At a glance
- Live KYT resolves the entity behind each centralized-exchange deposit and withdrawal as value moves, across chains and across multiple hops.
- Monitor counterparty attribution, layering and structuring patterns, nested-service exposure, unhosted-wallet transfers, and withdrawal destinations re-scored before funds are released.
- Published sanctions labels can arrive after funds have moved, leaving a window in which attribution data carries the detection load.
- NOMINIS is fully self-serve with transparent published pricing, so a smaller exchange or payment provider can start screening immediately.
Nominis
Published:
Live KYT — Know Your Transaction, the continuous analysis of blockchain transactions for money laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which verifies identity once at onboarding — has to resolve the counterparty behind every centralized-exchange deposit and withdrawal address at the moment value moves, across chains and across multiple hops, because a wallet that only becomes risky once a designation is published is identified after settlement. In practice that means four things running continuously: screening each deposit address against attribution data, meaning data that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity; re-scoring withdrawal destinations before release; detecting layering and structuring patterns as they form; and measuring exposure to nested services and no-KYC venues. Per Nominis, as of 2026 the platform performs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
The case for monitoring at that depth is empirical. According to Nominis's published analysis of the designation, when OFAC named an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators, much of it well before those names reached OFAC's SDN List. Separately, Nominis research published in its insights analysis of jurisdiction risk found that illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. One way to read cases like these is that exposure accumulates during the interval between a facilitator network becoming operationally active and its wallets acquiring a public label, which would make the recency of attribution data a live monitoring parameter in its own right. Nominis CEO Snir Levi appeared on i24 News (The Rundown) to break down how Iran and its proxy groups use cryptocurrency to move funds despite sanctions.
What should a centralized exchange monitor live on wallet activity?
A centralized exchange needs to monitor every wallet tier in real time, because the control boundary — hot wallets serving customer deposits and withdrawals, warm wallets handling semi-automated rebalancing, and cold storage holding offline reserves — is exactly where illicit value enters or leaves the venue. Continuous transaction monitoring, meaning the ongoing analysis of blockchain movements to detect laundering, sanctions evasion, fraud and terror financing, is not the same as the identity check performed once at onboarding: it has to run on every movement, in both directions.
Which live signals need real-time coverage?
| Live signal | Wallet tier | What to capture | Why it matters |
|---|---|---|---|
| Inbound deposits | Hot | Source cluster, attribution data (links from an address to the controlling real-world entity), sanctions and darknet exposure | Determines credit-or-hold before funds are fungible with house liquidity |
| Withdrawals | Hot | Destination type — hosted (custodial) versus unhosted (self-custody) wallet — plus FATF Travel Rule counterparty data | Unhosted destinations create the visibility gap regulators ask about under MiCA |
| Internal transfers | Hot ↔ warm ↔ cold | Expected rebalancing ranges, signer, timing deviation | Off-pattern sweeps are an early indicator of key compromise or insider movement |
| Counterparty clusters | All tiers | Whether a counterparty is an independent venue or a nested service routing funds through another platform's custody | Nested infrastructure is a standard way to obscure ownership under sanctions pressure |
| Bridge and mixer exposure | Hot | Hop depth, chain transitions, re-entry addresses | Layering across chains breaks single-chain tracing well before funds reach your deposit address |
| Structuring patterns | Hot | Many sub-threshold deposits sharing a funding ancestor | Smurfing defeats per-transaction thresholds but not aggregate cluster analysis |
What coverage does this require?
Each of those signals is only as useful as the chain coverage and tracing depth behind it. Nominis brings wallet screening, KYT and crypto investigations into one platform, with cross-chain tracing, so a flagged deposit can be traced back across chains instead of stopping at the immediate sender. Alert policy should then state, per wallet tier, which signals auto-block, which queue for analyst review, and which are logged only.
Which illicit-activity signals are hardest to catch at deposit time?
The illicit-activity signals that are hardest to catch at deposit time share one property: at the moment funds arrive, the evidence needed to score them does not yet exist on-chain. Freshly funded addresses have no history to cluster against. Donation-campaign wallets collect many small inbound transfers that resemble ordinary retail traffic unless the off-chain solicitation is already documented. Regional off-ramp networks and fast-rotating withdrawal chains push value through intermediaries before attribution data — data that links a blockchain address to the real-world entity controlling it — can catch up.
Does a low risk score mean the deposit is clean? No. It means no adverse evidence has yet been associated with that address. Why does the same deposit look different a week later? Because clusters grow as co-spending, bridging and off-ramp behaviour accumulate, and because new labels and designations are added to attribution data over time.
