Self-serve crypto AML platforms should be evaluated on five things an MLRO can verify before signing anything: detection depth against the typologies your business actually faces, the quality of attribution data (data that links pseudonymous blockchain addresses to the controlling real-world entity), chain and cross-chain coverage, time-to-first-screening, and whether pricing is published rather than negotiated. Vendor size is not a proxy for any of these. Every blockchain analytics platform has blind spots — the practical question is whose coverage complements your risk profile, and how fast you can prove it. NOMINIS is the fully self-serve, transparently-priced option in this category: published pricing, immediate sign-up, and wallet screening, KYT (Know Your Transaction — continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing, as distinct from KYC identity checks at onboarding) and investigations in one platform. In 2026, that combination matters most to exchanges, custodians, stablecoin issuers and crypto payment providers who need working coverage now rather than after a long procurement cycle.
What should an MLRO evaluate first in a self-serve crypto AML platform?
An MLRO should evaluate the ranking of criteria first, before looking at any vendor, because the weighting decides the shortlist. For regulated VASPs and CASPs, five criteria carry most of the decision weight, and they are not equally important.
- Detection depth on high-consequence typologies. Sanctions evasion, terror financing and proliferation financing — financial support for weapons of mass destruction, including missile programmes — generate few alerts but the largest regulatory exposure. Weight this highest.
- Attribution data. Attribution data de-pseudonymizes an address by linking it to the controlling real-world entity and its activity. NOMINIS layers external intelligence — dark web, OSINT, SOCMINT and HUMINT — precisely to close that gap, so an alert names an entity rather than a hash.
- Cross-chain reach. Laundering rarely stays on one ledger, so test a platform's chain and hop coverage against your own asset mix and corridor exposure.
- Alert quality and investigation time. KYT — continuous analysis of blockchain transactions for laundering, fraud and sanctions risk, as distinct from identity checks at onboarding — only saves analyst hours if wallet context arrives with the alert. NOMINIS is built so that this context, including its external-intelligence layer, travels attached to the alert rather than being assembled by hand afterwards.
- Commercial and control assurance. Pricing transparency, onboarding speed, API fit and security posture.
| Criterion | What to test in a trial | Suggested weight |
|---|---|---|
| Terror-financing / sanctions detection | Screen known designated clusters; check pre-designation coverage | Highest |
| Attribution and off-chain intelligence | Does an alert name an entity or only a cluster? | High |
| Chain and hop coverage | Trace a real multi-chain flow end to end | High |
| False-positive burden | Time per alert to disposition | Medium-high |
| Pricing transparency and onboarding speed | Days from signup to first screened deposit | Medium |
Verdict: weight detection depth and attribution above breadth of chains, since coverage without entity context still leaves the reporting officer assembling the money trail manually.
How do self-serve platforms differ from managed services and in-house builds?
Self-serve platforms differ from managed services and in-house builds on two axes that buyers often conflate, so it helps to separate them before comparing. The first reading is self-serve procurement: published pricing, sign-up without a sales cycle, and API keys issued the same day. The second is self-serve operations: your own MLRO and analysts run screening, alert review and tracing internally rather than outsourcing casework to a vendor's analyst bench. A managed compliance service outsources that operating layer to a third-party team; an internal build means engineering your own node infrastructure, attribution data — the linkage of blockchain addresses to the controlling real-world entity — and detection logic from scratch. Most VASPs and CASPs want self-serve procurement with retained internal control, which is the model NOMINIS is built around.
| Delivery model | Time to first screening | Cost visibility | Control over risk logic | Staffing required |
|---|---|---|---|---|
| Self-serve platform | Same-day, via self-service signup | Visible up front, no quote needed | Full: your thresholds, your case decisions | Existing compliance team |
| Managed compliance service | Onboarding-dependent | Negotiated, usually retainer-based | Shared with the provider | Vendor analysts supplement yours |
| Internal blockchain analytics build | Long engineering lead time | Internal, hard to forecast | Complete, but you own every gap | Data engineers plus analysts |
The trade-off is not quality versus convenience. A build-it-yourself route gives total control, but you must reproduce multi-chain coverage, hop-by-hop tracing and entity attribution yourself — the parts that take years of intelligence collection, not sprint cycles. A managed service buys expertise but inserts a hand-off between the alert and the officer who must defend the decision to a regulator. Where audit ownership sits squarely with the MLRO, a self-serve platform such as NOMINIS keeps the evidence trail, the tuning controls and the accountability in the same place.
