AML Query
What is AML Query?
Cregis AML is a risk management feature that helps users to identify, control and mitigate on-chain risks and is implemented through integration with Elliptic, a renowned crypto risk control service provider. Cregis AML supports Know Your Address (KYA) and Know Your Transaction (KYT) analyses and allows users to run manual queries and auto queries. Users may choose suitable features and methods based on their business requirements and manage on-chain transaction risks in a more efficient way.
Cregis AML is only available to subscribed users. Please subscribe to a paid plan to utilize these features.
Cregis AML charges an additional fee for each query beyond the monthly subscription fee. Please make sure to have sufficient team balance.
Feature Description
Cregis AML provides two features, manual query and auto query, to meet users' needs under different scenarios.
Manual Query
Manual query enables users to conduct Know Your Address (KYA) analyses. When users initiate an AML query for a wallet address, and Cregis AML will identify the entity linked to the targeted address, analyze its transaction history, conduct a comprehensive assessment of its risk profile, and generate a risk score for the target address along with query details. Users can take appropriate risk control actions based on query results.
To initiate a manual query, users need to input the wallet address to be evaluated. Cregis AML will conduct a holistic screen on the source and destination of its fund, trace fund inflows and outflows across unlimited hops, identify risky entities linked to the fund flows and analyze their risk categories and characteristics. Source and destination risk exposure are estimated based on these analyses, and risk scores for source and destination of funds are calculated accordingly. The final risk score for the address is determined following the highest risk principle.
The results of manual query include a risk score and query details of fund source and fund destination.
Risk Score
The risk score of an address ranges from 0.0 to 10.0, and a higher score indicates a higher risk level. A risk score of 0 means that the relative risk is minimal, while a risk score of 10.0 signals an extremely high risk. The ranges, risk levels and mitigation recommendations are as follows:
[0,2.5]
Low/Safe
Clear for normal transactions
[2.5,7.5]
Medium/Suspicious
Be prudent when transacting with address. Implement other methods to verify security.
[7.5,10.0]
High/Dangerous
Transaction with the address is NOT suggested.
Query Details
Query details include information for fund source and destination. Cregis AML provides risk scores and risk-linked entities for both source and destination. Users can further review the risk category, contribution value, and contribution percentage of each risk-linked entity.
Source/Destination Risk Score Source/Destination risk scores are also assigned on a scale of 0.0-10.0. Higher risk scores indicate larger risks. The overall risk score of an address equals the higher value of source and destination risk scores.
Risk-linked Entity From the perspective of source risks, a risk-linked entity is an entity labelled as risky by Cregis AML that has sent funds to the address of interest. From the perspective of destination risks, a risk-linked entity is an entity labelled as risky by Cregis AML that has received funds from the address of interest. A risk-lined entity is usually an enterprise, an organization or a group. An entity that cannot be identified is shown as Unknown. Users can also review the details of risk-lined entities, including:
Risk Category The risk category is the type of risk an entity is linked to, such as Scam, Thief, Dark Service, etc. Cregis AML utilizes the address label database of our partner to determine the risk category of an entity. A summary of risk categories and descriptions can be found in the appendix.
Contribution Value From the perspective of source risks, contribution value refers to the amount of fund inflows from a risk-linked entity to the address of interest, priced in the US dollar. From the perspective of destination risks, contribution value refers to the amount of fund outflows from the address of interest to a risk-linked entity, priced in the US dollar.
Contribution Percentage The contribution percentage is the incoming/outgoing funds of a risk-linked entity as a proportion to the total incoming/outgoing funds, in percentage terms.
User Manual
Before using the AML Query, please ensure you are a subscribe users.
Select the network and enter the address you want to check.
After clicking "Check", there will be a friendly reminder
Then you will need to finish the authentication.
After finished the authentication, you can view the result of the query.
You may also check the details in record page including source risk score and destination risk score.
Auto Query
With auto query, Cregis AML helps users screen their API incoming transactions based on predefined rules, conduct risk analyses for transactions they care about most, and apply risk controls according to query results. Users need to create and manage their rules on the desktop application, while query results can be seen on both desktop applications and mobile applications.To start auto query, users have to create query rule(s):
Set up triggered rules which specify projects, tokens and amounts for transaction monitoring. Users may create multiple rules, but can only create one rule for each project. Within each rule, different trigger amounts can be set for different tokens.
Define a specific risk control threshold based on business needs and risk preferences. Pick a number between 0 and 10.0 as the threshold, and Cregis AML will flag a transaction as dangerous when its risk score is higher than the threshold.
