Crypto Donations and Fundraising: How to Screen Incoming Funds for AML Risk

An organization publishes a wallet address for donations. Transfers begin arriving from different senders — some who identify themselves, some who do not. A blockchain confirmation shows that each transfer was recorded on-chain. It does not show who controls the sending wallet, where the funds originated, which services they passed through, or whether they carry exposure to sanctions, scams, stolen assets, mixers, or other high-risk sources.

The organization cannot prevent a transfer to a public address. On most blockchains, the recipient does not approve an incoming transaction before it is included in a block. The funds simply arrive. But the organization can decide what happens next — whether those funds are screened before they are consolidated with treasury, converted to fiat, spent on operations, or distributed to beneficiaries.

This is the core principle of AML screening for crypto donations: screening cannot always happen before receipt, but it can always happen before the funds are used. An anonymous donation is not suspicious simply because the donor did not provide a name. A high-risk screening result is not proof that the donor committed a crime. But an incoming transfer that carries documented exposure to sanctioned addresses, fraud infrastructure, or stolen funds creates a question that the organization needs to answer — and document — before those funds move further.

This article explains how charities, nonprofits, foundations, community projects, DAOs, and other fundraising initiatives can screen incoming crypto donations for AML risk, structure their donation wallets, interpret screening results, handle flagged transfers, and document their decisions — using a proportionate, risk-based approach rather than treating every donor as a suspect.

Why Crypto Donations Require a Different AML Approach

A crypto donation is not the same as a customer deposit on an exchange. The screening workflow that works for an exchange — where a customer creates an account, completes KYC, and then deposits from a known wallet — does not directly apply to a public fundraising address that receives transfers from unknown senders without advance notice.

1. Public donation addresses can receive unsolicited transfers. Once a wallet address is published on a website, social media post, or fundraising page, anyone can send funds to it. The organization does not approve each transfer before it arrives. This means the screening checkpoint is not before receipt — it is before the next outbound action: consolidation, conversion, spending, or distribution. For planned high-value donations, however, the organization can ask the donor for their sending address in advance and screen it before the transfer occurs.
2. The donor may be unknown or only partially known. A donation may come from a long-standing supporter who provides full contact details, from a company or foundation, through a fundraising platform, from a self-custody wallet with no accompanying information, or entirely without prior contact. A wallet address does not contain a verified name. Even if the donor identifies themselves, that alone does not prove they control the sending wallet. This is why wallet screening (on-chain risk), donor verification (identity), and source-of-funds review (economic origin) are three different checks — related but not interchangeable.
3. Risk may surface only when the funds are used later. A fundraiser may receive a donation and see no immediate problem. The risk becomes visible later — when the organization moves the funds to a treasury wallet, converts crypto through an exchange, pays vendors, distributes grants, or provides records to a bank, auditor, or funding partner. If unscreened donations have already been mixed with the main treasury balance, explaining the origin of specific funds becomes difficult. The problem is not abstract "tainted coins" — it is documented exposure, transaction history, and the organization's ability to show what controls it applied.

What Can Make an Incoming Crypto Donation High-Risk?

Risk assessment for donations should not be based solely on the amount or on whether the donor identified themselves. What matters is the origin of funds, the transaction path, exposure depth, entity attribution, and address behavior.

1. Direct exposure to sanctions, stolen funds, scams, or hacks is the most urgent category. This means the sending address itself appears in sanctions data, is attributed to a sanctioned entity or service, is linked to a known hack or theft, belongs to a recognized scam or fraud cluster, or directly originates from a darknet market, ransomware operation, or other high-severity source. Direct sanctions or stolen-funds exposure typically requires faster and more intensive review than a distant indirect signal.

2. Indirect exposure through earlier transactions means the immediate sending address may not itself be flagged, but the funds passed through sanctioned services, mixers, privacy tools, scam-related wallets, hacked addresses, high-risk exchanges, darknet markets, or multiple intermediary wallets at some earlier point. Not every indirect connection warrants the same response. The assessment should consider hop distance, exposed amount or percentage, recency, pattern repetition, risk category, type of intermediary service, and attribution confidence. A small, old indirect exposure through a large exchange is fundamentally different from a direct transfer from a sanctioned wallet or a recently hacked address.
3. Donation patterns that need additional context include unusually large donations relative to the campaign, multiple transfers from related addresses, splitting a large sum into many small transfers, rapid fund movement through several wallets before the donation, donations from freshly created wallets, sudden changes in donation size or frequency, transfers through multiple chains or bridges, donations whose stated purpose does not match the campaign, and large transfers from unknown individuals or entities. Unusual does not mean illicit. The purpose of flagging these patterns is to obtain context and determine whether the activity has a reasonable explanation.

