Using AMLBot and Other Tools to Check Coin Risk

Before you send crypto to a swap — or accept it as payment — it pays to know what that coin has been doing before it reached you. Compliance systems at exchanges score every deposit against the coin's on-chain history, and a bad score can get your swap paused, escalated to KYC, or frozen. Tools like AMLBot and other blockchain-analytics checkers let you run that same kind of screening yourself, before you move funds, so there are no surprises. This guide explains how these tools work, what actually drives a risk score, what trips review flags, and exactly what to do when a coin comes back high-risk.

This is a privacy-and-safety guide for legitimate traders. The point is to avoid being wrongly flagged and to keep yourself from unknowingly handling stolen or sanctioned funds — not to evade the law or launder money. If coins are genuinely illicit, screening tools won't make them clean, and trying to push them through anyway is both illegal and a fast way to lose them.

Why screen coins at all?

Instant swaps are no-KYC by default, but almost all of them reserve the right to screen deposits and ask for verification when something looks risky. The trigger is usually the history of the coins you send, not anything about you. The problem for ordinary users is that you can receive "tainted" coins without knowing it — simply because of where a previous owner got them. Screening turns that hidden risk into something you can see and act on. (For the behavioral side — how to avoid looking suspicious — see How to Avoid KYC and AML Flags.)

What an AML/risk tool actually does

An AML checker (also called a wallet-risk, transaction-risk, or "taint" tool) takes an address or transaction hash and scores it against a database of known sources. It traces the flow of funds across the blockchain and tells you what categories the coins are exposed to and how strongly. You typically get back:

A risk score — often 0–100 (or a low/medium/high band). Higher means more exposure to flagged sources.
A source breakdown — the percentage of the funds traced to each category (a regulated exchange, P2P, gambling, mining, a mixer, darknet markets, scams, ransomware, sanctioned entities, stolen funds, and so on).
Direct vs. indirect exposure — whether the coins came straight from a risky source or several hops removed from one.

Behind the scenes these tools use the same blockchain-analytics data that exchanges rely on, so your self-check is a reasonable preview of what a service will see when you deposit.

AMLBot and the alternatives

AMLBot is one of the better-known consumer-accessible checkers: you paste a wallet address or transaction hash, pick the asset/network, and it returns a risk score with a category breakdown. It covers major chains and common tokens and is designed for individual users, not just compliance departments.

It isn't the only option, and using more than one is wise because providers don't always agree:

AMLBot — pay-per-check address/transaction risk reports for individuals.
Other analytics-backed checkers — several blockchain-analytics firms (the kind that power exchange compliance) offer wallet-risk lookups or scoring APIs. Some are aimed at businesses but have consumer-facing report options.
Wallet- and swap-integrated scores — a few wallets and instant swaps surface a risk score on deposits directly, so you see it without a separate tool.
Block explorers — not risk scorers, but useful for tracing where coins came from by hand, and for spotting obvious red flags (a deposit straight from a known mixer or a flagged address).

Because two tools can score the same address differently, treat a single result as one opinion. If the stakes are high, check with two and look at why they disagree.

How a risk score is built — and what trips flags

Understanding the mechanics helps you read a report calmly instead of panicking at any non-zero number.

Direct vs. indirect exposure

Direct exposure means the funds you hold came immediately from a flagged source. Indirect (or "hops away") exposure means the risky source is several transactions back in the history. Direct exposure to a serious category is far more likely to freeze a swap than a small, distant, indirect trace. Most coins have some indirect exposure to something — that alone is normal.

The categories that matter

Not all exposure is equal. A small slice traced to an ordinary exchange or gambling site is routine. The categories that actually drive review flags are:

Sanctioned addresses or entities — the most serious. Any meaningful exposure here can stop a transaction cold and is a legal line, not just a risk score.
Stolen funds / hacks — coins traced to a recent exchange or DeFi theft are aggressively flagged.
Darknet markets — funds tied to illicit marketplaces.
Ransomware and extortion — heavily monitored.
Mixers / tumblers — coins recently through a mixing service (the exposure is often treated as high-risk by compliance engines even when the use was for ordinary privacy).
Scams and fraud — funds linked to known scam addresses.

What pushes a score up

In practice, a swap is most likely to flag when a checker shows: a high percentage of funds in a risky category, direct exposure rather than distant hops, exposure to sanctioned sources at any level, or a fresh trail to a recent theft. A large round-number trade on top of a questionable score makes a hold more likely still.

