Relying on a single AML provider is risky less because of what one provider misses than because of what a business then believes. One clean result means that this provider knows nothing bad about the address yet. Treated as proof, it closes the question at exactly the moment it should stay open, and the file records a check that did not see the risk.
Blockchain analytics providers disagree for structural reasons, not because some of them are broken; international standard-setters and industry research have documented limitations and variation in blockchain analytics data. The fix is not to abandon screening. It is to stop treating one opinion as a verdict: use more than one source where the stakes justify it, treat disagreement as a trigger for review, and write down how conflicting results are resolved.
Is one AML provider really worse than none?
Stated literally, no. A single screening check catches a great deal: sanctioned addresses the provider has labelled, known theft wallets, established mixers. A business that runs one check is better placed than one that runs none, in the narrow sense that more bad funds are stopped.
The claim is about something else: the false sense of security. A business with no screening has no illusions. It knows every incoming payment is unverified, and a careful team compensates with questions, limits and caution.
A business with one provider replaces that caution with a result. When the result says clean, the payment goes through, the file records a check, and nobody asks again. The risk has not gone down as much as the confidence has gone up. When the blind spot of that one provider is exactly where the problem was, the business is worse off than its own paperwork suggests, and that gap between belief and reality is where serious mistakes happen.
What does a clean result actually tell you?
A clean result says that this provider, at this moment, has no label linking the address to a risky category within the distance it traces. Each part of that sentence is a limit.
- This provider. Every analytics company builds its own clusters and its own labels from its own sources.
- At this moment. Labels follow events. A hack, a scam report or a sanctions designation reaches each dataset at a different time.
- Within the distance it traces. Providers follow flows differently and weigh indirect exposure differently.
Even the most authoritative label source is partial. The US Treasury's Office of Foreign Assets Control, which lists digital currency addresses on its sanctions list, says in its digital currency FAQs that those listings "are not likely to be exhaustive". Commercial screening datasets combine official lists with additional proprietary sources, but they should likewise not be treated as exhaustive.
Why do AML providers disagree?
Because the job involves inference at every step. Clustering, the grouping of addresses believed to belong to one entity, rests on heuristics that are probabilities, not proofs. Attribution depends on where each provider gets its labels: official lists, its own interaction with services, public reports, investigations. Coverage depends on which chains and tokens a provider has mapped. Scoring is a policy choice: one provider may treat any direct mixer link as high risk, another may reserve its top level for sanctions and theft.
FATF has documented significant variation and methodological limitations across blockchain analytics datasets. In its updated guidance on virtual assets and VASPs, FATF describes using data from seven blockchain analytics companies for its review of peer-to-peer transfers, and reports that "the high level of variation in the data" meant "there is no consensus" on the size of that sector, revealing "challenges and limitations" of the method "in terms of coverage, timeliness, accuracy and reliability". The same guidance notes that "not all VAs are covered by all vendors". This supports caution against over-reliance on a single source, although the FATF study was not an address-by-address comparison of screening results.
None of this makes any provider bad. It means each one sees part of the picture, and the parts do not fully overlap.
How does false certainty get into a compliance process?
It rarely arrives as a decision. It arrives as a series of reasonable shortcuts.
- The check becomes a checkbox. A clean result is enough to proceed, so nobody reads the categories or the exposure behind the headline.
- The result travels downstream as a fact. "Screened, clean" is written into the customer file, and later reviewers treat it as settled.
- Monitoring is tuned to the same source. Alerts only fire when that provider's data changes, so a label another dataset added weeks ago never reaches the team.
- The audit trail looks strong. When something goes wrong, the file shows a check on every payment, and the question of why the check missed is never asked.
Each step makes sense in isolation. Together they turn one dataset's gaps into the business's gaps, with documentation that says the opposite.
Isn't more data just more noise?
This is the fair objection. More sources mean more alerts, more disagreement and more work for the analyst. If a second provider regularly flags addresses the first calls clean, the queue grows, and a team that cannot handle the queue will start approving without reading, which brings back the checkbox by another route.
