| name | behavioral-risk-screening-concepts |
| description | Educational map of behavioral risk screening—volume, velocity, and transit-style heuristics at address and transaction level. Use when the user asks about suspicious pattern detection, structuring-like activity, rapid fund movement, or AML-style behavior rules—not for tuning systems to evade monitoring or for legal conclusions. |
Behavioral risk screening (concepts)
Educational reference only. Heuristic alerts are not proof of crime. Investigate with crypto-investigation-compliance, address-clustering-attribution, and on-chain evidence. For label-based exposure (sanctions, scam tags), see risk-exposure-screening-concepts. Product specifics live in your vendor docs (phalcon-compliance-documentation where applicable).
Behavioral Risk Engine (idea)
A behavioral risk engine flags suspicious transaction patterns using statistics and rules (thresholds, windows, frequencies) rather than—or in addition to—static address labels. Baselines may be global, peer-group, or customer-specific. False positives are common; triage before escalation.
Address-level behavior (common templates)
Many compliance stacks offer address-centric rules similar to the following:
| Template | What it approximates | Notes |
|---|
| Large-value transfers | Outbound or aggregate volume far above a typical-user or rolling baseline | Often uses USD notional at observation time; threshold is configurable. |
| High-frequency transfers | Many transfers in a short window, sometimes many just below a reporting or alert threshold (“structuring-like” pattern in traditional AML language) | Requires count and time bounds; may filter by asset. |
| Transit / pass-through | Address receives then sends most funds quickly, acting as an intermediary | Used as a layering-style signal; legitimate payment processors can resemble this—context matters. |
Illustrative scenarios (hypothetical):
- A wallet sends a single outbound transfer whose notional is far above the configured large-value threshold.
- An address sends fifteen transfers of just under a chosen threshold within 24 hours.
- An address receives a large amount and forwards nearly all of it within minutes to other addresses.
Use valid chain identifiers in real work; examples here stay generic to avoid implying real flagged wallets.
Transaction-level behavior (common templates)
At single-transaction granularity, platforms often add:
| Template | What it approximates | Notes |
|---|
| Large-value transfer | Transfer amount exceeds a user-defined notional cap | May apply per asset, per corridor, or per counterparty class. |
| Rapid transit | Funds leave shortly after arrival along a monitored path (same tx chain or multi-hop within a time window) | “Rapid” is policy-defined (for example within N minutes). Overlaps with transit heuristics at graph level. |
Illustrative scenario: a transfer exceeds a $100k policy threshold, or value moves A → B within five minutes while policy treats ten minutes as the rapid-transit window.
Relationship to exposure screening
| Engine style | Focus |
|---|
| Exposure (see risk-exposure-screening-concepts) | Who the funds touched—labels, hops, taint-style exposure. |
| Behavioral (this skill) | How the address or tx behaves—size, speed, frequency, pass-through timing. |
Both may fire together; analysts should reconcile narratives and avoid double-counting the same fact pattern.
Guardrails
- Do not assist with structuring advice to evade reporting thresholds or gaming monitoring rules.
- Do not treat alerts as adverse media or legal findings without case-level review.
- Legitimate businesses (payroll, market makers, bridges) can trigger behavioral rules—use corroboration and off-chain context when available.
Goal: shared vocabulary for behavioral AML-style pattern concepts aligned with common commercial monitoring templates, without binding any specific product configuration.
