What does 20% exposure mean? Haircut vs poison tracing in crypto screening
A 20% exposure figure reports how much of a measured amount a chosen tracing method attributes to a flagged source, and nothing more. This guide works through one illustrative transaction under haircut and poison tracing, shows why the same funds can score 20% or 100%, and sets out how to report the number without overstating it.
What does 20% exposure mean in crypto screening?
A 20% exposure figure means that, under a stated tracing method, one fifth of a measured amount of crypto is attributed to a flagged source such as a listed address. It describes how value was allocated through the transaction graph. It says nothing about the customer's identity, intent or legal status, and it changes when the method changes.
The figure reflects three choices: what amount is measured (the denominator), how value is allocated where flagged and clean inputs mix (the method), and how far back the trace runs (the hop convention). Change any of them and the percentage moves while the blockchain stays the same. In the layered review set out in our guide to on-chain sanctions screening, exposure sits between what the ledger records and the compliance decision.
What is the difference between haircut and poison tracing?
Haircut tracing allocates flagged value proportionally: each output of a transaction receives a share of the flagged inputs in line with their size. Poison tracing treats every output as tainted once any input is flagged. Both are analytical rules for following value through mixed transactions, and they can produce very different exposure figures for identical activity.
A 2019 preprint on taint analysis methods by Tironsakkul, Maarek, Eross and Just describes Poison as classifying all of a transaction's outputs as tainted, and Haircut as giving each output a portion of the tainted inputs according to their proportions.
| Haircut (proportional) | Poison | |
|---|---|---|
| Allocation rule | Each output carries the flagged share of the combined inputs | Every output is flagged if any input is flagged |
| Effect as value mixes | Flagged share shrinks as clean value is added | Flag spreads to every downstream output |
| Practical risk | Deliberate mixing with clean funds can make flagged value look minor | Large volumes of unrelated value end up flagged |
| Best read as | A measure of how much flagged value plausibly arrived | A marker that a flagged source sits somewhere upstream |
The last two rows are our assessment, not findings from the paper. Each method answers a different question, so the method has to travel with the number.
How does one transaction produce both 20% and 100% exposure?
In the illustrative example below, an intermediate address combines 20 units from a listed address with 80 units from elsewhere, then pays 50 units to a customer address. Haircut tracing attributes 10 of those 50 units to the listed source, or 20%. Poison tracing flags all 50 units, or 100%. Only the allocation rule differs.
Illustrative only: an invented Bitcoin-style transaction, fees ignored. S is a listed address, P an intermediate address and C the customer's address.
| Step | Activity | Haircut result | Poison result |
|---|---|---|---|
| 1 | S sends 20 units to P | 20 flagged units at P | 20 flagged units at P |
| 2 | An unflagged source sends 80 units to P | P holds 100 units, 20 of them flagged | P holds 100 units, 20 of them flagged |
| 3 | P spends all 100 units in one transaction: 50 to C, 50 as change | Each output carries 20% flagged value | Both outputs are fully flagged |
| 4 | C's receipt of 50 units | 50 × (20 ÷ 100) = 10 units, or 20% | 50 units, or 100% |
| 5 | P's change of 50 units | 10 flagged units | 50 flagged units |
From C's side, S sits two transfers upstream, so this is indirect exposure. Whether that path matters depends on who controls P, which no percentage can tell you. Our guide to direct vs indirect crypto exposure covers why hop count is not a legal test.
How should an analyst phrase an exposure percentage?
An analyst should state the method, the measured amount, the direction and the path before the number. For the example, a sound statement is: under the specified proportional method, 20% of this receipt is attributed to a listed-address source two transfers upstream. That sentence can be checked and reproduced. A bare "20% exposure" cannot.
| Statement | Problem |
|---|---|
| "20% probability the customer is sanctioned" | Turns an allocation share into a claim about identity |
| "Only 20% needs to be blocked" | Treats a tracing share as a legal blocking amount |
| "The customer has 20% sanctions exposure" | Attaches a receipt-level figure to the customer and drops the method and base |
| "Low exposure, cleared" | Records a disposition without assessing who controls P or the legal position |
| "Under proportional allocation, 10 of the 50 units C received (20%) trace to listed address S, two transfers upstream; under poison allocation the figure is 100%" | None: method, base, direction and path are stated |
Where two methods diverge materially, we recommend recording both figures.
Why is an exposure percentage not a probability, a blocking amount or the 50 Percent Rule?
An exposure percentage answers a narrower question than any of these. It reports how a chosen method allocated value along a path. A probability concerns who controls an address. A blocking amount follows from sanctions law and the facts of the transaction. OFAC's 50 Percent Rule concerns the ownership of entities by blocked persons.
