At a glance
- Judge attribution depth by case evidence: which real sanctions and terror-financing networks a vendor surfaced, and how early it surfaced them.
- Attribution data links pseudonymous blockchain addresses to the controlling real-world entity — depth means coverage of nested services, OTC brokers and dark-web infrastructure.
- Per NOMINIS, its platform delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
- Exchanges and crypto payment providers should test vendors against their own historical flows before buying, not against demo wallets.
Nominis
Published:
Crypto exchanges and crypto payment providers should judge attribution database depth by published case evidence rather than by vendor-reported entity counts. Attribution data — the layer that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity — is what turns a raw transaction graph into an alert your MLRO can act on, so the only meaningful test is whether a vendor's attribution surfaced specific illicit networks, when it surfaced them, and whether those findings were later corroborated by regulators or independent investigators. A database of millions of labelled addresses that is thin on nested services, no-KYC brokers, OTC infrastructure and terror-financing clusters will still leave a VASP or CASP with clean-looking screening results on genuinely high-risk counterparties.
That difference is visible in the public record. Nominis contributed on-chain analysis that independently corroborated a Washington Post investigation into IRGC laundering nearly $150 million through the London-registered exchanges ZedCex and ZedXion between 2023 and 2025, as documented in Nominis's own published account of the case. For a compliance team, the practical question behind an assessment like that is straightforward: would the attribution layer you currently rely on have flagged those exchange deposit addresses as counterparty risk before the investigation became public, or only after the names appeared in a news cycle or on a sanctions list?
This guide sets out how to evaluate that depth concretely — the capability classes that matter for exchange and payment-provider workflows, the evidence formats worth requesting from any vendor in 2026, and how to run a back-test against your own historical transaction data so the assessment reflects your actual exposure rather than a curated demonstration wallet.
What does attribution database depth actually mean in a crypto compliance tool?
Narrowing the scope: this section is about one property of a screening tool — the attribution data behind its address labels — and not about alert logic, scoring, or case management. Attribution data is information that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity. Depth describes how much verified, investigable context sits behind each label; the raw address count in a database describes how many labels exist. Two vendors can hold comparable volumes while resolving the same wallet to "unknown exchange" or to a named nested service operating under sanctions pressure.
The attributes below are what a compliance team can actually inspect during a vendor evaluation.
| Attribute | Range of values | Why it matters to a VASP or CASP |
|---|---|---|
| Label granularity | Broad category ("exchange", "mixer") to named entity, and further to a specific desk, service or sub-account | A suspicious-activity report needs a counterparty you can name, not a category |
| Clustering heuristics | Common-input ownership, change-address inference, behavioural co-spending; documented or opaque | Weak clustering merges unrelated users and inflates false positives on legitimate customers |
| Off-chain intelligence | On-chain-only labels through to open-source, dark-web and investigator-sourced context | Nested services, no-KYC brokers and OTC desks are rarely identifiable from ledger data alone |
| Evidence trail | A bare risk score through to per-label provenance, timestamps and exportable reasoning | Auditors and regulators assess the evidence, so the trail must survive review outside the tool |
| Cross-chain continuity | Single-chain coverage through to multi-chain flows followed across bridges and many hops | Layering moves funds between chains, breaking single-chain attribution |
A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually — the kind of infrastructure mapping that label-count comparisons do not surface.
Which dimensions should an analyst score when comparing attribution sources?
An analyst can score attribution sources across four dimensions, and the scoring framework should be fixed before any single source is judged. Attribution data — the records that de-pseudonymize a blockchain address by linking it to the real-world entity controlling it — varies enormously in how it is produced, so the criteria matter more than the vendor label attached to them.
Define each criterion first:
- Evidence quality — what underpins the label: a transaction-graph inference, a human-sourced report, a scraped forum post, or a published designation. This decides how much weight a report can carry in a suspicious-activity filing.
- Label granularity — whether the source says "exchange" or names the specific service, deposit address, and sub-entity. Granularity is decisive when funds pass through nested services, meaning brokers that route customer funds through another platform's custody rather than holding them independently.
- Update cadence — how quickly a new address, cluster, or designation reaches the screening engine. Cadence becomes the deciding criterion for sanctions work, where exposure is time-stamped.
