METHODOLOGY

What each check actually does

For every check: where the data comes from, how it is compared, how often it is refreshed, what it cannot tell you, and what happens when it fails. Every screening records which of these ran and with what result in its coverage matrix — this page is the legend. Live freshness is on the status page.

Sanctions lists

SourcesOFAC SDN (Sanctions List Service), UK OFSI consolidated list, EU consolidated financial sanctions list. Digital-currency address identifiers only.

MethodExact match of the normalised address (EVM lowercase; Tron/Bitcoin/Solana case-sensitive) against the latest stored snapshot. No fuzzy matching, no clustering.

RefreshEvery 6 hours. Each snapshot is stored with its address count and a SHA-256 content hash; decisions record the hash they used.

LimitsLists are not exhaustive (OFAC says so itself). A designated person's unpublished addresses are not caught. NO_KNOWN_MATCH is never "clean".

On failureA source that cannot be fetched keeps its last snapshot; if the newest OFAC snapshot is older than the tenant's limit (default 48h) coverage is STALE and the decision is TECHNICAL_HOLD.

Stablecoin issuer freezes

SourcesThe official USDT and USDC contracts: isBlackListed(address) (Tether) and isBlacklisted(address) (Circle), read live via JSON-RPC on Ethereum, BSC, Base, Arbitrum, Polygon, Avalanche, Optimism and via TronGrid on Tron.

RefreshLive at every screening — no cache.

LimitsBinance-pegged and other bridged tokens expose no blacklist function and are deliberately not checked. A freeze says the issuer acted; it does not say why.

On failureRPC unreachable → UNAVAILABLE for that token; the dimension is PARTIAL and the decision falls to review. The free tool shows UNAVAILABLE explicitly.

Transaction integrity

SourcesThe transaction receipt from the network's JSON-RPC (EVM chains).

MethodExists, succeeded, ≥ 12 confirmations, carries a canonical Transfer log from the official token contract; the sender is resolved from the token log, not the transaction signer, and that sender is what gets screened.

LimitsEVM only today; Tron/Bitcoin/Solana transfers are screened by address, integrity NOT_AVAILABLE. Amount comparison against the ledger is a separate step (reconciliation).

On failureHash not found, reverted or non-canonical token → tx-integrity-failure signal → REVIEW.

Wallet ownership

MethodEIP-191 personal_sign of a KYTGate-generated message (tenant, customer, nonce); the recovered signer must equal the registered address. Non-EVM chains: reviewer attestation in the console.

LimitsProves control of the key at signing time — not identity, not that the key is not shared.

Processor verdicts

SourcesWhat your payment processor posts to /api/v1/processor-signals: its assessment and, when it has one, an evidence reference.

MethodMatched to the screening by explicit reference or by transaction hash; the assessment enters the policy (HIGH_RISK / REJECTED block); the evidence dimension is COMPLETE only with an evidence reference — an approval alone is MISSING.

ConflictsProcessor cleared but public sources matched, or processor flagged but public sources found nothing → a labelled PROVIDER CONFLICT signal and webhook. The label never moves the decision; the underlying facts already did.

Behaviour rules

SourcesYour own funding events (deposits, withdrawal requests, trading summaries), your registered wallets, your open cases — never the blockchain, never other tenants.

MethodDeterministic rules with per-tenant thresholds; each fired rule states the numbers it saw. Pass-through, foreign withdrawal wallet, withdrawal with open case, structuring, wallet churn, large first deposit, dormant reactivation, rejected wallet returning, shared wallet, device/IP/bank links.

LimitsBehaviour signals reach REVIEW at severity ≥ 60 under the baseline policy and never block alone. Rules needing customer profile data (country, expected volume) are not yet implemented.

Second opinions and attribution

Chainalysis oracleThe public on-chain sanctions oracle contract is read as an additional sanctions source (exact match).

Not doneNo entity attribution, no mixer/darknet exposure, no multi-hop taint, no source-of-funds percentage. Those dimensions stay NOT_AVAILABLE until a commercial provider is connected, and the coverage matrix says so rather than implying a check that never ran.

Decisions and evidence

PolicyPlain-JSON rules evaluated by a pure function; every version immutable; built-in baselines frozen by version so any past decision replays under its own rules.

ReceiptEd25519 signature over canonical JSON of inputs, snapshot hashes, coverage, signals, policy version, decision; public key at /api/v1/receipt-key; browser verifier at /tools/receipt-verifier.

Human actionsAppend-only case timeline; BLOCK closures need two different accounts; a RELEASE on a BLOCK is labelled an MLRO override everywhere it appears.

Last updated 5 September 2026. Changes to any method are versioned in the policy engine and noted here.