CipherOwl is a blockchain intelligence provider that screens wallet addresses in real time against sanctions lists and illicit activity. A single address can carry several risk categories at once, for example OFAC sanctions, hack and scam. Every risk finding comes with its exposure direction, hop distance and USD value.

With the CipherOwl integration, you can:

• Screen deposit and withdrawal counterparty wallet addresses to assess counterparty risk.
• Get a 0–100 risk score with a risk band (Low, Medium, High, Severe) and the risk categories behind it, such as ofac, hack, scam, theft and mixer.
• Use CipherOwl results in Transaction Monitoring rules.

How CipherOwl works

CipherOwl is offered as BYOK (Bring Your Own Key). You hold a direct contract with CipherOwl and enter your CipherOwl API credentials on the Sumsub Marketplace page. Sumsub screens through your account and applies the results in transaction monitoring rules.

For every crypto transaction, Sumsub screens the counterparty wallet address:

1. CipherOwl returns a fast risk verdict for the address.
2. If risk is found, Sumsub requests the risk score, risk band and risk categories.
3. The result is mapped to a risk level:
   • Low — no risk found.
   • High — a High or Severe risk band.
   • Medium — any other risk found, including risk found without score details.

CipherOwl evaluates the address against a risk model that you choose in the integration settings:

Supported blockchains

The table lists the networks where counterparty wallets are screened. Scroll down the table to see the full list.

The coverage level depends on the network:

• Full — risk verdict, risk score, risk band and risk categories.
• Screening — risk verdict only. If risk is found, the transaction is flagged as medium risk without score details.

Transactions on a network that is not listed return an unsupported result, which can be routed with a dedicated rule.

Get started with CipherOwl

To start screening counterparty wallet addresses with CipherOwl, connect your CipherOwl account to Sumsub and install the CipherOwl rules.

Step 1: Get access

Connect your CipherOwl account to Sumsub on the Marketplace page. Make sure you have the following before you start:

• An active CipherOwl contract and API credentials (Client ID and Client secret).
• Crypto Monitoring access. To enable it, contact your Customer Success Manager.

To connect your CipherOwl account, do the following:

1. Copy the Client ID and Client secret from your CipherOwl account.
2. In the Dashboard, open the Marketplace page and find the CipherOwl solution.
3. Click Settings, paste the credentials and save. Sumsub validates them automatically.

Step 2: Install rules

Install the CipherOwl rules to apply screening results to your crypto transactions. To install the rules, do the following:

1. In the Dashboard, open the Rules library.
2. Install and activate the CipherOwl rule bundle.
3. Optionally, create custom rules with CipherOwl data points, such as the risk score and risk categories.

Review results

After setup, Sumsub screens the counterparty wallet address for every crypto transaction. To review the screening results:

1. On the Transactions page, open the transaction of your interest.
2. In the Counterparty wallet screening — CipherOwl section, review the risk level, the risk score and the risk categories.

The structured results are also available through the API. They are on the transaction object, under cryptoTxnInfo.cipherOwlMonitorData. To retrieve them, use this API method method with the transaction ID.

Request example:

curl -X GET \
     'https://api.sumsub.com/resources/kyt/txns/69f0721264ade593a3b99000/one' \
     -H 'X-App-Token: <your-app-token>' \
     -H 'X-App-Access-Sig: <your-signature>' \
     -H 'X-App-Access-Ts: <unix-timestamp>'