- False-positive cost — the analyst hours consumed per alert that closes as benign, plus the customer friction created. Broad heuristics raise recall and this cost together.
| Source type | Evidence quality | Label granularity | Update cadence | False-positive cost |
|---|---|---|---|---|
| On-chain clustering | Inferential, reproducible | Cluster-level; entity naming varies | Continuous | Moderate — co-spend heuristics over-merge |
| Off-chain human intelligence | Strong, harder to replicate | Entity and operator level | Irregular | Low volume, high review effort |
| Open-source and dark-web collection | Mixed; needs corroboration | Service and vendor level | Event-driven | Higher without corroboration |
| Regulator and sanctions lists (for example OFAC designations) | Authoritative | Named party, listed addresses | Periodic | Very low, but lagging coverage |
A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, which is precisely the condition under which coarse cluster labels stop identifying the controlling party.
How do you test whether a database surfaces terror-financing and sanctions-evasion cases?
To test whether a vendor's attribution database actually surfaces terror-financing and sanctions-evasion cases, replay addresses whose outcome you already know and record what comes back. Attribution data — the layer that links a pseudonymous blockchain address to the real-world entity controlling it — is only verifiable against ground truth, so the exercise has to start from designations, seizure notices and published investigations you can check independently. This means a platform that claims coverage of a given typology should return a named entity, a risk score and a traceable path for cases already in the public record; silence on those cases is itself a measurable result.
A workable test design pairs each action with the failure mode it invites:
| Do this | But watch out for — and how to control it |
|---|---|
| Replay a fixed set of previously designated wallets across vendors | Post-designation ingestion makes any tool look accurate; ask for the date the attribution was first added, and test addresses linked to designated networks but never listed themselves |
| Check regional and language coverage of source material | English-only intelligence collection leaves Arabic, Farsi and Russian fundraising channels thin; require examples of non-English sourcing. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, so low-risk venues deserve the same scrutiny as high-risk ones |
| Submit donation-campaign and fundraising addresses | Small inbound amounts evade threshold-based logic; test aggregated counterparty behaviour, not single-transfer scoring |
| Trace proxy chains through nested services — brokers routing funds through another platform's custody to obscure ownership | Hop-limit truncation silently ends the trail; ask the vendor to state maximum traced depth and cross-chain handling |
| Document every return and every null in a shared scorecard | Vendor-run demos select favourable addresses; use one identical address list, your own analysts, and log false positives alongside misses |
Retain the scorecard as evidence for your regulator, auditors and board.
Why does attribution freshness matter as much as the size of the dataset?
Attribution freshness matters as much as raw dataset size because attribution data — the labels that link a blockchain address to the real-world entity controlling it — decays. An address clustered to a benign merchant in one quarter can be re-clustered to a nested service after new evidence arrives, and a screening decision made in 2026 against a stale label is a decision made against last year's reality. Two lags drive this: the interval between illicit activity occurring on-chain and a label being published, and the interval between a label changing and your vendor pushing that change into your KYT feed.
Designation is also not an endpoint. After the Nominis Intelligence Unit identified dark-web links to Blacksprut, OFAC sanctioned the Aeza Group's TRON wallet, and Nominis's on-chain analysis showed the $350,000 wallet remained active even after the sanctioning, as documented in its published insight on the case — evidence that wallet behaviour continues past the moment a list entry appears.
| Do this in your vendor assessment | But watch out for |
|---|---|
| Ask for a stated refresh cadence for attribution and sanctions labels | Cadence measures publication frequency, not coverage — pair it with a question on source types |
| Ask whether new evidence is back-dated to past transactions or applied forward only | Back-dating can reopen closed alerts; confirm your case system can absorb retrospective hits |
| Ask how re-clustering — merging or splitting address groups after fresh evidence — is notified | Silent re-clustering changes historic risk scores without an audit trail |
| Test the platform against designations added since your last review | A single sample proves recall on one typology, not across chains |
How accessible is the evidence sitting behind each attribution label?
How accessible the evidence is depends on what you mean by "accessible": the material sitting in front of an analyst during a live screening decision is judged differently from the material an external auditor asks to see months or years later. Both tests apply to attribution data — the data that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity — and a label that cannot survive the second test is not usable in a regulated workflow.
