Free crypto wallet AML check: how to read the result
An AML check shows if a wallet is linked to scams, stolen funds, mixers or sanctions. What the risk score means, its limits, and how to run one for free.
By Web3 Copilot team6 min read
A crypto wallet AML check looks for links between an address and known criminal activity, such as scams, stolen funds, darknet markets, mixers and sanctioned entities, and sums them up in a risk score. All it needs is the public address. A real AML check never asks you to connect your wallet, approve a transaction or enter a seed phrase.
AML stands for anti-money laundering. Exchanges and payment companies run these checks on every deposit. Ordinary users run them for two reasons: to avoid paying a criminal, and to avoid receiving money that gets their own exchange account frozen.
What does an AML check look at?
Most AML checks combine three kinds of evidence:
- Labels on the address itself. Is it a known exchange, a scam wallet, a mixer, a gambling service or a sanctioned entity?
- Exposure. Has the address received money from, or sent money to, risky addresses? How much, and how many steps away?
- Sanctions lists. Does the address appear on a government list, such as the U.S. Treasury's OFAC list?
The risk categories usually look like this:
| Category | Typical examples |
|---|---|
| Sanctions | Addresses on the OFAC list, sanctioned exchanges |
| Fraud and scams | Fake investment platforms, phishing, impersonation |
| Stolen funds | Exchange hacks, drained wallets |
| Darknet | Illegal marketplaces |
| Mixers | Services that hide where funds came from |
| Gambling | Unlicensed online casinos |
| Exchanges | Usually low risk, unless the exchange has weak controls |
Who needs an AML check?
- P2P sellers. Before you release crypto or accept a payment, check where the buyer's funds came from.
- Freelancers and businesses paid in USDT. Funds from a high-risk wallet can trigger a review when you deposit them to an exchange.
- Anyone sending a large amount to someone new. A high score on the recipient is a reason to stop and ask questions.
How do you read the risk score?
The number is a summary. The reasons behind it matter more. Web3 Copilot uses a scale from 0 to 100, where higher means riskier, and names the level in words: Minimal observed risk, Low risk, Medium risk, High risk or Critical risk. If there is not enough data for a fair score, it shows "Limited assessment" instead of a number.
Left: a clean result. Right: elevated risk, with the share of money that came from scams and mixers. Demo data in the real Web3 Copilot interface.
Other tools use other scales, so compare reasons, not numbers. Three questions help:
- Direct or indirect? Direct exposure means the address itself sent or received money from a risky source. Indirect means the money passed through other wallets first. Direct exposure is much more serious.
- How big a share? One per cent of incoming funds from a mixer is very different from sixty per cent from a scam.
- How complete is the check? A good report says which sources checked the address and which networks they cover. A missing check is not a clean result.
What an AML check cannot tell you
- New addresses look clean. A scam wallet created yesterday has no history and no labels yet.
- Databases differ. Each provider has its own labels and coverage, so two tools can give different scores for the same address.
- Big services touch everything. Exchange hot wallets interact with millions of addresses, including bad ones. Some indirect exposure is normal.
- It is not a legal finding. A score helps you decide whether to look closer. It does not prove anyone committed a crime.
That is why an AML check works best together with the address history and the context of the deal. Our guide on how to check if a crypto address is a scam puts all the checks together.
How to run a free AML check with Web3 Copilot
Web3 Copilot is a free Chrome extension. It shows the AML result as part of a full address report:
- Add the extension to Chrome. No sign-up is needed.
- Open the address on a block explorer such as Tronscan or Etherscan, or paste it into the extension.
- Press Get score. The network is detected for you.
- Read the AML and sanctions card. Each source shows its own result.
| Result | What it means |
|---|---|
| No matches found | The OFAC check found no record of this address |
| Screening completed | The risk database checked the address and found no risky exposure |
| Review required | The risk database found some exposure worth a closer look |
| Elevated screening risk | A large share of the address's money is linked to risky sources |
| Exact address match | The address is on the OFAC sanctions list |
| Provider risk labels found | A risk database labels the address, for example as phishing. This is not a sanctions designation |
| Not supported | This source does not cover the network |
| Check unavailable | The source could not be reached. Try again later |
The badge at the top of the card sums up all sources. "No matches in checked sources" means every source that covers the network checked the address and found nothing. "Partially checked" means some sources could not run, so read the details before you rely on it.
The risk database covers nine networks: Ethereum, BNB Smart Chain, Polygon, Arbitrum, Base, Optimism, Bitcoin, TRON and Solana. On these networks it also shows the main risk factors and where the address's money came from. The AML result feeds into the overall Risk Score, together with the address history, and the report lists the reasons.
The extension is free with a fair-use limit on how many new addresses you can analyze in 24 hours. Checking the same address again does not count.
What to do if a wallet comes back high risk
- You are about to pay. Do not send yet. Ask the recipient about the flagged activity and check their story. If the explanation does not hold up, walk away.
- You are about to accept a payment. Do not release goods or crypto until you are comfortable with the source of funds. In P2P trades, cancel through the platform rather than in private chat.
- You already received the funds. Keep a record of the deal: the order, the chat, the transaction ID. If your exchange asks about the deposit, this record helps you explain it. Do not try to hide the funds' origin by sending them through other wallets, which looks worse, not better.
If the address is on the OFAC list, read OFAC sanctions screening for crypto addresses. If you are worried about frozen USDT, see USDT blacklist check.
This article is general information, not legal advice. Businesses with compliance obligations should use a professional screening provider.