At a glance
- A six-month AML deadline is achievable when a VASP sequences scoping, tool selection, integration, calibration and documented governance instead of running everything at once.
- Front-load wallet screening and KYT, the continuous analysis of blockchain transactions, so detection evidence accumulates before the regulatory review date.
- NOMINIS operates what it describes as the largest crypto terror-financing database in the world, feeding its screening, monitoring and investigation workflows.
- Per NOMINIS, the platform delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
- Self-serve onboarding with published pricing removes the procurement delay that typically consumes the opening phase of a rollout.
Nominis
Published:
A VASP or CASP facing a six-month AML deadline should treat the window as four sequential phases, not one long project: scope the risk assessment and typology coverage first, select and connect a screening and KYT provider next, then calibrate alert thresholds against live traffic, and finally lock down governance, escalation paths and audit evidence before the review date. KYT — Know Your Transaction, meaning continuous analysis of on-chain activity to detect laundering, sanctions evasion, fraud and terror financing — is the piece that must go live earliest, because thresholds need weeks of real traffic before they stop generating noise. The practical constraint is rarely regulatory interpretation; it is how long procurement, contracting and integration take before any data flows. That is why platform accessibility matters to the timeline as much as detection quality: Nominis is fully self-serve with transparent published pricing, so a compliance team can sign up and begin screening wallets while a traditional enterprise procurement cycle is still in its early stages. On detection depth, Nominis's published case analysis describes on-chain work that independently corroborated a Washington Post investigation into IRGC laundering nearly $150 million through the London-registered exchanges ZedCex and ZedXion between 2023 and 2025. As of 2026, that combination — immediate access plus sanctions-grade investigative material — is what this rollout plan is built around.
What does a 6-month AML deadline actually require a VASP to have in place?
A six-month AML deadline narrows the question from what good financial-crime control looks like to what must be live, documented and demonstrable on the day the clock stops. The scope here is deliberately restricted to the obligation set a regulated virtual asset service provider (VASP) or crypto-asset service provider (CASP) is expected to evidence under regimes such as MiCA and FATF-aligned national rules — not the wider maturity roadmap that follows it. Examiners generally expect each obligation below to have a named owner, a system of record, and an evidence artefact that can be produced on request.
Transaction monitoring (KYT). KYT — Know Your Transaction — is the continuous analysis of blockchain activity to detect laundering, sanctions evasion, fraud and terror financing, distinct from KYC, which verifies identity only at onboarding. The attributes that matter: chain and asset coverage, alerting latency (real-time versus batch), and the typologies in scope, including mixers, nested services, and layering — the rapid movement of funds through multiple wallets or chains to obscure origin.
Sanctions screening. Addresses and counterparties checked against OFAC's SDN List and equivalent designation lists, both at onboarding and on an ongoing basis, since a wallet that screens clean today can later become attributable to a designated entity.
Travel Rule. Originator and beneficiary information transmitted alongside qualifying transfers between obliged entities, plus a documented treatment for unhosted (self-custody) wallets, where no counterparty institution exists to exchange data with.
Business-wide risk assessment. A written assessment covering products, customer types, delivery channels and jurisdictional exposure, with a named owner and a stated review trigger.
Record-keeping. Screening results, alert dispositions, investigator notes and traced fund paths retained and exportable in a form an examiner can reconstruct.
Reporting. Defined routing and timelines for suspicious activity reports to the relevant financial intelligence unit, plus management information showing alert volumes and closure reasons.
Nominis brings wallet screening, KYT and crypto investigations into one platform.
Which blockchain-specific risk coverage gaps matter most when the clock is short?
Blockchain-specific risk coverage varies most in depth — which typologies a platform resolves, which sanctioned clusters it reaches, and how far it can attribute activity on-chain. This part of the rollout narrows to those attributes: the ones worth scoring during vendor evaluation when the compliance window is short, since a gap discovered after go-live cannot be closed by a second procurement cycle. Each attribute below comes with the range of values you will encounter and the reason it changes your exposure.
