Ongoing wallet risk monitoring

When you would read this

When a counterparty's risk tier changes without you touching anything, or when your own vault shows a wallet risk score you did not expect.

Why scores change on their own

Screening is not a one-off check at the moment you save an address. Addresses you have saved are re-screened over time, and what is known about an address changes as the wider picture changes.

An address can become higher risk because it later received funds from somewhere problematic, because it was subsequently associated with activity that screening cares about, or because information that was not available when you first added it has since emerged.

Nothing you did caused it. The world moved.

Where to see it

Governance › Counterparty shows a risk tier on each counterparty and a risk score against each of their registered addresses.

Governance › Vaults shows a wallet risk score on each vault, reflecting screening of the addresses that vault has interacted with.

Steps: when a score gets worse

1. Open the counterparty and identify which address changed. It is often one of several.
2. Look at what you have paid to that address and when. Past payments are not undone, but you need to know the exposure.
3. Contact the counterparty through a channel you already trust and ask them to receive on a different address.
4. Add the new address, and archive the affected one so nobody selects it out of habit.
5. Record what you did. If a future payment to this counterparty is flagged, your comment on that flag should reference this.

Your own wallet risk

A vault can pick up a risk score from what has been sent to it, not only from what you have sent out. Unsolicited deposits from unpleasant sources affect the picture even though you did not ask for them.

This is the main practical argument for quarantine addresses: unknown senders deposit there, you inspect, and your operating vaults stay clean. See "Use a quarantine address".

What to expect

A worsening score does not automatically block anything. It changes the risk picture, which feeds into the verdict on future payments, so payments involving that address are more likely to be flagged or blocked from now on.

Changes are recorded, so you can show an auditor both what you knew and when you knew it.

Common problems and what they mean

A long-standing supplier suddenly rates badly. Almost always one specific address. Identify it and move them onto another.

Your treasury vault has a risk score and you only ever pay known suppliers. Check for inbound dust deposits. See "View balances and history".

A score with no explanation you can act on. Contact your account manager rather than guessing.