False Positive AML Risk: How to Resolve a Disputed Flag

The problem usually starts with a "high risk" message or a request for documents. A high score may be due to an indirect link, old tagging, or clustering — you need to find the specific cause. But the number alone without context explains little.

Key thing to know right away: A risk score is an assessment by a specific service on a specific date, not a legal "verdict" on an address or token. To resolve it, you need the source of the flag, the depth of the link, and the context of the transaction.

Where risk comes from

A disputed flag may arise from outdated attribution, a deep indirect link, or clustering specifics. You need to analyze the basis of the risk, not try to prove "cleanliness" with a screenshot from another service.

A high score may be due to an indirect link, old tagging, or clustering — you need to find the specific cause. In a disputed situation, it helps to go from the overall risk percentage down to specific transactions and categories, and then compare them with documents and the economic meaning of the operation.

How to analyze the result

1. Look not only at the final score but also at risk categories and specific links.
2. Save the AML report with the date, network, and exact address.
3. Compare the result with transaction documents and an explanation of the source of funds.
4. For a disputed flag, trace the transaction route to the actual source of risk.
5. If a service requests documents, respond in a structured way: operation → counterparty → source of funds → supporting materials.

What to save

For an initial analysis, prepare the data in one message or file — this reduces the risk of losing an important detail:

• exact address
• network
• original AML report
• tx hash of the disputed operation
• documents or transaction context

Mistakes that hinder resolution

• Don't treat a single percentage as absolute truth.
• Don't compare scores from different services without understanding their methodology.
• Don't confuse AML risk with the established legal status of funds.

Important: An AML assessment is an analytical signal, not automatic proof of illicit origin of funds.

When a single AML check is not enough

If a service has restricted operations, a bank has requested documents, or different AML providers give contradictory results, it is useful to analyze the specific chain and the source of the flag. This allows you to explain the situation with facts rather than arguing only about percentages.

Frequently asked questions

Can a high risk score be considered proof of a violation?

No. It is an analytical assessment by a service. To draw a conclusion, you need to understand the specific source of risk and the context of the operation.

Why do two AML services give different results?

They may have different databases, clustering, categories, thresholds, and update dates.

Does low risk guarantee no problems?

No. It is an assessment of the data available to a specific service at the time of the check.

In short

A high score may be due to an indirect link, old tagging, or clustering — you need to find the specific cause. Analyze the specific source of risk and the context of the operation, not just the final percentage.