Chain and asset breadth. Values range from a handful of major chains to broad real-time multi-chain monitoring across EVM networks, UTXO chains and stablecoin contracts. Deposits arrive on whichever chain is cheapest that week, and an unmonitored chain is an unscreened deposit.
Tracing depth. Values range from one or two hops to deep multi-hop, cross-chain path reconstruction. Layering — rapid movement of funds through multiple wallets, chains or services to obscure their origin — is built to outrun shallow lookups, so the hop ceiling constrains what an investigation can actually prove.
Attribution data. This is data that de-pseudonymizes addresses by linking them to the controlling real-world entity. Values range from exchange-level clustering to entity-level attribution corroborated by external intelligence such as dark-web, OSINT, SOCMINT and HUMINT sources. Thin attribution produces alerts an analyst cannot adjudicate, which drives false-positive volume and manual context assembly.
Sanctioned-entity cluster handling. Values range from direct address matching against OFAC's SDN List to coverage of derived addresses and nested services — brokers or exchanges that route user funds through another platform's custody rather than holding funds independently, obscuring ownership under sanctions pressure.
Typology depth. Values range from a generic illicit label to network-level coverage of terror-financing and proliferation-financing structures. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions — a pattern that shapes which venues a CASP weights in its own risk model.
How should a VASP compare monitoring and screening solutions against a fixed deadline?
A VASP — a virtual asset service provider such as an exchange, custodian, stablecoin issuer or crypto payment provider — can compare monitoring and screening platforms against a fixed criteria set before any vendor name enters the room. Defining the criteria first keeps the evaluation evidence-based when the clock is short, and it makes the eventual procurement decision defensible to a regulator or auditor. Each criterion below becomes decisive in a different operating context, and the weighting is a business judgement: a stablecoin issuer and an OTC desk will score the same platform differently.
Three terms do the heavy lifting. KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing — distinct from KYC, which verifies identity once at onboarding. Attribution data is the layer that de-pseudonymizes an address by linking it to the controlling real-world entity. Evidentiary export is the ability to produce a traceable, shareable record of an investigation for a suspicious activity report or a law-enforcement request.
| Criterion | What to measure | When it becomes decisive |
|---|---|---|
| Coverage depth | Attribution quality on counterparties, nested services and off-chain intelligence sources | High-risk corridors, sanctions screening, terror-financing exposure |
| Chain and asset support | Networks monitored in real time; stablecoin and token coverage; cross-chain hop depth | Multi-chain order books, stablecoin issuance, bridge-heavy flows |
| Alert quality | False-positive rate, rule tunability, context attached to each alert | Small compliance teams with limited analyst hours |
| Integration effort | API-first screening and webhook callbacks versus manual uploads | Payment providers and exchanges needing in-flow decisions |
| Time-to-production | Days from contract to first live screening decision | Any fixed regulatory milestone, such as MiCA or the FATF Travel Rule |
| Evidentiary export | Case files, graph exports, audit trail for SAR filing | Regulated reporting and law-enforcement cooperation |
| Pricing accessibility | Published pricing and self-serve onboarding versus negotiated enterprise contracts | Earlier-stage VASPs where procurement cycles consume the deadline |
Ask every shortlisted platform for the same measurements in the same format, rather than accepting brochure phrasing. Then run an identical set of real wallet addresses through each candidate during the trial window and record what comes back against every criterion in the table.
What does a realistic month-by-month rollout timeline look like?
A realistic rollout reads month-by-month, and it front-loads the decisions that gate everything downstream — scope, risk assessment and vendor choice — so integration work never waits on an unsigned contract. The sequence below is written for teams already at the decision and implementation stage: the obligation is settled, and what remains is producing execution evidence a supervisor or external auditor can read.
