LogoLogo
English
  • Cregis Wallet Guide
  • Card Guide
  • Announcement
English
  • Welcome
    • Product Overview
    • Tokens and Protocols
  • Getting Started
    • Download and Installation
    • Registration and Login
  • Account Management
    • Team Space and Personal Space
    • Bill and Payment
      • Manage Your Pricing Plan
      • Paid Feature Activation
      • Manage Your Bills
      • Recharge Your Account
    • Security
    • General Setting
  • Team
    • Manage Your Team
    • Member
    • Permission
    • Team Activity
      • Initiate Send Request
      • Approval Process
      • Transaction Signing
  • Wallet and Transactions
    • Wallet
      • Create a Wallet
      • Wallet Member Management
      • Rename Your Wallet
      • Hide Your Wallet
      • Message Signature
    • Token
    • Address
    • Shard
    • Transaction
      • Transfer and Receive Payment
      • Transaction Speed Up and Cancellation
      • Transaction Resend
      • Transaction Dashboard
      • Address book
      • Tron Energy Mode
  • Risk Management
    • Policy Engine
    • Auto-Collection/Signing
    • AML Query
  • API
    • API Manual
      • Creation
      • Configuration
      • Query API access information
      • Create wallet address
      • Collection
      • Callback Query
      • Callback Setting
      • Notification Setting
      • Disable/ Delete an API Project
      • API Center for Developers
      • Integrating the TON Chain via API
    • API Type
  • Payment Engine
    • Introduction
    • Creation
    • Notification Setting
    • Settlement Setting
    • Payment and Settlement Records
  • Checkout Page
  • FAQ
    • Wallet Management
      • What is a Non-Custodial Wallet?
      • Why Can't I See the Team Wallet?
      • Why Does BTC Have Different Address Formats?
      • Can I Create Multiple Addresses Within a Single Wallet?
      • Why Does the Shard Not Support Adding Tokens?
      • Why Can't My Wallet Data Load?
      • Why Is My MATIC Missing?
      • Why Can’t the Member See the Shard Import Entrance When I Try to Authorize a Shard?
    • Transaction Management
      • Why Do Multi-Signature Wallets Require All Parties to Be Online Simultaneously?
      • Why Can't I See the Signature Option in My Team Activity?
      • Why Is My Transaction Status Stuck at "Pending"?
      • Which Policy Executes First if Priorities Are Equal?
      • Why Does It Display 'Please Import the fragment First' When Sending a Transaction?
      • What Should I Do if My Wallet Receives Blacklisted USDT (Black U)?
      • Why Do Some Addresses Require Activation Fees?
      • Can Auto-Signing Continue When Cregis Is Closed?
      • What Are the Differences Between Advanced Mode and Standard Mode for Gas Fee Settings?
      • What is Tron Energy Mode?
      • Can I use the team account balance to pay for the gas fee?
      • Can I Authorize My Employees to Sign?
    • API Management
      • Can I Edit the Type After an API Project Is Created?
      • Why Can't I Find the Option to Create an Order Collection Project?
      • Will the System Stop Immediately After API Address Limits Are Reached?
      • Is It Possible to Initiate Withdrawal Requests Directly via API?
      • What Should I Do When an Abnormal Callback Occurs?
      • Why Does the API Return Unsupported Token When Integrating TON?
      • What should I do if users transfer funds to a stopped project's address?
      • What Should I Do if My Team Version Expires and API address Funds Cannot Be Collected?
      • Is There a Limit on the Number of Transactions Per Collection?
    • Team Account Management
      • Why Can’t My Team Account Be Upgraded?
      • How to Handle Shards When a Member Leaves the Team?
      • How to Disband a Team?
      • How to Invite Team Members?
      • Why Can't I Perform Actions After Editing Permissions?
      • How to Set Up an Approval Process?
      • Will My Team Stop Functioning If I Don’t Renew the Subscription After It Expires?
    • Account Security
      • What is MPC?
      • Is There a Risk of MPC Shards Being Stolen?
      • Where Are My Assets Stored When Using Cregis?
      • What is a TEE Environment?
      • How to Safely Handle a Lost Recovery Phrase?
      • How to Safely Handle Lost or Damaged Devices?
      • How to Enable and Disable Address Book Verification?
      • What is a Policy Engine?
      • What Should I Do If I Forget My Transaction Password?
    • Others
      • How Can I Reimport My Cregis Wallet?
      • Does Cregis Offer a Testing Environment?
      • How Long Does KYB/KYC Approval Take?
      • How to Troubleshoot Issues When Installing the Cregis Application?
      • Why Can’t I Access My Testing Environment?
      • How Can I Check My Cregis Version?
  • Terms and Conditions
    • Terms of Service
    • Personal Information Collection Statement
  • Cregis Support
    • Contact Us
Powered by GitBook
On this page
  • What is AML Query?
  • Feature Description
  • Manual Query
  • Auto Query
  • Use Case
  • Limitation of AML Feature
  • FAQ
  • Appendix

Was this helpful?

