT — know your transaction — is the ongoing screening of crypto transfers and the addresses behind them, run at the moment money moves rather than once at account opening. It answers what a payment is connected to: a sanctioned entity, a darknet market, a mixer, a stolen-funds cluster, an unlicensed venue. Where KYC identifies the customer, KYT watches what the customer's money touches.

A money mule is a person whose bank account or crypto wallet is used to receive and pass on someone else's criminal proceeds, in exchange for a fee, a share, or nothing at all. Some know what they are doing; many are recruited through job adverts, relationships or offers that sound like ordinary work, and find out when an account is closed or an investigator calls. In screening terms the mule address is the layer between a fraud collector and a cash-out point, which is why it turns up on ordinary-looking wallets with short histories.

A no-KYC exchange is a venue that lets a user swap or trade without verifying their identity, which means no institution holds a record connecting the trade to a person. Screening names the category because that missing record is precisely what a receiving bank or exchange asks for when it reviews a deposit. The practical effect is not that funds become untraceable — the transactions stay on chain — but that nobody can evidence who was on the other side of them, and the burden of that gap lands on whoever receives the value next.

OFAC is the Office of Foreign Assets Control, the US Treasury unit that administers American sanctions programmes and publishes the SDN List. Digital currency addresses can appear on that list as identifiers attached to a designated person or entity, which is why sanctions are the first thing a desk resolves on a counterparty address. A sanctions match is not a risk you weigh against commercial upside; it is a legal fact about who is on the other side of the transfer.

A peel chain is a pattern in which a large balance travels through a long sequence of transactions, each one separating a small amount toward a cash-out point while the remainder continues to a new address. Analysts recognise it by its shape rather than by any single transaction, and it is one of the older typologies in on-chain investigation. Finding it in a counterparty's history does not by itself prove intent, but it does tell a desk that the value in front of it has a structured past that will need explaining.

A politically exposed person is someone entrusted with a prominent public function — a head of state, a senior politician, a senior judicial, military or state-enterprise official — together with their immediate family and close associates. The status is not an allegation; it is a marker that the relationship carries higher bribery and corruption risk and needs closer checks. Being a PEP is not a reason to refuse a customer, and blanket refusal is not what the standards ask for.

Pig butchering is a long-form investment fraud in which a stranger builds a relationship over weeks on a messaging or dating app before steering the victim to a fake trading platform. Deposits are real and leave the victim's wallet; the balance shown on the platform is a number in a web page, and withdrawals are refused or made conditional on further payments. The name comes from the operators' own vocabulary for fattening a target before slaughter, and the pattern is now one of the largest categories of crypto-denominated fraud by victim losses.

Ransomware is extortion malware: an attacker encrypts or steals an organisation's data and demands payment, usually in cryptocurrency, to addresses the attacker controls. Those addresses and the paths leading away from them are attributable, so a wallet that received value from a ransom payment carries the connection. Some ransomware actors are also sanctioned, which turns what looks like a risk category into a legal obligation.

A risk level is the verdict word a screening result puts on an address: CLEAN, LOW, MEDIUM, HIGH or CRITICAL, each paired with a recommendation to proceed, take care, review or reject. The level summarises what the address is connected to so an operator can act without reading the analysis underneath it. The words are a shared language for a queue, not a legal classification.

Sanctions screening is the check of a name, an entity or a blockchain address against official designation lists maintained by governments and international bodies. In crypto it has two halves: the customer's identity against name lists, and the addresses they transact with against the addresses published in designations. It is the one control where a miss is not a commercial loss but a legal one.

A SAR — suspicious activity report — is the filing a regulated firm makes to its national financial intelligence unit when it has grounds to suspect that funds relate to crime. In some jurisdictions the same filing is called an STR, a suspicious transaction report. The obligation is triggered by suspicion that survives a review, not by an alert on its own, and in most regimes the customer must not be told the report was made.