Pick one or more risk alert recipient. Cregis AML will send risk alerts to assigned recipient(s) when it identifies a dangerous transaction.
After completing rule configuration and enabling the rules, Cregis AML will perform transaction risk assessments (KYT) on all incoming transactions that trigger the rules. Upon completion of the assessment, Cregis AML will determine whether the transaction is high-risk based on the risk criteria defined in the triggered rules. If a receiving address/project is blocked, Cregis AML will cease screening any transactions associated with that address/project until it is manually unblocked.
When a high-risk transaction is identified, Cregis AML will disable the receiving address, suspend API callbacks and fund aggregation for that address, and send risk alerts to the designated alert recipients. After receiving the risk alert, users can review the query details to understand the source of the transaction risk. If the risk is determined to be within acceptable limits, users may manually restore API callbacks and unblock the address.
For transactions that trigger automated queries, Cregis AML will provide users with two types of information: risk scores and query details.
Risk Score
The risk score ranges from 0.0 to 10.0. The risk score is directly correlated with the contribution ratio of risky funds in the source of funds for the outgoing address. The higher the contribution ratio of risky funds, the higher the risk score. The approximate correspondence between the two is shown in the following table:
Risk Score
0.0
1.0
2.5
5.0
7.5
10.0
Contribution Ratio of Risky Funds
＜1%
10%
25%
50%
75%
＞99%
Query Detail
Query details show risk-linked entities of the sending address of the target transaction, i.e., risky entities which have sent funds to the sending address. Users can review the risk category, contribution value and contribution percentage of each risk-linked entity.
Risk Category The risk category is the type of risk an entity is linked to, such as Scam, Thief, Dark Service, etc. Cregis AML utilizes the address label database of our partner to determine the risk category of an entity. A summary of risk categories and descriptions can be found in the appendix.
Contribution Value The contribution value is the amount of fund inflows to the sending address from a risk-linked entity, priced in the US dollar.
Contribution Percentage The contribution percentage is the proportion of funds received from a risk-linked entity to total funds received in percentage terms.
User Manual of setting up automatic AML queries
First, navigate to the following page and click "Create."
After clicking, you can begin creating a rule
Rule Name: Name your rule
API Project: Select the project whose transactions you want to monitor. Please note that only one rule can be applied to a project.
Token: Choose the cryptocurrency and set the minimum amount that will trigger an automatic AML query
Risk Classification Criteria: Can be set between 0.0 (Safe) - 10.0 (Extremely Risky). When a transaction's risk score exceeds your set threshold, it will be flagged as a risky transaction, triggering alert notifications and automatically disabling the project address.
Alert Recipients: Designate team members to receive risk alerts
After completing the settings, click "Submit" and complete identity verification to finalize the creation process. The rule must be enabled after successful creation before it becomes active.
All rule activities (creation, editing, enabling, and deletion) are logged and can be viewed in the log page.
Use Case
Pre-transaction Risk Control
Pre-transaction risk control aims to identify, assess and control risks before making a transaction to avoid abnormal transactions caused by operational errors or malicious behaviors and prevent major financial losses. Users may conduct manual queries on receiving addresses before important transactions are made and learn about risk exposure. The risk exposure of a receiving address can be used as a preliminary risk indicator for the risk profile of the receiving address.If the risk score of a receiving address is high, it is strongly recommended that users do not transact with it to avoid risks of financial loss as well as operational, legal and regulatory risks. If the risk score falls in the medium risk range, it is suggested that users should double check the entity of recipient and the security of receiving address by other means, and proceed with the transaction after the address is verified as safe.
Transaction Monitoring
Transaction monitoring employs automated technologies to screen and monitor transactions at low latency, identify potential risks and suspicious behaviors, and ensure transaction compliance and asset security. An inflow of risky assets may increase the risk exposure of the receiving address, which is a common risk factor in crypto transactions. For users with a high frequency of payment collections and uncertain sources of funds, the auto query feature enables real-time monitoring of incoming transactions. Cregis AML helps to identify potential risks and isolate respective receiving addresses, thus preventing greater losses caused by a spread of risk.When a transaction is labelled as dangerous, Cregis recommends that users check and learn about the risk level of the transaction in a timely manner. In most cases, users are advised not to use the receiving address to avoid a spread of risk to other addresses. If the risk is assessed as acceptable, users may manually enable the receiving address.
Limitation of AML Feature
Cregis AML is NOT able to cover all risk factors. Cregis AML tracks and identifies risks based on the risk database provided by crypto risk management service providers such as Elliptic. The database covers 50 networks and includes over 6.4 billion addresses, transaction records and relative risk information. However, due to the limited scope of the database and the lag of data updates, it is not possible for Cregis AML to record and label every risky address and suspicious fund flows, and thus not all risk factors are identified. Users should use the query results as a reference to risk identification and management, rather than a sole piece of definitive evidence.
