> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/manual/risk-engines/exposure.md). # Risk Exposure Engine The Risk Exposure Engine identifies risks by leveraging a database of address labels and on-chain interactions, enabling it to accurately assess whether a screened address or transaction is associated with known risk entities. ## Key Concepts ### Risk Indicators Risk indicators are labels assigned to entities or addresses to denote specific risks. The following table lists all available indicators and their descriptions:
Risk IndicatorDescription
SanctionedAddresses associated with entities designated on official sanctions lists (e.g., OFAC SDN).
Terrorist FinancingAddresses associated with terrorist organizations or used to finance terrorist activities.
Human TraffickingAddresses associated with organizations or transactions involved in human trafficking activities.
Drug TraffickingAddresses associated with entities (such as individuals, groups, or organizations) involved in the illicit production, transportation, or distribution of drugs.
AttackAddresses related to attackers, exploit contracts, or associated fund transfers.
ScamAddresses involved in fraudulent schemes, including phishing, Ponzi schemes, honeypots, or pig-butchering scams.
RansomwareAddresses controlled by ransomware operators or used to pay ransomware.
Child Abuse MaterialAddresses facilitating transactions for platforms that distribute child sexual abuse material (CSAM).
LaunderingAddresses suspected of being engaged in money laundering activities.
MixingAddresses belonging to cryptocurrency mixers or privacy services that obscure transaction trails.
Dark MarketAddresses operated by darknet markets (e.g., Hydra).
Darkweb BusinessAddresses involved in illicit darknet commercial activities (e.g., weapon sales, identity theft).
BlockedAddresses blacklisted by major smart contracts or issuers (e.g., USDT, USDC).
GamblingAddresses belonging to online gambling platforms.
No KYC ExchangeAddresses associated with virtual asset service providers that lack robust Know-Your-Customer (KYC) procedures.
FATF High Risk JurisdictionEntities registered in countries or jurisdictions on the FATF blacklist.
FATF Grey List JurisdictionEntities registered in countries or jurisdictions on the FATF grey list.
### Exposure Value The total monetary value (in USD) of crypto assets that either originate from or have interacted with a specified risk source. ### Exposure Percentage The percentage of tainted assets relative to the total inflow or outflow value associated with the address. ## Address Exposure Engine The Address Exposure Engine is used to identify whether an address is associated with entities that have risk labels (e.g., sanctioned or fraudulent entities). Phalcon provides three detection templates: ### 1. Entity Risk Checks if the screened address itself carries a risk label (e.g., "Sanctioned" or "Scam"). **Example**: The address `0x742d35Cc6634C0532925a3b844Bc454e4438f44e` is flagged as "Sanctioned" for being on the OFAC list. ### 2. Interaction Risk Traces funds received or sent by the screened address across multiple transaction hops. If any address in the fund flow carries a risk label, it flags a risk based on customizable rules (e.g., transfer direction, amount threshold). **Example**: The address `0x1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p` received $100,000 from a "Darknet Market" address two hops away, triggering a risk alert. ### 3. Blacklist Interaction Determines if the target address has interacted with addresses on a user's blacklist. ## Transaction Exposure Engine The Transaction Exposure Engine assesses whether a transaction is associated with configured risk indicators. Phalcon provides three detection templates: ### 1. Participant Risk Assesses whether addresses involved in the transaction carry configured risk indicators. **Note**: If screening a transaction or transfer by a specified direction (deposit or withdrawal), the following limitations apply: * **Deposit**: Risk screening is only performed on the "***From***" address. * **Withdrawal**: Risk screening is only performed on the "***To***" address. ### 2. Interaction Risk Traces the fund flow of the screened transaction to identify potential risk exposure. **Example**: If the "***From***" address in a transaction has previously received funds from a "Phishing" address, the transaction will be flagged for direct exposure to phishing risk. * **Deposit**: Only the source of the transaction's funds is traced for risk exposure analysis. * **Withdrawal**: Only the destination of the transaction's funds is traced for risk exposure analysis. ### 3. Blacklist Interaction Checks if the target transaction is exposed to addresses on a user's blacklist.