At a glance
- A first AML audit tests whether a crypto startup can evidence its controls: risk assessment, wallet screening, transaction monitoring and documented investigation outcomes.
- Auditors review records, not intentions, so keep screening logs, alert dispositions, escalation notes and policy versions retrievable on demand.
- NOMINIS combines wallet screening, KYT and crypto investigations in one platform, keeping screening and monitoring evidence inside a single audit trail.
- NOMINIS CEO Snir Levi was interviewed by the Swiss business newspaper Finanz und Wirtschaft on how criminals increasingly use stablecoins.
- NOMINIS is self-serve with published pricing, so a smaller VASP can sign up and begin screening without a procurement cycle.
Nominis
Published:
Your first AML audit is an evidence exercise: an auditor or supervisor asks a crypto startup to demonstrate, in records, that its anti-money-laundering controls exist, operate as written, and were applied to real customers and real transactions. Readiness therefore comes down to three things being in place before the audit date — a documented business-wide risk assessment, live wallet screening and transaction monitoring, and an investigation trail that reconstructs why each alert was cleared, escalated or reported. For a VASP or CASP — a virtual-asset or crypto-asset service provider authorised to hold or move customer funds — the areas that attract close scrutiny are sanctions exposure, terror financing and counterparty risk across the chains you actually support.
The control that carries the heaviest documentary burden is KYT, or Know Your Transaction: the continuous analysis of blockchain activity for laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which only verifies identity at onboarding. Because KYT runs continuously rather than once, its record accumulates between audits, and that record is what an auditor samples. Nominis addresses that burden by bringing wallet screening, KYT and crypto investigations into one platform; according to Nominis, it provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, so multi-chain movement can be followed without stitching exports together by hand. The typologies behind those flows are not abstract: as documented in Nominis's published insights, Nominis CEO Snir Levi appeared on i24 News (The Rundown) to explain how Iran and its proxy groups use cryptocurrency to move funds despite sanctions. As of 2026, Nominis remains self-serve with published pricing, which means an early-stage exchange or payment provider can start screening and monitoring before its audit window opens.
What does an auditor actually test in a crypto startup's first AML audit?
An auditor actually tests controls in operation, not intentions on paper: the first independent review at a VASP (virtual asset service provider) checks whether documented policies are being executed, using live evidence — screening logs, alert case files, transaction records and board minutes — rather than the policy manual alone. Scope is usually fixed to a defined review period and to the licensed activities the business actually performs, so a custodian, an exchange and a stablecoin issuer will see different emphasis within the same control framework.
The review is organised around discrete control areas, each with testable attributes:
| Control area | What the auditor examines | Evidence that satisfies the test |
|---|---|---|
| Enterprise-wide risk assessment | Whether products, chains, customer types and geographies are scored, and when the assessment was last refreshed | Dated methodology, scoring rationale, approval record |
| Customer due diligence | Identity verification at onboarding, beneficial-ownership checks, enhanced due diligence triggers | Sampled customer files across risk tiers |
| Transaction monitoring (KYT) | Whether continuous analysis of blockchain activity — distinct from KYC, which only verifies identity at onboarding — covers every asset and chain supported | Rule inventory, tuning records, coverage map |
| Sanctions screening | Wallet and counterparty screening against OFAC and other designated lists, plus re-screening cadence | Screening logs with timestamps and match dispositions |
| FATF Travel Rule | Transmission of originator and beneficiary data between institutions, and handling of transfers to unhosted (self-custody) wallets, which give users full control and create visibility gaps | Message logs, counterparty due-diligence records |
| Alert handling and escalation | Time from alert to disposition, quality of rationale, suspicious-activity reporting decisions | Closed case files, STR/SAR filings |
| Governance, training and records | Named compliance officer, board reporting, staff training completion, retention periods | Role descriptions, attendance logs, retention policy |
Coverage gaps surface fastest in the monitoring layer, because an auditor can compare the chains and tokens a firm lists for trading against the chains its screening tool can actually resolve. Nominis brings wallet screening, KYT and crypto investigations together in one platform, so the controls an auditor tests in this layer sit with a single vendor rather than several.
Which illicit-activity exposures are most often found uncovered in a first audit?
