A MEDIUM or HIGH score is a prompt for a closer look, not a verdict. Here is what drives a flagged result, why flags are a feature rather than a flaw, and how your team should read QCA output day to day.
Every automated risk system, from credit card fraud detection to airport security screening, produces results that are not confirmations of wrongdoing. They are prioritisation signals: a way of directing limited human attention to the cases that deserve it most. QARS, the scoring engine behind QuantChainAnalysis, works the same way. A HIGH score means a wallet shares characteristics with patterns associated with elevated AML or sanctions risk. It does not mean the wallet's owner has done anything wrong, and it is not a legal finding of any kind.
A risk score is a starting point for review, not an ending point for judgement. The purpose of pre-broadcast screening is to make sure the right transactions get a second look before they become irreversible, not to declare guilt automatically.
QARS evaluates a wallet and its recent transaction history across ten risk dimensions covering things like counterparty exposure, transaction patterns, contract interactions, and proximity to addresses associated with sanctions lists or known illicit services. Each dimension contributes to an overall score between 0 and 10. A score climbs when a wallet shows several of these characteristics at once, even if each individual characteristic, on its own, would be unremarkable.
This means a legitimate wallet can sometimes score MEDIUM, and occasionally HIGH, for entirely innocent reasons. A few common, non-technical examples:
New wallets with no transaction history are, statistically, more often associated with risk. A legitimate user setting up a new wallet for a large but perfectly normal transfer (a business onboarding a new treasury wallet, for example) will share this characteristic with riskier patterns, even though nothing illicit is happening.
QARS checks not only whether a wallet itself appears on a sanctions list, but whether it has transacted with addresses that do. An exchange, a liquidity pool, or a payment processor that has, among millions of transactions, processed a small number of payments that later touched a flagged address can show elevated proximity scores without having done anything wrong itself. This is sometimes called the "six degrees" problem, and it is common across the entire industry, not specific to QARS.
Splitting a large payment into several smaller ones is a recognised money laundering technique, but it is also exactly how some businesses pay invoices, payroll, or supplier instalments. QARS flags the pattern because the pattern itself is what regulators expect institutions to be able to explain, not because the pattern is inherently wrongful.
| Tier | What it signals | Recommended action |
|---|---|---|
| LOW (0 to 4) | No significant risk indicators detected. Routine activity. | Proceed. No manual review needed in most workflows. |
| MEDIUM (4 to 7) | One or more risk indicators present, but not at a level requiring automatic intervention. | Optional review based on internal policy and transaction size. |
| HIGH (7 to 10) | Multiple significant risk indicators present, including possible sanctions proximity or known illicit patterns. | Hold for manual review before the transaction is broadcast, or before funds are released. |
The tier names describe the pattern, not the person. A HIGH score tells your compliance team "this transaction shares enough characteristics with risky patterns that a human should look at it before it becomes irreversible." That is a different statement from "this person is a criminal," and treating the two as equivalent creates real problems: legitimate customers get blocked unnecessarily, support teams get overwhelmed with appeals, and the credibility of the screening system itself erodes over time.
In most QCA configurations, a HIGH score triggers a hold for review, not an automatic refusal. The transaction is paused at the one point where pausing still matters: before it is broadcast and becomes permanent. A reviewer can then clear it in seconds if the context is legitimate, or escalate it if it is not. The value of pre-broadcast screening is the pause itself, because after broadcast, the option to pause no longer exists.
A small number of MEDIUM or HIGH scores on otherwise normal business activity is expected, and it is a sign the system is working as intended, not a sign of malfunction. The goal is not zero flags. A system tuned to never flag a legitimate customer would also, by definition, never flag the transactions that genuinely warrant a second look, which defeats the purpose of having the system at all.
What matters in practice is the review workflow around the score: how quickly a flagged transaction can be checked, what context the reviewer sees, and how that decision is recorded. QCA's reports are built to support exactly that, giving your compliance team the supporting detail behind a score so a review can be completed quickly and the outcome documented for your own records.
QCA's pre-broadcast screening is designed to sit alongside your existing compliance judgement, giving your team the information needed to make a fast, well-documented decision before a transaction settles. The system tells you where to look. Your team decides what it means.
For questions about tuning thresholds to your organisation's risk appetite, or for guidance on building a review workflow around QCA output, contact our team at contact@quantchainanalysis.com.