A scam label marks an address attributed to fraud against users — fake investment platforms, fake support staff, fake giveaways, goods that never arrive. The attribution comes from victim reports, published investigations and the on-chain behaviour of the addresses that collect and consolidate the proceeds. For anyone about to send money, it is the single most useful thing a check can tell you, because it is the category that most often appears before the loss rather than after it.

The SDN List — Specially Designated Nationals and Blocked Persons — is OFAC's list of people, entities and vessels whose property and interests in property US persons must block. Because digital currency addresses can appear as identifiers on a designation, a crypto address can be listed in the same way an account number or a passport number can. A match is not a risk signal to weigh against commercial factors; it is a legal obligation to act on.

Source of funds is the documented origin of the specific money in a transaction — where it came from, from whom, and on what basis. In crypto that means the trade, salary, sale or settlement that produced the coins, evidenced by records a third party can read without taking your word for anything. It is the difference between a deposit review that closes in days and one that does not close.

Stolen funds is the screening category for value taken from someone without their consent — a protocol hack, a drained wallet, a phishing loss, a theft under coercion — traced forward from the victim's address. It describes the money rather than the method, which is why it can appear alongside a hack, drainer or phishing label on the same result. For anyone receiving a payment, it is the category that most often arrives unannounced, because stolen value is cashed out through the same retail channels as everything else.

Tainted bitcoin is BTC whose transaction history traces back to a theft, a ransomware payment, a darknet marketplace or a sanctioned address. Bitcoin has no issuer that can freeze coins, so taint surfaces as a reviewed or refused deposit at the venue receiving it rather than as a blocked transfer on-chain. Because every output carries its own history, taint belongs to specific coins rather than to a wallet.

The Tether blacklist is the issuer-side control that stops a specific address from moving USDT. Tether's Terms of Service state that on suspected prohibited use the company may freeze or confiscate tokens, blacklist digital token addresses and report to authorities — so the action sits at the token contract rather than at any exchange. For a holder, the visible symptom is that the balance still shows on chain while every attempt to transfer it fails.

Transaction monitoring is the continuous screening of transfers into and out of a business, raising an alert whenever a transfer's counterparty or pattern meets the firm's criteria for a human look. In crypto it combines on-chain intelligence about the counterparty address with the firm's own view of the customer. A single screening answers one question once; monitoring keeps answering it for as long as the relationship lasts.

The Travel Rule is the requirement that identifying information about the originator and the beneficiary travels alongside a transfer between regulated providers, applied to virtual assets through FATF Recommendation 16. In practice a sending provider passes named customer details to the receiving provider, and the receiver expects to have them before making funds available. The threshold, the timing and the exact data set are set by each jurisdiction, not by a single global number.

TRC-20 is the token standard on the TRON network, and USDT on TRON is issued as a TRC-20 token. A TRON address is a Base58 string that begins with T and runs 34 characters, and the same address holds both native TRX and any TRC-20 tokens sent to it. Because USDT has an issuer, a TRC-20 balance can be frozen at the token contract, which is the single most important practical difference between holding it and holding a native coin.

A USDC blacklist entry is Circle exercising the blocking rights set out in its USDC Terms, which reserve the right to block certain USDC addresses and, where those addresses are Circle-custodied, to freeze the associated USDC temporarily or permanently. The terms also reserve the right to block transfers of USDC to and from an address on chain under the blocklisting policy. As with any issuer control, it acts at the token level rather than at an exchange, so it reaches self-custodial holdings too.

A USDT freeze is an action taken by the token's issuer, Tether, that stops USDT at a specific address from being transferred. Tether's Terms of Service reserve the right to freeze Tether Tokens held by a user and, where prohibited use is suspected, to freeze or confiscate tokens, blacklist digital token addresses and report to authorities. This is different from an exchange holding your account balance: an issuer freeze acts on the token contract itself, so the balance stays visible on chain while transfers from that address fail.