Export as PDF
  1. Risk Management

AML Query

What is AML Query?

Cregis AML is a risk management feature that helps users to identify, control and mitigate on-chain risks and is implemented through integration with Elliptic, a renowned crypto risk control service provider. Cregis AML supports Know Your Address (KYA) and Know Your Transaction (KYT) analyses and allows users to run manual queries and auto queries. Users may choose suitable features and methods based on their business requirements and manage on-chain transaction risks in a more efficient way.

  • Cregis AML is only available to subscribed users. Please subscribe to a paid plan to utilize these features.

  • Cregis AML charges an additional fee for each query beyond the monthly subscription fee. Please make sure to have sufficient team balance.

Feature Description

Cregis AML provides two features, manual query and auto query, to meet users' needs under different scenarios.

Manual Query

Manual query enables users to conduct Know Your Address (KYA) analyses. When users initiate an AML query for a wallet address, and Cregis AML will identify the entity linked to the targeted address, analyze its transaction history, conduct a comprehensive assessment of its risk profile, and generate a risk score for the target address along with query details. Users can take appropriate risk control actions based on query results.

To initiate a manual query, users need to input the wallet address to be evaluated. Cregis AML will conduct a holistic screen on the source and destination of its fund, trace fund inflows and outflows across unlimited hops, identify risky entities linked to the fund flows and analyze their risk categories and characteristics. Source and destination risk exposure are estimated based on these analyses, and risk scores for source and destination of funds are calculated accordingly. The final risk score for the address is determined following the highest risk principle.

The results of manual query include a risk score and query details of fund source and fund destination.

  1. Risk Score

The risk score of an address ranges from 0.0 to 10.0, and a higher score indicates a higher risk level. A risk score of 0 means that the relative risk is minimal, while a risk score of 10.0 signals an extremely high risk. The ranges, risk levels and mitigation recommendations are as follows:

[0,2.5]

Low/Safe

Clear for normal transactions

[2.5,7.5]

Medium/Suspicious

Be prudent when transacting with address. Implement other methods to verify security.

[7.5,10.0]

High/Dangerous

Transaction with the address is NOT suggested.

  1. Query Details

Query details include information for fund source and destination. Cregis AML provides risk scores and risk-linked entities for both source and destination. Users can further review the risk category, contribution value, and contribution percentage of each risk-linked entity.

  • Source/Destination Risk Score Source/Destination risk scores are also assigned on a scale of 0.0-10.0. Higher risk scores indicate larger risks. The overall risk score of an address equals the higher value of source and destination risk scores.

  • Risk-linked Entity From the perspective of source risks, a risk-linked entity is an entity labelled as risky by Cregis AML that has sent funds to the address of interest. From the perspective of destination risks, a risk-linked entity is an entity labelled as risky by Cregis AML that has received funds from the address of interest. A risk-lined entity is usually an enterprise, an organization or a group. An entity that cannot be identified is shown as Unknown. Users can also review the details of risk-lined entities, including:

    • Risk Category The risk category is the type of risk an entity is linked to, such as Scam, Thief, Dark Service, etc. Cregis AML utilizes the address label database of our partner to determine the risk category of an entity. A summary of risk categories and descriptions can be found in the appendix.

    • Contribution Value From the perspective of source risks, contribution value refers to the amount of fund inflows from a risk-linked entity to the address of interest, priced in the US dollar. From the perspective of destination risks, contribution value refers to the amount of fund outflows from the address of interest to a risk-linked entity, priced in the US dollar.

    • Contribution Percentage The contribution percentage is the incoming/outgoing funds of a risk-linked entity as a proportion to the total incoming/outgoing funds, in percentage terms.

  1. User Manual

Before using the AML Query, please ensure you are a subscribe users.

Select the network and enter the address you want to check.

After clicking "Check", there will be a friendly reminder

Then you will need to finish the authentication.

After finished the authentication, you can view the result of the query.

You may also check the details in record page including source risk score and destination risk score.

Auto Query

With auto query, Cregis AML helps users screen their API incoming transactions based on predefined rules, conduct risk analyses for transactions they care about most, and apply risk controls according to query results. Users need to create and manage their rules on the desktop application, while query results can be seen on both desktop applications and mobile applications.To start auto query, users have to create query rule(s):

  • Set up triggered rules which specify projects, tokens and amounts for transaction monitoring. Users may create multiple rules, but can only create one rule for each project. Within each rule, different trigger amounts can be set for different tokens.

  • Define a specific risk control threshold based on business needs and risk preferences. Pick a number between 0 and 10.0 as the threshold, and Cregis AML will flag a transaction as dangerous when its risk score is higher than the threshold.

