Understanding Risk Scores

Range’s risk scoring engine combines designation lists, counterparty analysis, behavioral detection, and threat intelligence to produce actionable risk assessments. This guide explains how to interpret results across endpoints. For the lists and feeds behind scoring, see Risk Data Sources. For how customer data is hosted and protected, see Security at Range.

---

​

Scoring Scales

Different endpoints use different scales: Address Risk (v2) is the current address-screening model. The v1 numeric score remains available for existing integrations.

---

​

Address Risk (v2)

Score a Single Address evaluates an address across three independent pillars. Each pillar produces its own signals. A signal that fires carries a severity, and the address’s overall result is the worst single signal across all three pillars. There is no blended composite score.

​

Severity

Alongside severity, assessments return USD volume totals and how much of that volume involved flagged counterparties.

​

Configuration

Scoring policy is per workspace. Range publishes a catalogue of signals and behaviours (List Signals & Behaviours), but what runs for your workspace is what you enable and how you set severity and thresholds (Get Risk Configuration / Update Risk Configuration). You can:

• Enable or disable individual attribution signals, exposure signals, and behaviours
• Set the severity for attribution categories
• Set exposure and behaviour thresholds that map observed activity to severity tiers
• Detect a behaviour without letting it drive the overall severity

Two workspaces can screen the same address and reach different conclusions when their policies differ, for example on gambling exposure or privacy-protocol usage.

​

Score and evidence

A score request returns severity and the signals that fired. Full justification (counterparties, designation detail, transactions, and detected patterns) is retrieved separately with the assessment’s screen_id via Fetch Assessment Evidence. You can also request evidence inline with include_evidence=true. That split keeps screening fast in payment and onboarding flows, while keeping an audit trail available when someone needs to explain a decision.

​

Attribution, exposure, and behaviour

Attribution answers whether the address itself is designated or identified, for example sanctions, blacklisting, hacks, scams, or other threat categories. Attribution also covers known-good infrastructure (protocols, exchanges, system programs) so high-volume legitimate activity is not treated as risk purely because of volume. Exposure looks at who the address has sent to and received from, and how those counterparties are labeled. Exposure is expressed as a share of counterparty activity against the thresholds you configure, not as a single opaque number that decays with distance. Behaviour detects suspicious transaction patterns, for example rapid movement of funds, structuring into many small transfers, or peeling funds through a chain of wallets. Detectors return a confidence that maps to severity through your workspace thresholds.

​

Sources at a glance

Address Risk draws on official sanctions and compliance lists, onchain stablecoin issuer blacklists, Range’s own indexing and threat research, and security partnerships. The full catalogue is on Risk Data Sources.

---

​

Address Risk Score (v1)

The Address Risk Score endpoint returns a 1–10 score based on proximity to known malicious addresses, machine-learning signals, and threat intelligence. Sanctions and stablecoin blacklist hits are included in the score. Search depth: Risk analysis examines paths up to 5 hops from the input address. Addresses with no connections to malicious entities within this range receive score 1. Known non-malicious addresses (system programs, verified protocols, major exchanges) receive the minimum score. Prefer Address Risk (v2) for new integrations: configurable pillars, severity tiers, and a dedicated evidence API. Keep v1 where you already depend on the numeric scale.

---

​

Token Risk Scoring (Percentage Scale)

The Token Risk Assessment evaluates up to 17 independent risk factors across 5 categories. Each factor scores:

• LOW = 0 points
• MEDIUM = 1 point
• HIGH = 2 points

The risk percentage is: (total_score / max_possible_score) × 100 Not all 17 factors may be assessed for every token due to data availability. The API adjusts the maximum possible score based on how many factors were successfully evaluated.

​

Token Risk Factor Summary

See Token Risk Assessment for detailed explanations of each factor.

---

​

Payment Risk Scoring (Maximum Risk Approach)

The Payment Risk Assessment runs up to 8 independent assessments. The overall risk level uses a maximum risk approach: if any individual factor returns “high”, the overall risk is “high”.

---

​

Best Practices

• Prefer Address Risk (v2) for new screening flows. Use severity and triggered signals; fetch evidence when you need to justify a decision.
• Calibrate policy to your use case. Configure which signals matter and at what severity. A payments processor and a fund may disagree on the same exposure.
• Don’t rely on a single endpoint for high-value flows. Combine address screening with payment risk and sanctions checks where relevant.
• Handle “unknown” gracefully. Payment Risk returns "unknown" for unsupported networks. That means insufficient data, not “safe.”
• Cache cautiously. Risk can change as designations and intelligence update. For compliance-critical flows, query in real time.
• Show context to end users. Prefer severity (or riskLevel / reasoning on v1) over a bare number.