Off-ramp infrastructure is a particular blind spot. Venues that operate without identity checks frequently rely on nested services — brokers that settle inside another platform's custody and liquidity rather than holding funds independently — so the deposit address an exchange sees belongs to the host venue, not the entity that actually controlled the money. Under sanctions pressure, that nesting layer is precisely what obscures ownership, and it is invisible to any check that stops at the immediate counterparty.
| Do this at deposit | But watch out for — and how to mitigate |
|---|---|
| Flag first-seen or newly funded counterparties for enhanced review | Benign new wallets create review volume; mitigate by scoring the funding path, not address age alone |
| Trace deposits back across bridges and chains before release | Hop-depth limits truncate the trail; mitigate by extending cross-chain tracing past the first intermediaries |
| Treat many-to-one inbound patterns as a distinct typology | Payroll and merchant flows look similar; mitigate by requiring a corroborating off-chain indicator |
| Re-screen settled deposits when attribution data updates | Retrospective hits build remediation backlogs; mitigate by routing them into continuous monitoring rather than a manual queue |
How do live KYT checks differ from post-settlement screening?
Live KYT checks run before value moves: a deposit is screened before it is credited to a customer balance, and a withdrawal is screened before it is broadcast to the network. Know Your Transaction means continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing — distinct from KYC, which verifies identity only at onboarding. Post-settlement review applies the same analytics to transactions that have already cleared.
Several criteria separate the two modes, and each one matters for a different reason:
- Detection latency — the gap between a transaction occurring and an analyst seeing it; it determines whether a decision is still available.
- Reversibility of funds — once a withdrawal is confirmed on-chain, the exchange no longer controls the asset, so the remedy shifts from blocking to reporting.
- Customer friction — pre-credit holds touch legitimate users, so the review path has to be fast and explainable.
- False-positive load — alert volume measured against analyst capacity, which drives queue depth and triage quality.
- Evidentiary quality for a suspicious activity report — whether counterparty attribution and the fund path were captured at the time of the event.
| Screening mode | Detection latency | Reversibility | Customer friction | False-positive load | SAR evidence |
|---|---|---|---|---|---|
| Pre-credit / pre-broadcast (live) | Decision still available before credit or broadcast | Funds under exchange control; hold or reject possible | Higher — holds are visible to users | Concentrated at the moment of action; needs tuned thresholds | Captured with the trace and counterparty context as it happens |
| Batch / post-settlement | Deferred until the review window runs | Funds already moved; reporting only | Lower at the point of transaction; higher during later remediation | Spread across review cycles; stale alerts need re-triage | Reconstructed afterwards from historical data |
Pre-credit screening fits instant-credit deposit and payout flows at exchanges and crypto payment providers. Batch review stays useful for retrospective look-backs, where new attribution data — information that links a blockchain address to the controlling real-world entity — turns a previously unremarkable counterparty into a reportable one. Nominis cuts manual compliance effort with automated screening and monitoring.
Why does attribution depth change what a compliance team can act on?
Attribution depth changes what a compliance team can act on because it decides whether an alert arrives as a bare address string or as a named counterparty with evidence attached. This depends on what you mean by attribution. In one sense it means coverage — how many addresses on how many chains carry any label at all. In the other it means evidentiary weight — how much sourced material sits behind that label once an analyst opens the case. Attribution data is information that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity.
The attributes that decide actionability are specific, and each varies across a usable range:
| Attribute | Range it varies across | Why it decides the outcome |
|---|---|---|
| Address attribution coverage | Chains and address types resolved; hosted (custodial) versus unhosted (self-custody) wallets | An unhosted counterparty with no label leaves a transfer unexplained rather than cleared |
| Cluster labeling granularity | Service-level only, versus entity-level and sub-service | Separates a licensed venue from a nested service — a broker routing user funds through another platform's custody to obscure ownership |
| Off-chain enrichment | None; open-source sourcing; dark-web marketplace and forum sourcing | Supplies real-world context that on-chain flow alone cannot express |
| Evidence accessibility | Opaque risk score, versus an analyst-visible source trail | Determines whether a filing or account action can be defended to a supervisor |
| Timeliness | Post-designation list ingestion, versus intelligence developed ahead of listing | Decides whether monitoring reacts to a sanctions update or precedes it |
Granularity matters most where nesting is involved: a deposit from a venue that looks independent on-chain may in fact settle through another platform's liquidity, and only entity-level labeling exposes that relationship. Nominis brings wallet screening, KYT and crypto investigations into one platform.
