Wallet Screening: What Is it And How Do You Do It?

‍

Summary

• Wallet screening inspects a crypto address's on-chain history to uncover its counterparties, risk factors, and likely real-world identity
• Blockchains are pseudonymous rather than anonymous, so screening closes that gap and helps businesses and individuals avoid unknowingly handling illicit funds
• AML regulations require exchanges and custodians to screen deposits and withdrawals and monitor risk on an ongoing basis
• Tools like Arkham allows wallet screening to be done either manually through the website or automated at scale via the Arkham API

How to Screen With Arkham

Arkham is built around the single idea that a blockchain address is far more useful when it is linked to a real name or entity. The platform's proprietary matching engine, Ultra, cross-references on-chain behavior against a large library of labeled wallets to attach identities to addresses wherever the evidence supports it. Arkham has used this system to map the on-chain holdings of notable market participants such as spot Bitcoin ETFs, Michael Saylor’s Strategy, Tesla, Robinhood, the German government, the Royal Government of Bhutan, and more, which gives screeners a reference point that goes well beyond a bare address.

A few features make Arkham an excellent starting point for screening work:

• Multi-chain coverage: The platform tracks activity across a wide range of networks rather than confining a search to a single chain, which is key as bad actors often bridge funds across chains to obfuscate their on-chain footprint.
• A dense label set. Arkham has built one of the largest libraries of tagged wallets in the industry, with over 3.1B labelled addresses and 700,000 distinct entities identified, covering exchanges, funds, market makers, government entities, and known illicit actors.
• De-anonymized entities. Rather than presenting a screener with a wall of addresses, Arkham groups related wallets under a single entity page, so an investigator or researcher sees the exchange, fund, or individual as a single entity rather than as fragments.
• A built-in risk score. Arkham assigns a number between 0 and 100 to addresses and entities, assessing exposure to illicit on-chain activity with a short reasoning behind the score. This enables the screener to quickly assess any address before investigating further.

‍

‍

Screening a wallet on the website

The most direct way to screen an address is through Arkham's Explorer. Simply paste the wallet address into the search bar at the top of the page. If Arkham has identified the owner, the entity's name, logo, and category, such as exchange, fund, protocol treasury, and more where applicable, will appear immediately rather than a blank address page. If no identity has been attached, the page will still show the raw transaction history, balance, and any behavioral tags Arkham's system has applied based on the wallet's activity patterns. These behavioral tags cover a large range of on-chain activities including governance activity, NFT trading, prediction market usage, airdrops received, and many more.

‍

‍

From there, a user works through the various elements presented on the account page.

1. Check the Entity Label and Tags: Confirm whether the address belongs to a known entity, and note the category Arkham has assigned to it. An address tagged as belonging to a licensed exchange carries a very different risk profile than one tagged as a mixer. Sanctioned or banned addresses will also be flagged under the account’s tags.

‍

‍

2. Review the counterparties: Open the Top Counterparties tab to view who the address has sent funds to and received funds from. Arkham labels counterparties wherever it can, so a user can often see at a glance whether a wallet has interacted with sanctioned addresses, darknet markets, or known theft proceeds.

‍

‍

3. Track individual transactions: To dive deeper into an address's specific on-chain activity, users can look into individual transactions, filtered by chain, token, value, or date,  to uncover anything worth highlighting. 

‍

‍

4. Visualizing transaction flows: For a more visual approach, Arkham’s Visualizer can be helpful in viewing all inflows and outflows from the address, rather than sifting through lists of transactions.

‍

‍

All of these analyses can be completed without writing a line of code, which is part of why the website interface is a common first stop for compliance analysts, journalists, and researchers who need an answer quickly.

Screening a wallet through the API

For teams that need to screen wallets at volume, whether that is a crypto exchange running onboarding checks or a fintech company screening every incoming deposit, the Arkham API exposes the same underlying data programmatically. The Arkham API provides direct query access to Ultra, Arkham's address-matching engine, which links blockchain addresses to real-world entities and lets sophisticated users customize data flows and integrate them into their own systems

In practice, an automated screening workflow through the API generally follows this shape:

1. Authenticate and query the address: A request to the relevant endpoint returns the entity match, if one exists, its associated labels, and the address's balance and holdings.
2. Pull the risk score: The same response, or a related endpoint, returns the numerical risk assessment so it can be logged automatically against an internal compliance threshold. The response also breaks down the risk into their respective categories such as exposure to funds linked to hacks or theft, exposure to sanctioned addresses, exposure to mixing services, and more.

