What is risk score 0–100% and how to read an AML report
A detailed breakdown: what risk score 0-100 means, the types of findings (sanctioned, mixer, scam, exchange), and how to interpret a VerifAML report for transaction decisions.
Risk score is a number from 0 to 100 indicating the risk level of a crypto address. 0 = clean, 100 = critical. But behind this number are specific findings, and understanding their structure is key to making the right decision.
The risk score scale
| Score | Category | Meaning | Action |
|---|---|---|---|
| 0 | Clean | Address not in any list | Proceed with the trade |
| 1-19 | Low risk | Light reputational flags | Usually safe |
| 20-49 | Medium risk | Connection to suspicious addresses | Think twice |
| 50-89 | High risk | Direct connection to mixer/scam | Decline |
| 90-100 | Critical | Address on a sanctions list | Cancel the trade |
Score = sum of "weights" of all findings. The first finding gives the base weight by severity (info=5, warning=25, danger=55, critical=90). Each subsequent finding adds 40% of the base. For mixer_exposure, a bonus based on percentage is added.
Finding types (FindingType)
Each finding in the report has a type explaining the nature of the risk:
sanctioned — sanctions
The address is on the OFAC SDN or EU consolidated sanctions list. This is the most serious type — severity is always critical, score ≥ 90.
Example: LAZARUS GROUP (DPRK) address in OFAC → score 90, Critical category.
mixer_exposure — mixer connection
The address directly or indirectly interacted with a crypto mixer (Tornado Cash, Blender). Severity warning (25) or danger (55), depending on the percentage of "dirty" funds.
scam — scam address
The address has been involved in fraud: phishing, honeypot, drainer, fake tokens. Sources: eth-labels (category=scam) and GoPlus (honeypot/blacklist). Coverage — EVM chains; no reliable bulk scam-address lists exist for BTC/TRON yet.
honeypot — honeypot contract
A smart contract from which you cannot withdraw funds (fraudulent token). Detected via GoPlus.
exchange — exchange
The address belongs to a centralized exchange (Binance, Coinbase, etc.). Severity info (5) — does not increase risk, this is a normal counterparty.
label — arbitrary label
The address has a label from eth-labels (DeFi protocol, NFT marketplace, etc.). Severity info.
Severity and its weights
Report examples
Example 1: clean address (score 0)
Address: 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 (Vitalik)
Chain: ETH
Risk score: 0 — Clean
Sources queried: OFAC, EU, GoPlus, eth-labels
Findings: none
Example 2: sanctioned address (score 90)
Address: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96
Chain: ETH
Risk score: 90 — Critical
Findings:
- source: OFAC
type: sanctioned
severity: critical
entity: LAZARUS GROUP
description: Address linked to OFAC-sanctioned entity
Example 3: exchange address (score 5)
Address: 0x...Binance hot wallet
Chain: ETH
Risk score: 5 — Low
Findings:
- source: eth_labels
type: exchange
severity: info
label: Binance 14
Interpreting multiple findings
If an address has multiple findings, they sum up. For example:
sanctioned(critical, 90) +mixer_exposure(warning, 25 × 0.4 = 10) = score 100
Several low-severity findings can give a medium score:
- 3 ×
label(info, 5 + 2 + 2) = score 9 — Low
Related materials
- Risk categories: Mixer/Darknet/Sanctioned — what each means
- How to check USDT on Tron before a P2P trade
- Why AML checkers disagree in their assessments
VerifAML is an informational service. Risk score is calculated from open data at the time of check and may change.