What happens after a crypto wallet risk alert?
A wallet risk alert begins an investigation. The reviewer must confirm the target, understand the strongest indicators, compare them with the payment context, and record a proportionate action.
This worked example follows that process inside Farona. The customer, wallet history, amounts, and evidence are fictional. The example does not reproduce a live report or predict the result that Farona would assign to any real address.
A digital services company receives an invoice payment of 8,400 USDC from a new business customer. Before granting access, the finance team checks the sending wallet. Farona returns a Medium risk assessment with indirect exposure that deserves review.
Step 1: Define the decision before opening the report
The team begins with a specific question: Can we accept this payment and activate the customer's account under our current policy?
That question controls the investigation. The reviewer records the invoice number, amount, asset, network, transaction hash, sending wallet, receiving wallet, payment time, customer name, and stated purpose.
The team also agrees on possible outcomes before seeing the result:
- Proceed and retain the report.
- Request additional evidence before activation.
- Pause and escalate for specialist review.
- Decline when company policy clearly requires it.
Step 2: Run the correct wallet check in Farona
From the Farona Dashboard, the reviewer pastes the sending wallet into Check a wallet or transaction. Farona detects the target format, while the reviewer confirms the network and token. An optional note links the check to the internal invoice reference without placing unnecessary personal data in the note.
Checking the correct target matters. A transaction hash answers a transaction focused question, while a wallet check examines the address. For this case, the question concerns the payer's wallet history, so the team chooses the sending wallet.
If your case starts with a specific transfer, our guide to investigating a suspicious crypto payment explains how to preserve transaction facts first.
Step 3: Read the base assessment in the right order
When the report is ready, the reviewer starts with the Farona assessment, not with a conclusion about the customer. The base report provides a Farona score, one of five Farona risk levels, a plain language verdict, and the available Risk indicators.
In this fictional case, the Medium result means the evidence needs review. It does not mean the wallet owner committed an offence, and it does not require an automatic rejection.
The reviewer reads the strongest indicator and records four facts:
- Risk type: What category produced the concern?
- Connection: Is the exposure direct or indirect?
- Distance: How many intermediate addresses appear in the path?
- Materiality: What volume or activity share is available?
The fictional report shows indirect exposure through two intermediate addresses. The team writes exactly that. It does not claim the customer transacted directly with the identified entity. For more detail on this distinction, read Direct and Indirect Crypto Wallet Exposure Explained.
Step 4: Separate fact from inference
A defensible case note separates observation from interpretation.
- Observed fact: The checked wallet has an indirect path to an identified risk category through two intermediate addresses.
- Possible inference: The payer may have received funds from a service connected to that path.
The inference remains uncertain until more evidence is available. Do not write that a customer used an illicit service when the blockchain evidence does not establish that claim.
Step 5: Unlock only the sections that answer a question
Farona offers six additional sections: Wallet overview, Address labels, Address actions, Address profile, Counterparties, and Transaction flows. Each available section can be unlocked individually, and Farona shows the credit cost before the action.
The team does not unlock everything. It identifies two remaining questions.
Question 1: Does this payment fit the wallet's normal activity?
The reviewer unlocks Wallet overview to examine balance, transaction count, total received and spent, and first and last activity for the selected token. In the fictional result, the wallet has months of activity and the invoice amount is not obviously inconsistent with its broader use.
Question 2: Where did the recent incoming value come from?
The reviewer unlocks Transaction flows to examine incoming and outgoing counterparties and amounts for the token. If the main relationship rather than individual movement were the question, Counterparties would be the more direct choice.
The deeper view does not erase the alert, but it narrows the uncertainty. The relevant funds appear to have arrived from an exchange withdrawal shortly before payment. The next question is therefore about ownership and source of funds, not a search through every available data section.
Step 6: Ask for evidence that can resolve the uncertainty
The business sends a focused request to the customer:
- Confirm that the sending wallet was under the customer's control at payment time.
- Provide the exchange withdrawal record showing the amount, destination address, and timestamp.
- Provide the invoice or accounting record that explains the payment purpose.
- Explain any third party involvement if the exchange account holder and contracting business differ.
This is more useful than asking the customer to “prove the funds are clean.” The requested records can be compared with the known transaction facts. Our article on why source of funds matters in crypto AML covers this process in more detail.
Step 7: Compare the answer with the blockchain evidence
In the example, the customer provides an exchange withdrawal record, the destination matches the checked wallet, the time and amount align with the payment, and the invoice belongs to the same business relationship. No document alone proves the entire history of the assets, but the records answer the immediate ownership and payment purpose questions.
The reviewer now compares three evidence layers: the transaction facts, the Farona assessment and selected sections, and the customer's documents and explanation.
If the records had conflicted with the blockchain activity, appeared altered, or failed to explain a material exposure, the correct next step would be escalation rather than repeated requests for random documents.
Step 8: Make and document a proportionate decision
Under the fictional company's policy, a Medium result with indirect exposure can proceed after enhanced review when the payment purpose and source are reasonably supported. A second reviewer approves the case, and the account is activated.
The final record includes:
- The Farona report ID and generation time.
- The wallet, network, token, transaction hash, and invoice reference.
- The risk level and the relevant indicators, described accurately.
- The additional sections reviewed and why they were opened.
- The customer's explanation and supporting records.
- The action, approver, date, and any condition for future review.
Farona can export a PDF containing the base assessment and the sections unlocked at export time. The business should retain it according to its own record keeping and privacy rules.
What would change the outcome?
The same starting alert could lead to a different action if the exposure were direct and material, the documents did not match the transaction, the customer refused a reasonable request, or several independent indicators formed a stronger pattern. A larger transfer, a new jurisdiction, or a policy threshold could also require specialist review.
Frequently asked questions
What is a crypto wallet investigation?
It is a structured review of a wallet, its blockchain risk indicators, the relevant transaction, and the business context needed for a decision.
Does a Medium or High risk level prove illegal activity?
No. A Farona level summarizes available risk evidence. Higher levels justify stronger review and may trigger action under your policy, but they do not independently prove identity, knowledge, intent, or a criminal offence.
Which Farona section should I unlock first?
Choose the section that answers the next unresolved question. Use Wallet overview for activity context, Address labels for attribution, Counterparties for major relationships, and Transaction flows for token movement.
From alert to accountable judgment
A strong investigation is not the one that collects the most data. It is the one that asks a clear question, opens the evidence needed to answer it, tests the explanation, and leaves another reviewer able to understand the decision.
Farona structures blockchain risk evidence. The business remains responsible for its policy, legal obligations, customer communication, and final action.
Sources and further reading
- FATF: Updated Guidance for a Risk Based Approach to Virtual Assets and VASPs
- FATF: Virtual Assets Red Flag Indicators
- European Banking Authority: ML and TF Risk Factors Guidelines
This article provides general risk operations information and is not legal advice. The scenario and all case details are fictional.
