Choosing between address screening tools comes down to what you need to detect, how fast you need it, how many chains/addresses you cover, and how much false positive handling you can tolerate. A good way to compare tools is to break them into three related but different jobs:

1) Wallet screening

Use this when you want to assess a single wallet/address for risk.

What to look for

• Coverage: which chains are supported (BTC, ETH, Tron, Solana, L2s, etc.)
• Risk signals:
  • direct exposure to sanctioned entities
  • darknet / scam / hacks / mixers / ransomware
  • source of funds / destination of funds
  • behavioral patterns and clustering
• Lookback window: how far back the tool analyzes
• Entity resolution quality: can it correctly cluster related addresses?
• Explainability: can it tell you why it flagged a wallet?
• Latency: real-time vs batch screening
• API usability: easy to integrate into onboarding/transaction flows?

Best for

• Onboarding checks
• Transaction approval workflows
• Investigating a wallet before accepting funds

Common tradeoff

Tools with deeper heuristics often produce more false positives, especially on privacy-preserving behavior or exchange wallets.

---

2) Counterparty screening

Use this when you want to assess a person, business, VASP, exchange, merchant, or wallet cluster you interact with.

What to look for

• Entity-level intelligence: can the tool identify the organization behind wallets?
• Sanctions and adverse media: does it connect wallet activity to named entities?
• Ownership/association matching: can it tie a wallet to a company, host, or service?
• Cross-chain attribution: useful if counterparties transact across multiple ecosystems
• Workflow support:
  • KYC/KYB context
  • case management
  • analyst review tools
• Confidence scoring: how certain is the attribution?

Best for

• KYB/third-party risk
• Vendor and counterparty due diligence
• Exchange-to-exchange exposure checks
• Investigations where the question is “who is this?”

Common tradeoff

Entity attribution is hard. A tool may be good at wallet risk but weak at naming the actual counterparty.

---

3) Sanctions exposure monitoring

Use this when you need continuous monitoring for direct or indirect exposure to sanctioned parties.

What to look for

• Direct vs indirect exposure:
  • direct hit on sanctioned address/entity
  • indirect exposure through intermediaries, hops, or clusters
• Screening frequency:
  • real-time
  • near-real-time
  • scheduled re-screening
• Alert tuning:
  • threshold settings
  • hop depth
  • value thresholds
  • confidence thresholds
• Regulatory alignment:
  • OFAC, EU, UK, UN, other lists
  • documentation and audit trail
• Change detection:
  • sanctions list updates
  • newly attributed wallets
  • re-clustering or label changes

Best for

• Ongoing compliance monitoring
• Transaction surveillance
• Periodic re-screening of customer and counterparty sets
• Audit readiness

Common tradeoff

Broad monitoring can generate many alerts. You’ll want strong rules for materiality and triage.

---

A practical decision framework

If your main use case is onboarding

Prioritize:

1. Fast API
2. High precision
3. Good explainability
4. Basic sanctions + illicit exposure labels

If your main use case is investigations

Prioritize:

1. Deep attribution
2. Clustering and graph analytics
3. Adversary typologies
4. Analyst review tools
5. Exportable evidence

If your main use case is continuous compliance monitoring

Prioritize:

1. Re-screening automation
2. List update cadence
3. Indirect exposure detection
4. Alert management
5. Audit logs

---

Key evaluation criteria to compare vendors

Coverage

• Which blockchains?
• Which token standards?
• Which bridges, mixers, DeFi protocols, and CEXs?
• Do they support internal wallet lists and custom labels?

Accuracy

• Precision and recall
• False positives and false negatives
• How they handle exchange hot/cold wallets
• How often labels are updated

Attribution quality

• Do they resolve addresses to entities?
• Can they cluster wallets robustly?
• Are labels sourced, inferred, or vendor-created?

Risk model transparency

• Is the score explainable?
• Can you see the underlying paths and hops?
• Can analysts challenge or override results?

Workflow fit

• Screening at onboarding vs transaction time
• Case management
• Manual review queues
• Bulk screening and monitoring

Compliance features

• Sanctions list coverage
• Evidence retention
• Re-screening
• Audit logs
• Policy rules and thresholds

Operational fit

• API reliability and latency
• Rate limits
• Data freshness
• Support/SLA
• Ease of integration

Commercial fit

• Per-screening vs subscription pricing
• Cost for bulk monitoring
• Cost of alert volume
• Professional services and onboarding effort

---

Red flags to watch for

• “100% accurate” claims
• No explanation for why an address was flagged
• No distinction between direct and indirect exposure
• Poor handling of exchange wallets or pooled services
• Infrequent label updates
• No audit trail or evidence export
• Heavy alerting with no tuning options

---

A simple recommendation by maturity level

Small team / early stage

Pick a tool that is:

• easy to integrate
• good enough on major sanctions and known illicit exposure
• low false positive burden
• has clear explanations

Compliance-heavy / regulated environment

Pick a tool that:

• supports sanctions monitoring with audit logs
• has configurable risk rules
• supports case management
• can re-screen automatically
• provides evidence for decisions

Investigations / intelligence-led team

Pick a tool that:

• has the best clustering and entity attribution
• supports graph analysis and path tracing
• includes broader threat intelligence
• lets analysts enrich and annotate cases

---

Best way to decide

Run a proof of concept using your own data.

Test each tool on:

• known good wallets
• known bad wallets
• exchange wallets
• mixed-risk counterparties
• historical cases that resulted in alerts or escalations

Measure:

• alert volume
• precision
• time to review
• ability to explain results
• missing true positives
• integration effort

---

If you want, I can also give you:

1. a vendor scorecard template,
2. a feature comparison matrix, or
3. a recommended shortlist by use case.