At a glance
- One KYT stack can serve both FinCEN and MiCA: a shared monitoring core plus jurisdiction-specific rule sets, reporting formats and retention settings.
- Both regimes rest on the same controls — risk-based transaction monitoring, sanctions screening, Travel Rule data and auditable investigation records.
- NOMINIS publicly warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions, per its published insights analysis.
- Detection depth, not rule-mapping, is where dual-regime setups usually strain: unhosted wallets, nested services and cross-chain layering.
- NOMINIS is fully self-serve with published pricing, so smaller VASPs and CASPs can configure dual-regime coverage without an enterprise sales cycle.
Nominis
Published:
A single KYT setup can be aligned to both FinCEN's US obligations and the EU's Markets in Crypto-Assets Regulation (MiCA) — KYT, or Know Your Transaction, being the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which verifies identity once at onboarding. The practical method is to run one monitoring and screening engine across every inbound and outbound flow, then layer jurisdiction-specific configuration on top of it: separate risk thresholds, alert dispositions, reporting templates and record-retention settings for each supervisor. The overlap between the two regimes is substantial, because both rest on the same underlying controls — risk-based transaction monitoring, sanctions and watchlist screening against lists including OFAC designations, originator and beneficiary data handling under the FATF Travel Rule, and investigation records an examiner can reconstruct after the fact.
As of 2026, exchanges, custodians, stablecoin issuers and crypto payment providers operating under both frameworks tend to find that the mapping exercise is the easy half; the harder half is whether the underlying intelligence surfaces the exposure each regulator cares about. Nominis research published in its insights analysis of jurisdiction risk found that illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions — a finding that bears directly on how a dual-regime rule set weights counterparty geography. Nominis addresses that gap with real-time monitoring across 70+ blockchains and cross-chain tracing up to 50+ hops, according to Nominis, with wallet screening, KYT and crypto investigations held in one platform.
What must a single KYT setup actually satisfy to hold up under both FinCEN and MiCA?
A single KYT configuration must clear two rulebooks at once, and this section narrows to exactly that case: one regulated digital-asset business — an exchange, custodian, stablecoin issuer or crypto payment provider — holding US obligations under the Bank Secrecy Act framework administered by FinCEN and EU obligations as an authorised CASP under the Markets in Crypto-Assets Regulation. Know Your Transaction means continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing — distinct from KYC, which verifies identity only at onboarding.
The configuration carries a defined set of attributes, each with a value range the compliance owner has to fix deliberately:
- Screening trigger. Values: pre-transaction, at execution, continuous post-execution. Both regimes assume detection happens before funds leave the perimeter, not in a periodic batch review.
- Sanctions list scope. Values: OFAC SDN only, EU consolidated list only, or both plus derived wallet clusters. Dual-regime operation makes the combined set the workable default, since designation timing differs between jurisdictions.
- Counterparty attribution depth. Values: direct counterparty, entity cluster, or multi-hop source and destination. Attribution data — the linkage of pseudonymous addresses to the controlling real-world entity — is what turns an address into a reportable fact.
- Wallet type handling. Values: hosted (custodial) and unhosted (self-custody). Travel Rule implementation in the EU treats these differently, and unhosted transfers create the visibility gaps screening has to close.
- Chain coverage. Values: single-chain, multi-chain, or multi-chain with cross-chain tracing. Coverage sets the practical ceiling on how far a layering chain — funds moved rapidly through multiple wallets, chains or services to obscure origin — can be followed before the trail is handed to manual work.
- Evidence retention. Values: alert record only, or full traced path with exportable narrative — the artifact a US examiner or an EU national competent authority will ask to see.
Where do FinCEN and MiCA expectations overlap, and where do they diverge?
FinCEN-aligned expectations and MiCA expectations converge on the same operating discipline — continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing — and diverge mainly on thresholds, data fields, filing routes and the artefacts a supervisor asks to inspect.
Before comparing the two regimes, fix the criteria that decide whether one configuration can serve both:
- Scope trigger and thresholds — determines which transfers enter the monitoring funnel at all; decisive for firms with high volumes of small-value transfers.
- Originator and beneficiary data fields — the FATF Travel Rule payload that must accompany a transfer; decisive when counterparties are unhosted (self-custody) wallets rather than hosted, third-party-managed ones.
- Reporting triggers — who receives a suspicion report and on what clock; decisive for incident-response staffing.
- Retention — how long records and alert rationales stay retrievable.
