Riferimento

Glossario AML

38 termini usati nella compliance crypto, nell'analisi del rischio blockchain e nelle operazioni AML. Scritto per professionisti del settore, non per avvocati.

AML KYC KYB Risk Score Risk Level Sanctions Screening OFAC SDN SAR STR FATF Travel Rule

AML (Anti-Money Laundering)

Laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In crypto, AML involves screening wallet addresses, monitoring transactions, and reporting suspicious activity.

Correlati:KYCSARFATF

KYC (Know Your Customer)

The process of verifying the identity of clients. Exchanges and financial institutions are required to collect identification documents before allowing transactions. Sanctuary focuses on AML (wallet risk), not KYC (identity verification).

Correlati:KYBAML

KYB (Know Your Business)

Similar to KYC but applied to business entities. Involves verifying company registration, beneficial ownership, and business legitimacy. Required for merchant onboarding in regulated jurisdictions.

Correlati:KYC

Risk Score

A numerical value (0–100 in Sanctuary) representing the assessed risk level of a wallet address. Based on multiple data sources, behavioral analysis, and intelligence feeds. Higher score = higher risk.

Correlati:Risk LevelScoring Methodology

Risk Level

Vedilo in azione

Con questi termini più chiari, esegui un controllo wallet e verifica il modello di evidenze.

A categorical classification derived from the risk score. Sanctuary uses 5 levels: Clean (0–9), Low (10–33), Medium (34–66), High (67–89), Critical (90–100). Each level triggers different recommended actions.

Correlati:Risk Score

Sanctions Screening

Checking addresses against official sanctions lists (OFAC SDN, EU, UN, UK HMT). Any match results in a Critical risk level. This is a regulatory requirement — not optional for regulated entities.

Correlati:OFACSDN

OFAC (Office of Foreign Assets Control)

A U.S. Treasury department that maintains sanctions lists including the SDN (Specially Designated Nationals) list. OFAC-listed addresses are automatically flagged as Critical risk.

Correlati:Sanctions ScreeningSDN

SDN (Specially Designated Nationals)

A list maintained by OFAC of individuals, companies, and entities whose assets are blocked. Includes crypto wallet addresses associated with sanctioned actors. Updated regularly.

Correlati:OFAC

SAR (Suspicious Activity Report)

A document filed with financial regulators when suspicious activity is detected. Sanctuary can auto-generate SAR drafts with evidence from AML checks, reducing manual compliance work.

Correlati:AMLSTR

STR (Suspicious Transaction Report)

Similar to SAR but focused on specific transactions rather than overall account activity. Some jurisdictions use STR instead of SAR. Both serve the same regulatory purpose.

Correlati:SAR

FATF (Financial Action Task Force)

An intergovernmental organization that sets international AML standards. FATF recommendations form the basis for most national AML/CFT regulations. The FATF Travel Rule (Recommendation 16) requires VASPs to share originator and beneficiary information.

Correlati:Travel RuleVASP

Travel Rule

FATF Recommendation 16 requiring VASPs to exchange originator and beneficiary information for transactions above a threshold (typically $1,000). Aims to prevent anonymous cross-border transfers. Implementation varies by jurisdiction.

Correlati:FATFVASP

VASP (Virtual Asset Service Provider)

Any entity that provides services involving virtual assets — exchanges, custodial wallets, payment processors. VASPs are subject to AML/KYC regulations in most jurisdictions.

Correlati:FATFTravel Rule

Mixer / Tumbler

A service that pools and redistributes cryptocurrency to obscure the connection between sender and receiver. Tornado Cash (Ethereum) and Wasabi Wallet (Bitcoin) are well-known examples. Mixer interaction is a significant risk signal.

Correlati:CoinJoinObfuscation

CoinJoin

A privacy technique where multiple users combine their transactions into one, making it difficult to determine which inputs correspond to which outputs. Used by Wasabi Wallet and JoinMarket. Detected during on-chain analysis.

Correlati:Mixer

Transaction Graph

A visual representation of fund flows between addresses. Used in investigations to trace the origin and destination of funds. Sanctuary provides graph analysis to identify proximity to known risk entities.

Correlati:Hop Distance

Hop Distance

The number of intermediate transactions between two addresses. A wallet "2 hops from Tornado Cash" means funds passed through one intermediary. Closer proximity = higher risk signal.

Correlati:Transaction GraphMixer

False Positive

When a legitimate address is incorrectly flagged as risky. No scoring system is immune to false positives. Sanctuary provides a formal dispute process with 24-hour review for confirmed false positives.

Correlati:Risk ScoreDispute

KYT (Know Your Transaction)

Continuous monitoring of transactions rather than one-time wallet checks. KYT systems alert when a previously clean address receives funds from a risky source or when transaction patterns change.

