Can an AI agent screen crypto transactions?

Yes, with blockchain analytics behind it. An AI agent can read the risk data your analytics tool returns for each address, trace exposure to sanctioned wallets, mixers or illicit markets, compare the transfer with the customer's profile and recommend release, hold or escalation. Blocking or returning funds, accepting exposure and reporting suspicion stay with a compliance officer.

What does crypto screening look at?

Screening a bank payment means checking names against lists. Screening a crypto transfer means checking addresses, and the history of the funds behind them. Because public blockchains record every movement, you can see whether the coins a customer is receiving passed through a sanctioned address, a mixing service, a darknet market or a hacked exchange's wallets, directly or a few steps back.

Blockchain analytics tools score addresses and transfers on that exposure. The output is useful but raw: a risk score, a list of exposure categories, a number of hops. Someone has to turn that into a decision about this customer and this transfer. That interpretation is the agent's job, up to the point of decision.

What evidence does the agent assemble?

For each flagged transfer the agent builds a short file:

• The analytics result: the risk score, exposure categories, direct or indirect exposure and the number of hops.
• The counterparty: whether the address belongs to a known provider or a self-hosted wallet, and, for providers, the information exchanged under the travel rule.
• The customer: risk rating, stated source of funds, expected activity, and previous transfers to or from similar addresses.
• The pattern: whether the transfer fits the customer's history, and whether it is part of a sequence, such as funds arriving and leaving quickly.
• Policy: which of your thresholds the transfer crosses, cited.

The agent then recommends an outcome with reasons. A direct sanctions exposure is never a recommendation to release; it goes straight to a person with the transfer held.

Which decisions stay with a person?

The compliance officer decides:

• Whether to block, return or release a held transfer.
• How much indirect exposure is acceptable, and for which categories. A deposit several hops from a mixer may be acceptable; one hop from a sanctioned address is not.
• Whether a pattern gives grounds for suspicion and a report.
• Whether to restrict or exit a customer.
• Changes to risk thresholds and categories in the analytics tool.

Incoming funds raise a specific question: once tainted coins arrive, they are on the firm's books. Whether to freeze, return or report them depends on the exposure type and the jurisdiction's rules, and that is a legal judgement for a person.

What does a screened transfer look like?

Take a crypto exchange. A customer deposits the equivalent of 25,000 in bitcoin. The analytics tool scores the deposit as high risk.

The agent reads the result. The exposure is indirect: three hops back, a share of the funds passed through a mixing service. The sending address is a self-hosted wallet. The customer has been with the exchange for two years, is rated low risk, and has made several similar deposits from the same wallet, all low risk until now. The customer's stated source of funds is mining income and long-term holdings.

The agent recommends holding the deposit and asking the customer, through normal channels, about the origin of the funds. It notes what would support release, such as evidence that the customer bought the coins from a provider, and what would support escalation. The officer agrees, the customer supplies purchase records from another exchange, and the officer releases the deposit with a note to watch the wallet. The same approach of asking a customer to confirm activity applies outside crypto; see how to confirm suspicious card transactions with customers with an AI agent.

Which controls make crypto screening safe?

• Outgoing transfers are held before sending. Blockchain transfers cannot be reversed, so screening happens before execution.
• Direct sanctions exposure is never released by the agent. Those transfers always go to a person.
• Thresholds are policy. The agent applies thresholds compliance has set; it does not invent its own.
• Analytics results are labelled as external. The analytics score is a third-party view, recorded as such, and is weighed with the firm's own records.
• Every hold and release is filed with the score, the reasoning and the officer's decision.

Coding and reconciling crypto movements for accounting is a separate task with different risks; see can an AI agent code transactions to the right accounts? The general principle is in our guide to AI compliance agents.