Section 5 · Lesson 5.5
Address monitoring: the check doesn't end with the deal
One of the most common and dangerous beginner mistakes is to assume that if an address is clean today, it is clean forever. The blockchain is alive: an address that passed a check yesterday with a zero score may tomorrow gain a link to a mixer, land on a sanctions list, or turn up in a theft chain. An AML check is not a one-off snapshot but a process. In this lesson we break down why an address's risk status changes over time and how to put addresses under monitoring so that you learn of a problem first, not last.
Why an address that's clean today gets "dirty" tomorrow
An address's risk score is not a property of the address itself but a reflection of its surroundings and history. Both of these change. Let's break down the main mechanisms that push the status upward.
- New incoming transactionsSomeone sent funds to the address from a mixer, a darknet market or a hacked protocol. Exposure rose — the score went up, even though the owner did nothing "bad."
- List updatesOFAC, national regulators and analytics companies constantly add addresses. A counterparty that was "unknown" yesterday landed on a sanctions list today — and everyone connected to it gained exposure.
- Retrospective labellingAnalysts uncovered the addresses of an old hack or scam after the fact. A transaction you accepted six months ago as clean is now tagged as theft-related.
- Graph evolutionFunds from the address moved on and "met" risky flows 2–3 hops out. Indirect exposure crept up.
Today
score 5, clean
→
Incoming from a mixer
→
Tomorrow
score 70, mixer
The key thought. You are checking not "a person" but the state of an address at a specific second. Time passes between the check and the next deal — and in that gap the risk can change. Monitoring closes precisely this gap.
Who needs monitoring, and why
Monitoring is not equally critical for everyone. Let's look at the typical roles and their stake in it.
- An exchanger/service. Holds clients' funds and working capital on its own addresses. If a treasury address received a dirty inflow, you need to know at once, so as not to "smear" it across payouts.
- A holder of a large sum. Accepted payment for a deal; the money sits for a month. Over that month the counterparty could land on a list — and when you cash out to an exchange it will surface, and you are the one who gets frozen.
- A compliance officer. Maintains a list of clients and their addresses. They need to learn of a risk change for already-accepted clients (ongoing due diligence — continuous checking, not just at intake).
- A private owner. Wants to know if something suspicious "landed" on their address, so as not to spend those coins and to keep them separate.
How to put an address under monitoring
Technically, monitoring is a subscription to events on an address. You tell the system: "watch this address and notify me if…". The notification conditions (triggers) are configurable.
- A new-transaction triggerAny movement on the address — incoming or outgoing. The basic level: you are simply aware of activity.
- A risk triggerA notification only if a new transaction or a recalculation pushed the score above a threshold (for example, it became ≥50). Less "noise," more signal.
- A category triggerFires only when critical categories appear:
sanctions, mixer, theft. The strictest and most important filter.
- A list triggerThe address or a close contact of it landed in an update of a sanctions/wanted list.
Technically the notification arrives via a webhook (the system knocks on your server), an email/messenger message (for a human), or via a periodic scheduled recalculation (for example, once an hour the system re-evaluates all the addresses on your list). Live systems do exactly this: a list of watched addresses + a regular recalculation + an alert when a threshold is crossed.
List of addresses
→
Recalc /hour
→
Threshold crossed → alert
What to do when an alert fires
An alert is not a verdict but a signal to investigate. Panic and hasty actions do as much harm as inaction.
- Capture the state. Save a report as of the alert: score, category, the specific trigger transaction, the date and time. This is your evidentiary base.
- Localise. Understand what exactly changed: a new inflow? a list update? growth in indirect exposure? Your response depends on it.
- Isolate the funds. If something dirty "dripped in," don't mix those coins with clean ones — keep them on a separate address. Mixing turns a local problem into a total one.
- Assess materiality. 0.3% indirect exposure at 4 hops is one thing; a direct inflow from a mixer is quite another. Not all alerts are equal.
- Make a decision. Keep watching, suspend operations with the address, initiate a return of funds, or prepare a compliance escalation — depending on the severity.
False positives and alert fatigue. If you set the threshold too low, you will drown in notifications and stop reacting to them — which is more dangerous than having none. Configure triggers by risk and category, not "on every movement." Better three precise alerts a month than three hundred useless ones.
Monitoring and regulation. Ongoing monitoring is not a whim but a requirement of FATF's risk-based approach and of most AML policies. The regulator expects you to watch a client not only at the moment of intake but throughout the relationship. Configured monitoring is part of your compliance hygiene.
A practical example: how a treasury address got "dirty"
Let's work through a typical scenario where monitoring saves the business. An exchanger keeps a working reserve of USDT on a treasury address and pays clients out of it. One day an incoming refund arrives at this address from a counterparty — a small amount, and no one checked the operation by hand. A day later this counterparty lands on a sanctions list: analysts uncovered its link to a sanctioned exchange.
- Without monitoring. The exchanger knows nothing. It keeps paying out from the treasury address — and "smears" the sanctions exposure across dozens of entirely innocent clients. Each of them, on depositing to an exchange, risks a freeze. The problem grew from local to widespread.
- With monitoring. The treasury address is watched with a trigger on the
sanctions category. At the moment the list updates, an alert arrives. The operator immediately suspends payouts from this address, isolates the received amount, moves the clean balance to a new address, and carries on. The damage is minimal.
The difference between these two outcomes is the difference between "set up monitoring in an hour" and "lost banking relationships and clients." That is exactly why, for a service, monitoring key addresses is not an option but a mandatory element of operational security.
Don't monitor "everything under the sun." Put under watch what genuinely matters: treasury and deposit addresses, large accepted sums, the addresses of key clients. Trying to watch every address that has ever flickered by is a road to overload and loss of focus. Monitoring is strong through prioritisation.
The lesson in brief
- An address's risk status changes over time: new transactions, list updates, retro-labelling, graph evolution.
- A check on the way in is a snapshot; a gap remains between deals, and monitoring closes it.
- Put addresses under watch with triggers by risk and category, not "on every movement."
- On an alert: capture, localise, isolate the funds, assess materiality, decide.
- Over-sensitive thresholds lead to alert fatigue — tune for precision.
This material is for educational purposes.