- Not a probability. Attribution is a separate finding. NYDFS's 2022 guidance on blockchain analytics notes that tools may not identify underlying owners without off-chain verification.
- Not a blocking amount. OFAC's FAQ 562 (2018) frames the obligation around an address owned by or associated with a designated person, and OFAC's FAQ 646 (2021) sets how blocked virtual currency is held and reported. Neither uses a tracing share. What must be blocked or rejected is a legal question on the facts; see blocking vs rejecting crypto transactions.
- Not the 50 Percent Rule. OFAC's FAQ 560 describes the rule that entities owned 50 percent or more in the aggregate, directly or indirectly, by blocked persons are themselves blocked. That is a test of entity ownership. A 60% tracing figure makes nobody blocked, and a 20% figure clears nothing.
In Canada, FINTRAC's 2021 virtual currency indicators treat direct and indirect exposure links to suspicious sources as an indicator to be assessed with facts and context, noting that a single indicator on its own may not appear suspicious. An exposure figure feeds that assessment; it does not replace it.
Which denominator and method questions should a reviewer ask?
A reviewer should ask what amount the percentage is measured against, in which direction, over what time window, through how many hops, and under which allocation method and tool version. The answers determine whether two exposure figures are comparable and whether the number can be reproduced when an examiner asks for it later.
- Denominator. This receipt, all inbound value to the address, the current balance, or lifetime volume? The same 10 flagged units are 20% of a 50-unit receipt and 0.1% of 10,000 units of lifetime inflow.
- Direction. Inbound (source) and outbound (destination) exposure answer different questions; report them separately.
- Hop convention. How many transfers back did the trace run, and did it stop at an exchange or pass through it?
- Method and version. The allocation rule, the tool version and the date of the label data.
- Control of intermediaries. Who controls P? The Tironsakkul preprint notes that exchanges often store users' bitcoins in their own wallet system, so a path through an exchange address may reflect no relationship between S and C.
- Economic context. Does the receipt fit the customer's profile and stated purpose?
These questions belong to the crypto screening result checklist; the control question turns on wallet attribution.
Sources
- Tironsakkul et al., methods for taint analysis (preprint, 2019)
- OFAC FAQ 560 (2018)
- OFAC FAQ 562 (2018)
- OFAC FAQ 646 (2021)
- NYDFS: Guidance on Use of Blockchain Analytics (2022)
- FINTRAC: virtual currency ML/TF indicators (2021)
FAQ
What is haircut vs poison tracing in crypto?
Haircut and poison are two rules for following flagged value through crypto transactions that mix flagged and clean inputs. Haircut tracing gives each output a share of the flagged value in proportion to the inputs, so exposure is diluted as clean funds are added. Poison tracing flags every output once any input is flagged. The same transaction can show 20% exposure under haircut and 100% under poison, so a screening result should always name its method.
Does 20% exposure mean the customer is 20% likely to be sanctioned?
No. An exposure percentage reports how a tracing method allocated value along a path, not the likelihood that anyone is a designated person. Whether an address is linked to a sanctioned party is an attribution question, answered with official listings, label and cluster quality, and off-chain customer information. A customer can receive highly exposed funds with no link to the sanctioned party, or funds showing little traced exposure from an address that party controls but no label yet identifies.
Do I only need to block the exposed percentage of a crypto transfer?
A tracing percentage does not set a blocking amount. OFAC's FAQ 562 frames the obligation around an address believed to be owned by or associated with a designated person, and FAQ 646 sets how blocked virtual currency is held and reported. What must be blocked, rejected or reported depends on the facts and the applicable law in the US, Canada or elsewhere, so the tracing figure informs the analysis without deciding it.
Is crypto exposure the same as OFAC's 50 Percent Rule?
No. OFAC's 50 Percent Rule, described in FAQ 560, treats an entity owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons as itself blocked. It is a test of who owns a company. A crypto exposure percentage measures how much of an amount a tracing method attributes to a flagged source, so a tracing figure above or below 50% has no bearing on whether the rule applies.
Is there a regulatory threshold for crypto exposure percentages?
The OFAC FAQs and FINTRAC indicators cited in this article frame the question in terms of ownership, association and reasonable grounds to suspect, and do not express the obligation as a tracing percentage. A firm may set internal review thresholds as policy. If it does, a sound practice is to tie each threshold to a stated method, denominator and hop convention, and to document that a figure below it is not, by itself, a clearance.
Report exposure figures a reviewer can reproduce.
Book a demo and talk to our team about how your program records crypto screening results, methods and the reasoning behind each decision.
Book a demo