Section 6 · Lesson 6.3
The "grey" case: indirect contact with risk
The most common and the most difficult case in practice. The score is in the middle, there are no direct violations, but there are indirect signals. This is where it's decided whether you can tell "medium" from "dirty."
The starting data
- Age8 months, medium activity.
- Score45/100. Breakdown: 78% exchanges, 18% high-risk exchange (no KYC, sanctioned), 4% gambling.
- Risky contact2 hops, ~5 months ago, ~$300 out of $9,000 total turnover.
- Sanctions / freezeNo direct matches.
Working through the checklist
- Sanctions / freeze. No direct matches — not an immediate stop. We go on.
- Age. 8 months — not a one-day wallet, but not an "old-timer" either. Neutral.
- Risk score and breakdown. The key point: 18% exposure to a sanctioned exchange with no KYC. This is not 0.3% of "noise."
- Materiality. We break the signal down along three axes:Share — 18% (significant). Amount — ~$300 out of $9k (moderate). Recency — 5 months (the signal weakens). Hops — 2 (indirect).
- Patterns. No obvious schemes (peel chain, splitting) are visible.
18% to a no-KYC exchange
significant
+
2 hops, 5 mo. ago
signal weakening
=
Manual review
not a stop, but not "green" either
Conclusion
Decision: accept with conditions. This is the classic case of "medium ≠ dirty." The contact is indirect (2 hops), the share in money terms is moderate, and it's fairly old. But 18% to a sanctioned exchange cannot be ignored.
Conditions: for a large amount, request the source of funds from the counterparty — for example, a screenshot of a withdrawal from a legitimate exchange. If you get a clear explanation and confirmation, accept and record all documents. If the counterparty refuses to explain — decline.
A typical mistake in both directions. You can neither "accept without looking" (18% is a real signal) nor "decline over a yellow score" (that scares off honest clients). The right path is to request the source of funds and decide on the answer.
What the case teaches. A "grey" wallet calls not for an automatic verdict but for work: break the signal down by share/amount/recency/hops and request the missing context from a human.
The example is instructional, assembled from typical features of real wallets.