Address Screening vs Transaction Monitoring: Which AML Control Do You Need?

TL;DR - Address screening is the right call for a single wallet or one-off transfer; transaction monitoring is the right call for an exchange or business watching ongoing account activity.

Anyone setting up AML controls for crypto activity eventually reaches the same fork in the road: check individual addresses before funds move, or watch an account's activity continuously as it happens. The two approaches share a lot of vocabulary and sometimes the same underlying blockchain data, but they answer different questions. Picking the wrong one leaves a real gap, and picking both when you only need one wastes budget you could spend elsewhere.

What do address screening and transaction monitoring actually check?

Address screening looks at one wallet at a time. It pulls that address's full on-chain history, checks it against sanctions lists, mixer contracts, and clusters tied to known hacks and scams, and returns a risk score for that specific address at that specific moment. It answers a narrow question: is this address safe to interact with right now?

Transaction monitoring works at the account level, not the address level. It watches a stream of activity over time, whether that is a customer's deposits and withdrawals at an exchange or a business's outgoing payments, and applies rules to catch patterns: structuring below reporting thresholds, rapid movement through multiple wallets, sudden volume spikes, or transfers to newly created addresses. Wallet screening is a single lookup. Monitoring is a running process that never really stops.

How do the two controls differ in scope and timing?

Screening is point-in-time. You run it once, get an answer, and act on it before you send or accept funds. There is no ongoing relationship with the address after that check; if you want an updated view six months later, you screen it again from scratch. This makes screening cheap and fast, but it also means it only reflects what the address's history looked like the moment you looked.

Monitoring is continuous by design. It sits inside an exchange's or payment processor's infrastructure and evaluates every transaction against rules that update as new data comes in. It catches behavior that only becomes suspicious in aggregate, like a customer who receives twenty small deposits in a day from twenty different addresses that never appeared before. A single address screen would miss that pattern entirely, because no one address in that chain looks unusual on its own.

Head-to-head

Put side by side, the practical differences come down to who is checking what, how often, and why.

When is address screening enough by itself?

If you are an individual, a freelancer being paid in crypto, or an OTC desk about to accept a large transfer from a new counterparty, screening is usually the whole job. You are not running a regulated business with reporting obligations; you just need to know whether the address you are about to interact with carries flagged history before you commit funds you cannot easily get back. Before sending or accepting a transfer, screen the address with Plastron to see sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains in one pass. That single check is proportionate to the risk: no case-management system, no ongoing surveillance, just an answer you can act on.

When do you need transaction monitoring instead?

If you operate an exchange, a custodial wallet service, or any business that touches customer funds, screening alone will not satisfy your obligations. Regulators including FinCEN and standards bodies like the FATF expect ongoing surveillance of customer activity, not a one-time check at onboarding. Transaction monitoring is what produces the suspicious activity reports those obligations require, and it is the only way to catch structuring or layering patterns that unfold across dozens of transactions rather than one. A compliance program built only on address screening at deposit time will miss a customer who passes every individual screen but moves funds in a pattern that only looks wrong in aggregate.

Verdict

Neither control replaces the other, and the choice usually is not really a choice. A regulated exchange needs both: screening at the point of deposit to catch direct exposure fast, and monitoring running underneath to catch everything a point-in-time check cannot see. An individual moving funds between two wallets does not need a monitoring program; a single screen before the transfer is the appropriate, proportionate control. The mistake is not picking the wrong tool outright, it is assuming that whichever one you already have covers the whole problem.

FAQ

Can transaction monitoring replace address screening entirely?

Not for a specific decision point. Monitoring looks at patterns across many transactions and can take time to raise an alert. If you need an answer before you send funds to one address, you still need a point-in-time screen.

Do exchanges need transaction monitoring, or is screening at deposit enough?

Both. Screening at deposit catches direct exposure to sanctioned or flagged addresses immediately. Monitoring catches the slower patterns, like structuring or rapid fund movement, that only appear across many transactions over time.

Is transaction monitoring only for regulated businesses?

In practice, yes. It requires a case-management workflow, staffing to review alerts, and a legal basis for filing reports. Individuals and small counterparties get most of the same protection from a free address screen.

How often should you re-run address screening?

Before every transfer that matters. History is cumulative, so an address that screened clean last month can pick up new exposure from a single inbound transaction.