Risk Scoring

Every screening result includes a numeric score and a risk level. Here's how they're calculated.

The risk score and risk level are informational indicators derived from the data sources screened at the time of the query. They are not a legal determination, a certification, or a guarantee, and they do not direct you to take or refrain from any transaction. Any escalation step suggested for a given level (for example, in respect of HIGH or CRITICAL results) is a suggestion you may consider within your own compliance process; the decision is yours.

How scores are calculated

Each risk label has a fixed score (0–100). When an address matches multiple labels, the score is the maximum of all matched label scores — not a sum.

score = max(label_scores) if labels else 0

# Example: address matches "sanctions" (100) and "scam" (75)
score = max(100, 75)  # → 100

This means a single sanctions label always produces a score of 100, regardless of how many other labels are present. The intent: one serious signal overrides milder signals.

Score → level mapping

Level	Score range	Typical action
CLEAN_NO_MATCH	0	Address not found in any data source. Proceed normally.
MEDIUM	40–69	Enhanced due diligence. Manual review before proceeding.
HIGH	70–89	Block or suspend. Escalate to compliance team.
CRITICAL	90–100	Block immediately. File SAR if required by your jurisdiction.

These thresholds are defaults based on common compliance patterns. Your program may use stricter thresholds — e.g., treating MEDIUM as block-worthy. Use the numeric score field to implement custom thresholds.

Unknown and new labels

Occasionally a data source may introduce a label category not yet in the scoring table — for example, when a community list starts tagging a new type of activity. Rather than treating the address as clean (score 0), the API applies a safe fallback:

Fallback score	40
Fallback level	MEDIUM

Score 40 maps to MEDIUM — the address is flagged for review rather than silently cleared. An internal alert is also fired so the new label can be reviewed, scored correctly, and added to documentation.

If you receive a score of 40 with a label value you don't recognise, treat it conservatively — as you would any other MEDIUM result — until you can verify the source.

Explainability

The labels array tells you exactly why an address received its score. Each label includes:

Field	Meaning
label	Risk category (e.g., `sanctions`).
source	Data source ID (e.g., `OFAC_SDN`).
source_ref	Entity name from the source list (e.g., `TORNADO_CASH`). May be null for community labels.
added_at	When this label was first ingested, in ISO 8601.

Versioning

The current scoring algorithm is v1.0. The scoring_version field in every response records the version used for that specific query.

If the scoring algorithm is updated in a backward-incompatible way (e.g., label scores change, level thresholds shift), the version number will increment. Log scoring_version alongside results for auditability.