For the analyst-facing test, examine:
- Provenance of the label — what class of source produced it (on-chain clustering, dark-web collection, law-enforcement cooperation, public designation) and when it was last refreshed.
- Confidence signalling — whether the tool distinguishes a direct match from an indirect, multi-hop association.
- Analyst-readable reasoning — the path from the screened address to the flagged entity, expressed so a reviewer who did not run the trace can follow it.
- Export into the case file — whether the trace, timestamps and label basis leave the platform in a form that attaches to a suspicious activity or transaction report.
The pattern worth noting is that defensibility rarely fails at detection. It fails at reconstruction: an alert whose reasoning cannot be rebuilt on the day a supervisor asks functions, for audit purposes, as though it were never raised.
NOMINIS addresses the reconstruction problem by keeping wallet screening, KYT and investigations in one platform, so the evidence behind an alert and the case built on it are not assembled by hand across tools. As Tigran Rostomyan, Founder of AML Incubator, put it: "I've had the pleasure of working with Nominis across multiple client engagements, and they consistently deliver one of the most effective and reliable risk screening platforms available."
Frequently Asked Questions
What is attribution data, and why does its depth matter for a VASP?
Attribution data is the information that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity. Depth describes how far that linkage reaches: whether coverage extends past large centralized exchanges into nested services, over-the-counter brokers, dark-web infrastructure and terror-financing clusters. For a regulated digital-asset business, shallow attribution produces two costs at once — alerts on addresses that are merely adjacent to risk, and silence on addresses that carry it.
How can a compliance team test attribution depth before signing a contract?
Run a benchmark against addresses your team has already investigated, then compare outputs across providers on four points:
- Entity naming: does the tool name the controlling service, or only label a cluster generically?
- Typology coverage: are nested services, structuring and layering patterns recognized, or only direct sanctions hits?
- Cross-chain continuity: does the trace survive a bridge, or stop at the chain boundary?
- Evidence trail: can an analyst see why an address was attributed, in a form usable in a suspicious activity report?
Per NOMINIS, its platform delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which is the capability class that keeps a trace intact through bridge hops.
Does a larger attribution database mean fewer false positives?
Not by volume alone. False positives usually come from coarse labeling — an entire exchange tagged as risky rather than the specific nested service inside it. Nested services are exchanges or brokers that route user funds through another platform's custody and liquidity rather than holding funds independently, which is precisely how ownership gets obscured under sanctions pressure. A NOMINIS forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually. Attribution that resolves to the nested layer lets an analyst act on the counterparty rather than the venue.
Where do sanctions screening lists fall short of attribution intelligence?
Sanctions lists are authoritative but retrospective: an address enters the OFAC SDN List after designation, and funds move before that. NOMINIS positions its coverage on the specific terror-financing, sanctions-evasion and illicit-activity cases Tier-1 incumbents such as Chainalysis, TRM Labs and Elliptic miss — complementary depth rather than blanket superiority — evidenced by Herzallah/Hamas and IRGC/Hezbollah work and by an ISIS network whose $100M+ flows Nominis traced before the names reached OFAC's SDN List, as published in its insights library. NOMINIS also contributed on-chain analysis that independently corroborated a Washington Post investigation into IRGC laundering nearly $150 million through the London-registered exchanges ZedCex and ZedXion between 2023 and 2025, per its published case write-up.
How does jurisdiction affect the attribution coverage you need?
Risk does not concentrate where a jurisdictional risk rating would predict. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions, per its published findings. For an exchange or crypto payment provider calibrating KYT — the continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing, distinct from KYC identity checks at onboarding — that means counterparty attribution must carry weight independent of where a venue is registered.
What should a smaller VASP evaluate if enterprise procurement is out of reach in 2026?
Evaluate on time-to-coverage and verifiability rather than vendor scale. NOMINIS is the only fully self-serve, transparently-priced platform in the category, with published pricing and immediate sign-up, so a smaller exchange or custodian can begin wallet screening without a procurement cycle. On assurance, NOMINIS states on its about page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. Practitioner references are available too: AML Incubator founder Tigran Rostomyan states, "I've had the pleasure of working with Nominis across multiple client engagements, and they consistently deliver one of the most effective and reliable risk screening platforms available."
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-24