Step 1
Address and network
Your system passes the address and the network: Bitcoin, Ethereum or TRON. For USDT the standard is specified — ERC-20 or TRC-20: the same token on different networks has different addresses and different history.
AML check of crypto wallets
AML crypto screening is a check of a wallet address before a deal: where the funds came from and whether the address is linked to sanctioned addresses, mixers, the darknet or fraud. For an address and network you get a risk score, source labels and the share of funds by category, and you check the wallet owner against the Rosfinmonitoring lists and sanctions in the same process. From 1 September 2026 this digital analysis of addresses is mandatory for exchanges, brokers, exchange offices and digital depositories.
Address and owner in one process A report with the date of the check Russian software registry no. 19972
What the AML check of an address shows: risk score, labels and sources of funds
AML crypto is not a check of a person but a check of money: what history the address has and through which addresses the coins have passed. The result arrives via the API in JSON and is shown in the account as an address card.
-
Risk score and risk level
A number from 0 to 100 and a level — low, medium or high. You set the level thresholds in your own rules: for one exchange office 70 is enough, for another 50.
-
Address labels
What is known about the address itself: an exchange, a payment service, an exchange office, a mixer, a darknet marketplace, a fraud scheme, a sanctioned address. An address without a label is not “clean”, it is simply unlabelled.
-
Share of funds by category
What percentage of receipts came from each category of source. 3% from a mixer and 60% from a mixer are different decisions with the same label.
-
Direct and indirect link
Direct — the address is itself labelled or received funds directly from a risky address. Indirect — risky funds arrived through one or several intermediate addresses. How this affects the score — below.
-
Sanctioned addresses
Addresses from the OFAC, EU, UK and UN sanctions lists and addresses linked to sanctioned persons. A match with a sanctioned address is a separate flag, not diluted in the overall score. Sanctions screening of people and companies — on the page sanctions screening page.
-
Report for audit
The date and time of the check, network, address, score, labels and shares — in one report. It is stored together with the deal: address labelling is updated, and a month later the same address may get a different score.
Digital analysis under Federal Law No. 282‑FZ: what a market participant must check
Federal Law No. 282‑FZ of 4 August 2026 “On Digital Currencies and Digital Rights” has been in force since 1 September 2026. Article 35 introduced digital analysis — a check of cryptocurrencies, digital rights and addresses for links with activity for which criminal or administrative liability is established. Compliance in cryptocurrency now starts with the address.
- Persons organising the circulation of digital currencies
A trading organiser, a broker, a trust manager, a digital depository and an organisation that exchanges digital currencies - A clearing organisation and an operator
The operator of an information system in which digital financial assets are issued, and clearing of cryptocurrency deals
- Identifier addresses
The addresses from which and to which digital currencies and digital rights move under a deal - The assets themselves and the risk level
The characteristics of the currency and the address and the risk level assigned to the deal or operation
- Before the deal
The analysis is carried out before the deal or operation is made - No later than three business days
If it is actually impossible before the deal — within the period set by the digital analysis rules, but no later than three business days after it - Without depository addresses
An exchange, broker, manager, exchange office and clearing organisation carry out the analysis if the deal is not executed through addresses administered by a digital depository
- Digital analysis rules
An internal document that takes into account the type and scale of activity; not disclosed to third parties; sent to the Bank of Russia within five business days of adoption - Digital analysis service provider
The analysis may be entrusted to a provider from the register kept by the authorised body; responsibility for the result remains with the organisation
- The requirements are given according to the text of the law as of 21 October 2026. The Bank of Russia requirements for digital analysis rules and the procedure for the register of providers are still being prepared — check with your lawyer.
- How to turn these requirements into thresholds and actions — in the block “Digital analysis rules”.
Who needs to check crypto addresses
The law names market participants individually. For everyone else, an address check is needed so as not to receive funds that a bank or counterparty will later block.
