01How a screening runs筛查是怎么跑的

The big picture first: the steps a screening goes through, and where each ruleset plugs in.

先建立整体印象：一次筛查经过哪几步，两套规则集分别插在哪里。

You submit an address (KYA) or a transaction (KYT). The system runs a path investigation against the on-chain data layer, tracing the address's funds upstream and downstream for several hops to produce a fund-flow graph. Then the two rulesets take over in sequence: the path-matching ruleset finds every violation on this graph, and the scoring ruleset converts those hits into a 0–100 score and a disposition.

你提交一个地址（KYA）或一笔交易（KYT）。系统先向链上数据层发起一次路径调查，把这个地址的资金往上游、下游各追若干跳，得到一张资金流图。随后两套规则集依次介入：路径匹配规则集在这张图上找出所有违规命中，打分映射规则集把这些命中折算成一个 0–100 的分数和一个处置判定。

Input               Step 1               Ruleset A            Ruleset B           Output
Address / TX hash → Path investigation  → Path matching     → Scoring mapping   → Score + verdict
Ethereum / Tron     Expand hop-by-hop     Match each path     Direction × hops    Pass / Review /
USDT / USDC         fund-flow graph +     against rules,      × severity ×       EDD / Block
                    counterparty labels   produce hit list    share of funds

输入                第一步              规则集 A            规则集 B            输出
地址 / 交易哈希  →   路径调查        →   路径匹配        →   打分映射        →   分数 + 判定
Ethereum/Tron       按跳数展开          逐条路径匹配        按方向、跳数、       通过 / 复核 /
USDT/USDC           资金流图 +          规则,产出           严重度、资金占比     加强尽调 / 拦截
                    对手方标签          命中列表            折算成分数

02The two rulesets at a glance两套规则集的分工

On the “Rulesets” page, four cards correspond to the two kinds of rulesets.

在「规则集」页面，四张卡片对应两类规则集。

Compliance rulesets page: left — the Rulesets entry; KYA / KYT-IN / KYT-OUT — path-matching rulesets; Scoring — the scoring ruleset; the rule count opens the full rule list.

合规规则集页面：左侧「规则集」入口；KYA / KYT-IN / KYT-OUT —— 路径匹配类；评分 —— 打分映射类；规则条数，点进去查看该规则集下的全部规则。

1. Left — the “Rulesets” entry
2. 左侧「规则集」入口
3. KYA — address screening, path-matching type
4. KYA —— 地址筛查，路径匹配类
5. KYT-IN — transaction inflow side (source of funds), path-matching type
6. KYT-IN —— 交易流入侧（资金来源），路径匹配类
7. KYT-OUT — transaction outflow side (destination of funds), path-matching type
8. KYT-OUT —— 交易流出侧（资金去向），路径匹配类
9. Scoring — fund-attribution scoring, scoring-mapping type
10. 评分 —— 资金占比评分，打分映射类
11. Rule count — click through to see all rules under that ruleset
12. 规则条数，点进去查看该规则集下的全部规则

The first three cards are the same kind of thing (path-matching); the fourth is a different kind (scoring-mapping).

前三张卡片是同一类东西（路径匹配），第四张是另一类（打分映射）。

03Path-matching rulesets路径匹配规则集

How the 72 rules are organized, and what a single rule is made of.

72 条规则如何组织，以及一条规则由什么构成。

Rule list: code (unique id, echoed verbatim in results) · category (risk class) · risk (severity, converted to a weight when scoring) · action (suggested disposition) · direction (inflow / outflow / both).

规则列表：代码（唯一标识，命中后原样出现在结果里）· 分类（风险类别）· 风险（严重度，打分时换算成权重）· 操作（建议处置动作）· 方向（对流入侧、流出侧还是双向生效）。

1. Code — unique rule id, echoed verbatim in results
2. 代码 —— 规则唯一标识，命中后原样出现在结果里
3. Category — risk class that decides which scenario it belongs to
4. 分类 —— 风险类别，决定它属于哪个场景
5. Risk — severity, converted to a weight when scoring
6. 风险 —— 严重度，打分时换算成权重
7. Action — suggested disposition
8. 操作 —— 建议处置动作
9. Direction — applies to inflow, outflow or both
10. 方向 —— 对流入侧、流出侧还是双向生效
11. Built-in rulesets are read-only — copy one before editing
12. 内置规则集为只读，如需修改请先复制一份

The five rules in the screenshot are all “self-hit” rules: the address itself carries sanctions, terrorism-financing, law-enforcement-freeze and similar labels.

