> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extractor.live/llms.txt
> Use this file to discover all available pages before exploring further.

# AML Detector

> The AML Detector scans blockchain transactions and flags addresses that appear on AML lists, sanctions registries, and known exploit databases.

The AML Detector acts as a **pre-screening tool** — providing fast initial risk detection before deeper analysis. It checks every transaction against the configured address lists and fires an alert when a match is found.

<Warning>
  AML scores are not always real-time. When you open an alert, the system may re-query the score — so the value shown may differ slightly from the one that originally triggered it.
</Warning>

## Source

Specifies which address list the detector checks against. Only **one source** can be selected at a time.

<Tabs>
  <Tab title="ext">
    Extractor's proprietary AML address database — maintained and updated continuously by Hacken.
  </Tab>

  <Tab title="custom">
    Only addresses you define in the **Custom Addresses** field are checked. Useful for internal watchlists.
  </Tab>

  <Tab title="empty">
    Uses the global internal address list shared across your tenant.
  </Tab>
</Tabs>

## Tags filter

Narrows alerts to specific AML risk categories. Enter tags as comma-separated values — prefix with `!` to exclude.

```
sanctions, exploit        ← match either
!sanctions                ← exclude sanctions, match everything else
```

| Tag                  | Meaning                                    |
| -------------------- | ------------------------------------------ |
| `cybercrime`         | OFAC-listed or cybercrime-related activity |
| `sanctions`          | Directly sanctioned entities               |
| `sanctions_exposure` | Indirect exposure to sanctioned entities   |
| `suspicious`         | Flagged for suspicious behavior            |
| `exploit`            | Involved in a known exploit                |

## Score condition

Filters alerts based on AML risk score in the range **0.0 – 100.0**.

<AccordionGroup>
  <Accordion title="Score > 0 (recommended for known addresses)">
    Addresses **without a score will NOT trigger** an alert. Use this when you only care about addresses with confirmed risk data.
  </Accordion>

  <Accordion title="Score >= 0 (include unscored addresses)">
    Addresses **without a score WILL trigger** an alert at Info severity. Use this when you want visibility into any address interaction, regardless of scoring coverage.
  </Accordion>
</AccordionGroup>

## Tracking options

Select which transaction components are evaluated:

* **Track Transaction** — all addresses involved in the transaction
* **Track From** — sender address only
* **Track To** — recipient address only
* **Track Token** — token transfer addresses (the monitored address is treated as the token contract)

## Custom addresses

Add your own addresses in CSV format:

```csv theme={null}
Address, Score, Name, Tags
0x1049a94a2238297156826cfcd8b35a3c0400ee98, 80.0, Tornado Cash, ofac;sanctions
```

* **Score** — value between `0.0` and `100.0`
* **Tags** — semicolon-separated (e.g., `ofac;sanctions`)

## Severity

Set to **Auto** to let the detector map the AML score to severity automatically, or override with a fixed level: `Critical` · `High` · `Medium` · `Low` · `Info`.