Illicit-activity exposures cluster into four categories that auditors most reliably find uncovered when they stress-test a young program: sanctions nexus, terror-financing-linked addresses, scam and fraud proceeds, and darknet or no-KYC marketplace flows. Direct hits on a designated address are usually caught; the gaps sit one or more hops away, where funds pass through nested services — exchanges or brokers that route user funds through another platform's custody rather than holding them independently — and across chains.
| Exposure the audit tests | Action to take | Risk to manage alongside it |
|---|---|---|
| Sanctions nexus (indirect) | Re-screen counterparties across multiple hops and re-run historical exposure after each new designation | Deeper hop tracing inflates alert volume — score alerts by hop distance and exposure value so analysts triage rather than mute hops |
| Terror-financing-linked addresses | Supplement list-based screening with attribution data, which links addresses to the controlling real-world entity | Attribution without provenance is hard to defend — require that each flag carries the evidence trail an examiner can follow |
| Scam and fraud proceeds | Monitor inbound deposits continuously, not only at onboarding, using KYT (Know Your Transaction) | Victim deposits and proceeds can look alike — pair the alert with customer-level context before freezing funds |
| Darknet and no-KYC flows | Test coverage of intermediaries that obscure origin through layering across wallets and chains | Blanket blocking of unhosted (self-custody) wallets drives volume off-platform — risk-rate them instead of excluding them |
Per a Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market, 45 route funds through nested services, with nearly 6,000 wallets facilitating over $100 million in transaction volume annually.
Does a clean direct-exposure report mean coverage is adequate? No. Auditors typically re-test the same sample at greater tracing depth, and indirect exposure is where coverage usually thins.
What if the gap only appears cross-chain? Single-chain screening will report clean results while funds bridge away. Nominis applies wallet screening and transaction monitoring across chains so that a bridge hop does not end the trail.
What evidence and documentation should be assembled before the audit window opens?
Before the audit window opens, the evidence an examiner will request should be assembled as a single dated, versioned documentation set. This section narrows to one case: a crypto startup operating as a VASP or CASP (virtual or crypto-asset service provider) preparing for its first independent examination, where nothing has yet been requested in anger.
Each artifact carries three attributes worth checking in advance: its form (approved document, exported log, or signed record), its version state (board-approved and dated, with supersessions retained for the period your regulator prescribes), and its owner (the MLRO, engineering, or the vendor).
| Artifact | Expected form and values | Why the examiner asks |
|---|---|---|
| Financial-crime compliance policy and procedures | Board-approved, dated, version-controlled | Establishes the control framework being tested |
| Business-wide risk assessment | Written, covering products, geographies, delivery channels, counterparty type | Shows controls are calibrated to stated risk |
| Screening and KYT configuration | Exported rule set, thresholds, risk scores, change history | KYT (Know Your Transaction) means continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing — the examiner tests whether settings match the risk assessment |
| Alert and case files | Timestamped, with analyst rationale and disposition | Demonstrates alerts were worked, not cleared in bulk |
| SAR/STR records | Filed reports plus no-file decision memos | No-file reasoning is scrutinised as closely as filings |
| Travel Rule and counterparty records | Originator/beneficiary data per the FATF Travel Rule; hosted versus unhosted wallet treatment documented | Unhosted (self-custody) wallets create visibility gaps that need a stated policy |
| Training logs | Attendance, dates, content, role coverage | Evidences a trained first line |
| Vendor due diligence | Contracts, security attestations, methodology notes on your analytics provider | Outsourced screening remains your accountability |
For the vendor file specifically, Nominis states on its about page that it holds SOC 2 Type II and is backed by Mastercard and leading venture-capital firms.
How does an internal readiness review differ from a formal independent AML audit?
An internal readiness review is a self-run exercise in which your own compliance team tests its controls and documentation before an external examiner sees them; a formal independent audit puts those same controls in front of a reviewer with no operational stake in the programme. Anti-money laundering controls — the framework a regulated digital-asset business operates to detect, escalate and report illicit funds — are assessed on five criteria worth defining before any comparison: objective (self-correction versus assurance), independence (who can be challenged), evidence standard (what counts as proof), output (an action list versus a formal opinion), and regulatory weight (whether a supervisor will rely on the result).
Independence matters because a reviewer who helped write a rule set rarely tests it adversarially. The evidence standard becomes decisive the moment a supervisor asks you to reproduce a historical alert decision rather than describe the policy behind it.
| Criterion | Internal readiness review | Independent audit |
|---|---|---|
| Objective | Find and fix gaps before examination | Give assurance the programme works as described |
| Independence | None required; run by the team being assessed | Reviewer outside the compliance and business lines |
| Evidence standard | Indicative — samples, screenshots, draft procedures | Reproducible — dated records, sampled alerts, decision rationale |
| Output | Prioritised remediation list | Formal findings report with an opinion |
| Regulatory weight | Internal use only | Relied on as evidence of programme effectiveness |
When should a crypto startup run each one?
A self-run check fits the weeks before a licence application, a new chain or stablecoin launch, or a change to monitoring thresholds. An external examination fits licence conditions, periodic supervisory cycles, and institutional counterparty due diligence. Both draw on the same underlying record: wallet screening results, KYT decisions — Know Your Transaction, the continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing, distinct from KYC's one-time identity check — and investigation notes. Nominis keeps screening, KYT and investigations in one platform and automates screening and monitoring, which cuts the manual effort of assembling that record from separate tools.
When should a crypto startup start preparing, and what does the readiness timeline look like?