图中五条都是「自身命中」型规则：地址自己带了制裁、恐怖融资、执法冻结等标签。

What a rule is made of

一条规则由什么构成

Each rule is a set of conditions plus a scope. Real built-in rules (from production) look like this:

每条规则是一组条件，加上生效范围。真实的内置规则（取自生产库）长这样：

// 自身命中:地址自己就是制裁实体。跳数 0,max_hops = -1 表示「只看地址本身」
// Self-hit: the address itself is a sanctions entity. 0 hops, max_hops = -1 = "the address only"
KYA_SANCTION_SELFHIT      critical / block / 0..-1
  [{ "parameter": "primary_category", "operator": "==", "value": "Sanctions" }]

// 直接暴露:一跳之内的对手方是制裁实体,且金额 > 10 USD
// Direct exposure: a counterparty within 1 hop is a sanctions entity, amount > 10 USD
KYA_SANCTION_EXPOSURE     critical / block / 1..1
  [{ "parameter": "primary_category", "operator": "==", "value": "Sanctions" },
   { "parameter": "amount",           "operator": ">",  "value": 10, "unit": "USD" }]

// 分层暴露:2 跳,且该路径的风险资金占比 >= 5%
// Layered exposure: 2 hops, and the path's risk funds share >= 5%
KYA_SANCTION_EXPOSURE_H2  critical / block / 2..2
  [{ "parameter": "primary_category", "operator": "==", "value": "Sanctions" },
   { "parameter": "amount",           "operator": ">",  "value": 10, "unit": "USD" },
   { "parameter": "risk_rate",        "operator": ">=", "value": 5 }]

The three rule shapes

三种规则形态

The 72 rules are combinations of three shapes. Understand these three and you understand the whole ruleset:

72 条规则由三种形态组合而成，理解这三种就理解了整套规则集：

Risk categories and rule counts

风险类别与规则条数

The 72 built-in KYA rules span 9 categories:

内置 KYA 规则集的 72 条规则分布在 9 个类别：

KYA vs KYT

KYA 与 KYT 的关系

The three path-matching rulesets are structurally identical — all 72 rules — differing only in what they screen:

三套路径匹配规则集内容同构，都是 72 条，区别只在适用对象：

• KYA — screens one address. Traces both its inflow and outflow sides.
• KYA —— 筛查一个地址。追它的流入和流出两侧。
• KYT-IN — screens a transaction's payer: “where did this money come from — is the source clean?”
• KYT-IN —— 筛查一笔交易的付款方，回答「这笔钱从哪来，来源干净吗」。
• KYT-OUT — screens a transaction's payee: “where does this money go — is the destination clean?”
• KYT-OUT —— 筛查一笔交易的收款方，回答「这笔钱去哪了，去向干净吗」。

When screening a transaction you can look at one side only, or choose “both” — the system screens both ends separately and merges the results, taking the higher risk level.

筛查交易时可以只看一侧，也可以选「双向」——系统会分别筛两端再合并结果，取两者中较高的风险等级。

04Scoring ruleset打分映射规则集

Converting the hit list into a 0–100 score, then mapping it to a disposition.

把命中列表折算成 0–100 分，再映射成处置判定。

This ruleset contains no “rules” — only a set of parameters. At its core is a contribution matrix: the maximum contribution of each cell, keyed by “fund direction × hop distance × hit severity”.

这套规则集里没有「规则」，只有一组参数。核心是一张贡献矩阵：按「资金方向 × 跳数距离 × 命中严重度」给出每一格的满分贡献值。

Scoring ruleset configuration: severity weights · the contribution matrix (direction × hops × severity) · inflow direct hit of extreme severity contributes a full 80 points · outflow at 2 hops contributes only 10.

评分规则集配置：严重度权重 · 贡献矩阵（方向 × 跳数 × 严重度）· 流入·直接命中极高风险，满贡献 80 分 · 流出·2 跳同样极高，只有 10 分。

1. Severity weights — extreme ×1 · high ×0.8 · medium ×0.6 · low ×0.3
2. 严重度权重 —— 极高 ×1、高 ×0.8、中 ×0.6、低 ×0.3
3. Contribution matrix — direction × hops × severity
4. 贡献矩阵 —— 方向 × 跳数 × 严重度
5. Inflow · direct hit of extreme severity — full contribution 80
6. 流入·直接命中极高风险，满贡献 80 分
7. Outflow · 2 hops, same severity — only 10
8. 流出·2 跳同样极高，只有 10 分
9. Each cell = base × severity weight, i.e. the contribution at a 100% funds share
10. 每格 = 基数 × 严重度权重，即资金占比 100% 时的贡献

Contribution matrix (built-in defaults)

贡献矩阵（内置默认值）

How it is calculated

计算方式

单格得分 = 基数 × 严重度权重 × 资金占比
Cell score = base × severity weight × funds share
资金占比 = 去重后的风险金额 ÷ 地址链上总流入(或总流出)
funds share = deduped risk amount ÷ address total on-chain inflow (or outflow)
总分     = Σ 各格得分,封顶 100
total    = Σ cell scores, capped at 100

若命中「自身命中」型规则:
If a "self-hit" rule fires:
总分 = 自身命中分(100) × 严重度权重,忽略以上累加
total = self-hit score (100) × severity weight, ignore the sum above

Note the denominator is the address's total on-chain flow, not the flow inside the path-investigation graph. The path investigation only returns paths connected to a risk source — using it as the denominator would badly overstate an address with lots of normal activity.

