> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/manual/transactions.md).
# Transaction Screening
In Phalcon, the transaction module enables users to screen the risk of on-chain transactions, typically those involving interactions between customers and your platform. By scanning every incoming or outgoing transaction in real-time, Phalcon helps you detect risky funds promptly, ensuring effective risk mitigation.
The smallest unit for transaction scanning is a single transfer. If a transaction contains multiple transfers, you can screen these transfers individually or in bulk to assess the overall risk of the transaction comprehensively.
## Key Concepts
### Direction
The direction of a transaction or transfer determines the screening strategy applied.
* **Deposit**: When a transaction involves customer funds being deposited into the platform, the direction should be set to Deposit.
* **Withdrawal**: When a transaction involves customer funds being withdrawn from the platform, the direction should be set to Withdrawal.
Note: Specifying the direction affects the risk screening strategy. For example:
* If a risk engine is configured for **Deposit** transactions, it will not apply to transactions with a **Withdrawal** direction.
* For **Deposit** transactions, only the inflow of funds is traced and screened.
* For **Withdrawal** transactions, only the outflow of funds and the destination address are traced and screened.
* Setting the direction correctly allows for tailored risk rules for fund inflows and outflows, reducing false positives.
If no direction is specified, the transaction will be screened for both deposit and withdrawal directions by default.
### Notes
Users can add notes to any transaction or transfer to record additional context or observations.
## Screening Transactions
Phalcon supports two methods for importing transactions:
1. Screening a single transaction hash.
2. Bulk screening transactions via CSV.
All transactions are automatically screened against activated risk engines and displayed in the transaction list.
### Screening a Single Transaction
To screen a single transaction:
1. Enter the transaction hash you wish to add. Phalcon will automatically fetch the transfer data associated with the transaction.
2. Select the desired transfer(s) to proceed.
3. You can:
* Set the direction (Deposit or Withdrawal) to define the screening scope.
* Assign labels to provide additional context.
* Associate the transfer or transaction with a specific customer.
### Bulk Screening via CSV
Users can import multiple transactions simultaneously using a CSV file.
* Download the provided CSV template.
* Upload up to 400 transactions per batch.
* Fill out the template using the following fields:
| Field | Description |
| ---------------- | ------------------------------------------------------------------------------ |
| Chain | The specific chain name as specified in the template |
| Transaction Hash | The blockchain transaction hash. |
| Label | A user-defined private label (optional) |
| Direction | Specify "Deposit" or "Withdrawal" to define the transfer direction. (optional) |
| Customer ID | The identifier for an existing or new customer (optional) |
| Transfer From | Combined with 'Transfer To' to locate a specific transfer (optional) |
| Transfer To | Combined with 'Transfer From' to locate a specific transfer (optional) |
* Upload the CSV file.
* Review the import results in the pop-up window and ensure every desired transaction has been imported successfully.
## Transaction List
All screened transactions are displayed on the Transaction List page, showing the following details:
* Transaction Hash
* Risk Summary
* Screening Direction
* Unresolved Alerts
* Last Screened Time
* Value (USD)
* Token Amount
* Asset Involved
* From & To Addresses
* Transaction Timestamp
* Customer
* Labels
* Added Timestamp
For transactions containing multiple transfers, these transfers are collapsed by default. Click to expand and view the details of each transfer.
## Exporting Transactions
You can export your transaction list as a CSV file by clicking the **Export** button on the Transaction List page. This feature is available to paid plan users only.