  • Pick one or more risk alert recipient. Cregis AML will send risk alerts to assigned recipient(s) when it identifies a dangerous transaction.

After completing rule configuration and enabling the rules, Cregis AML will perform transaction risk assessments (KYT) on all incoming transactions that trigger the rules. Upon completion of the assessment, Cregis AML will determine whether the transaction is high-risk based on the risk criteria defined in the triggered rules. If a receiving address/project is blocked, Cregis AML will cease screening any transactions associated with that address/project until it is manually unblocked.

When a high-risk transaction is identified, Cregis AML will disable the receiving address, suspend API callbacks and fund aggregation for that address, and send risk alerts to the designated alert recipients. After receiving the risk alert, users can review the query details to understand the source of the transaction risk. If the risk is determined to be within acceptable limits, users may manually restore API callbacks and unblock the address.

For transactions that trigger automated queries, Cregis AML will provide users with two types of information: risk scores and query details.

  1. Risk Score

The risk score ranges from 0.0 to 10.0. The risk score is directly correlated with the contribution ratio of risky funds in the source of funds for the outgoing address. The higher the contribution ratio of risky funds, the higher the risk score. The approximate correspondence between the two is shown in the following table:

Risk Score

0.0

1.0

2.5

5.0

7.5

10.0

Contribution Ratio of Risky Funds

<1%

10%

25%

50%

75%

>99%

  1. Query Detail

Query details show risk-linked entities of the sending address of the target transaction, i.e., risky entities which have sent funds to the sending address. Users can review the risk category, contribution value and contribution percentage of each risk-linked entity.

  • Risk Category The risk category is the type of risk an entity is linked to, such as Scam, Thief, Dark Service, etc. Cregis AML utilizes the address label database of our partner to determine the risk category of an entity. A summary of risk categories and descriptions can be found in the appendix.

  • Contribution Value The contribution value is the amount of fund inflows to the sending address from a risk-linked entity, priced in the US dollar.

  • Contribution Percentage The contribution percentage is the proportion of funds received from a risk-linked entity to total funds received in percentage terms.

  1. User Manual of setting up automatic AML queries

First, navigate to the following page and click "Create."

After clicking, you can begin creating a rule

  • Rule Name: Name your rule

  • API Project: Select the project whose transactions you want to monitor. Please note that only one rule can be applied to a project.

  • Token: Choose the cryptocurrency and set the minimum amount that will trigger an automatic AML query

  • Risk Classification Criteria: Can be set between 0.0 (Safe) - 10.0 (Extremely Risky). When a transaction's risk score exceeds your set threshold, it will be flagged as a risky transaction, triggering alert notifications and automatically disabling the project address.

  • Alert Recipients: Designate team members to receive risk alerts

After completing the settings, click "Submit" and complete identity verification to finalize the creation process. The rule must be enabled after successful creation before it becomes active.

All rule activities (creation, editing, enabling, and deletion) are logged and can be viewed in the log page.

Use Case

Pre-transaction Risk Control

Pre-transaction risk control aims to identify, assess and control risks before making a transaction to avoid abnormal transactions caused by operational errors or malicious behaviors and prevent major financial losses. Users may conduct manual queries on receiving addresses before important transactions are made and learn about risk exposure. The risk exposure of a receiving address can be used as a preliminary risk indicator for the risk profile of the receiving address.If the risk score of a receiving address is high, it is strongly recommended that users do not transact with it to avoid risks of financial loss as well as operational, legal and regulatory risks. If the risk score falls in the medium risk range, it is suggested that users should double check the entity of recipient and the security of receiving address by other means, and proceed with the transaction after the address is verified as safe.

Transaction Monitoring

Transaction monitoring employs automated technologies to screen and monitor transactions at low latency, identify potential risks and suspicious behaviors, and ensure transaction compliance and asset security. An inflow of risky assets may increase the risk exposure of the receiving address, which is a common risk factor in crypto transactions. For users with a high frequency of payment collections and uncertain sources of funds, the auto query feature enables real-time monitoring of incoming transactions. Cregis AML helps to identify potential risks and isolate respective receiving addresses, thus preventing greater losses caused by a spread of risk.When a transaction is labelled as dangerous, Cregis recommends that users check and learn about the risk level of the transaction in a timely manner. In most cases, users are advised not to use the receiving address to avoid a spread of risk to other addresses. If the risk is assessed as acceptable, users may manually enable the receiving address.

Limitation of AML Feature

Cregis AML is NOT able to cover all risk factors. Cregis AML tracks and identifies risks based on the risk database provided by crypto risk management service providers such as Elliptic. The database covers 50 networks and includes over 6.4 billion addresses, transaction records and relative risk information. However, due to the limited scope of the database and the lag of data updates, it is not possible for Cregis AML to record and label every risky address and suspicious fund flows, and thus not all risk factors are identified. Users should use the query results as a reference to risk identification and management, rather than a sole piece of definitive evidence.

