What gets screened and when

When you would read this

When you need to explain your controls to an auditor or a bank, and when you want to understand why a particular payment was held.

What gets screened

Every outbound payment. When you run checks on a payment request, the destination address is screened before the payment can be signed. Nothing goes out unscreened.

Every recipient in a batch. Each address in a batch is screened individually, and the batch takes the risk level of its riskiest member.

Incoming deposits. Funds arriving into your wallets are screened too, so you know what you have received and from where.

Saved counterparty addresses. Addresses are screened when you add them, and re-screened over time. See "Ongoing wallet risk monitoring".

What the checks look at

Screening combines several kinds of check into a single result:

Address risk. Whether the destination has known associations that make it high risk, and whether it appears on a blocklist.

Policy checks. Whether the payment satisfies your own rules: is it above your self-approval limit, does it need a supporting document, is the recipient new to you, is strict payout mode engaged.

Behavioural signals. Whether the payment fits your organisation's normal pattern. Unusual timing, unusual size relative to your history, or a sequence of payments that looks like it is being split to stay under a limit will all raise attention.

Counterparty context. Whether the address belongs to a counterparty you know, how long you have used it, and what you have paid them before.

When it runs

Screening runs when you select Run checks on a payment request, before anything can be signed. It runs again on incoming funds when they arrive. It also runs in the background against addresses you have saved.

You will see a Checking status while it is in progress. This usually takes moments.

What to expect

The result is one of three verdicts, PASS, FLAG or BLOCK, presented as a risk dossier attached to the payment. See "Read a risk result".

Everything screening produces is retained and forms part of the evidence pack for that transaction, so the result you saw at the time is reconstructable later. See "Export an evidence pack".

Screening supports your compliance programme. It does not replace it, and it does not tell you what your obligations are. Those remain yours.

Common problems and what they mean

A payment sits on "Checking". Screening is running. If it stays there far longer than usual, contact support.

The same address passed last week and is flagged now. Either re-screening found something new, or a behavioural check fired because this payment does not fit your pattern.

An incoming deposit is flagged. The funds have arrived and cannot be un-received. Review the result before moving them into your main vault, and consider using quarantine addresses. See "Use a quarantine address".