A report mentions a flagged service several transfers away from a customer's wallet. The customer says they never used it. Your colleague says any connection is enough to reject the payment. Neither response explains the evidence. Start by identifying the path, the category and the scope of the check. Direct and indirect exposure describe different relationships, and that difference matters when deciding what to investigate.
What direct exposure means in the sample
The A2 Route synthetic report explains direct exposure as a direct transfer from a flagged entity or a sanctions-list address. That is a relationship in the recorded trace. It still needs to be read alongside the report's subject, direction and limitations. Do not skip those fields just because a category sounds serious.
A sanctions-list match and a provider's sanctions-associated label are not interchangeable. The REVIEW sample can show indirect exposure to a provider-flagged entity while its sanctions-list rows say no match. If you summarise both as “the customer is sanctioned,” you have changed the meaning of the report and made a claim the evidence does not establish.
What indirect exposure means
The same sample describes indirect exposure as reaching a flagged entity through intermediaries, at two or more hops. Think of a fictional chain of labels: FAKE_SOURCE_NOT_A_WALLET, then FAKE_INTERMEDIARY_NOT_A_WALLET, then FAKE_CUSTOMER_NOT_A_WALLET. These are deliberately invalid synthetic labels, not real addresses. The point is the relationship between steps, not an allegation about an identifiable wallet.
An intermediary changes the relationship being described. It does not automatically make upstream evidence irrelevant. A business may still want to understand why the path appears, whether it concerns the intended payment and whether the customer can explain the sending arrangement. A good reviewer preserves the distinction instead of collapsing every connection into the same category.
Do not assume that a hop count measures ownership. A series of transfers is not proof that one person controls every wallet on the path. Likewise, a long path alone does not prove that an exposure can be ignored. Describe what the report records, then state what additional information your business needs.
Categories name different concerns
The report appendix describes sanctions, mixer, cybercrime and other exposure categories. Read their definitions on A2 Route's data-sources page. A category label describes recorded exposure. It is not a verdict about a person's intent, and it should not be rewritten as one in an email to the customer.
A mixer-related label concerns a service associated with obscuring provenance or laundering flows in the appendix definition. A cybercrime label concerns a different category, covering scam and phishing activity in the appendix. Keep the actual label in your notes. “Flagged” is a useful shorthand for starting a review, but it is too vague to explain why a particular payment was held.
Do not invent a single hierarchy for every business from these category names. Your operational response should consider the recorded evidence and its limits. If a legal question arises, refer it to qualified advice rather than treating a screening category as an answer about what the law requires.
Percentages require careful reading
A2 Route's sample report includes source shares and top exposure. Before interpreting a share, find the mode explanation. The outgoing sample states that address-mode shares concern the destination wallet's traced incoming funds. A figure there is not a claim that the same fraction of your proposed outgoing payment has a particular origin.
Do not add rows from different sections simply because each contains a percentage. Read how to read the report and the shared methodology on the data-sources page. If the report does not support your intended calculation, leave the calculation out. A precise-looking number with the wrong denominator can mislead a decision more than a plain statement of uncertainty.
Why indirect exposure still deserves review
An indirect flag can raise a practical question even without a direct list match. For example, your customer's proposed sending arrangement may differ from the arrangement documented in the invoice file. The result can prompt you to ask which service processed the payment and why a different wallet is involved. That is an investigation step, not an accusation.
Check the timestamp and coverage before escalating. The public A2 Route FAQ describes partial results as reduced coverage and recommends a re-check. Retain the first result and the later result separately. Labels can change, and a later review should not erase the evidence available to the original decision maker.
If the payment is held, use the flagged counterparty checklist. If it has not yet been sent, use the incoming USDT guide to establish the proposed sender and receiving instructions first.
For a customer explanation involving a bridge, read the mixer and bridge evidence guide. It separates reported labels from the customer's account of their sending arrangement without promising cross-network reconstruction.
Keep the conclusion proportionate
Write “indirect exposure recorded through intermediaries” when that is what the evidence says. Do not write “confirmed criminal funds” or “guaranteed clean” because neither follows from a wallet trace. The report is informational, not legal advice or a guarantee of regulatory compliance.
Check a supported address with A2 Route and keep the explanation with the trade record. For a separate supplier-payment workflow, see the A2vanta business payment blog. An incoming exposure review does not approve a different outgoing destination, even when both payments belong to the same commercial deal.