> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataspike.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Risk Scoring & Entity Types
> How the Dataspike KYT risk score is calculated, what the grades mean, how to turn a score into policy — and the full taxonomy of entity categories behind every breakdown.
The KYT risk score answers one question: **how much of the money touching this address or transaction can be traced to sources that regulated institutions treat as a problem?**
This page covers the methodology, how to build policy on it, and the entity taxonomy that drives it. For reading an actual result, see [How to read a KYT report](/wallet-checks-kyt/how-to-read-a-kyt-report).
***
## How the score is built
KYT follows funds in and out of the subject address, across **direct interactions** (1 hop) and **indirect ones** (n-hop, further along the trail).
Addresses along the trail are matched against Dataspike's entity database and clustered. Each recognized entity carries a category — *Licensed exchange service*, *Mixing service*, *Sanctions*, and so on. See the [entity taxonomy](#entity-types) below.
For every category, KYT computes the **share of funds** associated with it. These shares are what you see in the category breakdown of a result.
The shares are combined into a **0–100% score**, with high-risk categories weighted more heavily than the same share of moderate- or low-risk exposure, and the result is classified into a grade.
Inputs to the assessment include interactions with tagged entities, direct and indirect connections, asset movement history, and the proportion of funds tied to high-risk categories.
***
## Bands and grades
| Grade | Score | Interpretation | Typical policy |
| ------------- | ------- | --------------------------------------------------------------------------------------- | ------------------------------------------ |
| **Low** | 0–25% | Minimal suspicious exposure | Proceed |
| **Moderate** | 26–74% | Suspicious exposure detected | Enhanced due diligence, monitor |
| **High** | 75–100% | Significant high-risk exposure; funds may be held or frozen by regulated counterparties | Manual review, consider blocking, escalate |
| **Undefined** | — | Not enough reliable data to classify the source of funds | Fall back to other controls |
The band legend is printed on every PDF report, so recipients outside your team can interpret the number without extra context.
**In the API, `risk_score` is a 0–1 coefficient, not a percentage.** `"risk_score": "0.34"` corresponds to **34%** in the dashboard. Multiply by 100 before displaying it, and prefer `risk_score_grade` (`low` │ `moderate` │ `high` │ `undefined`) for decision logic — it needs no conversion.
***
## The score is explainable, not a verdict generator
Every result ships with the breakdown that produced it: the share of funds per entity category, across all tiers, covering direct and indirect connections. Alongside it, the **Direct transfers** table names the counterparties one hop away with amounts.
That means you can always answer three questions about a score:
* **Which categories drove it** — scam, sanctions, darknet, unlicensed venues, bridges.
* **How much of the money** each category accounts for.
* **Who, by name**, the address dealt with directly.
What the score is *not* is a probability that your customer is a criminal, or a figure you should recompute by hand. Per-category weights are not exposed field by field; the published breakdown is the explanation.
***
## Small high-risk exposure still matters
Because the score is a weighted composite, an address can be **Low overall while carrying non-zero high-risk exposure** — a real example is a 23% Low score containing 0.42% sanctions exposure. Supervisory expectations increasingly treat *any* high-risk nexus as something to address, independent of percentage size.
**Recommended policy:** make any High-tier exposure an escalation trigger in its own right. Use the overall grade to prioritize work, not to skip it.
***
## Scores change over time
Assessments update as new transactions appear and as entity classifications are added to the database. An address that scored Low last quarter can score higher today — because it received new funds, or because a counterparty was newly classified.
**Re-screen addresses periodically**, especially for customers with ongoing deposit activity, and treat every stored result as a point-in-time record.
***
## From score to policy
A workable baseline, to be adapted to your risk appetite and jurisdiction:
* **`low`** — approve the deposit, withdrawal, or onboarding step. Archive the report.
* **`moderate`** — hold for enhanced due diligence: verify source of funds, request supporting documentation, review the category breakdown, schedule re-screening.
* **`high`** — block the operation, escalate to compliance, archive the PDF report as case evidence.
* **Any High-tier category present** — flag for review even when the overall grade is low.
* **`undefined`** — do not read as clean; rely on KYC evidence and source-of-funds documents.