‍

‍

3. Retrieve transaction history: A separate call returns the wallet's transfer history, which can be filtered by counterparty, token, or time window, letting a compliance system flag transactions above a certain value or involving a specific labeled entity.
4. Automate the decision: Since the response comes back as structured data, it can be fed directly into a rules engine that approves, flags, or blocks an account without requiring human intervention.

‍

‍

Arkham's API documentation covers the practical side of this integration, including access and onboarding, authentication, rate limits, pagination, and further details on the underlying data model of addresses, entities, labels, and tags.

What Is Wallet Screening?

Wallet screening is the process of inspecting the historical on-chain behavior and activity of a wallet to uncover its counterparties, risk factors, and where possible, the real-world identity behind it. Think of screening a wallet address in the way the police might screen a car’s license plate. The plate alone tells you almost nothing. Only when you run it against a registry do you learn about the car’s owner, where it has been driven, and whether it was involved in anything worth flagging. Wallet screening does the same job for a crypto address: it checks the address against known records, labeled entities, and behavioral patterns to work out who is likely holding it and whether their activity carries risk.

For most compliance screening purposes, this process answers three questions. Has this wallet been linked to a real-world entity? Has it sent or received funds from anything considered high-risk, such as sanctioned addresses, ransomware wallets, or funds stolen in a hack? And does its overall pattern of behavior look consistent with legitimate use, or does it resemble the layering typical of laundering?

Why Is Wallet Screening Important?

Bitcoin and most other public blockchains are pseudonymous rather than anonymous. Every transaction is permanently recorded and viewable by anyone with an internet connection, but the addresses themselves do not carry a name attached. Wallet screening seeks to close that gap, and it is also exactly what bad actors count on to cover their tracks after an on-chain crime.

‍

‍

For a business accepting crypto payments, wallet screening is the difference between knowingly or unknowingly processing funds tied to fraud, theft, or sanctioned parties. For an individual, it can be as simple as checking a wallet before sending funds to a counterparty for a peer-to-peer trade, or confirming that a deposit address has not shown up in reports of prior scams. For investigators and journalists, screening is often the starting point of a longer trace, used to establish where a set of funds has been before following it further.

Wallet Screening and Compliance

For regulated entities, most notably exchanges, custodians, and payment processors, wallet screening is not optional. Anti-money laundering (AML) obligations require these businesses to have a process for identifying whether the funds moving through their platform originate from or are heading toward high-risk sources. A regulator reviewing a firm's compliance program will typically expect to see documented screening at deposit and withdrawal, as well as ongoing monitoring rather than a single point-in-time check, and a clear escalation path when a wallet triggers a risk threshold.

This is where the risk score and label data become operationally useful. A compliance team can easily set a rule that any deposit above a certain risk threshold is automatically held for review, or that any wallet linked to a sanctioned entity is blocked outright. The use of APIs and automated systems enable these compliance checks to scale across an entire organization, with minimal need for human input along the pipeline.

Blockchain Intelligence

Wallet screening is a single, core function, but it sits inside a broader discipline usually known as blockchain intelligence. While screening answers a narrow question about one address at a point in time, blockchain intelligence tools extend that work in several directions.

Clustering is one such example. Clustering techniques group wallets that are very likely controlled by the same person or organization based on shared transaction patterns, so a user analyzing one address can often see the fuller picture of other addresses and entities connected to it. Visualization is another core aspect of blockchain intelligence, which turns a list of transactions into a node graph, making multi-hop laundering attempts, where funds are deliberately split and passed through many wallets to obscure their origin, far easier to follow than scrolling through raw data.

‍

‍

Entity resolution closes the loop, by grouping several related addresses under one named entity, be it an exchange, a fund, or an individual, turning a screening result into a more complete profile than a single data point.

Conclusion

Public blockchains were built to be transparent, and that transparency is precisely what makes wallet screening possible. The practical challenge has always been removing the veil of pseudonymity on  millions of blockchain addresses into something a compliance officer, investigator, or ordinary user can actually act on. Blockchain intelligence tools like Arkham exist to close that gap, whether through a quick search on the website or an automated check running through the API. As crypto adoption continues to widen, screening every counterparty a wallet touches is becoming less of a specialist skill and closer to second nature.