-
Organisations that carry out exchange
- Two or more deals a month for more than 3.5 million ₽ — an exchange office under Art. 18 of Federal Law No. 282‑FZ, only from the Bank of Russia register
- Digital analysis of the customer's address before the deal
- From 1 September 2027 — a check that the address belongs to the customer
-
Exchanges, brokers and managers
- Analysis of deposit and withdrawal addresses if settlement does not go through depository addresses
- Sanctions and lists check on the owner when opening an account
- Brokers and investment platforms
-
Digital depositories
- Analysis of the addresses to which the customer withdraws funds
- A transfer of more than 100 thousand ₽ to an external address — no earlier than after 48 hours from 1 September 2027
- Checking the recipient against the Bank of Russia database
-
Importers and exporters
- Cryptocurrency is permitted in settlements under foreign trade contracts
- The address of a foreign counterparty — before payment, the company — by INN and sanctions
-
Banks and payment services
- The customer brings income from the sale of cryptocurrency — the source address confirms the origin of the funds
- From 1 July 2027 banks refuse transfers to unauthorised intermediaries
- Solutions for banks
-
Mining pools and DFA operators
- The operator of a DFA information system and clearing — directly in Art. 35
- The pool checks payout addresses of participants before distributing the reward
How an address check works before a deal
Five steps from the address in the request to the decision in the log. Steps 1–3 go in one API request, step 4 is the owner checks if the customer is new.
Step 2
Labelling and link graph
The service checks the address against the database of labelled addresses and follows the chain of incoming transfers: who the funds came from and where they came to the sender from.
Step 3
Risk score and reasons
The response contains a score from 0 to 100, the level, address labels and shares of funds by category. If the score is high, you can see why: for example, 41% of receipts came through a mixer.
Step 4
Owner check
For a new customer — a passport with an authenticity check, the list of terrorists and extremists, sanctions and, if needed, the basic package of checks against Russian databases. For a foreigner — international screening with PEP.
Step 5
The decision and the log
Your system applies the digital analysis rules: proceed, request the source of funds or refuse. The check report is stored together with the deal.
Direct and indirect link: how address risk is calculated
Risk is a share, not a label
A single transfer from a doubtful source does not make an address “dirty”. The decision is based on the share, the length of the chain and the category of the source.
- 01
The label of the address itself
If the address belongs to a mixer, a darknet marketplace or is on a sanctions list, the risk is determined at once — the history of receipts no longer matters.
- 02
Direct link
The address received funds directly from a risky address. This is the strongest signal after the address's own label: there are no intermediaries between the customer and the source.
- 03
Indirect link
Risky funds reached the address through one or several intermediate wallets. The longer the chain and the smaller the share, the weaker the contribution to the score — splitting and “running” through transit addresses is what people try to exploit.
- 04
Share and recency
The score depends on what part of receipts is linked to each category and how long ago it was. Labelling is constantly updated, so the check is repeated before every large operation, not once at onboarding.
- 8 categories of risk sources
- 0–100 risk score with reasons
- 1 request address, labels, shares and score
Low, medium or high risk: what to do with the deal
The customer's address or someone else's: checking ownership under Article 45
-
What the law requires
If the information about the customer and the owner of the address or bank account does not match, the exchange office must refuse the deal (Parts 1–2 of Art. 45 of Federal Law No. 282‑FZ). A depository also refuses if the recipient does not match (Parts 5–6).
-
Message signature
The customer signs a short text generated by your system with the address key, and the service verifies the signature. This confirms control over a non-custodial wallet without transferring any money.
-
An address on an exchange or in a depository
If the address is labelled as an exchange or custodial service address, the customer cannot provide a signature — then a statement or confirmation from the platform is needed. The address label suggests which route to choose.
-
Transfers without consent
An exchange office and a depository check the recipient against the Bank of Russia database of transfers made without voluntary consent, and a depository also against the data of the Antifrod state information system. How to connect to the system — on the page GIS Antifrod.
From 1 September 2027 an exchange office checks before a deal that the address for crediting cryptocurrency belongs to the customer, and a digital depository checks that the address belongs to the named recipient. The risk score does not replace this: a clean address may belong to a fraudster.
