What a risk score is and is not
A score is a vendor’s opinion expressed as a number. Two vendors can score the same address 30 and 70 without either being wrong, which is why a score opens an investigation rather than settling one.
A risk score is a single number a vendor assigns to an address or a transfer, summarising how concerned it thinks you should be. An address scoring 82 out of 100 is one the vendor would like you to look at.
The number is produced by a model, and every model embeds decisions that somebody made deliberately. Knowing which decisions they were is the difference between using a score and deferring to it.
What sits underneath the number
- Which categories count
Sanctions, darknet, ransomware, mixing, gambling, high-risk jurisdiction. Not every vendor treats gambling as concerning at all.
- How heavily each weighs
A point of sanctions exposure and a point of gambling exposure do not move the score equally.
- How far to look
The hop cap, and the apportionment rule applied through each pool.
- Where the bands fall
The boundary between medium and high is a threshold somebody chose. Moving it by five points moves cases across it.
- How recency is handled
Exposure from 2021 and exposure from last week may or may not be weighted the same.
Why two vendors disagree
Each of those five decisions is reasonable, and each has more than one reasonable answer. Two vendors reading the same chain with different answers produce different scores, and neither has made an error. A disagreement between vendors is information about the methods, not evidence that one is unreliable.
Seventy is not a fact about these cases. It is where somebody drew the line, and at this setting it raises 69 of them.
An illustrative distribution. Nothing about the addresses changes when the line moves.
What a score is good for
| Use it to | Do not use it to |
|---|---|
| Decide what to look at first | Decide an outcome |
| Compare two addresses screened by the same vendor on the same day | Compare figures from two vendors |
| Trigger a review under your own policy | Stand in for the reason a case was escalated |
| Notice that an address changed character | Assert anything about the person holding it |
What this changes
Write the reason, not the score. A report saying the address scored 82 tells a reader nothing they can check. A report saying 31% of the value reaching the address came within two hops of a mixing service, per a named vendor on a named date, tells them what the 82 was made of. The second survives a review and the first does not.
Related
Direct and indirect exposure
Exposure measures how much of the value reaching an address can be traced back to a category of concern, and how far away that category sits. The further away, the more of the figure is methodology rather than observation.
What KYT is
Know your transaction screens onchain activity against categories of concern. It tells you about the money an address has touched, and nothing at all about the person holding it.
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Last checked against the product on .