A public ledger with no names
Bitcoin, Ethereum and most other major blockchains keep a public record of every transaction. Anyone can see that a certain amount moved from one address to another at a certain time. What the ledger does not show is who controls each address. This combination, full transparency of movements with no built-in identity, is what makes analytics both possible and necessary.
Blockchain analytics firms build large databases that attach labels to addresses. Some labels come from public information, such as an exchange publishing its cold wallet addresses. Some come from the firms' own investigations, from law enforcement announcements and sanctions designations, from data shared by industry, and from patterns in how wallets behave. Once enough addresses are labelled, the software can follow funds from address to address and say where they came from and where they went.
Regulated businesses dealing in digital assets use these tools to screen the addresses they interact with. The aim is to avoid receiving funds connected to crime or sanctioned parties, and to avoid sending funds to them.
How addresses are grouped
A single person or business typically controls many addresses. An exchange may generate a new deposit address for each customer, and a wallet app may create a new change address with every transaction. Analytics tools use heuristics to group addresses likely to be controlled by the same entity, a process usually called clustering.
On Bitcoin and similar chains, one common heuristic relies on the fact that when several inputs are combined in a single transaction, they are usually controlled by the same wallet. On account-based chains such as Ethereum, patterns of interaction with smart contracts and known services play a larger role. Once a cluster is linked to a known service, every address in it inherits that label.
Clustering is powerful but not perfect. Heuristics can produce false links, and some privacy techniques are designed to defeat them. Good compliance teams treat analytics output as strong evidence that still needs judgement, rather than as a final verdict.
What analytics shows
For a given address or transaction, a screening tool will usually report:
- Entity attribution. Whether the address belongs to a known service, such as a named exchange, payment processor, gambling site or decentralised finance protocol.
- Category. The type of entity, using categories such as exchange, merchant services, mining pool, mixer, darknet market, ransomware, scam, stolen funds or sanctioned entity.
- Exposure. How much of the value passing through the address can be traced to or from each category, and how many steps away.
- Risk score. A summary rating based on the provider's chosen rules, often shown as low, medium, high or severe.
- Transaction history. The chain of transfers leading into and out of the address, which an analyst can examine in detail.
Direct and indirect exposure
Exposure is the concept compliance teams rely on most. Direct exposure means the address sent funds to, or received funds from, a risky entity in a single step. Receiving coins directly from a darknet market address is direct exposure.
Indirect exposure means the connection runs through one or more intermediate addresses. Coins that left a ransomware wallet, passed through three unlabelled addresses and then reached the client have indirect exposure to ransomware.
Direct exposure to a serious category is generally treated as high risk. Indirect exposure is more nuanced. Because digital assets circulate widely, almost any coin with a long history will have some remote connection to something undesirable if traced far enough back. Analytics tools therefore weigh indirect exposure by how many steps away it is and by what proportion of the funds it represents. A small fraction of value, many steps removed, carries far less weight than a large share received one step away.
Providers set their own thresholds. Two firms using the same analytics software may reach different conclusions about the same address because their risk appetites differ.
How risk scores are built
A risk score is a summary of the exposure findings, filtered through rules the provider has chosen. A provider might decide that any direct exposure to sanctioned entities is severe, that direct exposure to mixers is high, that indirect exposure to stolen funds above a certain share is medium, and that exposure to regulated exchanges is low.
The score helps a compliance team prioritise. Low scores may be cleared automatically. Medium scores may be checked by an analyst. High and severe scores will be escalated and usually held until reviewed.
Scores are not static. An address considered clean today may be re-rated tomorrow if new information links part of its history to a hack or a newly sanctioned party. For this reason, providers often re-screen addresses and transactions after the fact, and may raise questions about a transfer that was cleared weeks earlier.
Categories that commonly cause concern
Some categories are treated seriously by almost every regulated business:
- Sanctioned addresses and entities. Dealing with these may breach sanctions law. Providers generally will not proceed and may have reporting obligations.