Wallet owner check: lists, sanctions and passport
The address answers the question “where does the money come from”, the owner — “who is bringing it”. Both checks run in one process and one report, and database checks do not require a KYC session: the full name, date of birth and document details are enough.
- Catalogue of checks
A Russian citizen
Passport — document recognition and anti-fraud, then Russian databases.
What is checked
- Rosfinmonitoring list of terrorists and extremists
- OFAC, EU, UK and UN sanctions lists
- Passport validity
- Wanted lists of the Ministry of Internal Affairs and the Federal Bailiff Service
- Bankruptcy
- The basic package of checks against Russian databases — 50 ₽
- About PEP screening
A foreign national
The passport of a foreign citizen and the checks that matter for a non-resident.
What is checked
- International screening: sanctions and PEP in one request — 36 ₽
- Register of controlled foreign persons of the Ministry of Internal Affairs
- PEP screening with relatives and associated persons
- KYB by INN
Company
A corporate customer or a foreign counterparty under a foreign trade contract.
What is checked
- Status, address and signs of a shell company by INN
- Director and founders
- Sanctions on the company and its head
For the Rosfinmonitoring lists, the duty to check and freeze is established by Federal Law No. 115‑FZ — details on the page list checks.
Digital analysis rules: what to put in the internal document
The law requires rules but does not give their content: the Bank of Russia may set requirements for it (Part 8 of Art. 35). Below are the sections that usually go into them and what the address check provides for each.
- Risk levels
Which score is considered low, medium and high for your product - Action for each level
Proceed, request the source of funds, refuse, pass to the responsible employee
- Categories without a threshold
A sanctioned address, a direct link with the darknet or ransomware — refusal at any score - Share for an indirect link
What percentage of funds from a risky category is acceptable through a chain
- Moment of the check
Before the deal; if impossible — no later than three business days - Repeating the check
Before every operation above the amount threshold and for addresses the customer uses regularly
- Who makes the decision
A responsible employee for medium and high risk, the grounds for the decision in the log - Storage of results
Address and owner check reports together with the deal — for the Bank of Russia and for audit - Sending the rules to the Bank of Russia
The rules and amendments — within five business days of adoption, unless the Central Bank has set otherwise
- This is a guideline for your lawyer, not a document template. The rules take into account the type, nature and scale of your activity (Part 5 of Art. 35).
How much an AML check of a crypto address costs
You pay for checks performed, with no subscription fee. Skipped database checks are not charged.
- Calculate
Address check
on request
Risk score, labels, shares and links on the Bitcoin, Ethereum and TRON networks. The price depends on volume and the set of networks
- Catalogue
Owner by Russian databases
5 ₽
per check: Rosfinmonitoring lists, sanctions, wanted lists and others; the basic package of checks — 50 ₽
- Price matrix
International screening
36 ₽
per check: sanctions and PEP in one request
KYC of the owner by passport — from 16 ₽ per session, with a liveness check — from 29 ₽ (price matrix).
How to embed address checks in an exchange office, exchange or depository
- Risk score
- Address labels
- Shares by category
- JSON in and out
Test access on the day you ask for it.
Integration — from one business day, NeuroVision engineers support the rollout. Cloud or installation in your environment.
Glossary of AML crypto address screening
Terms of the law and blockchain analytics that appear in the report and the rules.
- Identifier address
- An address on a blockchain on which digital currencies or digital rights are recorded. The term of Federal Law No. 282‑FZ for what is commonly called a wallet address.
- wallet address
- Digital analysis
- A check of currencies, rights and addresses for links with activity for which criminal or administrative liability is established, with the assignment of a risk level (Art. 35 of Federal Law No. 282‑FZ).
- Digital analysis rules
- An internal document of the organisation on the procedure and deadlines of the analysis; sent to the Bank of Russia.
- Risk score
- A score from 0 to 100: how closely the history of the address is linked to risky categories.
- risk score
- Direct link
- Funds arrived at the address from a risky address without intermediaries.