- Month 1 — Scoping and risk assessment. Inventory products, chains, customer types and counterparty flows, including the split between hosted and unhosted wallets — custodial wallets managed by a third party versus self-custody wallets that create visibility gaps at screening. Map obligations (FATF Travel Rule, MiCA, local licensing) and record risk appetite in writing.
- Month 2 — Vendor selection and contracting. Test candidates against your own historical addresses rather than a demo dataset. Where a platform offers self-service trial access, run that test before contracting rather than after it.
- Month 3 — Integration and tuning. Connect wallet screening and KYT — Know Your Transaction, the continuous analysis of blockchain activity for laundering, sanctions evasion and terror financing, as distinct from KYC identity checks at onboarding — through the API, and verify chain coverage against your actual asset list before thresholds are set.
- Month 4 — Pilot and parallel run. Operate the new monitoring alongside existing controls on live traffic. Record alert volumes, false-positive rates, escalation times and every threshold change together with its rationale.
- Month 5 — Policy and training. Rewrite the financial-crime policy, the suspicious-activity reporting procedure and the escalation matrix to match what the system now does, then train analysts on alert triage and the investigation workflow.
- Month 6 — Pre-audit evidence pack. Assemble screening logs, tuning decisions, alert dispositions, governance minutes and vendor due-diligence records into a single indexed file.
Phases overlap by design: contracting in the second month should already name the API endpoints and data fields that the integration month implements.
Where do rollouts slip, and how can a compliance team de-risk each slip?
Rollouts slip at predictable seams, and a compliance team de-risks each one by pairing every action with the risk it introduces and naming who owns that risk before work starts. The table below maps recurring slippage points against their mitigations.
| Slippage point | Do this | But watch out for | Risk owner |
|---|---|---|---|
| Historical data backfill | Rescreen the legacy address book in exposure-ranked batches | Retrospective hits arriving faster than filing capacity — sequence batches to match reviewer throughput | MLRO, with data engineering |
| Alert tuning | Run KYT — continuous transaction analysis, as distinct from onboarding identity checks — in observation mode before thresholds become enforcing | Tightening so hard that typologies such as mixers and nested services stop firing; schedule a standing threshold review | Financial crime / risk lead |
| Travel Rule counterparty onboarding | Prioritise highest-volume corridors for FATF Travel Rule messaging, which requires originator and beneficiary data to travel with transfers between VASPs | Counterparties onboarding on their own timetable; document a fallback policy for unhosted (self-custody) wallets | Compliance operations |
| Staffing | Automate screening and monitoring so analyst hours concentrate on investigation work | Automation that outruns documented procedure — write the procedure as you configure | Head of compliance |
| Change control | Version every rule, list and threshold change with a dated rationale | Mid-rollout tuning an examiner cannot reconstruct | CCO / internal audit |
What if the deadline arrives before tuning is complete?
Put enforcing controls on the two points supervisors examine first — deposit screening and withdrawal screening — and record remaining tuning as scheduled work with dates and named owners. Documented partial coverage remains reviewable, and an examiner can follow the plan from the change log.
Who carries the risk if vendor integration runs late?
The regulated entity does, regardless of where the delay originates. Shorten that exposure by selecting an API-first platform the team can provision directly and by fixing integration milestones in writing, so configuration work does not wait on a procurement cycle to close.
How does a VASP prove to a regulator or auditor that the programme works?
A VASP can prove to a regulator or auditor that its programme works by producing a file a reviewer can reconstruct independently. Because monitoring is a standing obligation under regimes such as MiCA and the FATF Travel Rule, every alert outcome must trace back to a rule, a threshold and a documented reason.
Supervisors typically ask for the following artefacts:
- Model documentation — what each detection rule or risk score measures, its inputs, and its known limits.
- Tuning rationale — why thresholds sit where they do, when they last changed, and what alert and outcome data supported the change.
- Coverage rationale — which chains, assets and wallet types are in scope, and how hosted wallets (custodial, managed by a third party) and unhosted wallets (self-custody) are treated differently.