The results provided by Cregis AML are time-sensitive. Cregis AML adopts a risk assessment model based on historical behaviors. Risk is identified if and only if the address involved in the fund flow has a history of suspicious activities and has been marked accordingly. If the risky activities of an address are not detected or an activity happens after the query is completed, these risks cannot be captured in the query result. Therefore, query results provided by Cregis AML are a holistic evaluation of the known risky activities associated with the query target when the query is made. The results may not be used to predict future risk profiles. When users initiate queries at different times, the results may be different.

FAQ

  • Why did my query fail? What should I do when it fails? A query failure is usually caused by insufficient team balance or an error in the third party server. If it's caused by insufficient team balance, you can top up and conduct a manual query to learn about the risk level of the address of interest.

  • Is there a charge for a failed query? No. Failed queries will not be charged.

  • Why is my manual query results page showing no risk score or query details? This indicates that there is no record of any risky activities of the target address in the risk database. The target address might just be created and has no transaction records, and it's also possible that there are no records of fund interactions between the target address and flagged addresses in the database. Cregis AML labels such addresses as safe based on their historical records. However, users need to consider other risks such as scams and phishing attacks.

  • Why is my auto query results page showing no results? Reasons for empty results include: 1) information about this transaction has not been included in the database; 2) our database does not contain any risk information related to the source of funds for the queried transaction. In the second case, the transaction can usually be viewed as a safe one, but it is not possible to rule out all potential risks.

  • Why are there details for risk-linked entities while the risk score is 0.0? It means that the total amount of funds associated with all risk-linked entities accounts for less than 1% of total funds of the target address. Since the proportion of risky funds is very low, the risk score is determined to be 0.0.

  • Why is the contribution value of a risk-linked entity shown as 0.00 while the contribution percentage is positive? It happens when the inflow/outflow of funds of this entity is less than USD 0.01 and the total fund amount of the target address is less than USD 100. The proportion of risky funds to total funds exceeds 0.01%, and thus the contribution percentage is positive.

Appendix

Risk Category

Description

Example

Criminal Organisation

A group of individuals engaged in organized crime

The Shadow Brokers

Coin Swap Service

Coin swap service with fixed exchange rate, which usually doesn't require login or KYC

Credit Card Data Vendor

Online card vendor that provides illegal credentials and other illegal personal financial information

JokerStash.store

Dark Forum

TOR-only online forum

DNM Avengers

Child Sexual Abuse Material Vendor

Vendor that provides child sexual abuse materials in exchange for crypto assets

Dark Market-Centralized

TOR-only market that sells illegal goods and services via centralized infrastructure

Dream Market

Dark Market-Decentralized

TOR-only market that sells illegal goods and services via decentralized infrastructure

Wall Street Market

Dark Service

Illegal service, including hackers, wallets and web hosting services

PinPays

Dark Vendor Shop

TOR-only individual vendor in the dark market that sells illegal goods and services

Euroarms

Extortion

Entity obtaining funds from individuals or groups by means of force or threat

Ashley Madison Extortion

Far-Left/Far-Right Extremism

Entity which, (a) convicted of crimes directly related to far-left/ far-right extremist activities, or (b) identified and verified by multiple legal sources (with evidence) that has long been inciting violence, sexual abuse or other major crimes like far-left/ far-right extremist speech

High Transaction Fee

Entity involved in above-average transaction fees related to miners, which could be signs of losses or crimes

Known Criminal

Individual known to be engaged in illegal activities. Usually associated with criminal organizations.

Ross Ulbricht and Carl Mark Force

Malware

Software aiming to impair or disable computers and computer systems

Trickbot

OFAC Sanctioned Entity

Entity sanctioned by the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury

Phishing

A fraudulent activity in which the message sender attempts to deceive the recipient into leaking important personal information, transferring funds or installing malwares. The message sender usually impersonates a representative of a legal organization

TRON Web Wallet Phishing

Ponzi Scheme

A fraudulent activity in which original investors get rapidly paid off by funds from later investors so as to cultivate a belief in the success of a company that doesn't exist

Ransomware

Cryptovirology-based malware that threatens to publish victims' data or terminate access to the data unless a ransom is paid

WannaCry 2.0

Scam

Any other type of fraudulent activities

Prodeum

Terrorist Organization

Organization involved in terrorism or related activities

ISIS

Thief

Recipient of stolen funds

Stolen CoinSecure Funds

PreviousAuto-Collection/SigningNextAPI Manual

Last updated 18 days ago

Was this helpful?

Navigate to the AML Query Page and click "New Query", or click the icon next to address on the transaction detail page.