- direct exposure
- Indirect link
- Risky funds arrived through one or several intermediate addresses.
- indirect exposure
- Mixer
- A service that mixes the coins of many users to hide the link between sender and recipient.
- mixer
- Administered address
- An address to which access is provided by a digital depository; for deals through such addresses, an exchange and an exchange office do not carry out the analysis (Part 9 of Art. 35).
- custodial address
- Travel Rule
- The FATF rule on passing information about the sender and recipient between providers when cryptocurrency is transferred. It relates to transaction monitoring, not to address checking.
- Travel Rule
Read also
375 25
KYC, AML and Digital Identification
AML checks and KYC: how modern financial compliance and sanctions screening systems work
163 16
KYC, AML and Digital Identification
KYT (Know Your Transaction): What It Is, How Transaction Monitoring Works, and Where the Travel Rule Fits In
143 28
KYC, AML and Digital Identification
Financial Monitoring and AML/CFT in Simple Terms: What It Is, Who It Applies To, and How It Works
364 22
KYC, AML and Digital Identification
AML and Sanctions Compliance: How to Build Customer Verification Without Losing Onboarding Speed
Frequently asked questions about AML checks of crypto wallets
It is a check of the history of a wallet address: where the coins came from and whether the address is linked to sanctioned addresses, mixers, the darknet, fraud or stolen funds. The result is a risk score, labels and shares of funds by category. It differs from an AML check of a customer in its object: there a person is checked, here — money. A general overview of AML — in the blog article.
Yes. An organisation that exchanges digital currencies is among the persons organising the circulation of digital currencies and must ensure digital analysis of addresses under Art. 35 of Federal Law No. 282‑FZ — if the deal is not executed through addresses administered by a digital depository. The law treats as an exchange office an organisation that makes two or more deals a month for more than 3.5 million ₽ (Part 2 of Art. 18).
Federal Law No. 282‑FZ and Article 35 on digital analysis have applied since 1 September 2026. The requirement to make deals only through authorised persons — from 1 July 2027; checking that the address belongs to the customer and delaying large transfers by 48 hours (Art. 45) — from 1 September 2027 (Art. 56).
The law permits engaging a digital analysis service provider included in the register of the authorised body (Part 11 of Art. 35). Responsibility for the analysis remains with your organisation (Part 12), and you approve the digital analysis rules yourself. NeuroVision provides the result of the address and owner check and a report that fits into these rules.
KYC answers who the customer is: passport, face, data. An AML check of an address answers where their money comes from. A clean address may belong to a person on the terrorist list, while a customer with no issues may send funds from a mixer. That is why both checks run in one process — the owner is checked against lists, sanctions and the passport.
Act under its own digital analysis rules: do not proceed with the deal until it is reviewed, request the source of funds from the customer, and refuse in the case of a sanctioned address or a direct link with the darknet. If you are a subject of Federal Law No. 115‑FZ and the operation is recognised as suspicious, the information is sent to Rosfinmonitoring no later than three business days after it is identified. Save the decision and the check report.
Bitcoin, Ethereum and TRON, including USDT tokens of the ERC‑20 and TRC‑20 standards. The network is specified in the request: the same token on different networks has different addresses and different history. If you need another network, write to us — we will tell you the connection timeline.
For two reasons: new funds arrive at the address, and the database of labelled addresses is updated — an address unknown yesterday may today turn out to be the address of a fraud scheme. That is why the report is stored with the date of the check, and the check is repeated before large operations.
No. An address check assesses a specific address before a deal. Transaction monitoring (KYT) follows the flow of a customer's operations, and the Travel Rule is the FATF rule on passing information about the sender and recipient between providers. More — in the article on KYT and the Travel Rule and on the page KYT.
An address check is priced by volume and set of networks — leave a request and we will send a quotation. Owner checks are by the price matrix: 5 ₽ per Russian database check, 50 ₽ per package of basic checks, 36 ₽ per international screening with PEP.
Connect crypto address checking
Tell us which networks and volumes you need — we will open test access and send a quotation.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
