Sample ChainGuard AML Report

Sample ChainGuard wallet due diligence report

This is a fully synthetic sample built to show the structure and depth of a ChainGuard report. The institution, wallet, addresses, and reviewer shown are placeholders — it is not a customer record and is not a legal or AML determination.

Wallet Due Diligence ReportIllustrative example · not a real wallet or institution

Review required

InstitutionSample Pilot Institution

WalletXRP · rHb9…k2Qz (illustrative)

Entity attributionNone recorded

ClassificationInternal compliance review

Risk bandMedium · illustrative

Sanctions screeningNo direct match

Activity reviewedBounded sample

Counterparty scopeMultiple relationships

Report narrative

ChainGuard pairs every score with the reasoning behind it, written for a human reviewer rather than left as a bare number.

Executive summary

The review for this illustrative wallet shows a medium risk profile driven by transaction volume and counterparty diversity rather than any direct sanctions match. Sample activity reflects transfers consistent with routine exchange-linked behavior, alongside a small number of new counterparties within the sampled window.

Screening and risk assessment

The risk score reflects rule-based factors such as a transfer above the wallet's typical activity level and a moderate rate of new counterparties, combined with anomaly-assisted scoring. No single factor indicates wrongdoing on its own; together they indicate the wallet is worth a closer look before a business decision proceeds.

Transaction analysis

Sampled transaction history shows a mix of inbound and outbound transfers consistent with exchange-adjacent activity, without the repeated-amount or dusting patterns that would push the score materially higher in this example.

Graph and counterparty review

Graph analysis surfaces the wallet's most-connected counterparties by edge count, giving the analyst a starting point for further investigation rather than a conclusion in itself.

Data quality notes

No entity labels are available for this wallet or its counterparties in this sample, which is common for a wallet that has not previously been reviewed. Attribution can be added manually as part of the review and will be reflected in future reports.

Recommended analyst actions

Confirm wallet ownership and expected business purpose, review the top counterparties for context, and record the analyst's rationale and final disposition in the case file.

Primary risk drivers

The risk band traces back to readable signals and evidence, without exposing internal scoring thresholds.

Signal	Impact	Summary
Large transfer activity	Primary	One or more transfers were materially above the wallet's normal activity pattern.
New counterparty concentration	Supporting	Several new counterparties appeared during the review window.
Elevated transaction velocity	Supporting	Transaction activity increased over a short period compared with the wallet's baseline.
Moderate anomaly signal	Contextual	The wallet pattern moved outside its expected baseline, but not at a high-risk anomaly level.
Exchange proximity	Contextual	The wallet transacted with addresses consistent with exchange deposit activity.

Counterparty evidence

The most-connected counterparties are listed by edge count so an analyst knows where to start.

Counterparty	Edges	Entity labels	Last seen
rP3k…9mZq (illustrative)	42	None recorded	2026-07-01
rT8h…2Lxa (illustrative)	31	None recorded	2026-07-03
rM5w…7Vbn (illustrative)	19	None recorded	2026-06-29

Evidence appendix & disposition checklist

Each alert stays linked to its review reason and status, and the checklist keeps the final decision structured rather than freeform.

Severity	Status	Review reason
Medium	New	Large transfer activity
Low	New	New counterparty concentration

Check	Required disposition
Ownership	Confirm wallet ownership and expected business purpose.
Evidence	Review transactions, graph paths, sanctions results, and alert evidence.
Decision	Record analyst rationale, reviewer identity, and final disposition in case notes.

View ChainGuard Read workflow example

How to read this sample

Each field in the sample above maps to a specific part of the review, so an analyst — or the person auditing the analyst — can see exactly where a conclusion came from.

Risk status

A starting point, not a verdict.

The risk status (low, medium, high) reflects the combination of rule-based factors and anomaly-assisted scoring described elsewhere on this site. "Medium" here means the wallet warrants a closer look, not that it is confirmed problematic.

Sanctions

Direct list matches, checked explicitly.

This field reports whether the wallet address itself appears on a sanctions or reference list. "No direct match" describes the list-check result only — it does not evaluate indirect exposure through counterparties, which is covered separately.

Exposure

What the wallet has actually transacted with.

Exposure summarizes the pattern of counterparties and transaction flows sampled from the wallet's history — in this example, proximity to known exchange deposit addresses, which is a common and often benign pattern worth noting rather than a red flag on its own.

Recommended action

The human step the system cannot skip.

ChainGuard's output always ends with a recommended next step for a human reviewer, not an automatic approval or rejection. The final disposition — and the responsibility for it — stays with the analyst.

Sample ChainGuard AML report.