Why services give different scores and what consensus is

Cause 1: different label databases

Scoring is only as good as its label database (attribution). A label is the assertion "address 0x… belongs to the Binance exchange / the Tornado mixer / the Hydra darknet market". No one has a complete and perfectly accurate database, and here is why they differ.

• Different attribution sourcesSome buy data from certain providers, some run their own intelligence, some rely on open lists. The overlap is incomplete.
• Different network coverageOne is strong in Ethereum and Bitcoin but weak in Tron and Solana; another the reverse. A service sees more in "its" network.
• Different freshnessA new mixer or a fresh hack does not appear in databases simultaneously. A day or two of difference — and one service already paints the address, while another does not yet.
• Different label accuracyFalse labels exist: an address may have been mistakenly attributed to a service. One provider verifies more strictly, another more loosely.

Cause 2: different traversal depth and model

Even with identical labels, two engines give different numbers if they traverse the graph differently. We examined this in detail in Lessons 4.1–4.2; here the practical consequences matter.

1. Different hop depth. One counts 2 hops, another 6.A deeper traversal will find links a "shallow" one won't see — and will show higher risk.
2. Different painting model. Haircut versus FIFO versus poison.Poison inflates the assessment, haircut understates it. The same graph — different numbers.
3. Different decay by hop. Some aggressively dampen distant links, some do not.Hence the "noisy" high scores of services without a proper decay function.
4. Different handling of direction. Some mix incoming and outgoing exposure into a single number, some separate them.Mixing masks where exactly the risk comes from.

Cause 3: different band thresholds

Even with an identical raw number, the final label "low/medium/high" depends on where a service draws its band boundaries. This is purely a matter of policy (risk appetite), not mathematics.

The same wallet with a raw number of 60 is "high, refuse" at the first service and "medium, work with a caveat" at the second. That is why comparing the labels "low/medium/high" between services is almost pointless — what you need to compare is the raw numbers and, above all, what stands behind them: which categories, at which hops, with which labels.

The consensus approach: cross-checking several sources

If one source is incomplete and biased in its own way, the sensible response is not to hunt for the "best" service, but to aggregate several and read them together. This is the consensus approach (at the heart of the AMLConsensus brand).

• Union of labelsWe take the union of the databases: if even one reliable source knows a counterparty is a mixer, that label cannot be ignored. This is how the "blind spots" of individual providers are closed.
• Comparison of raw scoresWe look at the spread. If three sources gave 78, 82, 90 — the consensus is confident. If 10, 50, 92 — that is a signal to investigate by hand.
• Priority of hard factsA sanctions flag, an on-chain stablecoin freeze — these are objective facts, not assessments. They outweigh any "soft" numbers and are not put to a majority vote.
• Source transparencyConsensus shows not just the result but who found what — so the analyst sees the basis, not only the figure.

How to read divergences in practice

A spread of scores is a diagnostic tool. Here is how to interpret it.

1. All services agree and low (e.g. 8/12/15). High confidence in cleanliness. Standard procedures.Agreement of independent sources is a strong signal.
2. All agree and high (e.g. 80/85/91). High confidence in risk. Refusal/escalation.There is no need to dig deeper here — the conclusion is stable.
3. A strong spread (e.g. 12/48/91). A red flag of uncertainty. Manual review is mandatory.We look for who has a label the others lack and verify its reliability.
4. One source knows a hard fact, the others are silent. We trust the one that found the fact.The absence of a flag is ignorance, not confirmation of cleanliness.

Section 4 summary

We have walked the whole chain from graph to decision. Lesson 4.1: risk is shares (exposure) that flow through the graph (taint), with a painting model and decay by hops. Lesson 4.2: shares are weighted by category severity, direction and recency, while hard flags override the arithmetic; this is how a 0–100 number and a "traffic light" are born. Lesson 4.3: different services give different numbers because of different label databases, traversal depths and thresholds — and this is not noise, but the reason to cross-check sources.