Topic starter
10/07/2026 9:21 pm
TL;DR: Nearly half of organisations onboarded in 2026 now operate at alerting standards that would have placed them in the top 10% in 2020, while indirect exposure thresholds are often 10 to 20 times looser than direct thresholds for categories like ransomware and fraud shops, according to Chainalysis. That gap makes indirect flow governance the control line that determines whether compliance programmes detect risk early or inherit it late.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “The New Compliance Floor: Organizations are Adopting Stronger Than Ever Monitoring Practices”.
Key questions
Q: What breaks when indirect exposure thresholds are too loose?
A: When indirect thresholds are too loose, suspicious flows can move through several hops before any alert appears, which delays investigation and weakens defensibility.
Q: Why do indirect exposure settings need separate governance from direct monitoring?
A: Indirect exposure carries more attribution uncertainty, so the tolerance for ambiguity must be defined separately from direct first-hop contact.
Q: How do compliance teams know whether their monitoring baseline is still current?
A: They compare alert thresholds, severity rules, and category treatment against current peer cohorts and supervisory expectations, then review whether their own configurations still match today’s risk environment.
Practitioner guidance
- Separate direct and indirect exposure policies Maintain distinct threshold logic for first-hop and multi-hop flows so that indirect risk is not diluted by settings designed for direct contact.
- Benchmark thresholds against current peers Compare alert floors, category severity, and sensitivity settings against current market cohorts rather than historical internal baselines.
- Document category-specific tolerance levels Record why ransomware, fraud shops, sanctioned jurisdictions, and other categories receive different indirect alert thresholds and review that rationale with compliance leadership.
Bottom line: Digital asset compliance has tightened, but indirect exposure remains the weak point because intermediary hops create more room for threshold drift and inconsistent escalation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Indirect exposure has become the real governance gap in digital asset compliance. Direct monitoring is now comparatively standardised, but indirect-flow settings still vary enough to create inconsistent defensive coverage. That inconsistency matters because sophisticated actors do not need to defeat all monitoring, only the weaker layer between first-hop detection and downstream attribution. Practitioners should treat indirect exposure policy as a primary control, not a tuning detail.
A question worth separating out:
Q: What should global compliance teams do when regional thresholds differ?
A: They should define which differences are driven by legal or supervisory requirements and which are just local preference. If the same risk category is treated differently across regions, the organisation needs a documented rationale, consistent oversight, and a way to explain the variation to auditors or regulators.
👉 Read our full editorial: Indirect exposure monitoring is tightening across digital assets