- Stolen funds and hacks. Proceeds of exchange hacks and protocol exploits are tracked closely and can surface years later.
- Ransomware and scams. Funds traced to known extortion and fraud operations.
- Darknet markets. Marketplaces for illegal goods.
- Mixers and certain privacy services. Services that pool and redistribute coins to break the trail. Using them is lawful in some places, though they are frequently used to launder proceeds of crime, and providers apply caution.
Other categories, such as gambling services or high-risk exchanges in poorly regulated jurisdictions, may be acceptable or not depending on the provider's policies and the client's circumstances.
What happens when funds are flagged
When a transfer or address triggers an alert, the provider moves from automated screening to human review. The steps usually look like this:
- Hold. The provider pauses processing of the flagged transfer while it is reviewed. Incoming funds may be credited but not converted or released.
- Analysis. A compliance analyst examines the exposure in detail: what category, how direct, what share of value and when.
- Enquiry. The provider may ask the client to explain the source of the funds. Useful responses include exchange statements showing the coins were bought on a regulated platform, records of how long the client has held them, and invoices or contracts where coins were received as payment.
- Decision. The provider decides whether to proceed, proceed with conditions, return the funds to their source, or decline the transfer. Where it has a legal obligation to report suspicion, it will do so and may be restricted in what it can tell the client.
Clients sometimes worry that a single flag means they are suspected of wrongdoing. Most alerts are resolved with a sensible explanation, particularly where the exposure is indirect and small. Clear records of how and where assets were acquired are the best preparation.
Screening before and after a transfer
Screening happens at more than one point. Before accepting a deposit, a provider will typically screen the address the client says the funds will come from. When the transfer arrives, it screens the actual transaction, since coins can be sent from a different address than expected, or the address may have received new funds since it was first checked. Before sending a withdrawal, it screens the destination address.
Screening of the destination is easy to overlook from the client's side. A client asking for funds to be sent to an address may be surprised when the provider queries it, but a destination with direct exposure to a sanctioned service, or one recently linked to a scam, is as serious a problem as a risky source. Clients paying third parties in digital assets should expect their counterparties' addresses to be screened in the same way.
Analytics also supports the travel rule, which applies to virtual currency transfers and requires originator and beneficiary information to travel with them. Identifying whether an address belongs to another regulated service tells the provider whether it should exchange travel rule data with that service, or whether it is dealing with a self-hosted wallet that calls for a different approach. In that sense, attribution data does two jobs: it measures risk, and it tells the provider who is on the other side of the transfer.
Records of each screening result are kept with the transaction file, so that the provider can later show what it knew at the time it acted.
Limits of analytics
Blockchain analytics is a powerful tool with real limits. Attribution databases have gaps, especially for newer chains and smaller services. Clustering heuristics can create false links. Privacy-focused coins and techniques can make tracing difficult or impossible. Cross-chain bridges and swaps can break trails unless the tools specifically support them.
Analytics also says nothing directly about the client. It describes the history of coins and addresses. A client who bought coins on a reputable exchange and holds them in their own wallet may still receive a medium score if those coins once passed near a risky service. That is why screening is combined with ordinary client due diligence, including identity, source of wealth and, for self-hosted wallets, wallet ownership verification.
Keeping a clean history
- Buy and hold digital assets through regulated platforms where possible, and keep the statements.
- Use separate addresses for different purposes, such as one for transfers to and from a fiat provider.
- Avoid services that obscure transaction history unless you have a clear lawful reason and records to support it.
- Check counterparties before accepting coins as payment for goods or services.
- Expect questions on large or unusual transfers and have your documents ready.
General information only
This article is general information about blockchain analytics and screening. It is not legal, tax or investment advice. Each regulated business applies its own risk policies, so outcomes for a given transfer will differ between providers.
CCYFX screens digital asset transfers on-chain as part of its conversion service. See our digital assets page for an overview.
