> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/manual/concepts.md). # Core Concepts This page explains the core terms and concepts used throughout the Phalcon Compliance platform. Understanding them will help you make better use of the platform. ## Risk Levels Each screened address or transaction is assigned a risk level. When creating or editing a risk engine, you can define the risk level it assigns when an alert is triggered. The available levels, from highest to lowest severity, are: * **Critical** * **High** * **Medium** * **Low** * **Informational** * **No Risk** — Automatically assigned to whitelisted addresses or when no risk indicators are detected. The meaning of each level is determined by your organization — configure them to align with your internal compliance policies and risk tolerance. ## Risk Types Phalcon uses two complementary risk detection methods: ### Exposure Risk Detects risk based on **what the target is** and **who it interacts with**: * **Entity Risk**: Checks whether the screened address itself has risk labels — for example, whether it has been identified as a sanctioned entity, scam address, or mixer. * **Interaction Risk**: Traces fund flows to check whether the target has direct or indirect connections to known risky entities, such as sanctioned addresses, mixers, darknet markets, or scam operations. * **Blacklist Interaction**: Checks whether the target has interacted with an address on your blacklist. Learn more: [Risk Exposure Engine](/manual/configure/risk-engines/exposure.md) ### Behavioral Risk Detects risk based on **how funds move**. The system identifies suspicious patterns such as unusually large transfers, high-frequency transactions, or rapid fund relaying — common indicators of money laundering or layering. Learn more: [Behavioral Risk Engine](/manual/configure/risk-engines/behavior.md) ## Transactions vs Transfers * **Transaction**: An on-chain transaction identified by a transaction hash. A single transaction may contain multiple token transfers. * **Transfer**: An individual token movement within a transaction (for example, an ERC-20 transfer). A transfer is the smallest screening unit in Phalcon — each transfer is evaluated for risk separately. ## Screening Direction When screening a transaction, you can specify a direction to tailor the risk analysis: * **Deposit**: The transaction represents customer funds flowing into your platform. Only **inbound** risks (the source of funds) are traced. * **Withdrawal**: The transaction represents customer funds flowing out of your platform. Only **outbound** risks (the destination of funds) are traced. * **Both** (default): If no direction is specified, both inbound and outbound flows are screened. Setting the correct direction reduces false positives by focusing the analysis on the relevant fund flows. ## Labels, Tags, and Notes These three mechanisms help you annotate and organize addresses: | Concept | Source | Editable | Description | | --------- | ---------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Label** | System-generated | No | A human-readable identifier from BlockSec's verified address database (for example, "Binance Hot Wallet"). | | **Tag** | System + user | Partially | System tags (for example, "Sanctioned" and "Mixer") are immutable. Custom tags (for example, "VIP Customer" and "Pending Review") can be freely added or removed. Each address can have up to 5 tags in total, combining system and custom tags. | | **Note** | User | Yes | Free-text annotations visible to all team members. Recorded in the address's audit log. | ## Risk Indicators Risk indicators are labels assigned to entities or addresses that represent specific risks (for example, "Sanctioned," "Scam," or "Mixing"). Risk exposure engines use them to assess whether a screening target is associated with known risky entities. For the complete list of risk indicators, see the [Risk Indicator List](/api-documentation/introduction/risk-indicator-list.md). ## Risk Engine Risk engines are configurable rules that define which risks to detect and when to trigger alerts. Each rule specifies: * **Target Type**: Address or transaction * **Risk Type**: Exposure or behavioral * **Template**: The detection method (for example, Entity Risk, Interaction Risk, Large Transfer) * **Trigger Conditions**: Thresholds and parameters that determine when an alert is triggered * **Risk Level**: The severity assigned to a triggered alert * **Notification Channels**: Where alerts are sent Rules are categorized as: * **Default Rules** — Provided by BlockSec based on FATF guidelines and industry best practices. You can enable, disable, or clone them, but cannot edit their detection logic. * **Custom Rules** — Created by your team with full control over all settings. Phalcon provides a set of [default rules](/manual/configure/risk-engines/default-engines.md) that are ready to use. You can customize them or create new ones from templates. ## Monitor Monitor provides continuous risk monitoring for addresses. Once enabled, the system automatically reanalyzes addresses on a dynamic schedule and sends alerts when their risk status changes — eliminating the need for manual rescreening. Learn more: [Monitor](/manual/monitoring/monitor.md) ## Blacklist and Whitelist * **Blacklisted** addresses are automatically marked as **Critical** risk and bypass all rule evaluation. * **Whitelisted** addresses, entities, or categories are automatically marked as **No Risk** and bypass all rule evaluation. Whitelists support three subject types: Address, Entity, and Category. Manage your lists under [Risk Engine → Lists](/manual/configure/risk-engines/lists.md). ## Rule Whitelist A Rule Whitelist allows you to exempt specific addresses, entities, or categories from individual rules. Unlike the global Whitelist (which bypasses all rules and marks the address as No Risk), a Rule Whitelist only skips the rules you specify — all other rules continue to evaluate normally. You can create multiple Rule Whitelists, each targeting different rules and subjects. This is available on the Scale plan and above. Learn more: [Lists](/manual/configure/risk-engines/lists.md) ## Evaluation Priority When an address or transaction is screened, lists are evaluated in the following order: 1. **Blacklist / Whitelist** — If matched, the result is returned immediately. No rules are evaluated. 2. **Rule Whitelist** — If matched, only the specified rules are skipped. Remaining rules evaluate normally. 3. **Risk Engine Rules** — All enabled rules evaluate against the target. ## Rule Overlap When two rules of the same template and target type have overlapping trigger conditions, both may fire on the same address or transaction. Phalcon detects these overlaps and shows warnings on the Overview, Rules list, and Rule Detail pages. Overlapping rules are not blocked — they may be intentional (for example, different risk levels for different thresholds). The overlap indicator helps you review whether the overlap is expected or needs adjustment. ## Alerts An alert is generated when a screened address or transaction matches a rule's trigger conditions. Alerts have three statuses: | Status | Description | | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Unresolved** | The default status. Awaiting review. | | **Resolved** | Manually marked as completed by a team member. | | **Expired** | Automatically marked when the triggering conditions change — for example, the rule is deleted, the address is whitelisted, or a rescan no longer matches. | Manage alerts in the [Alert Hub](/manual/monitoring/alert-hub.md). ## Exposure Value and Exposure Percentage * **Exposure Value**: The total monetary value, in USD, of crypto assets originating from or interacting with a specified risk source. * **Exposure Percentage**: The proportion of tainted assets relative to the address's total inbound or outbound value. These metrics help you quantify the severity of risk exposure.