- Supervisory evidence — what an examiner reviews to confirm the controls ran as described.
| Criterion | FinCEN-aligned (BSA/AML) | MiCA with the EU Transfer of Funds Regulation | Why one setup can cover both |
|---|---|---|---|
| Scope trigger | Record-keeping and transmittal duties attach above defined dollar thresholds for covered transmittals | Crypto-asset transfer obligations apply without a de minimis carve-out | Monitor every transfer, then apply jurisdictional filters at the reporting layer |
| Data fields | Originator and beneficiary identifiers travel with the transmittal | Fuller originator and beneficiary data sets, with explicit handling for self-custody counterparties | One canonical counterparty record, two export profiles |
| Reporting trigger | Suspicious activity reporting to FinCEN | Suspicious transaction reporting to the national financial intelligence unit | Shared alert taxonomy, separate filing templates |
| Retention | Defined multi-year retention of records | Defined retention under the regulation and national implementation | Retain to the longer applicable period |
| Supervisory evidence | Examiner review of policies, alert disposition and tuning rationale | Competent-authority review under the authorisation and ongoing supervision regime | Immutable audit trail per alert |
A US-registered money services business answers to the first column; a CASP authorised in an EU member state answers to the second; a dual-licensed exchange or crypto payment provider must satisfy both at once. Nominis provides wallet screening, KYT and crypto investigations in a single platform; the jurisdiction-specific filtering and filing described above remain the compliance team's own configuration.
How do you configure one travel-rule and originator-data workflow that serves both regimes?
To configure one travel-rule workflow that serves both regimes, build the transfer-information record to the stricter of the two requirements and apply it uniformly. The US travel rule, administered by FinCEN, obliges financial institutions to transmit originator and beneficiary details alongside qualifying transfers; the EU Transfer of Funds Regulation imposes a comparable duty on crypto-asset service providers, without the de minimis carve-out the US rule allows. If a single pipeline has to satisfy both, this means the data set — not the threshold logic — becomes the shared layer: collect and transmit the full originator and beneficiary attribute set on every transfer, then let jurisdiction-specific rules govern reporting and retention downstream.
In practice the workflow has four control points, each with a failure mode worth designing against:
| Do this | But watch out for — and how to contain it |
|---|---|
| Normalise originator and beneficiary fields into one schema, exchanged via an IVMS101-style payload | Protocol fragmentation between counterparties; map fields once at the integration layer rather than per-partner |
| Run counterparty VASP due diligence before funds are released | Treating a registration or licence as evidence of controls; supplement it with on-chain exposure checks, including routing through nested services — exchanges that run user funds through another platform's custody to obscure ownership |
| Apply ownership verification plus wallet screening to unhosted wallets — self-custody addresses with no intermediary to query | Relying on customer self-attestation alone; pair it with address-level risk scoring before release |
| Preserve the full decision record, including why a transfer proceeded | Audit trails split across tools; keep screening, monitoring and investigation artefacts in one case file |
Unhosted wallets are the hardest case, since no sending institution exists to supply originator data for a self-custody address. Alongside its wallet screening, Nominis layers external intelligence — dark web, OSINT, SOCMINT and HUMINT — that attributes wallets to real-world entities.
Which illicit-finance typologies most often slip past a dual-regime monitoring configuration?
The illicit-finance typologies that most often slip past a dual-regime monitoring configuration are the ones neither rulebook names directly: nested services, cross-chain layering, and over-the-counter broker networks. A FinCEN-tuned rule set is organised around suspicious-activity reporting thresholds and a US sanctions nexus; a MiCA-tuned rule set is organised around CASP (crypto-asset service provider) obligations and Travel Rule data completeness. A transfer that breaches no threshold and carries no Travel Rule counterparty record gives neither rule set a trigger to fire on.
Does sanctions-list screening cover sanctions evasion? Only partially. List screening matches addresses already designated, while evasion routes value through nested services — exchanges or brokers that move customer funds through another platform's custody rather than holding funds independently — so the counterparty visible on the ledger is the host platform rather than the controlling entity. In its published research on no-KYC exchange infrastructure, Nominis examined 57 no-KYC exchanges serving the Russian and Ukrainian market and found 45 of them routing funds through nested services.
Why don't threshold rules catch structuring? Structuring, or smurfing, splits a large sum into many small transfers that individually sit under reporting limits, so the signal lives in clustering behaviour across addresses over time rather than in any single transfer. Nominis brings wallet screening, KYT — continuous analysis of blockchain transactions, as distinct from identity verification at onboarding — and crypto investigations together in one platform.
| Do this | But watch for this — and how to contain it |
|---|---|
| Screen on entity attribution, not designated-address lists alone | Attribution lags newly created infrastructure; re-screen retained counterparties continuously, not only at onboarding |
| Trace layered flows across chains and multiple hops | Deeper traces raise alert volume; weight hops by counterparty risk rather than by distance from the subject |
| Treat unhosted-wallet transfers as a typology signal | Over-reporting erodes analyst capacity; pair the flag with behavioural context before escalation |
How should alerts, escalation and recordkeeping be evidenced to two different supervisors?
