Free AML check for crypto —
know where the money's been before you accept it.

Anti-money-laundering law predates crypto by half a century. The US Bank Secrecy Act is from 1970. FATF, the body that writes the global rulebook and defines the risk-based approach every AML program follows, was founded in 1989 to fight drug-cartel banking — crypto wasn't a glimmer in anyone's eye yet.

Crypto got pulled into that regulatory compliance machinery gradually, then all at once. FATF extended its recommendations to "virtual asset service providers" in 2019. Enforcement lagged for years, then closed hard between 2023 and 2025: the UK's Travel Rule took effect in September 2023, the EU's MiCA became fully binding across all 27 member states in December 2024.

None of this happened because regulators suddenly discovered crypto. It happened because crypto became large enough — and useful enough to actual criminals — that ignoring it stopped being an option anyone in Brussels or Washington was willing to defend.

You don't get a vote on whether your deposit gets screened. The only choice you actually have is whether you find out what it'll show before you send the money or after.

Strip away the marketing language and a wallet screening does three things. It matches — is this exact address on a sanctions list, or blacklisted at the contract level. Binary, no interpretation required.

It traces — who sent money to this wallet, and who sent money to them. Two hops is the standard depth; by hop four you're usually looking at an exchange's entire deposit pool, not anything meaningful about your specific counterparty.

And it labels — scam reports, phishing tags, drainer contracts, sourced from public reporting rather than a government list.

That's the category, industry-wide. This build wires up matching — against 879 real OFAC-sanctioned addresses, known mixer contracts, and a curated scam/phishing address list — plus one thing outside that taxonomy entirely: reading Tether's own freeze registry live, in real time. Tracing isn't wired in yet — see what we screen for the honest breakdown.

Here's the part nobody selling AML software likes to say: different blockchain forensics engines disagree with each other constantly. Chainalysis and Elliptic score the same wallet differently often enough that it's a known joke among compliance teams. Treat any score, from anyone, as a strong opinion — not a court verdict.

A mixer pools deposits from strangers and pays them back out from a shared pool, severing the on-chain thread between source and destination. Whether that's privacy or laundering depends on who's asking — and the people asking have mostly been regulators.

OFAC put Tornado Cash's smart contracts on the sanctions list in August 2022 — the first time code itself, not a person or company, got sanctioned. A US appeals court eventually ruled the immutable contracts weren't "property" under sanctions law, and OFAC delisted it in March 2025.

Almost nothing changed in practice. Exchange compliance teams still treat mixer exposure as a hard flag, court ruling or not — the obligation was never really about the sanctions list, it's about not laundering money. ChipMixer's servers were seized in March 2023 and never came back. Assume every exchange downstream notices mixer contact, ever — the delisting bought a legal argument, not a clean bill of health.

Every contract Tether has deployed ships with a function that lets Tether — and only Tether — blacklist an address. Flip that switch and the tokens stay visible on-chain, fully intact, completely inert. Just frozen, until Tether decides otherwise.

There's no customer-facing appeal, because you're not really Tether's customer — the exchange or wallet you used is. Tether launched a joint financial-crime unit with Tron and TRM Labs in late 2024. Since December 2023, Tether's policy has been to freeze anything OFAC sanctions, automatically.

This is the single most concrete thing an AML check can tell you: a contract either reports an address as frozen or it doesn't, no probability involved. Everything else in a screening report is a judgment call dressed up as data. The freeze check isn't.

Dirty-USDT swap. Someone pays you in tokens with a bad history, you hand over fiat, and the problem becomes entirely yours the moment you try to deposit. Screen the buyer's wallet before you release anything, full stop.

Repeat-offender wallets. The trace often shows the tell before you'd notice yourself: small inbound transfers from strangers, then a burst outward toward a mixer, on a loop.

Pig-butchering deposit addresses. One address, funded by dozens of different people, each convinced they're the only one investing. Check the deposit address before you send a cent.

Drainer contracts. Wallets tied to known campaigns get flagged before you interact — which matters, because with drainers the interaction itself is the damage.

What none of this catches: anything off-chain. A reversed bank transfer, a faked screenshot — a wallet check has nothing to say about it. For that half of P2P risk, the only real protection is actual escrow.

First: stop arguing with general support. It was triggered algorithmically, before any human looked at anything. Find the compliance or AML-review channel specifically.

Second: run a check on the wallet that sent you the funds — a small crypto investigation of your own, so you know what you're walking into before you respond to anything.

Third: build your evidence file. P2P receipts, invoices, trade history. Compliance teams unlock accounts on paperwork, not on how sincerely you explain yourself.

Fourth: wait it out. Clean funds with real documentation typically clear in one to four weeks. Anyone offering to "expedite" it for a fee is running a scam — that's never once been a real service.

Screening isn't magic — it's pattern matching on public data, and patterns catch innocent wallets too. The most common false positive: a wallet received funds from a large, popular address — a mining pool payout, a well-known liquidity pool, a faucet — that also happens to have paid out to someone flagged for something else entirely. Sharing an upstream funder with a bad actor isn't the same as being one, but a shallow trace can't always tell the difference.

Secondhand hardware wallets are another common trigger. Buy a used Ledger or Trezor without wiping it properly, and you inherit whatever history came with the seed — not because you did anything, but because the address existed before you touched it.

There's no button that clears a false positive, because there's no central authority correcting scores across the industry. What actually works is documentation. If you're disputing a freeze, source-of-funds paperwork settles it regardless of what triggered the flag in the first place — the exchange doesn't need to agree the flag was wrong, only that your funds are clean.

And an honest limitation, ours included: a screening tool can tell you a wallet touched a mixer. It can't tell you why. Five years of privacy-minded caution and five minutes of laundering intent produce the exact same on-chain signal.

Ask a compliance team exactly what tripped the alert on your account and you'll almost always get some version of "we can't discuss the specifics of an ongoing review." That's not a stonewall for its own sake. In a lot of jurisdictions, telling a customer their transaction generated a suspicious-activity report is called tipping off, and it's a criminal offense for the institution, not just a policy — the UK's Proceeds of Crime Act has an explicit tipping-off provision, and the EU's AML directives carry similar language. The person answering your ticket may be legally barred from telling you the one thing you actually want to know.

There's a second, quieter reason. Specificity is a map. Explain exactly which upstream address caused the flag, and you've told every future bad actor which patterns to avoid — the same logic that keeps airport security vague about exactly what their screening looks for.

What this means practically: stop expecting an explanation and start building a file instead. You don't need to know the exact trigger to clear a review — you need to show your funds are clean regardless of what the algorithm thought it saw. That's the one lever you actually have.