The answer is not to average the opinions into one score. An average hides the most useful information: that the sources disagree. The answer is policy. Decide in advance which disagreements matter. A disagreement about a mixer several hops away may be noted and accepted. A disagreement where one provider reports direct exposure to sanctions or stolen funds goes to review, whatever the others say. Written down, that rule turns extra data into a short list of cases that deserve a person, rather than a long list of alerts that deserve nobody.
What does a second opinion change in practice?
Three things.
Coverage. A label present in one dataset and absent from another is caught by the business that looks at both. The address that one provider calls clean and another flags is exactly the case a single-provider process never sees.
Calibration. When several sources agree, confidence is earned rather than assumed. When they disagree, the analyst knows the case is not routine before spending time on it.
Resilience. A process built on one provider stops when that provider is unavailable, or quietly proceeds without a check. A process with several sources can continue with a thinner result and say so.
None of this replaces the other half of due diligence: knowing who the customer is and whether the activity fits their profile. Screening data, however many sources it comes from, is about addresses and flows, not about people.
How can a team use several sources without drowning?
- Set hard stops by category, not by source. If any source reports direct exposure to a sanctioned entity or stolen funds, the case goes to review.
- Treat disagreement as a trigger. When one source flags what others call clean, look at the category and the distance before deciding.
- Record which source said what. The file should show each opinion, not a blended score, so a later reviewer can see what was known.
- Match depth to stakes. A large OTC settlement deserves every available opinion. A routine small payment from a known customer may not.
- Revisit known addresses. Keep regular counterparties under transaction monitoring, so a label added later reaches you.
Where does AMLOfficer stand on this?
AMLOfficer is built around this argument, so it is fair to say how the product applies it. AMLOfficer is an aggregator of four AML providers in one interface, including BitOK, Global Ledger and Beosin. The point of aggregating several providers is disagreement between them: an address one provider calls clean is regularly flagged by another.
The providers a user selects run in parallel rather than one after another, and if one of them fails the report comes back thinner instead of failing. Each provider returns its own risk level out of four (Low, Medium, High and Severe), so two providers can disagree about the same address. A report carries each provider's verdict, its risk level and the risk categories it found, so where the providers disagree is visible in the report. Checks run from the web application, the Telegram mini app and the AML API.
AMLOfficer delivers the risk signal; the decision to accept, hold or refuse, and any freeze, stays with your business. It does not replace a legal or compliance team, and no number of providers turns a screening result into a guarantee. What several opinions do is make a single blind spot visible. For a closer look at what the platform covers, see the AML compliance software overview, or run an AML check on an address you already consider clean and compare what the providers say.
Single AML provider risk: common questions
Why is relying on one AML provider risky?
Because a clean result from one provider only means that this provider has no label on the address yet. Treated as proof, it ends the review at the point where a gap in that dataset matters most, and the file records a clean check that did not see the risk.
Why do blockchain analytics providers give different results for the same address?
Each provider clusters addresses with its own heuristics, gathers labels from its own sources at its own pace, covers its own set of chains and tokens, and scores risk by its own policy. FATF, comparing data from several analytics companies in a study of the peer-to-peer market, documented variation and limitations in coverage, timeliness, accuracy and reliability; the study was not an address-by-address comparison of screening results.
Should results from several providers be averaged into one score?
No. Averaging hides the disagreement, which is the most useful part of the result. Keep each provider's opinion visible and decide by category: a direct link to sanctions or stolen funds from any source should go to review.
Does using several providers create too many alerts?
It can, without a policy. Decide in advance which disagreements are accepted and which go to a person, and match the depth of checks to the size and risk of the transaction.
Is screening with several providers a guarantee?
No. Several sources reduce the chance that a single blind spot decides the outcome, but every dataset lags events and none is exhaustive. Screening supports a decision; it does not replace it.
Does an AMLOfficer report show each provider's view?
Yes. A report carries each provider's verdict, risk level and risk categories, so the analyst sees where they agree and where they do not. The decision stays with your business.