注意分母是地址在链上的总流量，不是路径调查图里的流量。路径调查只会返回与风险源连通的路径，如果拿它当分母，一个大量正常交易的地址会被严重高估。

Disposition tiers

判定档位

05Using the console控制台使用方式

From a blank input to an auditable snapshot — four steps.

从空输入框到可审计的快照——四步走。

Step 1 · Run a screening

第一步 · 发起筛查

Go to “Compliance › Screening”, paste an address or transaction hash. The system auto-detects the chain and screening type, and shows the two ruleset dropdowns.

进入「合规 › 筛查」，粘贴地址或交易哈希。系统会自动识别链和筛查类型，并显示两个规则集下拉框。

Screening page: input · auto-detected chain & type · path-matching ruleset picker (★ = default) · scoring ruleset picker · run button · advanced options · CEX-immune toggle (on by default, see §07).

筛查页面：输入框 · 自动识别的链与筛查类型 · 路径匹配规则集选择器（★ 为默认）· 打分映射规则集选择器 · 运行按钮 · 高级选项 · 免疫交易所地址开关（默认开启，见第 07 节）。

1. Address / transaction-hash input
2. 地址 / 交易哈希输入框
3. Auto-detected chain and screening type (Ethereum · KYA)
4. 自动识别的链与筛查类型（Ethereum · KYA）
5. Path-matching ruleset picker — ★ marks the default
6. 路径匹配规则集选择器，★ 为默认
7. Scoring ruleset picker
8. 打分映射规则集选择器
9. Run button — the detected type is shown in parentheses
10. 运行按钮，括号内是识别出的类型
11. Advanced options: time window, currency, hops, min amount, max nodes per hop
12. 高级选项：时间窗口、币种、跳数、最小金额、每跳最大节点数
13. CEX-immune toggle (on by default — read §07 first)
14. 免疫交易所地址开关（默认开启，见第 07 节）

The two dropdowns are the subject of this manual: the left one picks “what counts as a violation”, the right one picks “how severe it is”.

两个下拉框正是本手册的主题：左边选「什么算违规」，右边选「有多严重」。

Advanced options

高级选项说明

Step 2 · Read the result summary

第二步 · 读懂结果摘要

Result summary: final score & disposition · self-hit marker · the address's own labels · hit paths / deduped risk edges · address overview with inflow / outflow / balance / active range.

筛查结果摘要：最终分数与判定 · 地址自身命中标记 · 地址自身携带的标签 · 命中路径数/去重后的风险边数 · 地址总览（总流入/总流出/余额/活跃区间）。

1. Final score and disposition — produced by the scoring ruleset
2. 最终分数与判定，由打分映射规则集产出
3. Address self-hit marker — score goes straight to the top
4. 地址自身命中标记，分数直接拉满
5. The address's own labels
6. 地址自身携带的标签
7. Hit paths → deduped risk edges
8. 命中路径数 → 去重后的风险边数
9. Address overview: total inflow / outflow / balance / active range — below it, the risk-funds share of direct inflow, indirect inflow and outflow
10. 地址总览：总流入 / 总流出 / 余额 / 活跃区间，下方一行是直接入金、间接入金、流出各自的风险资金占比

The three tabs on top: Summary / Graph / History. The Graph tab visualizes the fund flow; History shows past screenings of this address.

顶部三个页签：摘要 / 图谱 / 历史。图谱页可视化资金流，历史页显示该地址过往筛查记录。

Step 3 · Verify where the score came from

第三步 · 核对分数来源

“Score calculation basis” and “triggered rules” break the final score open for you.

「分数计算依据」和「触发规则」把最终分数拆开给你看。

1. The calculation basis used this time (a self-hit in this example)
2. 本次采用的计算口径（此例为自身命中）
3. Cell derivation: $332.6K / $1.10M · 30% × 80 = 24.2
4. 单格推导：$332.6K / $1.10M · 30% × 80 = 24.2
5. The matrix cell it maps to — “inflow · direct · extreme”
6. 该格对应矩阵中的「流入 · 直接 · 极高」
7. Triggered rule list — expandable hit details
8. 触发规则列表，展开可看命中详情
9. Each rule's severity, action and hit-path count
10. 每条规则的严重度、处置动作与命中路径条数

This example shows both calculation paths at once: the additive path gives the inflow-direct cell 24.2 points, but because a self-hit rule also fired, the final score takes “self-hit score × severity weight = 100 × 1” — straight to Block.

