TRM Labs - Wallet & Transaction Risk Screening

The trmlabs plugin screens the addresses on your exchange's crypto deposits and withdrawals with TRM Labs before they go through. It uses TRM Labs Wallet Screening, and falls back to TRM Labs' Sanctions screening if your API key doesn't include Wallet Screening. Risky transactions stay on hold for your team; the rest are released automatically. You use and pay for your own TRM Labs account.

What you need

• The Enterprise plan on HollaEx Cloud.
• Your own TRM Labs account and API key.
• Auto Deposit and Auto Withdrawal turned off. See Turn off Auto Deposit and Auto Withdrawal.
• No other risk-screening plugin. Only one can run at a time (Scorechain, AMLBot or TRM Labs). If another is installed, this one doesn't start and your audit email is told why.

Turn off Auto Deposit and Auto Withdrawal

The plugin only screens transactions that are on hold. With Auto Deposit and Auto Withdrawal on, deposits and withdrawals are processed straight away and never wait on hold, so there is nothing to screen.

1. Go to Operator Controls → Exchange → Configuration → Security.
2. Turn off Auto Deposit. Incoming blockchain deposits now stay pending until they are approved.
3. Turn off Auto Withdrawal. Withdrawal requests now stay pending until they are approved.

The plugin never changes these settings itself. While one of them is on, the plugin doesn't screen that kind of transaction, and it emails your audit address asking you to turn it off. It starts screening on its own within about a minute of the setting being turned off.

Set it up

1. Get your API key. In the TRM Labs dashboard, create a key under Configure Environment → API Tokens.

2. Turn off Auto Deposit and Auto Withdrawal as described above.

3. Install the plugin. Go to Operator Controls → Exchange → Plugins, find trmlabs under Available to install and click Install.

4. Configure it. Open the plugin with Configure, fill in the settings and save.

   Setting	What it does
   api_key	Your TRM Labs API key. Secret, from TRM Labs. Required. Until it is set, nothing is screened and on-hold transactions stay on hold.
   min_usdt	Smallest value, in USDT, that gets screened. Transactions worth less are released without a check. Default 100.
   min_risk_score_level	TRM risk level (1–15) at or above which a transaction is held. TRM levels are 1–4 Low, 5–9 Medium, 10–14 High and 15 Severe. Default 15, severe only. Lower it, for example to 10, to also hold high risk.
   risk_volume_percent_threshold	Share, in percent, of the wallet's volume from risky counterparties at or above which a transaction is held. Default 50. Lower it to be stricter.
   risk_threshold	Severity that holds a transaction: CRITICAL (default, severe), HIGH, MEDIUM or LOW.
   block_on_sanctions	On (default): any address with a sanctions hit is held, whatever the thresholds. Leave it on.
   check_withdrawals	On (default): withdrawals are screened too. Off: only deposits are screened, and on-hold withdrawals are left for you to approve.
   cache_ttl_hours	How long a TRM Labs result is reused for the same address. Default 48.
   request_timeout_ms	How long to wait for TRM Labs on each request, in milliseconds. Default 10000.
   alert_email	Who gets an email when a transaction is held. Empty (default) uses your exchange's audit email, set in Operator Controls → Exchange → Configuration → Alerts.
   api_url	TRM Labs' API address. Leave the default, https://api.trmlabs.com.

5. Check it's running. Make a small test deposit above min_usdt. If TRM Labs finds no risk, it is released on one of the next runs.

What your users see

Users see their deposit or withdrawal as pending while it is on hold. A transaction the plugin releases then goes through as usual. A held one stays pending until your team releases or rejects it.

How it works

Every 60 seconds, the plugin goes through your on-hold deposits and withdrawals:

1. Blacklist first. If the address is on your exchange's address blacklist, the transaction stays on hold straight away, without asking TRM Labs, and your team is emailed.
2. Small amounts. A transaction worth less than min_usdt is released without a check, unless it is also waiting on the Travel Rule.
3. Screening. Otherwise the plugin screens the transaction's address with TRM Labs.
4. Decision. The transaction is held if the address has a sanctions hit (with block_on_sanctions on), or if it reaches min_risk_score_level, risk_volume_percent_threshold or risk_threshold.
   • Held: the transaction stays on hold, an alert with the details goes to alert_email, and the address is added to your exchange's blacklist for all networks. The transaction gets a note starting [trmlabs-reviewed], so it isn't screened or charged again.
   • Not risky: the transaction is released and goes through as usual. A deposit still waiting on the Travel Rule stays on hold until that is done.

The plugin fails closed:

• If TRM Labs can't be reached or returns no result, the transaction stays on hold and is tried again on the next run.
• If a transaction's value can't be worked out, it isn't released as a small amount; it is screened.
• Transactions on a network the plugin doesn't recognise are left on hold, untouched, for you to review.
• The plugin only clears its own screening hold. A transaction held for another reason stays on hold until that reason is cleared too.

Review held transactions

Open the transaction in Operator Controls → Operations → Deposits or Withdrawals. Its hold reason shows the plugin's note with the reason and risk. If you decide the transaction is fine, use Release to clear the hold. Remember that the plugin has also added the address to your blacklist; remove it there if it was a false positive.

Troubleshooting

• You got an email saying the plugin is inactive and to turn off Auto Deposit or Auto Withdrawal. One or both are still on. Turn them off in Operator Controls → Exchange → Configuration → Security.
• You got an email titled "Duplicate KYT Plugin Installation Blocked". Another risk-screening plugin was installed first, so this one didn't start. Only one can run. Remove the one you don't want with Remove plugin. If you keep this one, open it in Operator Controls → Exchange → Plugins and click Restart.
• Nothing is being released. Check that api_key is set and correct. While it is empty, the plugin screens and releases nothing. Whenever TRM Labs returns no result, transactions above min_usdt stay on hold.
• Only sanctions seem to be checked. Your API key doesn't include TRM Labs Wallet Screening, so the plugin is using Sanctions screening only. Ask TRM Labs to enable Wallet Screening for your key.
• Withdrawals wait even though they look fine. If check_withdrawals is off, the plugin doesn't touch withdrawals; approve them yourself.

Need help? Open a ticket from your HollaEx dashboard.