A crypto business that cannot say where a deposit came from, or where a withdrawal is going, cannot meet its sanctions, anti-money laundering and Travel Rule duties, and blockchain analytics tools are how most firms answer those questions at scale. These tools cluster addresses into entities, label them (exchanges, mixers, sanctioned parties, scams, darknet markets), score the risk of each transaction and let investigators trace funds across hops and chains. This vendor-neutral buyer's guide is for compliance, financial crime and security teams at exchanges, custodians, payment firms, banks with crypto exposure and investigators. It covers wallet screening, chain coverage, Travel Rule fit and investigations. Protocol teams watching their own contracts should read the Blockchain Analytics and On-Chain Monitoring Guide, which covers alerting and response for smart contracts.
Key takeaways
- Attribution data is the product. Clustering and labels decide every risk score, so ask how labels are sourced, reviewed and corrected, and test them on addresses you already know.
- Coverage must match your flows, not a brochure. List the chains, tokens and stablecoins you actually move. FATF's June 2025 targeted update reported that most on-chain illicit activity now involves stablecoins, so token-level coverage matters as much as chain count.
- Screening and investigation are different jobs. Real-time transaction screening needs low latency and clear rules; investigations need graph depth, cross-chain tracing and exportable evidence. Many firms need both.
- Analytics does not satisfy the Travel Rule on its own. Travel Rule compliance means exchanging originator and beneficiary data with other providers; analytics helps identify counterparties and self-hosted addresses but is a separate capability.
- Explainability protects you with regulators. A score you cannot explain, reproduce or evidence later is a weak basis for a blocked payment or a suspicious activity report.
Define requirements
Write requirements from your own regulatory duties and transaction flows before speaking to suppliers.
- Regulatory drivers: FATF Recommendation 15 (updated in 2019 to bring virtual assets and VASPs into scope), national AML rules, sanctions law and Travel Rule regimes. In the EU, Regulation (EU) 2023/1113 has applied since 30 December 2024, covers crypto-asset transfers of any value and requires an ownership or control assessment for transfers above EUR 1,000 involving self-hosted addresses. The UK applies fuller data rules on non-UK routes at GBP 800 or more. See the Crypto Travel Rule Compliance Guide.
- Sanctions: OFAC's FAQs state that sanctions obligations are the same for digital currency as for fiat, and that the digital currency addresses on the SDN list are not exhaustive. A tool that only matches listed addresses misses indirect exposure. See CDD, EDD, PEP and sanctions screening.
- Flows: deposits, withdrawals, OTC desk trades, treasury movements, staking payouts and merchant settlement. Mark which need pre-transaction screening (before you send) and which can be screened after the fact.
- Volumes and latency: peak transactions per minute, acceptable screening time per request and whether a timeout should fail open or fail closed.
- Users: how many analysts, investigators and auditors need access, and whether law enforcement liaison is in scope.
- Integration: core ledger, case management, AML transaction monitoring, Travel Rule messaging and data warehouse.
Capability areas
| Capability | What it does | What to check |
|---|---|---|
| Address and wallet screening | Scores an address before onboarding or a withdrawal, using its labels and exposure | Direct and indirect exposure, number of hops considered, handling of brand new addresses |
| Transaction monitoring (often called KYT) | Screens deposits and withdrawals continuously against configurable rules | Rule flexibility, thresholds per category, re-screening when labels change |
| Entity clustering and attribution | Groups addresses controlled by one entity and labels them by category | Label sources, review process, false attribution correction route |
| Investigations and tracing | Graph view to follow funds across hops, bridges, swaps and chains | Cross-chain and bridge tracing, token swaps, export of the trace as evidence |
| Sanctions and watchlist data | Maps official sanctions designations and other risk lists to addresses and entities | Update latency after a designation, source shown per label |
| Travel Rule support | Identifies counterparty VASPs and self-hosted addresses; some tools add data exchange | IVMS101 data model support, interoperability with the messaging networks your counterparties use |
| Case management and reporting | Alert queues, notes, approvals and audit trail; feeds suspicious activity reporting | Four-eyes approval, immutable history, export formats |
| API and data access | Programmatic screening, bulk lookups and data feeds | Rate limits, SLAs, scoped API keys, webhook signing |
Where identity fits
The screening integration runs on API keys or service accounts that can see every customer transaction and often influence whether funds move. Treat them as privileged non-human identities: store them in a secrets manager, scope them to the minimum endpoints, rotate them, alert on use from unexpected locations, and give the investigations console SSO with MFA and named accounts. See the Crypto Exchange Identity and Key Security Guide.