When Should Crypto Donations Be Screened?

The timing of screening depends on whether the donation was planned in advance and how much control the organization has over the receiving flow.

1. Before a planned high-value donation, the organization can request the sender's wallet address, blockchain network, asset, intended amount, donor name or organization, purpose, and — where appropriate — a brief source-of-funds explanation. The sending wallet can be screened before the transfer is made. If the address changes before the actual transaction, the new address should be checked as well. A pre-transfer check reduces uncertainty but does not replace screening the transaction itself once it appears on-chain.
2. Immediately after an unsolicited donation arrives, screening should begin before the funds are moved further. The organization should save the TxID, identify the sending address, confirm the correct network and asset, run wallet and transaction screening, check for sanctions and high-risk exposure, link the transaction to a campaign or donation record, and determine whether manual review is needed. The object of screening is the incoming transaction and the sending address — not just the receiving wallet's overall balance.
3. Before consolidation, conversion, spending, or distribution is the operational control point. Even when the fundraiser cannot stop an incoming transfer, it can define what must happen before the next outbound action. Screening should be completed before the donation is moved into the central treasury, combined with other campaign funds, sent to an exchange, swapped through a conversion service, used for payments, or transferred to a beneficiary or grant recipient. This prevents unscreened risk from propagating downstream and maintains a clear link between the incoming donation and the decision that followed.

How to Structure Donation Wallets Before Fundraising Starts

1. Use dedicated wallets for donations. Do not receive public donations directly into the main operating or treasury wallet if the organization can set up a separate structure. A dedicated donation wallet helps separate fundraising activity from other transactions, makes it easier to match transfers to campaigns, creates a natural review point before treasury consolidation, produces cleaner records, and limits the number of people who can move funds. A separate wallet does not eliminate AML risk and does not block unsolicited transfers. It creates a more manageable process.
2. Separate campaigns or planned donors where practical. Distinct addresses or wallets can be used for different fundraising campaigns, different legal entities, different blockchain networks, large pre-agreed donations, different regions or operating teams, and separation between donations and commercial revenue. This simplifies attribution and documentation. The qualification "where operationally practical" matters — a small organization cannot always maintain a complex wallet architecture.
3. Do not automatically sweep every donation into the treasury. Many wallet systems automatically transfer incoming funds to a central wallet. For donation flows, this sweep should occur only after a defined review point. The organization should determine which transactions can be cleared automatically, which require manual review, who authorizes the treasury transfer, which risk signals stop the sweep, and what data is preserved before the funds move. For small campaigns, a manual check may suffice. For ongoing flows, an automated screening rule may be more appropriate.

A Practical AML Workflow for Incoming Crypto Donations

1. Record the donation and transaction details. Before interpreting any risk score, save the baseline data: TxID, sending address, receiving address, network, asset, amount, timestamp, campaign or fundraising purpose, donor contact details (if available), how the donor found the address, and an internal donation reference. Without these details, linking a screening result to a specific donation later becomes difficult.
2. Screen the sending wallet and incoming transaction. Check the sending wallet's risk profile, the transaction risk, direct and indirect exposure, sanctions connections, risk categories, identified entities or services, exposed amount, and — where the screening depth allows — the transaction path. A blockchain explorer shows that a transfer happened; a screening tool evaluates what risk the transfer may carry. For occasional donations, individual on-demand checks are sufficient — tools like AMLBot's crypto wallet AML checker provide risk scores, exposure categories, and entity attribution for individual addresses and transactions.
3. Interpret the risk result in context. The team should look beyond the overall risk level to understand what triggered the result, whether the exposure is direct or indirect, what percentage or amount is linked to the risk source, how close the source is in the transaction chain, how reliable the entity attribution is, whether the signal is isolated or recurring, whether the donation fits the donor's known context, and whether there has been prior activity from this address. A risk score is the beginning of the decision process, not the decision itself.
4. Assign the donation to a defined review outcome. Based on the screening result and context, the organization should categorize the donation: clear for normal use, clear with documented observation, request additional donor context, hold from further movement pending review, escalate to a responsible manager or compliance specialist, apply enhanced monitoring, or take any jurisdiction-specific action required by applicable rules. These outcomes should be defined in internal policy before a donation is received — not improvised after each alert.
5. Document who made the decision and why. Record the screening result, risk categories, reviewed context, supporting information, final outcome, reasoning, decision date, responsible person, any approvals or escalation, and subsequent follow-up. The organization should be able to reconstruct what it knew, what it checked, and why it decided to use, hold, escalate, or further review the donation.

Wallet Screening, Donor Verification, and Source of Funds Are Different Checks

These three processes are related but serve different purposes, and confusing them creates gaps.

