A P2P desk screens a new counterparty’s TRON address on Monday. It comes back clean, so the desk trades. Two weeks later the same counterparty sends a second, larger USDT transfer. In between, that address received funds from a wallet linked to a scam cluster, but nobody looked again. So how do you detect if a wallet’s risk level changed between screening and the next transfer? Treat every screen as a snapshot with a date on it. Re-screen the address before each new transfer, or whenever a defined trigger fires, and compare the new risk score and its reasons with the last result. If you put counterparties on a watchlist with alerts, you can see many of these changes before the next transfer instead of after it.
Why a wallet’s risk can change after you screen it
A blockchain address has no fixed reputation. Its risk depends on what it is connected to, and those connections keep changing for as long as the address is in use. A crypto wallet screening result describes the address at the moment you ran it. After that, several things can change:
- New incoming funds. The address can receive coins from a mixer, a darknet market, a scam or stolen funds. A wallet with clean history can pick up direct or indirect exposure in a single transaction.
- Upstream addresses get flagged. A wallet that sent funds to your counterparty months ago may be added to a sanctions list or linked to an incident later. The history is the same, but its meaning has changed.
- Freeze status changes. Tether, the USDT issuer, can freeze an address that was active and unrestricted when you checked it. Funds already in that address cannot be moved once it is frozen.
- Behaviour shifts. An address that used to make a few personal transfers starts acting like a pass-through, with fast in-and-out flows, many small deposits or links to newly created wallets.
None of this shows up in a report you ran last month. The crypto wallet risk score you recorded then was accurate for that day. It tells you nothing about the address’s activity since.
Events that should trigger a re-check
You do not need to re-screen everything all the time. You need clear triggers that every operator applies the same way. The checklist below works for most P2P desks, OTC brokers and small exchanges.
| Trigger | Why it matters | Action |
|---|---|---|
| A new transfer is about to be sent or credited | The last screen may be days or weeks old | Re-screen before releasing funds or crediting the deposit |
| Transfer size is clearly larger than usual for this counterparty | Higher value means higher exposure if the source is tainted | Re-screen and record the result with the transaction |
| The counterparty sends from a new address | A new address has no screening history with you | Screen it as a new counterparty |
| An alert fires on a watched address | Something in its risk profile or freeze status changed | Pause pending transfers and review the reasons |
| Public news of a hack, exploit or sanctions action in your market | Funds may already be moving through counterparties | Re-screen active counterparties on the affected network |
| A fixed period has passed with no check | Dormant relationships drift without anyone noticing | Run a scheduled batch re-screen |
When you review a re-check, look at more than the headline number. Compare the reasons: new exposure to a sanctioned address, a new freeze, a new high-risk source a few hops back, or a new behavioural pattern. Our guide to the signs of a high-risk crypto address covers what each of these looks like on-chain.
One-time screening vs. ongoing monitoring
One-time screening answers one question: is this address acceptable right now? It suits occasional, low-value counterparties you are unlikely to deal with again. Ongoing monitoring answers a different question: has anything changed since we last decided this address was acceptable? It suits repeat counterparties, high-value relationships and any address you send funds to on a schedule.
| One-time screening | Ongoing monitoring | |
|---|---|---|
| Best for | One-off or low-value counterparties | Repeat, high-value or scheduled counterparties |
| What it catches | Risk present at the time of the check | Risk that appears between checks |
| Main weakness | Blind to anything that happens later | Needs a clear process for handling alerts |
| Evidence trail | A single dated report | A series of dated results and alert reviews |
Most teams need both: screen every new address once, then move the counterparties that matter onto continuous monitoring.
A practical re-screening policy for P2P desks and small exchanges
A written policy keeps decisions consistent when different operators handle the same counterparty. Keep it short enough that people actually follow it.
- Screen every new address before the first transfer. No exceptions for “trusted” referrals. Store the report, including the PDF, with the trade record.
- Set your own score thresholds. For example: accept below one level, require manual review in a middle band, decline above a higher level. Choose these levels based on your own risk appetite and any obligations that apply to you; there is no universal correct number.
- Treat certain reasons as stop signs regardless of score. Direct exposure to an OFAC-sanctioned address or an active USDT freeze should always go to manual review.
- Re-screen before every transfer to or from a repeat counterparty above a value you define, and at least on a fixed schedule for the rest.
- Add active counterparties to a watchlist so changes reach you without someone remembering to look.
- Document each decision. Note who reviewed the alert, what the reasons were and what was decided. This is what you will need if a bank, partner or exchange later asks how you handled a counterparty.
This is an operational template, not legal advice. Your actual obligations depend on where you operate and how you are regulated.
Using a watchlist and alerts to catch changes before the next transfer
Manual re-screening relies on someone remembering to do it at the right time. A watchlist reverses that: you register the addresses you care about, and you are told when something changes.
In SafeON, you can add a counterparty’s address to your watchlist and receive alerts, including in Telegram. Each screen returns a risk score from 0 to 100 together with the reasons behind it, covering OFAC sanctions exposure, USDT freeze and blacklist status, multi-hop tracing of where funds came from (mixers, darknet markets, scams, stolen funds, exchanges and Iran-linked exchanges) and behavioural risk patterns. TRON (TRC20) and BNB Smart Chain are fully covered; for Ethereum, SafeON checks freeze status.
A sensible workflow:
- Screen the address once through the AML wallet check and save the report.
- Add it to the watchlist if you expect further transfers.
- When an alert arrives, hold any pending transfer with that counterparty until someone has read the reasons.
- Re-screen right before the next transfer anyway. An alert tells you something changed. A fresh screen tells you where the address stands now.
Monitoring reduces the gap between a change and your awareness of it. It does not remove that gap entirely, so the pre-transfer re-check stays in the policy.
Automating checks through an API
Once volumes grow, manual checks become the bottleneck and the place where steps get skipped. Businesses can use SafeON’s API to build screening into their own systems, for example:
- screening a deposit address automatically before a deposit is credited;
- screening a withdrawal destination before the payout is signed;
- running scheduled batch re-screens of active counterparties and flagging any whose score or reasons changed;
- writing every result into your own case records so reviews and audits have a full history.
Keep a human in the loop for anything above your review threshold. Automation should send cases to people, not make the final decision on borderline ones.
To see how a counterparty looks today, check a wallet’s risk on SafeON before your next transfer.
FAQ
How do you know if a wallet’s risk changed after screening?
Re-screen the address and compare the new risk score and reasons with your previous result. To be told about changes between your own checks, put the address on a watchlist with alerts.
How often should a counterparty wallet be re-screened?
At a minimum, before every new transfer with a repeat counterparty and whenever an alert or other trigger fires. Add a regular scheduled re-screen for active counterparties. How often depends on your volumes and risk appetite.
Can a low-risk wallet become high-risk later?
Yes. It can receive funds from sanctioned, scam-linked or stolen sources, its earlier counterparties can be flagged later, or Tether can freeze it. A clean result only applies to the date of the check.
What should I do if a wallet I already accepted funds from becomes high-risk?
Pause further transfers with that counterparty, record the alert and its reasons, and review the relationship under your internal policy. If you have reporting or legal obligations, take advice from a qualified professional. Screening tools identify risk; they cannot reverse past transfers or release frozen funds.