Evaluation criteria
Weights are illustrative; adjust them to your business model. A custodian with few transactions may weight investigations higher than throughput.
| Criterion | Weight | Evidence to request |
|---|---|---|
| Attribution accuracy on your sample | 20% | Results on 100 to 200 addresses you have already investigated, with labels you know are correct |
| Chain, token and stablecoin coverage | 15% | Written list of supported chains and tokens, with depth of support per chain (screening only or full tracing) |
| Screening latency and availability | 15% | Measured p95 latency in your PoC, contractual SLA, status history |
| Cross-chain and bridge tracing | 10% | Live trace through a bridge and a swap of your choosing |
| Explainability and evidence export | 10% | Why each score was given, which labels and hops drove it, exportable report |
| Rule configuration and tuning | 10% | Category thresholds, exposure percentages, allow lists with expiry and approval |
| Integration and API security | 10% | API documentation, key scoping, IP allow lists, SSO and role-based access for the console |
| Data handling and residency | 10% | What customer data you send, where it is stored, whether your queries are used to build their dataset |
Questions to ask vendors
- How are entity labels created, and what share are reviewed by a person before release? How do we dispute a wrong label, and how quickly is it fixed?
- How soon after a new sanctions designation that includes digital currency addresses does the label appear in screening results?
- Which chains and tokens support full tracing, and which only basic screening? How are new stablecoins added?
- How do you handle privacy-enhancing tools, cross-chain bridges and token swaps when calculating indirect exposure?
- When a label changes after a transaction was screened, do we get a retrospective alert?
- What exactly is sent when we screen an address, and do our queries or customer data contribute to your dataset or other clients' results?
- Can the console enforce SSO, MFA and role-based access, and can API keys be scoped to read-only screening? How are keys rotated?
- What evidence have regulators or courts accepted from your traces, and how do you document your methodology?
- How does your product work with our Travel Rule messaging provider to identify counterparty VASPs and self-hosted addresses?
Red flags
- Scores without reasons: a risk number with no visible labels, hops or exposure breakdown.
- Coverage counted in chains only: large chain counts with no statement of which tokens and which depth of tracing are supported.
- No dispute process: no route to correct a wrong attribution, which leads to blocked legitimate customers.
- Sanctions as a static list: matching only listed addresses, with no indirect exposure analysis.
- Vague data use terms: unclear whether your customer data or query history is reused.
- Shared console accounts or unscoped API keys: the tool holds sensitive investigative data and screening decisions; it needs the same access controls as your core systems.
Proof of concept
- Build a labelled test set. Take 100 to 200 addresses and transactions you have already investigated, covering exchanges, known scams, sanctioned exposure, mixers and clean retail customers. Include stablecoin transfers and at least one bridge hop.
- Run blind screening. Send the set to each shortlisted tool without telling the supplier which results you expect. Record true positives, false positives and missed exposure.
- Measure latency under load. Replay a peak hour of your withdrawal requests through the API and record p50 and p95 latency, errors and timeouts. Decide your fail-open or fail-closed policy from the results.
- Run two investigations. Ask your own analysts, not the supplier, to trace one historical case end to end, including a cross-chain step, and export the evidence pack. Time it.
- Test label change handling. Ask how a newly attributed address would trigger alerts on past transactions and observe it if possible.
- Review security and data terms. Confirm SSO, MFA, role-based access, API key scoping, audit logs, data residency and data reuse terms in the contract, not only in the demo.
- Score and decide. Apply the weighted criteria, record the reasons and keep the results as evidence of a risk-based tool selection for supervisors.
How NHI Mgmt Group can help
We provide independent advice on crypto security, identity and key management, and can help you build requirements and run a fair evaluation. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Blockchain Analytics and On-Chain Monitoring Guide · Crypto Travel Rule Compliance Guide · AML programme and transaction monitoring · Sanctions and PEP Screening