1. Wallet screening shows on-chain risk. It evaluates which addresses and services are connected to the transaction, where the funds came from on the blockchain, which risk categories are present, whether there is sanctions or illicit-fund exposure, and how direct or indirect the connection is. Screening does not confirm the donor's name and does not explain the economic reason the person obtained the funds.
2. Donor verification shows who is behind the donation. Donor information may be particularly useful when the donation is large, when the donor requests an official acknowledgment or naming rights, when the transfer comes from a corporate or institutional donor, when the transaction does not match typical campaign patterns, when the screening result requires additional context, or when applicable rules or internal policy require identification. Depending on the situation, information may include name, contact details, organization, country, relationship to the campaign, confirmation of wallet control, and purpose of the donation. Not every small donation requires the same identity procedure.
3. Source-of-funds review explains how the donor obtained the assets. For large, unusual, or higher-risk donations, the organization may need to understand the economic origin of the funds — exchange purchases, investment proceeds, salary received in crypto, asset sales, company treasury, grants from another organization, mining or staking income, or documented fundraising proceeds. Supporting evidence may include exchange statements, agreements, invoices, transaction records, or other documents. An AML screening report can complement this package but does not replace it.

How to Build a Risk-Based Crypto Donation Review Policy

1. Define review triggers. The organization should determine in advance which factors prompt additional review: direct sanctions hits, stolen-funds or hack attribution, high-severity risk categories, material indirect exposure, unusually large amounts, repeated linked donations, use of mixers or complex transaction routing, mismatch between donor explanation and on-chain activity, unknown institutional donors, risk scores above an internal threshold, or new risk signals on previously used donor wallets. The specific thresholds depend on the organization's size, geography, campaign model, and applicable requirements.
2. Define proportionate response levels. A risk-based approach prevents two extremes: automatically using all incoming funds without review, and automatically treating every flagged donation as illegal. A practical model includes low-risk donations receiving standard record and clearance; moderate or unclear risk triggering manual review and additional context; high-severity direct exposure requiring immediate escalation before further movement; repeat or pattern-based risk prompting a broader donor or campaign review; and unresolved cases requiring professional compliance or legal assessment.
3. Decide when donor information is needed. Not every donation requires the same level of donor information. The review policy should define when additional donor context is necessary — and when a screening result combined with transaction data is sufficient. Common triggers for requesting donor details include donations above a defined value, corporate or institutional senders, repeated transfers from the same address, screening results that require context, and situations where applicable rules or internal policy require identification.

What to Do When a Crypto Donation Is Flagged

A flagged donation is a signal for review, not a verdict. The immediate response should be to pause further movement of the funds, preserve the TxID, sending address, and all transaction details, confirm what triggered the screening result, and assess the severity, directness, and category of the exposure.

After the initial assessment, the organization should determine whether additional donor information could resolve the question. If the donor is reachable — for example, a repeat donor or someone who provided contact details — the organization may request context about the source of the funds, the wallet's connection to the flagged entity, or the donor's explanation of the transaction history. If the donor is unreachable, the decision relies on the on-chain evidence alone.

Should a flagged donation be returned? Not automatically. Sending funds back to a potentially sanctioned or illicit address may itself create compliance, sanctions, or operational issues. The organization should first understand the reason for the alert, assess whether the exposure is direct or indirect, and determine which actions are permitted under its policy and applicable requirements before initiating a return transfer. For organizations that have already received funds with significant exposure, see our article on what to do after receiving tainted crypto funds.

When Manual Screening Is No Longer Enough

Manual donation screening — checking individual wallets and transactions through a web dashboard — works when the organization receives a manageable number of donations. It becomes unreliable when donations arrive frequently, across multiple networks, through automated treasury sweep processes, or at volumes where consistent review and documentation cannot be maintained through individual checks.

At that point, the transition to API-based screening or continuous transaction monitoring provides systematic coverage. API integration enables automated screening of every incoming donation at the point of receipt, with alerts generated only when risk thresholds are crossed. Continuous monitoring adds ongoing re-screening — catching risk changes on previously checked wallets, new sanctions designations, and behavioral patterns that emerge across multiple transactions over time.

Conclusion

An organization that accepts crypto donations cannot always prevent an unknown or high-risk transfer from arriving at a public wallet. But it can build a process in which every significant incoming donation is visible, screened, and documented before the funds are consolidated, converted, spent, or distributed. The goal of screening is not to treat every donor as a suspect. It is to make proportionate, documented decisions based on on-chain risk, donor context, and available supporting information — so that when a bank, auditor, exchange, or funding partner asks where the money came from, the organization has an answer that is traceable, consistent, and supported by evidence.

FAQ