AML checks in a crypto exchange: what to check and what to do with risky orders

A client sends 2,000 USDT, the exchange pays out hryvnias, and the coins go on to the exchange where you keep your liquidity. A week later that exchange freezes your account: a few transfers back, part of those USDT passed through a wallet linked to a hack. The client's money has long since reached their card, and you're the one left to sort it out.

An AML check is how you see this before the payout instead of after it.

What gets checked

An AML provider analyses an address or a transaction on the blockchain and shows where the funds came from. The result usually has two parts:

• a risk score, often as a percentage;
• sources: what share of the funds is linked to exchanges, mixers, scams, darknet markets, sanctioned addresses or stolen funds.

Don't confuse AML with KYC. KYC checks the person: documents, a selfie, whether the details match. AML checks the money: the history of the funds that arrived at your address. A verified client can send tainted coins without knowing it.

When to check

The check that matters happens once the payment has arrived and before the payout. Screening the client's address when the order is created is a useful quick filter, but the decision is made on the actual transaction, because those are the funds you'll end up holding.

In directions where you pay out in crypto, it also makes sense to check the recipient's address: sending to a sanctioned address can get your exchange account in trouble too.

How to read a risk score

A single number says little without the sources behind it. 15% of funds that passed through a large exchange and 2% from a sanctioned address are very different cases. So set your thresholds along two lines:

• low risk: the order goes on automatically;
• medium risk: the order waits for an operator;
• critical sources (sanctions, stolen funds, darknet): manual review whatever the percentage.

The exact numbers depend on your provider and on what the exchanges you work with will accept. Ask your exchange which thresholds it considers acceptable and set yours slightly stricter.

What to do with a risky order

A risky order doesn't mean a fraudster. Most often the client simply received the coins from another exchange or from someone they didn't vet. So the order isn't rejected automatically: the payout stops and the order goes to an operator. Depending on your rules, they can then:

• ask the client to explain where the funds came from;
• request verification if the client hasn't passed it yet;
• return the funds or hold them while the review lasts.

Decide in advance what happens to the funds, and agree it with a lawyer: the requirements depend on the country your exchange operates in. Meanwhile the client should see an "under review" status rather than silence, or they'll write to support or leave a complaint on a monitor.

Exchange rules

Describe the AML check in your exchange rules: what you check, when an order is stopped, how long a review takes and on what terms funds are returned. When a dispute comes up, the rules the client accepted when creating the order are your main argument.

A log of decisions

Record every decision on a risky order: the provider's score, which operator reviewed it, what they decided and why. If an exchange or a bank ever asks about a specific transaction, the answer takes minutes, not days.

What it costs

Providers charge for every check. At hundreds of orders a day that's a noticeable cost, so build it into your markup, just like payment system fees.

---

In Obminly the AML provider is connected to your own account, incoming addresses are checked automatically, and risky orders go to an operator for manual review together with the risk score. How this fits into an order's path is covered in our post on automatic payouts.