Risk score bands: what the number actually means

Most checkers compress everything into a single 0–100% score and a colour-coded band. AMLBot, for example, uses three levels:

0–25% — Low risk. Clean enough that most exchanges credit the deposit without a second look.
25–75% — Medium / suspicious. The grey zone. A deposit here may sail through, or it may trigger a source-of-funds question or a manual review — it depends on the exchange's risk appetite and which category the exposure sits in.
75–100% — High risk. Very likely to be held, escalated to KYC, or blocked outright.

Treat those bands as a guide, not gospel. Different tools use different scales (some analytics firms score on their own 1–10 or banded systems), and every exchange tunes its own thresholds privately — so a 60% on one tool can read as 40% on another. That's exactly why you cross-check.

The percentages that actually flag — and why "10–30%" is only half the story

You'll often hear a rule of thumb like "anything over 10–30% tainted gets flagged." There's truth in it, but the single most important thing to understand is that the percentage is weighted by category severity and by directness. The threshold that matters is wildly different depending on what the exposure is — the same 10% means very different things coming from a licensed exchange versus a sanctioned mixer.

Checkers like AMLBot sort every source your coins have touched into risk tiers. Here is how those tiers behave and roughly what share starts causing trouble:

High-severity (the "danger" tier) — sanctions, stolen coins/hacks, darknet markets, ransomware, terrorism financing, child-exploitation material, mixers, scam clusters, and fraudulent or illegal services. The trigger here is low. For sanctions and stolen funds, many exchanges act on any direct exposure at all — fractions of a percent — because it's a legal line, not a risk dial. For the other danger-tier sources, a small direct slice (often single digits, very roughly 5–10%) can be enough to hold a deposit. A real example from compliance practice: ~35% of a deposit traced directly to a sanctioned mixer (Tornado Cash) is an automatic freeze and a suspicious-activity report — but you don't need anywhere near 35%; a few percent of direct danger-tier exposure can do it at a strict venue.
Medium-severity (the "suspicious" tier) — unlicensed or high-risk exchanges, unlicensed P2P desks, crypto ATMs, liquidity pools, and unnamed services. This is where the "10–30%" rule of thumb actually lives. A small amount is usually tolerated, but once a meaningful share — very roughly a quarter or more — of your funds traces here, expect a review or a source-of-funds question.
Low-severity (the "trusted" tier) — licensed exchanges, miners, marketplaces, merchant services, payment processors, ICOs, and ordinary wallets. Benign even at high percentages. Most legitimate coins are mostly this — licensed exchanges alone account for the large majority of all traced funds — so a deposit that's 60% "regulated exchange" and 5% "mining" is a perfectly ordinary, clean profile.

So the realistic mental model is: near-zero tolerance for direct high-severity exposure, roughly a 25–30% comfort ceiling for medium-severity sources, and effectively no limit on low-severity ones. A 20% score that's all "regulated exchange + mining" is fine; a 5% score that's direct "stolen coins" is not.

What happens when you submit these coins to a CEX

A centralized exchange runs the same blockchain-analytics screening on your deposit (and again when you withdraw). Knowing the bands above lets you predict the outcome before you ever hit send:

Clean / low band: credited normally.
Medium band, or notable medium-severity exposure: the deposit may be credited but flagged internally, or held pending a source-of-funds (SoF) request — they'll ask you to document where the coins came from before releasing them or letting you withdraw.
High band, or any direct high-severity / sanctions exposure: expect a frozen balance, account restriction, enhanced due diligence, a filed suspicious-activity report, or an outright rejection. Funds can be held indefinitely while they investigate, and money traced to a sanctioned source may not be returnable at all.

Exchanges almost never publish the exact number that trips each action — it's deliberately opaque and tuned to their own risk appetite and jurisdiction. The whole point of self-screening is to see what they'll see first, so a frozen deposit is never a surprise.

The risk metrics to run on your coins ahead of time

Before you deposit anywhere — CEX or swap — run these specific checks and read them in this order:

Sanctions hit (binary). Any direct sanctions exposure is disqualifying; treat it as a hard stop, not a percentage.
Overall risk score and band. Where does it land — low (0–25%), medium (25–75%), or high (75%+)?
Direct vs. indirect split. The same percentage is far more serious as direct exposure than as a distant, many-hops trace.
Top source categories and their share. Don't stop at the headline number — read the breakdown. Is the exposure in the danger tier or the trusted tier?
Largest single counterparty and recency. A fresh, direct trail to a recent hack or a single high-risk service is scored harder than old, scattered exposure.
Hops to the nearest high-risk source. One hop from a mixer is a different world from six hops.
Second-tool cross-check. If a score is borderline, confirm with another provider and see which source each is reacting to.

If those metrics come back clean and low, deposit with confidence. If a high-severity category shows up direct — even at a few percent — assume a CEX will act on it, and handle the coins deliberately instead (next sections).

