> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/manual/concepts.md).

# Key Concepts

This page explains the core terms and concepts used throughout Phalcon Compliance. Understanding these will help you get the most out of the platform.

## Risk Levels

Every screened address or transaction is assigned a risk level. When creating or editing a Risk Engine, you define which risk level it assigns to triggered alerts. The available levels, from highest to lowest severity, are:

* **Critical**
* **High**
* **Medium**
* **Low**
* **Informational**
* **No Risk** — Assigned automatically to whitelisted addresses, or when no risk indicators are detected.

The meaning of each level is up to your organization — configure them to match your internal compliance policies and risk appetite.

## Risk Types

Phalcon uses two complementary risk detection approaches:

### Exposure Risk

Detects risk based on **what the target is** and **who it interacts with**:

* **Entity Risk**: Checks whether the screened address itself carries a risk label — for example, being identified as a sanctioned entity, a scam address, or a mixer.
* **Interaction Risk**: Traces fund flows to check whether the target has connections (direct or indirect) to known risky entities such as sanctioned addresses, mixers, darknet markets, or scam operations.
* **Blacklist Interaction**: Checks whether the target has interacted with addresses on your blacklist.

Learn more: [Risk Exposure Engine](/manual/risk-engines/exposure.md)

### Behavioral Risk

Detects risk based on **how** funds move. The system identifies suspicious patterns such as unusually large transfers, high-frequency transactions, or rapid fund transit — common indicators of money laundering or layering.

Learn more: [Behavioral Risk Engine](/manual/risk-engines/behavior.md)

## Transaction vs Transfer

* **Transaction**: An on-chain transaction identified by a transaction hash. A single transaction may contain multiple token transfers.
* **Transfer**: A single token movement within a transaction (e.g., one ERC-20 transfer). Transfers are the smallest screening unit in Phalcon — each transfer is individually assessed for risk.

## Screening Direction

When screening a transaction, you can specify a direction to tailor the risk analysis:

* **Deposit**: The transaction represents customer funds coming into your platform. Only the **inflow** (source of funds) is traced for risk.
* **Withdrawal**: The transaction represents customer funds leaving your platform. Only the **outflow** (destination of funds) is traced for risk.
* **Both** (default): If no direction is specified, both inflow and outflow are screened.

Setting the correct direction reduces false positives by focusing the analysis on the relevant fund flow.

## Labels, Tags, and Notes

These three mechanisms help you annotate and organize addresses:

| Concept    | Source           | Editable  | Description                                                                                                                                                                                      |
| ---------- | ---------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Labels** | System-generated | No        | Human-readable identifiers from BlockSec's verified address database (e.g., "Binance Hot Wallet").                                                                                               |
| **Tags**   | System + User    | Partially | System tags (e.g., "sanctioned", "mixer") are immutable. Custom tags (e.g., "VIP customer", "pending review") can be freely added or removed. Max 5 tags per address (system + custom combined). |
| **Notes**  | User             | Yes       | Free-text annotations visible to all team members. Logged in the address's Audit Log.                                                                                                            |

## Risk Indicators

Risk indicators are labels assigned to entities or addresses that denote specific risks (e.g., "Sanctioned", "Scam", "Mixing"). They are used by Risk Exposure Engines to evaluate whether a screened target is associated with known risk entities.

For the complete list of risk indicators, see [List of Risk Indicators](/api-documentation/introduction/risk-indicator-list.md).

## Risk Engines

A Risk Engine is a configurable rule that defines what risks to detect and when to trigger alerts. Each engine specifies:

* **Target type**: Address or Transaction
* **Risk type**: Exposure or Behavioral
* **Trigger conditions**: Thresholds and parameters that determine when an alert fires
* **Risk level**: The severity assigned to triggered alerts
* **Notification channels**: Where alerts are sent

Phalcon provides a set of [default risk engines](/manual/risk-engines/default-engines.md) based on FATF guidelines. You can customize these or create new ones from templates.

## Monitor

Monitor is a continuous risk monitoring feature for addresses. Once enabled, the system automatically re-analyzes the address on a dynamic schedule and sends alerts when risk status changes — without manual re-screening.

Learn more: [Monitor](/manual/monitor.md)

## Blacklist and Whitelist

* **Blacklisted** addresses are automatically marked as **Critical Risk** and bypass standard risk engine screening. Any address that transacts directly with a blacklisted address is also flagged.
* **Whitelisted** addresses are automatically marked as **No Risk** and bypass standard risk engine screening.

Manage your lists in [System → Blacklist & Whitelist](/manual/system/blacklist-whitelist.md).

## Alerts

An alert is generated when a screened address or transaction matches a Risk Engine's trigger conditions. Alerts have three statuses:

| Status         | Description                                                              |
| -------------- | ------------------------------------------------------------------------ |
| **Unresolved** | Default state. Awaiting review.                                          |
| **Resolved**   | Manually marked as completed by a team member.                           |
| **Expired**    | Automatically marked when the triggering rule or address status changes. |

Manage alerts in the [Alert Hub](/manual/alert-hub.md).

## Exposure Value and Exposure Percentage

* **Exposure Value**: The total monetary value (in USD) of crypto assets that either originate from or have interacted with a specified risk source.
* **Exposure Percentage**: The proportion of tainted assets relative to the total inflow or outflow value of the address.

These metrics help you quantify the severity of risk exposure.