How this actually works —
and how to check that yourself.

Verify it yourself

This checker runs client-side. No backend decides your score and nothing you paste is logged, because there's no server here to log it. If you don't want to take that on faith, open dev tools before you run a scan and watch the network tab. You will see exactly three kinds of request and nothing else: ofac-addresses.json and scam-addresses.json, both fetched from this domain — plain lists of addresses, downloaded once and matched inside your browser — and, for an Ethereum address only, one call to a public RPC node, because reading Tether's freeze state means asking the contract. The address you typed is never sent to us; the only place it goes is into that one contract read, which is a public function anyone can call.

The production build is minified for load speed — but not obfuscated: function and variable names are untouched (search for generatePDF or isBlackListed in View Page Source and you'll land on them directly), only whitespace and comments are stripped. For the fully formatted version with comments, read app.js on GitHub instead — same code, easier to skim. Search for any wallet address from the data-sources table below and you'll find it sitting in a plain array either way.

Data sources, named

Every dataset below is something you could go verify at the link given. None of it is inferred or estimated.

Methodology, in short

Six named checks run on every scan. Right now, one of them is genuinely live: the Tether freeze read above. The OFAC, mixer-contract, and scam/phishing checks are matched against real data that was pulled at a point in time rather than queried on the spot, mainly because none of those sources expose anything a browser can call directly. The remaining two checks — FATF jurisdiction risk and counterparty tracing — aren't built yet, and they're labeled that way rather than quietly absorbed into your score. The full per-check breakdown lives on the main checker page.

Change log

Real dates, not a rolling "today" placeholder. This is the actual history of what's been built and fixed, kept here instead of implied by a single "last updated" badge.

• 2026-09-01 — Maintenance pass, no scoring changes. Fixed the live-chat loader, which was setting its account key on a local variable and so never initialised. Replaced every glyph the subsetted webfonts don’t carry (check marks, warning and arrow symbols, the Bitcoin, Ethereum and Litecoin currency marks) with drawn SVG, so nothing falls back to a system font mid-sentence. The 404 page now loads its stylesheet from an absolute path, so it renders correctly on nested URLs. An OFAC match found via the named-entity snapshot is now reported as a match even when the bulk address list fails to load, instead of showing a high-risk verdict beside an “unanswered” row. Network counts on the front page corrected to 9 supported and 7 auto-detected, matching the code.
• 2026-08-28 — Scam & phishing address check wired up, replacing the "needs a paid threat-intel feed" placeholder: matches against ScamSniffer's open-source drainer/phishing blacklist (2,500+ addresses, refreshed when a new build is deployed, on the same schedule as the OFAC list). 4 of 6 named checks now run on live or curated data, up from 3.
• 2026-08-27 — OFAC coverage expanded again, from 780 to 879 crypto addresses, re-synced across all covered chains instead of a manual pull.
• 2026-08-25 — OFAC coverage expanded from 22 hand-picked addresses to 780: the full crypto-address portion of OFAC's published list, not a sample. Live-scan step indicators fixed to visually distinguish real checks from ones not wired yet — they used to look identical mid-scan. This page published.
• 2026-08-24 — Live checker shipped: real-time Tether freeze read against the ERC-20 contract, OFAC snapshot matching, known sanctioned-mixer contract matching, and client-side PDF report generation.

Limitations, stated plainly

• The OFAC snapshot covers Bitcoin (533), Tron (203), Ethereum-format 0x addresses (120), Litecoin (13), Bitcoin Cash (6) and Zcash (4) — 879 in total, counted from the file itself. All 879 sit in the bulk address list; one of them, a Bitcoin address tied to Garantex (3E6ZCKRrsd…), also carries a named-entity record in the snapshot, so it comes back tagged with its entity rather than as a bare list match. It contains no Monero and no Solana addresses, so a Monero address cannot be entered at all and a Solana address returns "not checked — chain not covered" rather than a clean result.
• A "clear" result means not on this list as of the pull date — not verified against every sanction OFAC has ever issued, and not a guarantee the address stays clean tomorrow. Designations can be added anytime.
• Tether's live freeze check only works for the Ethereum ERC-20 contract. TRC-20 and BEP-20 USDT use different contracts this build doesn't call.
• FATF jurisdiction risk and counterparty tracing are not implemented — see the methodology note above for why, and don't let their absence from your score read as "clean" on those fronts.

Who runs this

Alex Komanov builds and maintains AML.legal, operating as AMLlegal (United States) — not a registered money-services business, compliance vendor, or law firm, despite the domain. LinkedIn · source code on GitHub.

Roughly four to six years combined across software development, crypto, and compliance-adjacent work sit behind this project — no single incident triggered it, just the accumulated annoyance of watching how the compliance-tooling industry actually operates: screening logic sold as a black box, pricing behind a sales call, and risk scores with no reasoning attached. AML.legal is the opposite bet — free, client-side, and built so you can check every claim it makes against the code itself.

Questions, corrected data, or a bug in the checker: use the contact form, the chat in the corner, or email [email protected] directly. We aim to reply within 24 hours.

Independence & no guarantees

AML.legal is built and maintained independently, and it isn't a licensed compliance vendor. The binding scope sits in the terms of use, and what happens to a pasted address is in the privacy policy. Despite the domain name, it's not a law firm either, and it has no relationship with any exchange, regulator, or the U.S. Treasury. There's no support line and no SLA — what you get instead is everything on this page: sources you can check and code you can read.

There's no warranty, express or implied, on any result this tool produces. A clean scan is not legal advice, not a compliance certification, and not something you can point to if a transaction goes wrong later — see the Terms for the full version of that sentence. If a business decision hinges on whether a wallet is sanctioned, the source of record is OFAC's own Sanctions List Search, not this site.