AML Screening
The Vault can screen outgoing transfers against a blockchain analytics provider before they are approved or signed. Screening is an optional module: the deployment decides whether it runs at all, and each profile then configures its own providers, credentials and enabled functions. Vendor endpoints and block thresholds are deployment-wide.
Screening runs after policy evaluation and before approvals and MPC signing. A transfer a policy already rejected never reaches a provider.
What Is and Is Not Screened
The subject of a screening call is the destination address of an outgoing transfer. Incoming deposits are not screened, and a profile with no provider enabled is not held for screening at all — its transfers go straight from policy evaluation to approvals.
Two functions can be enabled per provider:
| Function | What it checks |
|---|---|
| Address screening | The risk and sanctions exposure of the destination address |
| KYT | Chainalysis transaction monitoring: the withdrawal attempt is registered with the vendor and the Vault waits for its assessment |
Where Screening Sits in the Flow
Verdicts
| Outcome | What happens to the transfer |
|---|---|
| Passed | Continues to PENDING_APPROVAL, or to PENDING_SIGNATURE when the matching policy requires no approvals |
| Blocked | Becomes AML_VERIFICATION_FAILED — terminal; nothing is signed |
| No verdict within the screening window | Becomes AML_VERIFICATION_FAILED — screening is fail-closed |
A transfer waits in PENDING_AML_VERIFICATION while screening runs in the
background; failed provider calls are retried until the window closes. The
window is a deployment setting, five minutes by default. The number of
approvals the matching policy required is preserved, so a passed transfer is
not re-evaluated.
A provider outage does not let transfers through. If no verdict is reached in time, the transfer is rejected and has to be re-created. The same holds if the Vault cannot read a profile’s screening settings — transfers are held, not released.
Configuring Providers
Screening is configured per profile in the dashboard under Settings → Compliance: pick a provider, store its credentials, enable the functions you need, and turn the provider on. Several providers can be configured at the same time. See Providers & Coverage.
- Credentials are encrypted at rest and never returned — the dashboard shows only whether a key is stored and its masked tail.
- Validate checks a stored key against the vendor per function and records when it was last verified.
- If a stored credential can no longer be decrypted, the dashboard flags it and it must be entered again.
- Changing screening settings is an audited action, performed in the dashboard by a member of the profile.
Changes to settings and credentials, and every transfer rejected by screening, are written to the audit log. The provider’s own reason for a block stays in the stored screening report; the transfer itself carries a generic rejection reason.