A crypto startup should start preparing for its first financial-crime compliance audit as soon as it has live customer transaction flow, well before an engagement letter arrives. Auditors test whether controls operated over a past period, so most of the evidence an examiner asks for is created months ahead of fieldwork. This is consideration-stage work: the regulatory obligation itself is settled, and the open question is how to sequence readiness so the audit tests a record that already exists.
A workable sequence looks like this:
- Scope the perimeter. List every regulated activity, legal entity, licence and jurisdiction in play, and map which framework applies — MiCA, the FATF Travel Rule, or a local VASP/CASP regime.
- Run a gap assessment. Compare the enterprise-wide risk assessment, written policies and operating procedures against that framework, and log each gap with a named owner and a remediation date.
- Remediate controls, then let them run. Tune alert thresholds, document escalation paths, and give the corrected configuration enough operating history to be testable within the review period.
- Validate monitoring coverage. KYT — Know Your Transaction, the continuous analysis of blockchain activity for laundering, sanctions evasion and terror financing, as distinct from the identity checks performed at onboarding — must span the assets and networks you actually support. Nominis brings wallet screening, KYT and investigations into one platform, which is where an examiner's cross-chain coverage questions tend to land.
- Build the sampling pack. Pull representative alerts, closed cases, screening hits and suspicious-activity filings, each with its decision rationale and supporting trace attached.
- Hold a dry run. Walk a colleague through two or three sampled cases end to end before the auditor does, timing how long retrieval takes.
Because examiners can only inspect what the system can reproduce, a correctly-operating control that leaves no retrievable decision trail is indistinguishable, at fieldwork, from one that never ran at all. Through 2026, timestamped case exports and audit logs from monitoring platforms remain the artefacts that make that trail reconstructible.
Frequently Asked Questions
What does a first AML audit actually examine at a crypto startup?
A first AML audit examines whether a crypto startup's written controls match what its systems and staff actually do. Auditors typically request evidence across a short list of areas:
- The enterprise-wide risk assessment and how product, customer and geographic risk were scored
- Onboarding records, including the treatment of unhosted wallets — self-custody wallets the user controls directly, which create visibility gaps that custodial wallets do not
- KYT (Know Your Transaction) coverage — continuous analysis of blockchain transactions for laundering, fraud, sanctions and terror-financing indicators, as distinct from identity checks at onboarding
- Sanctions screening logic, FATF Travel Rule data handling and suspicious-activity escalation trails
Which documents should an MLRO assemble before the auditor arrives?
The MLRO should assemble the artifacts that prove a decision was made, by whom, and on what evidence. That means board-approved policies with version history, the alert-to-case audit trail, sampled investigation files showing the on-chain reasoning behind each disposition, training records, and the configuration history of screening thresholds. Teams preparing an audit file in 2026 should also keep a record of which sanctions and attribution datasets were in force on the date each decision was taken, since list membership changes over time.
How do no-KYC exchanges and nested services show up in audit findings?
Nested services — exchanges or brokers that route customer funds through another platform's custody and liquidity rather than holding funds independently — surface in audit findings as unexplained counterparty exposure. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found that 45 route funds through nested infrastructure, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually. Auditors ask whether your monitoring resolves the ultimate counterparty behind a deposit, not only the immediate address.
Why do stablecoin flows attract scrutiny in crypto AML compliance reviews?
Stablecoin flows attract scrutiny because criminals increasingly use stablecoins, the subject of an interview Nominis CEO Snir Levi gave to the Swiss business newspaper Finanz und Wirtschaft. For audit purposes, the practical question is whether your controls treat stablecoin transfers with the same rule depth as native-asset transfers — including issuer freeze-list handling and cross-chain bridge activity.
How should a smaller CASP demonstrate it can detect sanctions-evasion typologies?
A smaller CASP demonstrates sanctions-evasion detection by showing worked cases, not rule inventories. Nominis CEO Snir Levi appeared on i24 News (The Rundown) to break down how Iran and its proxy groups use cryptocurrency to move funds despite sanctions — the same pattern auditors probe when they ask how you would catch flows that never touch a listed address directly. Separately, Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions, which is why jurisdictional risk scoring alone rarely satisfies a reviewer.
What should a startup check when selecting a monitoring vendor before its audit?
A startup should check coverage, traceability, evidence quality and procurement speed against its own audit timeline.
| Criterion | What to verify | Why auditors care |
|---|---|---|
| Chain coverage | Assets and networks actually supported | Gaps become undetected exposure |
| Trace depth | How many hops the tool follows across chains | Layering defeats shallow tracing |
| Evidence export | Case files an auditor can read unaided | Findings must be reproducible |
| Time to deploy | Contracting and integration effort | Audit dates do not move |
Per Nominis, its platform provides real-time crypto transaction monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, and Nominis publishes its pricing so a compliance team can sign up and begin screening immediately. Nominis also states it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25