The full triage flow, including sanctions handling and edge cases, is in the [decision matrix](/wallet-checks-kyt/how-to-read-a-kyt-report#decision-matrix). Custom risk profiles and configurable thresholds are planned — see [Feature availability](/wallet-checks-kyt/result-fields-coverage#feature-availability).
***
## Entity types
Every entity KYT identifies in a fund flow is classified into a **risk tier**. These categories appear as **Flags** in the dashboard, as line items in the category breakdown, in the PDF report, and in the API as the machine-readable `type` field with a human-readable `type_label` (e.g. `EXCHANGE_LICENSED` / *Licensed exchange service*). The share of funds associated with each category — weighted by tier — is what drives the score above.
### Low-risk entities
| Entity type | Description |
| ------------------------- | ------------------------------------------------------------------------------------------- |
| Licensed exchange service | Exchanges licensed in the EU that allow unlimited withdrawals (e.g. Binance, Bybit, Kraken) |
| P2P Exchange licensed | EU-licensed peer-to-peer trading platforms |
| Online wallet | Funds stored with verified custodial wallet providers |
| Online marketplace | Funds used to purchase goods and services on legal platforms |
| Rewards/commissions | Rewards paid to miners for producing blocks or processing transactions |
| Miner | Newly mined coins |
| Seizure of funds | Assets confiscated by governments and subsequently legalized |
### Moderate-risk entities
| Entity type | Description |
| ---------------------------- | ----------------------------------------------------------------------- |
| Decentralized exchange (DEX) | Exchanges that trade via smart contracts (e.g. Uniswap, Curve, 1inch) |
| Bridges | Funds transferred between blockchains using cross-chain bridge services |
| Unlicensed exchange service | Exchanges without an EU license that allow unlimited withdrawals |
| P2P Exchange unlicensed | Peer-to-peer platforms without an EU license |
| Lending protocol | DeFi platforms for lending and borrowing crypto (e.g. Aave, Compound) |
| Payment system | Funds associated with verified payment providers and gateways |
| ATM | Funds obtained from cryptocurrency ATMs |
### High-risk entities
| Entity type | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------- |
| Scam | Funds obtained through confirmed fraudulent activity |
| Scam crypto exchange | Exchanges involved in exit scams or illegal operations |
| Stolen assets | Funds from hacked wallets or confirmed theft |
| Sanctions | Addresses of individuals or organizations on OFAC, UN, EU, or other international sanctions lists |
| Sanctioned jurisdiction | Funds associated with countries that do not comply with AML/KYC standards |
| Darknet marketplace | Markets operating on the dark web |
| Darknet service | Darknet-adjacent services linked to severe crimes |
| Illegal service | Funds associated with other illegal activities |
| Mixing service | Coin mixers and tumblers used to obfuscate fund trails |
| Privacy protocol | Protocols that conceal sender, recipient, amounts, or IP addresses |
| Gambling | Funds associated with unlicensed gambling |
| Terrorism financing | Funds used to finance terrorism |
| Malware | Funds obtained through malware attacks or cyberattacks |
| Ransom | Funds obtained through blackmail or ransomware |
| Drugs trafficking | Funds associated with the drug trade |
| Illegal arms trafficking | Funds associated with illegal weapons trade |
| Child abuse material | Funds used for the purchase or distribution of CSAM |
| Extremism | Funds linked to extremist crimes and organizations |
| Seized assets | Assets seized by law enforcement in connection with criminal cases |
**Seizure of funds** (Low) and **Seized assets** (High) are distinct categories: the former covers confiscated assets that were subsequently legalized by the state; the latter covers assets seized in connection with criminal cases.
### Entities with undefined risk
| Entity type | Description |
| ----------- | ----------------------------------------------------------------------------- |
| Other | A counterparty exists but has not yet been classified in Dataspike's database |
| Undefined | No reliable data on the source of funds |
**Undefined is not a red flag by itself** — it is typical for ordinary personal wallets that don't belong to any recognized service. Evaluate it in context: a wallet that is *mostly* undefined with no attributable counterparties warrants more scrutiny than one with a small undefined remainder.
Dataspike continuously expands and updates entity classifications. New attributions can change the risk picture of an address that was previously unclassified — one more reason to re-screen periodically.