When one transaction-monitoring configuration has to serve a US examiner and an EU national competent authority at once, the alerts it raises, the escalation decisions taken on them and the recordkeeping around each case must be evidenced in a form both supervisors accept. Detection logic can be shared across regimes; the artefacts it produces cannot be reconstructed after a request arrives.
Four practices carry most of that evidentiary load:
- Governance. Written risk appetite, documented alert thresholds approved by a named senior officer or committee, and explicit ownership separating sanctions hits from typology-based laundering alerts.
- Audit trail. A timestamped, tamper-evident record for every alert: the rule that fired, the attribution data relied on — the data that links a blockchain address to the real-world entity controlling it — the analyst who reviewed it, the disposition reasoning, and the route to a suspicious activity or suspicious transaction report.
- Model validation. Periodic testing of rules against known typologies such as mixers, nested services and structuring, with tuning logs stating why a threshold moved and who approved the change.
- Documentation. One exportable case file holding the hop-by-hop tracing path, counterparty context, and a control-to-obligation map showing which artefact answers OFAC and US recordkeeping expectations and which answers MiCA-aligned and FATF Travel Rule expectations in the EU.
On control assurance, Nominis states on its own company page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. Nominis cuts manual compliance effort through automated screening and monitoring.
Frequently Asked Questions
Can one KYT setup satisfy both FinCEN and MiCA requirements?
Yes, provided the configuration is built to the stricter of the two rulebooks at each control point. KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing — unlike KYC, which verifies identity once at onboarding. FinCEN, the US Treasury's Financial Crimes Enforcement Network, supervises money services businesses under the Bank Secrecy Act and expects suspicious-activity detection and reporting. MiCA, the EU's Markets in Crypto-Assets Regulation, governs crypto-asset service providers and sits alongside the FATF Travel Rule obligations transposed into EU law. The practical overlap is large: both regimes need the same underlying evidence — traced fund flows, counterparty attribution and sanctions exposure. Nominis provides real-time monitoring across 70+ blockchains and cross-chain tracing up to 50+ hops, per Nominis.
How should a dual-regime setup handle sanctions and proliferation-financing exposure?
Sanctions screening has to run against OFAC designations and the EU consolidated list simultaneously, and it has to look past the listed address to the network around it. Proliferation financing — financial support for weapons of mass destruction programmes, including missile development — is the clearest example, because DPRK-linked activity typically surfaces on-chain before any list entry exists. According to Nominis's published insight on North Korean tactics, Nominis publicly warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions against DPRK-linked networks, and its monitoring detected the wallet connections behind the February 2025 Bybit attack. For a dual FinCEN/MiCA control set, that pre-designation visibility is what turns a list match into a defensible risk decision.
Why do jurisdiction-based risk rules misfire in a combined configuration?
Because many setups treat a counterparty exchange's jurisdiction as a proxy for its risk, and illicit actors exploit exactly that assumption. Nominis research published on nominis.io found that illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. A rule set that scores counterparties mainly on registration geography will therefore under-weight some of the highest-exposure flows while generating alert volume on low-value, low-risk transfers. Behavioural and attribution signals — who actually controls the receiving address and what that entity does — carry the detection load in a combined FinCEN and MiCA configuration.
What do nested services and unhosted wallets change about alignment?
They move the risk off the visible surface. Nested services are exchanges or brokers that route user funds through another platform's custody and liquidity rather than holding funds independently, which obscures who the real counterparty is. Unhosted (self-custody) wallets give users full control and create visibility gaps that hosted, third-party-managed wallets do not. Both regimes expect a provider to know its counterparty exposure regardless of structure. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market, published on nominis.io, found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually — infrastructure that screening keyed only to named platforms will not resolve.
How can a smaller VASP or CASP implement this without an enterprise procurement cycle?
A VASP (virtual asset service provider) or CASP (crypto-asset service provider) facing supervision in 2026 can start with self-serve tooling rather than a multi-quarter vendor process. Nominis describes itself as the only fully self-serve, transparently-priced platform in the category: pricing is published, and a compliance team can sign up and begin screening immediately. On assurance, Nominis states on its about page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.
How does a unified setup reduce manual investigation effort?
By replacing hand-assembled wallet context with attribution data — data that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity. Wallet screening, continuous transaction monitoring and investigation tooling sitting in one platform means an analyst escalating an alert under FinCEN suspicious-activity rules and an analyst documenting a MiCA control both work from the same traced path. Nominis cuts manual compliance effort through automated screening and monitoring. As Tigran Rostomyan, Founder of AML Incubator, puts it: "I've had the pleasure of working with Nominis across multiple client engagements, and they consistently deliver one of the most effective and reliable risk screening platforms available."
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25