The Short Answer: Yes, Address Risk Drifts Over Time This page is part of the KYT Resource Center.
A question that surfaces repeatedly in compliance operations - whether a wallet can be clean one day and risky the next - deserves a direct answer. Yes. A crypto wallet that returns a clean risk verdict at onboarding can become risky hours, days, or weeks later. The wallet itself did not change. The funds moving through it did.
The reason is that a single screening is a snapshot. It captures the address at one moment against the risk data available at that moment. The moment passes, the address keeps transacting, and the risk picture keeps moving. A clean verdict at 10:00 says nothing about the deposit that lands at 10:05.
This is the central problem this article addresses. Wallet risk is not a fixed property. It is a moving target, and a compliance program that treats it as fixed has a structural blind spot. The framing that helps here is simple: one-time screening is a snapshot, ongoing monitoring is the video. The rest of this article explains why the picture moves, why a snapshot is not enough under the risk-based obligations that govern virtual asset service providers, and what continuous monitoring actually does differently.
Why a Clean Wallet Becomes Risky
A wallet becomes risky because of what touches it next. The blockchain does not freeze an address's counterparty list at the moment of screening. Every incoming transaction can introduce a new connection to a risky counterparty, and that connection is what changes the risk verdict.
The mechanism is fund contamination. When an address receives funds from, or sends funds to, an address linked to sanctions exposure, a mixer, a scam operation, or an illicit service, the exposure travels along the path. The originally clean address now carries a measurable connection to that exposure. In Phalcon Compliance, this shows up as Exposure Value, the USD amount of contaminated assets linked to the address, and Exposure Percentage, the share of the address's total balance or volume that the contaminated assets represent. Both figures move as new transactions settle.
Phalcon Compliance reads risk across 17 Risk Indicator categories rather than from a single label. An address that was clean across all 17 at onboarding can pick up exposure on one or more indicators as it transacts. A sanctions touchpoint, a mixer interaction, or a connection to a known fraud cluster is enough to move the address from clean to risky, even if the address itself was never directly involved in illicit activity. The address is a node in a graph, and the graph keeps updating.
This is why a wallet can be clean one day and risky the next. The screening was correct on day one. The world moved on day two.
Why One-Time Screening Is Not Enough
If risk drifts, then one-time screening at onboarding is structurally incomplete. It answers the question "is this address clean right now" once, and then stops answering it. Every transaction that follows happens outside the verdict.
That gap is not just an operational limitation. It is a compliance gap under the frameworks that govern VASPs. The FATF framework for virtual assets combines the risk-based approach of Recommendation 1 with the ongoing-monitoring duty of Recommendation 10, and expects financial institutions and VASPs to conduct ongoing monitoring of business relationships and transactions, not a single check at the point of onboarding. The same continuing-monitoring duty sits inside US rules through FinCEN's AML program rule (31 CFR 1022.210) and suspicious activity reporting rule (31 CFR 1022.320), which together make ongoing monitoring necessary rather than a one-time onboarding step. The duty is continuous because the risk is continuous. A program that screens once and never re-screens has a distance between the duty to monitor and the control that actually runs, and examiners read that distance as a program gap, not as a deployment preference.
The operational cost of the gap is equally concrete. A wallet that drifts from clean to risky after onboarding sits inside the exchange's user base, transacting, until something forces a re-check. If that re-check only happens on the next deposit, or on a manual review triggered by an unrelated alert, the exchange has been carrying a risky address as if it were clean for the entire interval. The exposure has been compounding, the audit trail has been accumulating risk that was never logged, and the compliance team has been operating on a picture that no longer matches reality.
The false comfort of a clean verdict is the core issue. A clean snapshot is not evidence that the address is safe. It is evidence that the address was safe at one moment. Treating the snapshot as the verdict, rather than as the most recent reading, is what turns a screening tool into a false sense of security.
Ongoing Monitoring: The Video, Not the Snapshot
The fix is to replace the snapshot with the video. Ongoing monitoring means the address is re-evaluated on a continuing basis, and the moment its risk changes, the compliance team is told.
This is what Phalcon Compliance Monitor does. Monitor continuously watches already-screened addresses on a dynamic schedule, automatically re-analyzes each address as new risk data arrives, and emits an alert when the address's risk changes. A wallet that drifts from clean to risky because of a new counterparty exposure does not wait for the next manual check. Monitor surfaces the change.
Two design points matter for teams operating under quota pressure. First, Monitor does not consume Screening quota. A team that leaves Monitor running on a watched address list is not spending the per-check budget that its real-time deposit and withdrawal screening depends on. Monitor runs on its own track, billed by the Monitor tier, which is sized by the number of concurrently monitored addresses across a range from 1 to 200. Second, on the Essential and Scale tiers, the first monitored address is free, so a team can validate the workflow on one address before scaling up.
The practical difference is this. With snapshot screening, a compliance team can only say "this address was clean when we checked." With Monitor, the team can say "this address was clean when we checked, and we have been watching it since, and we were alerted the moment that changed." The second statement is what ongoing monitoring actually means under the risk-based approach, and it is the statement an examiner, an auditor, or an internal reviewer is looking for.
What to Do Next
If your compliance program still treats onboarding screening as the verdict, the next step is to add the video layer. Identify the addresses that matter most, the ones tied to active accounts, high-value wallets, or counterparties with higher exposure. Put them under continuous monitoring so that the moment one of them drifts from clean to risky, your team is alerted rather than surprised.
Monitor wallet risk with Phalcon Compliance, and turn a one-time clean verdict into an ongoing assurance that the address is still clean today.