Skip to main content
The KYT risk score answers one question: how much of the money touching this address or transaction can be traced to sources that regulated institutions treat as a problem? This page covers the methodology, how to build policy on it, and the entity taxonomy that drives it. For reading an actual result, see How to read a KYT report.

​
How the score is built

1

Fund flows are traced

KYT follows funds in and out of the subject address, across direct interactions (1 hop) and indirect ones (n-hop, further along the trail).
2

Counterparties are attributed

Addresses along the trail are matched against Dataspike’s entity database and clustered. Each recognized entity carries a category — Licensed exchange service, Mixing service, Sanctions, and so on. See the entity taxonomy below.
3

Exposure shares are computed

For every category, KYT computes the share of funds associated with it. These shares are what you see in the category breakdown of a result.
4

Shares are weighted into one number

The shares are combined into a 0–100% score, with high-risk categories weighted more heavily than the same share of moderate- or low-risk exposure, and the result is classified into a grade.
Inputs to the assessment include interactions with tagged entities, direct and indirect connections, asset movement history, and the proportion of funds tied to high-risk categories.

​
Bands and grades

The band legend is printed on every PDF report, so recipients outside your team can interpret the number without extra context.
In the API, risk_score is a 0–1 coefficient, not a percentage. "risk_score": "0.34" corresponds to 34% in the dashboard. Multiply by 100 before displaying it, and prefer risk_score_grade (low │ moderate │ high │ undefined) for decision logic — it needs no conversion.

​
The score is explainable, not a verdict generator

Every result ships with the breakdown that produced it: the share of funds per entity category, across all tiers, covering direct and indirect connections. Alongside it, the Direct transfers table names the counterparties one hop away with amounts. That means you can always answer three questions about a score:
  • Which categories drove it — scam, sanctions, darknet, unlicensed venues, bridges.
  • How much of the money each category accounts for.
  • Who, by name, the address dealt with directly.
What the score is not is a probability that your customer is a criminal, or a figure you should recompute by hand. Per-category weights are not exposed field by field; the published breakdown is the explanation.

​
Small high-risk exposure still matters

Because the score is a weighted composite, an address can be Low overall while carrying non-zero high-risk exposure — a real example is a 23% Low score containing 0.42% sanctions exposure. Supervisory expectations increasingly treat any high-risk nexus as something to address, independent of percentage size. Recommended policy: make any High-tier exposure an escalation trigger in its own right. Use the overall grade to prioritize work, not to skip it.

​
Scores change over time

Assessments update as new transactions appear and as entity classifications are added to the database. An address that scored Low last quarter can score higher today — because it received new funds, or because a counterparty was newly classified. Re-screen addresses periodically, especially for customers with ongoing deposit activity, and treat every stored result as a point-in-time record.

​
From score to policy

A workable baseline, to be adapted to your risk appetite and jurisdiction:
  • low — approve the deposit, withdrawal, or onboarding step. Archive the report.
  • moderate — hold for enhanced due diligence: verify source of funds, request supporting documentation, review the category breakdown, schedule re-screening.
  • high — block the operation, escalate to compliance, archive the PDF report as case evidence.
  • Any High-tier category present — flag for review even when the overall grade is low.
  • undefined — do not read as clean; rely on KYC evidence and source-of-funds documents.
The full triage flow, including sanctions handling and edge cases, is in the decision matrix. Custom risk profiles and configurable thresholds are planned — see Feature availability.

​
Entity types

Every entity KYT identifies in a fund flow is classified into a risk tier. These categories appear as Flags in the dashboard, as line items in the category breakdown, in the PDF report, and in the API as the machine-readable type field with a human-readable type_label (e.g. EXCHANGE_LICENSED / Licensed exchange service). The share of funds associated with each category — weighted by tier — is what drives the score above.

​
Low-risk entities

​
Moderate-risk entities

​
High-risk entities

Seizure of funds (Low) and Seized assets (High) are distinct categories: the former covers confiscated assets that were subsequently legalized by the state; the latter covers assets seized in connection with criminal cases.

​
Entities with undefined risk

Undefined is not a red flag by itself — it is typical for ordinary personal wallets that don’t belong to any recognized service. Evaluate it in context: a wallet that is mostly undefined with no attributable counterparties warrants more scrutiny than one with a small undefined remainder. Dataspike continuously expands and updates entity classifications. New attributions can change the risk picture of an address that was previously unclassified — one more reason to re-screen periodically.