Notifications
Clear all
Topic starter
10/07/2026 9:21 pm
TL;DR: Nearly half of organisations onboarded in 2026 now operate at alerting standards that would have placed them in the top 10% in 2020, while indirect exposure thresholds are often 10 to 20 times looser than direct thresholds for categories like ransomware and fraud shops, according to Chainalysis. That gap makes indirect flow governance the control line that determines whether compliance programmes detect risk early or inherit it late.
NHIMG editorial — based on content published by Chainalysis: The New Rails, How Digital Assets Are Reshaping the Foundations of Finance
By the numbers:
- 2026 now operate at alerting standards that would, w operate at alerting standards that would have placed them in the top 10% of alerting strictness in 2020.
- Traditional financial institutions maintain lower dollar-detection floors for both illicit and non-illicit categories, with non-illicit indirect exposure averaging $150 versus $950 for crypto exchanges.
- Indirect thresholds are often 10 to 20 times more lenient than direct thresholds for categories like ransomware, fraud shops, and sanctioned jurisdictions.
Questions worth separating out
Q: How should financial institutions set thresholds for indirect exposure monitoring?
A: They should set indirect exposure thresholds separately from direct thresholds and justify the difference by category, jurisdiction, and investigative capacity.
Q: Why do indirect transaction thresholds need different treatment from direct thresholds?
A: Indirect flows introduce attribution ambiguity because the funds do not arrive straight from a known illicit source.
Q: What do compliance teams get wrong about regional monitoring differences?
A: They often assume that a shared platform creates shared policy outcomes.
Practitioner guidance
- Define separate thresholds for direct and indirect flows Maintain distinct policy baselines for first-hop exposure and multi-hop exposure, with documented rationale for category-specific sensitivity and escalation paths.
- Benchmark against current peer cohorts Compare alerting floors, category coverage, and severity settings against present-day peers rather than 2020-era baselines, because the acceptable range has tightened materially.
- Include regional posture in counterparty review Assess AMER, EMEA, and APAC monitoring behaviour during due diligence so you can spot counterparties whose indirect exposure policies are materially looser than yours.
What's in the full report
Chainalysis' full report covers the operational detail this post intentionally leaves for the source:
- Benchmark methodology for the compliance index, including how alert severity and trigger sensitivity were combined
- Category-by-category threshold data for indirect versus direct exposure across ransomware, fraud shops, scams, and sanctioned jurisdictions
- Regional distributions for AMER, EMEA, and APAC that show where indirect monitoring is most lenient
- Practical guidance on evaluating blockchain analytics data quality before tuning production alerting
👉 Read Chainalysis' report on how digital assets are reshaping financial compliance rails →
Indirect exposure monitoring: what compliance teams need to act on?
Explore further
10/07/2026 9:44 pm
Indirect exposure is the category that exposes compliance maturity, not direct exposure. Direct monitoring has already converged toward a global baseline, so the differentiator is how organisations treat multi-hop flows. When indirect thresholds are 10 to 20 times looser, the control is signalling a tolerance for ambiguity rather than a mature risk posture. Practitioners should treat indirect exposure as the real test of compliance discipline.
A question worth separating out:
Q: How do organisations know if indirect exposure monitoring is actually working?
A: They should test whether suspicious multi-hop flows generate alerts early enough to support investigation before funds are dispersed. A working control has coherent thresholds, consistent category treatment, and reliable entity attribution. If alerts only appear after value has already moved through several layers, the monitoring programme is late rather than effective.
👉 Read our full editorial: Indirect exposure monitoring is tightening across digital assets