Correlati:WatchlistMonitoring

Watchlist

A set of addresses monitored for risk score changes over time. When a watched wallet's risk level changes, an alert is sent via webhook or Telegram. Essential for ongoing counterparty monitoring.

Correlati:KYTMonitoring

Snapshot

A point-in-time record of an AML check result. Sanctuary snapshots are cryptographically signed and independently verifiable. Used as compliance evidence — the signature proves the check existed at a specific time.

Correlati:Evidence Pack

Evidence Pack

A collection of signed snapshots and PDF reports that document AML due diligence. Used when banks, partners, or exchanges request a review record. Includes the verdict, evidence categories, and an explanatory narrative.

Correlati:SnapshotPDF Report

OSINT (Open Source Intelligence)

Information gathered from publicly available sources such as blockchain explorers, forums, social media, and community reports. Sanctuary uses OSINT as one evidence category inside a governed risk review.

Correlati:Community Reports

MiCA (Markets in Crypto-Assets)

The EU's comprehensive regulatory framework for crypto-assets. Entered into force December 2024. Requires CASPs (Crypto-Asset Service Providers) to obtain authorization by July 2026. Mandates AML/KYC procedures, reserve requirements for stablecoins, and market abuse rules.

Correlati:CASPTravel RuleFATF

CASP (Crypto-Asset Service Provider)

MiCA's term for regulated crypto businesses — exchanges, custodial wallets, brokers, portfolio managers operating in EEA. CASPs must register, meet capital requirements, and implement AML procedures. Replaces the patchwork of national VASP registrations.

Correlati:MiCAVASP

Peel Chain

A laundering technique where an address sends a small amount to a destination, then forwards the remainder to a new address, repeating the process. Each "peel" creates a new address, making automated tracing difficult. Commonly used in Bitcoin laundering.

Correlati:MixerTransaction Graph

Address Poisoning

An attack where a scammer sends zero-value token transfers from a look-alike address to a victim, hoping they will copy the attacker's address from their transaction history. Over 17 million poisoning attempts were recorded on Ethereum in 2025.

Correlati:PhishingRisk Score

Pig Butchering

A romance-investment scam where criminals cultivate trust over weeks or months, then guide victims to transfer funds to fake investment platforms. Accounted for $5.7 billion in U.S. losses in 2025. Increasingly uses AI-generated deepfake video calls.

Correlati:SARSanctions Screening

Dust Attack

Sending tiny amounts of cryptocurrency ("dust") to many wallets to de-anonymize users by tracing how the dust is later consolidated. Can also be a tracking mechanism used by analytics firms or attackers.

Correlati:Address PoisoningPrivacy

Flash Loan

An uncollateralized DeFi loan that must be borrowed and repaid within a single transaction. Used legitimately for arbitrage, but also exploited in protocol attacks (flash loan exploits). A flash loan interaction in a wallet's history is a moderate risk signal.

Correlati:DeFiRisk Score

Rug Pull

A scam where token creators launch a token, attract investment, then drain all liquidity — leaving holders with worthless tokens. Sanctuary's Token Analyzer includes honeypot and rug pull scoring.

Correlati:HoneypotToken Analyzer

Honeypot Token

A token designed so buyers can purchase but never sell. The smart contract allows buy transactions but blocks or heavily taxes sell transactions. Detected through automated contract analysis.

Correlati:Rug PullToken Analyzer

Contagion Score

A measure of how much a wallet's risk is affected by its transaction partners. If you transact with a high-risk wallet, your contagion score increases based on proximity, volume, and frequency of interaction.

Correlati:Risk ScoreTransaction Graph

Source of Funds (SoF)

Verification of where a customer's funds originate. Required by CDD (Customer Due Diligence) regulations. On-chain, SoF analysis traces wallet deposits back to their origin — exchange deposits, mining rewards, DeFi yield, etc.

Correlati:CDDKYC

CDD (Customer Due Diligence)

The process of identifying and assessing customer risk. Includes Simplified (low-risk), Standard, and Enhanced (EDD) levels. On-chain CDD uses wallet screening as one input alongside traditional identity verification.

Correlati:EDDKYCSource of Funds

EDD (Enhanced Due Diligence)

Additional scrutiny applied to high-risk customers, PEPs (Politically Exposed Persons), or large transactions. May include manual investigation, source-of-wealth documentation, and ongoing monitoring.

Correlati:CDDPEP

PEP (Politically Exposed Person)

An individual who holds or has held a prominent public function — heads of state, government officials, military leaders. PEPs and their family members require enhanced due diligence due to corruption risk.

Correlati:EDDSanctions Screening