Asks "is this person on a list or in the media?" — sanctions, PEP, watchlist, adverse media. Each hit is resolved through the L1–L4 adjudication layer (name → DOB/ID → source tier → prior decision) before it scores, and the fuzzy-match namesake filter (≥ 0.85) gates whether a hit counts at all. The sub-score is the single most severe resolved finding — a confirmed hit is never averaged away.

INDIVIDUALSAsks "is this person who they claim to be, and is that still true?" — a different question from screening. The client runs IDV at onboarding; Sentinel consumes the pass/fail result and then monitors for identity drift — document expiry, re-KYC falling due, data-consistency changes, and synthetic-identity signals emerging after the customer goes live. Gate-like: a hard fail caps the customer at high-risk regardless of a clean screen, because a name you can't confirm is real makes every other check unreliable.

ENTITIESThe entity equivalent of KYC — "who really controls this company?" D7 verifies the corporate structure and maps UBOs and directors; those individuals are then screened as natural persons and their sanctions/PEP/adverse-media findings flow up into this score. Gate-like, because a sanctioned person cannot hide behind a clean shell — which is exactly what the override enforces.

Sentinel does not analyse the chain itself — it consumes your integrated on-chain analytics feed (bring-your-own: Chainalysis / TRM / Elliptic) and scores the returned exposure. Takes the single most severe exposure, not an average. Two modifiers: severity scales with the proportion of funds exposed, and exposure is time-weighted so recent activity outweighs a stale one-off.

Evaluates every touchpoint — nationality, residence, funding origin, counterparty jurisdictions — and takes the highest-risk tier. A small additive bump applies when several high-risk touchpoints coincide; a low-risk residence partially mitigates but does not erase a high-risk nationality or funding origin.

Reads your transaction-monitoring alerts and sums points per distinct pattern, capped at 100 — because two independent suspicious behaviours are worse than one. This is the one additive dimension: the others take the worst single finding, behavioural takes the aggregate of conduct.

VASP COUNTERPARTIESA sixth dimension applied only when the party is another crypto business. Assesses whether the counterparty VASP is licensed, runs a credible AML programme, and can meet Travel Rule obligations — the crypto-specific question of "is this a compliant business to plug into?" Not applied to individuals or ordinary corporate customers.