Checking addresses/transactions against known-risk lists (sanctions, ransomware, darknet services, fraud infrastructure) as an investigative lead.