What AML screening is and why clean addresses get flagged

Every regulated exchange runs your deposits and withdrawals through AML screening before it decides whether to let funds move. Understanding this machine, at least at the level it acts on you, is the difference between panic and a plan when your withdrawal suddenly pauses.

Risk score, not guilt

Screening does not ask whether you are a criminal. It produces a risk score: a number that estimates how exposed an address is to known bad activity. A high score does not mean you did anything wrong. It means the engine sees a connection it is required to treat cautiously. The exchange then decides what to do with that score, which can be nothing, a request for documents, or a freeze.

Hops and exposure

The core idea is exposure through hops. A hop is one transaction step away from your address. If your coins arrived directly from a sanctioned wallet, that is one hop and very direct exposure. If they came from an address that received from a mixer several steps back, that is indirect exposure, weaker but still counted. Screening engines trace outward a limited number of hops and categorize what they find into buckets: sanctioned, scam, stolen, gambling, exchange, unknown. Your score is largely a function of how much of your fund's history touches the bad buckets.

Why a clean wallet still gets flagged

This is the part that surprises honest users. You never touched anything illegal, yet your withdrawal is held. Common reasons:

• Someone paid you with tainted funds. A P2P buyer, a client, a refund, the taint travels to you through the deposit, not through your intent.
• Proximity, not participation. Your funds passed through an address that also handled dirty money for unrelated people. The engine sees the shared address, not the separation.
• Pattern, not source. Behavior alone, a large sudden withdrawal, a new device, a new country, can raise your profile even when every coin is clean.

The lesson is not to be afraid of screening. It is to know that a flag is a starting point for a conversation, not a verdict, and that you can check your own exposure before you deposit. Screen an address to see what an engine would see. The next lessons break down the specific triggers and signals.