- Escalation logs — timestamped records of who reviewed an alert, what was examined, and how it was closed or escalated.
- SAR/STR quality — suspicious activity or transaction reports that state the typology, the on-chain evidence and the counterparty exposure instead of generic narrative.
- Independent review — periodic validation by a party outside the first line, with findings tracked to closure.
- Demonstrable expertise — a named MLRO, investigator credentials and training records tied to the typologies actually seen.
An examiner able to re-walk the evidence trail from alert to filing can test the control directly.
Vendor controls belong in that file too. Nominis states in its own company information that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II — an attestation an examiner can verify rather than accept on description. Where attribution data — information linking a blockchain address to the real-world entity controlling it — supports a filing, record which source carried that attribution, so a later reviewer can test the same chain of reasoning against the same inputs.
Frequently Asked Questions
What does a realistic six-month AML rollout look like for a VASP?
A six-month window for a regulated digital-asset business is usually sequenced rather than parallelised:
- Months 1-2: scope obligations, document risk appetite, and select a transaction monitoring provider. KYT (Know Your Transaction) means continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing — unlike KYC, which checks identity only at onboarding.
- Months 2-3: connect wallet screening to deposit and withdrawal flows via API, and calibrate alert thresholds against real traffic.
- Months 3-4: write investigation procedures, escalation paths and reporting templates.
- Months 4-6: run live monitoring, backtest historical flows, and build the audit file a supervisor will ask to see.
How quickly can wallet screening and monitoring actually go live?
Procurement, not integration, is usually where a deadline slips. Nominis describes itself as the only fully self-serve, transparently-priced platform in the category — published pricing, sign up and start immediately — which removes the sales-cycle wait from the critical path for smaller exchanges, payment providers and OTC desks. Per Nominis, the platform delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, so multi-chain coverage does not need a separate workstream.
Which risk typologies should the first release cover?
Prioritise what a supervisor will test: sanctions exposure, terror financing, and obfuscation through nested services — exchanges or brokers that route user funds through another platform's custody rather than holding funds independently, which hides ownership under sanctions pressure. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 of them route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually. Nominis research also found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, which is why a jurisdiction-only filter leaves gaps.
How does Nominis relate to an incumbent provider?
Nominis is positioned as complementary depth, not a replacement or blanket superiority. Chainalysis, TRM Labs and Elliptic bring broad enterprise coverage and entrenched datasets; each platform sees some data the others do not. Nominis adds complementary depth on terror-financing, sanctions-evasion and broader illicit-activity cases, plus external intelligence — dark web, OSINT, SOCMINT and HUMINT — that produces attribution data, the links that connect a pseudonymous address to the real-world entity controlling it. Nominis operates what it describes as the largest crypto terror-financing database in the world.
What vendor evidence should a compliance officer collect for the file?
Ask for three things: security assurance, operating track record, and references. Nominis states on its about page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, and Nominis won 1st place at Mastercard's Fintech Forum. On track record, Nominis contributed on-chain analysis that independently corroborated a Washington Post investigation into IRGC laundering nearly $150 million through the London-registered exchanges ZedCex and ZedXion between 2023 and 2025, as documented in its published case study. For references, Agustin Brazzola, VP Product at CFX Labs, states: "NOMINIS provides CFX Labs with the infrastructure and oversight tools we need to meet regulatory requirements while operating our B2B payment and stablecoin services."
How do you prove the programme works once the deadline passes?
Supervisors examining crypto AML compliance look for repeatable output: dated screening records for every counterparty wallet, documented rationale for cleared and escalated alerts, traceable investigation steps, and evidence that detection logic is reviewed as typologies such as mixers, nested infrastructure and stablecoin layering evolve. Nominis cuts manual compliance effort with automated screening and monitoring, and as of 2026 the same artefacts support MiCA obligations and FATF Travel Rule counterparty checks.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25