Screen with Elliptic

Elliptic is a screening provider you can use with your own key. Dynamic sends each address to your Elliptic account, applies the sanctions baseline to the response, and then evaluates your screening policy against it. The calls run under your Elliptic contract and appear in your Elliptic audit trail. Elliptic works only with your own key. Dynamic-managed screening does not include an Elliptic account.

What you need

• An Elliptic account and an API key with Lens access. Lens is the Elliptic product that provides address screening, so a key with only Navigator access cannot screen addresses. Elliptic issues a key as two parts, an access key and a secret, and you need both.
• The Admin role on the Dynamic environment.
• Elliptic screening enabled for the environment.

Create and add your key

Create the key in your Elliptic account, under API Keys in Elliptic’s settings, and give it Lens access. Elliptic can change these screens, so follow its API key generation article for the current steps. The article requires you to be signed in to Elliptic. Elliptic’s authentication reference explains how the two parts of a key are used. Then add the key in the Dynamic Console:

1. Open Fraud Protection.
2. Under Compliance Screening, find Bring Your Own Screening Key.
3. On the Elliptic card, select Add key.
4. Enter your Elliptic access key in Access key and your Elliptic secret in Secret, then select Save.

Elliptic is the only provider that takes two inputs. Dynamic validates the pair against Elliptic before it stores anything. If Elliptic rejects either part, the Dynamic Console reports that the provider rejected the key, and nothing is stored. The same applies to a key that is in the wrong format, to a rate or quota limit on your Elliptic account, and to an Elliptic outage. A rejected signature and a rejected access key produce the same message, so check both inputs when you see it. Use Replace key to rotate the pair and Remove key to delete it. Both behave as they do for the other providers. See rotate or remove a key.

What Dynamic screens

Elliptic analyzes an address and returns the labels on the address itself and the exposure of the address to other entities. Dynamic reads both.

• Labels on the address. Elliptic groups addresses into entities. If the entity that owns the screened address carries a category such as a mixer or a darknet market, a rule on the address itself matches it.
• Exposure. Elliptic reports the entities that the address received funds from or sent funds to, directly and through intermediaries. A rule on someone it dealt with matches direct exposure, and a rule on someone further out matches indirect exposure.
• The risk score. Elliptic returns one number for the address. A rule can act on it. See how scores work.

The sanctions baseline

The sanctions baseline blocks an address when the entity that owns the address is on any sanctions list that Elliptic reports. The lists include the OFAC SDN list and others, such as the EU consolidated list and the UK sanctions list. The baseline does not depend on the risk score or on the category names, and no screening policy can weaken it. Elliptic’s response also lists sanctions that belong to entities the address has dealt with. Those listings never block on their own. An address that received a small share of its funds from a sanctioned entity is not blocked by the baseline, because blocking on counterparties would stop many legitimate users. You can opt in to acting on that exposure with a rule of your own on a sanctions category.

What the baseline does not block

As with every provider, the baseline does not block on a risk score, on counterparty or indirect exposure, or on non-sanctions categories. A screening policy is how you act on those signals.

Supported chains

Dynamic has verified Elliptic screening on EVM chains, Solana, Bitcoin, Tron, and XRP. Elliptic lists coverage for other chains that Dynamic wallets support, but Dynamic has not exercised them, so treat their results as best effort. The same applies to TRM Labs and Chainalysis on a chain they do not index.

An address with no data

Elliptic has no data on an address that has never been used, that is too new to be indexed, or that is on a chain Elliptic does not index. Dynamic treats that as a clean result, in the same way it treats an empty result from TRM Labs or Chainalysis. Your address exceptions and your rules still run against it, so a Block this address exception still blocks an address Elliptic has no data on. The sanctions baseline has nothing to match, so a sanctioned address that Elliptic has never seen is not caught by Elliptic.

How scores work

An Elliptic risk score is calculated by the rules in your own Elliptic account. It is not a Dynamic scale. Two accounts that screen the same address can return different scores, because each account scores the share of funds that touch the entities its own rules list.

• Elliptic reports the score as a number. A rule in Dynamic compares it to a threshold you choose, from 0 to 10 and with one decimal place.
• A score of 0 is a score. A missing score means that none of your Elliptic rules fired for the address.
• An Elliptic account with no risk rules returns no score for any address. A score threshold in a Dynamic rule then never matches, and only the sanctions baseline and your category rules can fire. Dynamic does not work around this. Configure risk rules in Elliptic first, which Elliptic manages under Risk Settings in its settings.

Because the score is a function of your Elliptic rules, Dynamic does not recommend a threshold. A value that suits one account’s rules can block or miss the wrong addresses on another. Choose a threshold by screening addresses you understand against your own account, and review past alerts and blocks before you tighten it. See Validate a screening policy.

Write a policy for Elliptic

Author an Elliptic policy in the same editor as the other providers. See Configure a screening policy. The parts that differ are:

• Categories come from Elliptic’s own taxonomy. A category that Elliptic adds later and that the editor does not list yet is shown by its name when it appears in a rule you authored through the API.
• The relationship is one choice: the address itself, someone it dealt with, someone further out, or someone it dealt with or someone further out. To act on a category however it appears, add one rule on the address itself and another on someone it dealt with or someone further out.
• The score is a number from 0 to 10 that you type, instead of a risk level you pick.

A condition the editor cannot express, such as one on the percentage or dollar value of an exposure, or on which of your Elliptic rules fired, is authored through the API. The fields you can use are listed under Elliptic fields in the rule format reference. Elliptic has its own policies. Configuring Elliptic does not change the policies for TRM Labs or Chainalysis. When more than one provider is configured, each produces its own verdict and the most severe one wins.

When screening fails

Screening fails open, as it does for every provider. If Elliptic is slow, returns an error, or rejects your key after you stored it, the request proceeds, and Dynamic-managed screening checks the address against Dynamic’s own sanctions list. Dynamic does not notify you when your Elliptic key stops working, so monitor your Elliptic usage and your screening events. An answer from Elliptic is reused for the environment’s screening result cache interval, which is 24 hours by default. A reused answer is re-evaluated against your current policy, so editing a policy changes the verdict on a stored response without a new Elliptic call.