When to screen

• Before accepting a deposit — screen the sender's address (direction: "inbound"). Block or hold if the result is CRITICAL or sanctions_hit is true.
• Before sending a withdrawal — screen the destination address (direction: "outbound") so you never pay out to a sanctioned or high-risk wallet.
• At wallet onboarding — screen a wallet when a user first registers it, and keep the result on file.
• Periodic re-screening — re-screen high-value wallets on your own schedule; risk exposure changes over time.

Suggested disposition matrix

This is guidance, not a rule engine — you decide the action; the compliance responsibility is yours.

Scores measure exposure, not guilt. A heavily used, fully compliant exchange wallet can still show a high score because it has indirect exposure to risky funds somewhere in its history. Anchor decisions on sanctions_hit and on direct exposure (is_direct: true) in each entry rather than on the total score alone.

Truncation

Wallets with large transaction histories can produce very long exposure lists. To keep responses fast, source_of_funds, destination_of_funds, and counterparty_connections are trimmed: every HIGH/CRITICAL-risk entry and every entry in a critical category (sanctions, terrorist financing, ransomware, stolen funds, darknet, mixers, scams) is always kept, plus the largest remaining entries by percentage. When a list was trimmed, its matching *_truncated flag is true.

Each entry contains: category, entity_name, entity_type, entity_subtype, exposure_direction, exposure_type, is_direct, amount_usd, percentage, hops, risk_level, country.

Sandbox vs. production

In sandbox, each account gets a small number of free screenings per month; once used up, this endpoint returns 429 until next month, and sandbox screenings are never billed. In production, every successful screening (status: SCREENED) is metered and appears on your monthly invoice.

Errors