Check the coins you RECEIVE, not just the ones you send

Most people only think to screen funds right before a swap. Screening coins on arrival is just as important:

Getting paid in crypto? Run the incoming transaction through a checker before you treat those funds as spendable. If they're high-risk, you want to know now — not when a swap freezes weeks later.
Buying P2P or from an individual? Screen the coins you receive. P2P is great for privacy but you have no idea where the other party's coins have been.
Keep clean coins separate. Don't deposit freshly-checked clean funds into the same address as coins of unknown history — mixing them in one address blends their risk, and a future check will score the whole pile by its worst input.

Check the coins you SEND — before you deposit

The moment to screen outgoing funds is before they hit a swap's deposit address, not after:

Run the address (or the specific UTXO/transaction) you plan to send through your checker.
Read the percentage and the categories, not just a pass/fail badge.
If the score is clean, swap normally. If it's borderline or high, slow down and handle it deliberately (next section).
Many privacy-minded traders keep a "clean" wallet of screened coins specifically for swaps, and never let it touch unscreened funds.

How to read a report without overreacting

A risk score is a signal, not a verdict. To interpret it sensibly:

Tiny indirect exposure is normal. A few percent traced to a gambling site or an exchange several hops back is not the same as direct exposure to stolen funds.
Weigh category over number. A 15% exposure to a normal exchange is fine; 2% direct exposure to a sanctioned address is not.
Look at recency and directness. Old, distant, indirect traces matter far less than fresh, direct ones.
Cross-check disagreements. If one tool says clean and another says high, find out which source it's reacting to before deciding.

What to do when coins come back high-risk

If a check flags your coins, do not just push them through a low-fee no-KYC swap and hope — that's how funds get frozen mid-transaction. Instead:

Stop and isolate. Don't co-mingle the flagged coins with clean funds. Keep them in their own address until you've decided what to do.
Document provenance. Gather records of how you got the coins — the purchase, the payment, the trade. If you ever need to prove source of funds, having it ready is the difference between a quick resolution and a permanent loss.
Consider a venue where you can prove source of funds. If the coins are legitimately yours but carry an unlucky history, a regulated exchange where you can complete verification and document provenance is sometimes the safest place to deal with them — for example Coinbase or Kraken. You give up privacy on that transaction, but you gain a clear, accountable path.
Ask the swap's support first. Reputable services would rather answer a question up front than freeze a transaction. Ask what risk score tends to trigger a hold and whether your planned trade would look unusual.
Don't try to "wash" the score. Routing flagged coins through more swaps or a mixer to hide the trail is exactly the structuring/laundering behavior that makes things worse, and is illegal in many places.

Handling a swap that gets flagged anyway

Even with screening, a transaction can occasionally be held. If it happens:

Respond to support promptly and honestly. Provide the provenance you documented. Most holds on legitimate funds are resolved once you can show where the coins came from.
Be patient and keep records. Save your transaction IDs, the deposit address, and all correspondence.
Learn from it. Note which coin/source triggered the review so you can screen for it next time.
Pick services with clear policies. Some exchanges are far more transparent about limits and screening than others — choose accordingly.

The limits of these tools

Risk checkers are useful but imperfect — know what they can't do:

False positives happen. Legitimate coins get flagged because of a previous owner. A flag is a reason to investigate, not proof of wrongdoing.
Providers disagree. Different databases and heuristics produce different scores for the same address.
Privacy coins work differently. Monero and similar coins can't be chain-traced the way Bitcoin or Ethereum can, so address-level "taint" scoring largely doesn't apply to them. That's part of why privacy coins sidestep this entire category of risk — see Bitcoin vs Monero: Privacy and KYC.
Mind your own privacy when checking. Submitting your address to a checker reveals it to that provider. Prefer tools that don't log, use them over Tor, and don't tie the lookup to your identity.

A simple screening workflow

Screen coins when you receive them and again before you send them to a swap.
Keep a clean, screened wallet for swapping and never mix it with unknown funds.
Read the category and directness, not just the headline number.
Cross-check anything borderline with a second tool.
If it's high-risk: stop, isolate, document, and choose a deliberate path — never force it through.
Ask support first whenever you're unsure.

Find no-KYC exchanges and their policies on SwapRaven

Screening your coins is half the job; choosing a swap with clear limits and a sensible policy is the other half. Browse the SwapRaven directory to compare instant swap exchanges by KYC level, grade, and fees, and check each listing's policy before you trade. New to instant swaps? Start with What is an Instant Swap Exchange? and How to Use an Instant Swap Exchange.