The results provided by Cregis AML are time-sensitive. Cregis AML adopts a risk assessment model based on historical behaviors. Risk is identified if and only if the address involved in the fund flow has a history of suspicious activities and has been marked accordingly. If the risky activities of an address are not detected or an activity happens after the query is completed, these risks cannot be captured in the query result. Therefore, query results provided by Cregis AML are a holistic evaluation of the known risky activities associated with the query target when the query is made. The results may not be used to predict future risk profiles. When users initiate queries at different times, the results may be different.
FAQ
Why did my query fail? What should I do when it fails? A query failure is usually caused by insufficient team balance or an error in the third party server. If it's caused by insufficient team balance, you can top up and conduct a manual query to learn about the risk level of the address of interest.
Is there a charge for a failed query? No. Failed queries will not be charged.
Why is my manual query results page showing no risk score or query details? This indicates that there is no record of any risky activities of the target address in the risk database. The target address might just be created and has no transaction records, and it's also possible that there are no records of fund interactions between the target address and flagged addresses in the database. Cregis AML labels such addresses as safe based on their historical records. However, users need to consider other risks such as scams and phishing attacks.
Why is my auto query results page showing no results? Reasons for empty results include: 1) information about this transaction has not been included in the database; 2) our database does not contain any risk information related to the source of funds for the queried transaction. In the second case, the transaction can usually be viewed as a safe one, but it is not possible to rule out all potential risks.
Why are there details for risk-linked entities while the risk score is 0.0? It means that the total amount of funds associated with all risk-linked entities accounts for less than 1% of total funds of the target address. Since the proportion of risky funds is very low, the risk score is determined to be 0.0.
Why is the contribution value of a risk-linked entity shown as 0.00 while the contribution percentage is positive? It happens when the inflow/outflow of funds of this entity is less than USD 0.01 and the total fund amount of the target address is less than USD 100. The proportion of risky funds to total funds exceeds 0.01%, and thus the contribution percentage is positive.
Appendix
Risk Category
Description
Example
Criminal Organisation
A group of individuals engaged in organized crime
The Shadow Brokers
Coin Swap Service
Coin swap service with fixed exchange rate, which usually doesn't require login or KYC
Credit Card Data Vendor
Online card vendor that provides illegal credentials and other illegal personal financial information
JokerStash.store
Dark Forum
TOR-only online forum
DNM Avengers
Child Sexual Abuse Material Vendor
Vendor that provides child sexual abuse materials in exchange for crypto assets
Dark Market-Centralized
TOR-only market that sells illegal goods and services via centralized infrastructure
Dream Market
Dark Market-Decentralized
TOR-only market that sells illegal goods and services via decentralized infrastructure
Wall Street Market
Dark Service
Illegal service, including hackers, wallets and web hosting services
PinPays
Dark Vendor Shop
TOR-only individual vendor in the dark market that sells illegal goods and services
Euroarms
Extortion
Entity obtaining funds from individuals or groups by means of force or threat
Ashley Madison Extortion
Far-Left/Far-Right Extremism
Entity which, (a) convicted of crimes directly related to far-left/ far-right extremist activities, or (b) identified and verified by multiple legal sources (with evidence) that has long been inciting violence, sexual abuse or other major crimes like far-left/ far-right extremist speech
High Transaction Fee
Entity involved in above-average transaction fees related to miners, which could be signs of losses or crimes
Known Criminal
Individual known to be engaged in illegal activities. Usually associated with criminal organizations.
Ross Ulbricht and Carl Mark Force
Malware
Software aiming to impair or disable computers and computer systems
Trickbot
OFAC Sanctioned Entity
Entity sanctioned by the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury
Phishing
A fraudulent activity in which the message sender attempts to deceive the recipient into leaking important personal information, transferring funds or installing malwares. The message sender usually impersonates a representative of a legal organization
TRON Web Wallet Phishing
Ponzi Scheme
A fraudulent activity in which original investors get rapidly paid off by funds from later investors so as to cultivate a belief in the success of a company that doesn't exist
Ransomware
Cryptovirology-based malware that threatens to publish victims' data or terminate access to the data unless a ransom is paid
WannaCry 2.0
Scam
Any other type of fraudulent activities
Prodeum
Terrorist Organization
Organization involved in terrorism or related activities
ISIS
Thief
Recipient of stolen funds
Stolen CoinSecure Funds
Last updated
Was this helpful?