The exported CSV contains the following fields:
| Field | Description | Example |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
| Chain | Blockchain network | ETH |
| Tx Hash | Transaction hash | 0xa51fa6e0ccc6b9b3... |
| Transfer Index | Index of the transfer within the transaction. `0` if only one transfer | 0 |
| Risk Level | Risk level of the transfer | Critical |
| Participant Risk Tags | Risk tags of the participating addresses. Multiple tags separated by `;` | Scam; Blocked |
| Interaction Risk Breakdown | Interaction risk indicators with details. Format: `{Risk Tag}: {Direction} {Value} ({Ratio})`. Multiple entries separated by `;` | No KYC Exchange: Incoming $0.02 (0.08%) |
| Participant Risk Details (JSON) | Structured JSON for participant risk, for programmatic parsing | See below |
| Interaction Risk Details (JSON) | Structured JSON for interaction risk, for programmatic parsing | See below |
| Screen Direction | Screening direction | Both |
| Unresolved Alerts | Number of unresolved alerts | 2 |
| Last Screening Time | Time of the most recent screening | 2026-03-31 10:23:45 |
| Value (USD) | Transfer value in USD | 5478.25 |
| Token | Token address or asset identifier | BTC |
| Amount | Token amount | 0.08199 |
| From Address | Sender address | bc1qhva56p9cnsc9d8j96... |
| From Label | System label for the sender address | Binance Hot Wallet |
| To Address | Recipient address | 3LhsVdFsMeSZhn... |
| To Label | System label for the recipient address | ChangeNow Hot Wallet |
| Transaction Time | Time the transaction occurred | 2026-03-31 09:58:02 |
| Customer | Associated Customer ID | Customer123 |
| Note | User-added note | VIP deposit address |
| Added Time | Time the data was added | 2026-03-30 15:20:11 |
**Participant Risk Details (JSON) example:**
```json
[
{
"riskIndicator": "Scam",
"appliesTo": "from",
"riskLevel": "critical"
},
{
"riskIndicator": "Blocked",
"appliesTo": "to",
"riskLevel": "high"
}
]
```
**Interaction Risk Details (JSON) example:**
```json
[
{
"riskIndicator": "No KYC Exchange",
"direction": "incoming",
"minHop": 1,
"exposureValue": 0.02,
"exposurePercentage": 0.0008,
"riskLevel": "medium"
}
]
```
## Transaction Details Page
Clicking on a transaction in the **Transaction List** opens its **Details Page**.
### Basic Information
Displays key details such as the asset involved, transaction time, labels, customer, and other relevant information.
### Screening Result
The screening result shows the risk analysis from the most recent screening, organized into the following areas:
#### Risk Summary
A quick overview of all detected risks, grouped into three categories: **Entity Risk**, **Interaction Risk**, and **Behavior Risk**. Each category has a link to jump to its detailed view.
#### Entity Risk
Shows risk attributes for all participating addresses in the transaction, grouped by address. Each address group displays:
* The address (with label if available) and its role in the transaction (e.g., "Transfer No.1 · Sender", "Transfer No.2 · Receiver").
* All risk attributes for that address — such as sanctions designations, known attack involvement, or blacklist/whitelist membership — with risk indicators, details, and triggered rules.
Address groups are sorted by risk level (highest first).
#### Interaction Risk
Shows how the transaction's participating addresses have interacted with risky counterparties through fund flows. This section includes the same three sub-sections as the address details page:
* **Indicator Breakdown** — Bar charts comparing incoming and outgoing exposure across risk indicators, distinguishing between direct and indirect exposure.
* **Risk Addresses** — A table of counterparty addresses with triggered risk indicators. You can export the list as a CSV file.
* **Fund Flow** — A visual graph of fund flows. Click **"View Detailed Fund Flow"** to open the full analysis in MetaSleuth.
{% hint style="info" %}
**Triggered vs. Not Triggered**: An indicator is "Triggered" when its exposure meets the threshold of a rule in your active Risk Engine, generating an alert. "Not Triggered" means exposure was detected but did not reach any threshold — shown for reference only.
{% endhint %}
#### Behavior Risk
Lists suspicious patterns detected in the transaction. Transaction-level behavior types include:
* **Large Transfer** — A transfer with a high USD value. Shows the transfer value, token amount, and token type.
* **Rapid Transit** — Funds that were received and sent out within a short time window. Shows the value and time window.
### Token Transfers
Displays all transfers within the transaction in two formats: a **fund flow graph** and a detailed list. Each transfer displays associated alerts. Unscreened transfers are also listed, allowing you to initiate a screening directly.
### Transfers Overview
Provides a quick-reference list of all transfers in the transaction, with shortcuts to navigate to each transfer's details.
### Alerts, Audit Logs, and Comments
* **Alerts** — All alerts triggered by this transaction. Filter by status and click through to Alert Hub for details.
* **Audit Logs** — System-generated records of screening events, risk level changes, and other activities.
* **Comments** — Team members can leave notes and collaborate on investigations.
### Available Actions
* **Re-screen** — Rescreen the entire transaction or a specific transfer. The direction can be specified for each rescreening. While re-screening is in progress, the previous result remains visible.
* **KYT Report** — Export the transaction risk details as a report.
* **STR Report** — Export data in a format compliant with Suspicious Transaction Report requirements. Select the region for the report, and ensure the transfer direction has been specified during screening. A separate STR report is generated for each transfer.
* **Share** — Generate a shareable link to the screening result. Recipients can view the report without logging in.
* **Delete** — Remove the transaction and all its associated transfers.
## Deleting a Transaction
To delete a transaction and all its associated transfers:
Click the delete button on the transaction details page or in the transaction list.