这个例子同时展示了两条计算路径：累加口径算出流入直接格 24.2 分，但因为同时命中了自身命中规则，最终分数走「自身命中分 × 严重度权重 = 100 × 1」，直接判定为拦截。

Step 4 · Keep records

第四步 · 留档

Every screening automatically generates a snapshot recording the request parameters and the complete result at that moment. “Compliance › Snapshots” lets you revisit any historical screening for audit purposes — snapshots cannot be tampered with.

每次筛查都会自动生成一份快照，记录当时的请求参数与完整结果。在「合规 › 快照」可以回查历史筛查，用于审计留痕。快照详情不可篡改。

06Using the APIAPI 使用方式

Everything the console can do, the API can do. The two rulesets are selected with two parameters.

控制台能做的，API 都能做。两套规则集通过两个参数分别指定。

Create an API key under “Account › API Keys”; “Account › API Reference” lets you test every endpoint right in the page. Base URL: https://api.trustin.bond.

在「账户 › API 密钥」创建密钥，「账户 › API 参考」可以直接在页面上调试所有接口。基础地址 https://api.trustin.bond。

Run a screening

发起筛查

// KYA:筛查地址 / KYA: screen an address
POST /api/v3/screen/kya?apikey=YOUR_KEY

{
  "chain_name": "Ethereum",
  "address": "0x...",
  "token": "usdt",
  "inflow_hops": 3,
  "outflow_hops": 1,
  "ruleset_id": 0,          // 路径匹配规则集,0 = 内置默认 / path-matching ruleset, 0 = built-in default
  "scoring_ruleset_id": 0,  // 打分映射规则集,0 = 内置默认 / scoring ruleset, 0 = built-in default
  "cex_immune": true,
  "mode": "async"           // sync 直接返回结果,async 返回 job_id / sync returns inline, async returns a job_id
}

KYT uses /api/v3/screen/kyt with tx_id, and you can set screen_direction to in / out / both, plus separate in_ruleset_id and out_ruleset_id.

KYT 用 /api/v3/screen/kyt，传 tx_id，并可用 screen_direction 指定 in / out / both，以及分别指定 in_ruleset_id 与 out_ruleset_id。

Fetch results asynchronously

异步取结果

GET /api/v3/screen/result/{job_id}?type=kya&apikey=YOUR_KEY

// status: PENDING | PROCESSING | COMPLETE
// COMPLETE 时 result 字段带完整结果 / when COMPLETE, the result field carries the full result

After submitting an async job the system starts computing immediately — polling only reads status, it never triggers computation. Most integrations should use async: sync mode can take a long time on deep hops or highly active addresses.

提交异步任务后系统会立即开始计算，轮询只是读取状态，不会触发计算。绝大多数集成建议使用 async：同步模式在深跳数、高活跃地址上可能耗时较久。

07Notes & gotchas使用注意事项

• Denominator — “funds share” in results is risk amount ÷ the address's total on-chain flow; the per-path “risk-funds share (risk_rate)” is a different concept used for layered-exposure thresholds. Don't mix them up.
• 分母口径 —— 结果里的「资金占比」是风险金额占地址链上总流量的比例；而单条路径上的「风险资金占比（risk_rate）」是另一个概念，用于分层暴露规则的门槛判断。两者不要混用。
• Hops vs latency — the graph grows exponentially with each hop. For daily screening, inflow 3 hops / outflow 1 hop is recommended.
• 跳数与耗时 —— 跳数每增加一跳，图规模成倍增长。日常筛查建议流入 3 跳、流出 1 跳。
• Time window — narrowing the window is slower (edge-by-edge filtering, not index-based) and returns fewer paths. Keep ALL unless you have a specific need.
• 时间窗口 —— 缩小时间窗口反而更慢（逐边过滤而非索引过滤），且返回路径更少。没有明确需求就保持 ALL。
• Custom rulesets — built-in rulesets are read-only. To adjust rules or the matrix, copy one first, then edit the copy.
• 自定义规则集 —— 内置规则集只读。要调整规则或矩阵，先复制一份，再在副本上修改。
• Quota — every screening consumes quota; the top bar shows remaining quota and expiry.
• 额度 —— 每次筛查消耗额度，顶部横条显示剩余额度与有效期。

Compiled from production configuration: path-matching rulesets v1.3 (built-in IDs 22 / 23 / 24), scoring ruleset v1.0 (built-in ID 51). Screenshots from the AML console v2.

本手册内容依据生产环境实际配置整理：路径匹配规则集 v1.3（内置 ID 22 / 23 / 24），打分映射规则集 v1.0（内置 ID 51）。截图取自 AML 控制台 v2。