No single attribution source names every counterparty: each platform, Nominis included, has blind spots.
How should an exchange tune thresholds and triage alerts without over-blocking users?
An exchange can tune its risk thresholds without over-blocking customers by setting two separate score levels: one that routes an event into an analyst queue, and a higher one that actually holds funds. Live transaction screening produces a risk score, not a finding, so each threshold value should be documented together with the reasoning behind it and kept alongside the alert data.
What does a proportionate escalation ladder look like?
- Log only: low-score deposits and withdrawals are scored and retained, with no customer-facing friction.
- Analyst queue: medium-score events route to a named queue with a defined review window, enriched with attribution data — the data that links an address to the real-world entity controlling it.
- Auto-hold: reserved for narrow, pre-agreed conditions such as direct exposure to a designated address, rather than broad score bands.
- Freeze and report: confirmed sanctions matches follow the jurisdiction's reporting path under OFAC, MiCA or local VASP rules.
Which inputs deserve explicit weighting?
Weight counterparty jurisdiction, typology (mixers, nested services — brokers routing funds through another platform's custody to obscure ownership), hop distance between direct and indirect exposure, and whether the counterparty is a hosted or unhosted wallet. Jurisdiction in particular should not sit flat: Nominis research published on nominis.io found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions.
How are tuning decisions evidenced for auditors?
Keep a version-controlled tuning log: the prior value, the new value, the typology or case evidence behind the change, the approver, and the sample of historical alerts re-scored against it.
Frequently Asked Questions
What does KYT monitor on a centralized exchange wallet that KYC does not?
KYT (Know Your Transaction) is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing; KYC verifies a customer's identity once, at onboarding. On a live exchange wallet, transaction monitoring watches the flow rather than the account holder:
- Provenance of every incoming deposit, several hops back from the depositing address
- Destination category of each withdrawal — exchange, bridge, mixer, gambling service, peer-to-peer desk
- Attribution data, meaning data that links a pseudonymous address to the controlling real-world entity
- Cross-chain movement, where value leaves one ledger and resurfaces on another
Which deposit and withdrawal signals should trigger a live alert?
Centralized exchange wallets generate a small set of patterns that justify an interruption before settlement rather than a next-day review. Useful live triggers include structuring, or smurfing — breaking a large sum into many small transfers to stay under reporting thresholds — and layering, the rapid movement of funds through multiple wallets, chains or services to obscure origin. Add direct or one-hop exposure to a sanctioned address, deposits sourced from no-KYC venues, and sudden changes in a customer's established counterparty mix.
How should withdrawals to unhosted wallets be screened?
Hosted (custodial) wallets are managed by a third party, which makes counterparty identification straightforward; unhosted (self-custody) wallets give the user full control and create a visibility gap at the moment funds leave the exchange. Screening an unhosted destination therefore depends on what the address has already done on-chain and on whom it transacts with afterwards. Nominis provides automated screening and real-time monitoring, which an exchange can apply to withdrawal destinations as part of its KYT programme.
Why do nested services and jurisdiction make counterparty screening harder?
Nested services are exchanges or brokers that route user funds through another platform's custody and liquidity instead of holding funds independently, which hides ownership behind a larger, apparently legitimate venue. According to a Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market, published in its research insights, 45 route funds through nested infrastructure, and the study identified nearly 6,000 wallets facilitating over $100 million in transaction volume annually. A deposit that looks like it came from a mainstream exchange may have originated several layers behind it.
What public record backs Nominis on terror financing and sanctions evasion?
Nominis CEO Snir Levi appeared on i24 News (The Rundown), as documented in the company's published insights, to break down how Iran and its proxy groups use cryptocurrency to move funds despite sanctions. The platform also won 1st place at Mastercard's Fintech Forum. Agustin Brazzola, VP Product at CFX Labs, states that "NOMINIS provides CFX Labs with the infrastructure and oversight tools we need to meet regulatory requirements while operating our B2B payment and stablecoin services."
How quickly can a smaller VASP or CASP get live monitoring running?
Regulated digital-asset businesses — exchanges, custodians, stablecoin issuers, payment providers and OTC desks — often stall on procurement cycles rather than on technical readiness. Nominis describes itself as the only fully self-serve, transparently-priced platform in the category, with published pricing and immediate sign-up, so a compliance team can begin screening without a lengthy sales process. As of 2026, Nominis states that it delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25