Skip to main content

Why a screening policy reached its verdict: which layer matched, and what it matched on in the vendor's own vocabulary.

Only provider and matched are always present. The rest depend on the vendor and on which leaf actually fired — a floor match on a Chainalysis cluster carries a category and no riskType.

​
provider
enum<string>
required

The vendor whose response produced this verdict.

Available options:
trm-wallet-screening,
chainalysis-address-screening,
dynamic-sanctions-screening
​
matched
enum<string>
required

Which layer decided. floor is the non-configurable sanctions baseline, address an allow/deny list entry, customer one of the environment's own rules, default the terminal allow. On this event it is always customer or address; a floor block emits wallet.sanctions.blocked instead.

Available options:
floor,
address,
customer,
default
​
revision
integer

The policy generation that produced this verdict. Scoped to one screening moment, so two verdicts in the same environment can legitimately carry different revisions.

​
rule
object

The matched rule, verbatim as evaluated. Present only when matched is customer: the floor and the terminal allow are generated from code, so there is nothing stable to point at. Deliberately untyped — nothing routes on its internal shape, and it is carried for the audit record.

​
category
string

The vendor's category string, verbatim, in the vendor's own casing.

Maximum string length: 128
​
riskType
string

TRM only. OWNERSHIP, COUNTERPARTY or INDIRECT.

Maximum string length: 64
​
score
number

TRM only. The numeric risk score the matched signal carried.

​
risk
string

Chainalysis only. The risk level the matched signal carried.

Maximum string length: 32
​
summary
string

Human-readable rendering of what matched, for display and logs.

DISPLAY ONLY AND NON-CONTRACTUAL: the wording may change in any release. Do not parse it — route on category, provider and matched instead.

Maximum string length: 256
Last modified on October 6, 2026