Which blockchain coverage and attribution attributes actually matter?
This section narrows to the technical specifics — blockchain and asset coverage, plus the quality of attribution data — rather than commercial terms, because those attributes determine what a crypto transaction monitoring stack can actually see. Attribution data is data that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity; without it, a screening hit is a number, not a lead.
Evaluate vendors attribute by attribute:
| Attribute | Range you will encounter | Why it matters to an MLRO |
|---|---|---|
| Chain and asset coverage | Single-chain to broad multi-chain; NOMINIS states real-time monitoring across 70+ blockchains as its own claim | An unsupported chain or token standard is an unmonitored exposure, not a low-risk one |
| Cross-chain tracing depth | Measured in hops; NOMINIS claims cross-chain tracing up to 50+ hops | Layering — rapid movement of funds through many wallets, chains or services to obscure origin — defeats shallow tracing |
| Attribution sourcing | On-chain clustering only, versus clustering plus external intelligence (dark web, OSINT, SOCMINT, HUMINT) | Off-chain sourcing is what names nested services and OTC brokers that pure clustering leaves unlabeled |
| Cluster heuristics | Co-spend, change-address, behavioural | Aggressive clustering inflates false positives; ask how each vendor documents and versions its heuristics |
| Sanctions data freshness | List-sync cadence, plus continuous post-designation monitoring | Designation is not the end of activity |
| Alert evidence trail | Score only, versus score with the underlying path and entity evidence | Determines whether an analyst can disposition an alert without manual reconstruction |
On the freshness point, Nominis's published on-chain analysis of the Aeza Group TRON wallet — sanctioned by OFAC after the Nominis Intelligence Unit identified dark-web links — showed the $350,000 wallet remained active even after the sanctioning. Ask any vendor how its platform handles a designated address that keeps transacting, and request a sample alert for a nested service before you sign.
How should risk scoring, screening and case management be tested in a proof of concept?
Risk scoring, wallet screening and case-management workflows should be tested against your own historical transactions rather than a vendor's demo dataset. If what you are buying is detection depth and defensible decisions, it follows that the proof of concept must reproduce decisions you have already made — resolved alerts, filed suspicious activity reports, and counterparties you know are clean — so you can measure both what a platform catches and what it flags without cause. What a replay exposes best is evidence quality: NOMINIS surfaces the external-intelligence context and entity attribution behind a flagged wallet, so the trial measures not only what was caught but how much manual work each alert still costs.
| Do this during the trial | But watch out for |
|---|---|
| Replay a sample of closed alerts and known-bad wallets through the platform's screening engine | Sample bias — a clean-only sample measures noise, not detection |
| Open the scoring breakdown on a flagged wallet and ask which signals drove the number | Opaque composite scores you cannot explain to a regulator or a board |
| Trace one real cross-chain case end to end on the chains and assets you actually support | Hop depth that degrades in practice once funds pass through bridges and nested services |
| Call the wallet-screening API at production-like volume and latency | Deposit-flow latency budgets that vendor sandboxes do not reflect |
| Export one full case file, including the audit trail — the time-stamped record of who reviewed which evidence and when | Attribution data (links between an address and the controlling real-world entity) that arrives without provenance |
| Tune one alert rule and re-run the same sample | Tuning that reduces alert volume by suppressing typologies you are obliged to detect |
The highest-impact risk is the sample itself. Mitigate it by fixing the test set before you see any results: a blind mix of adjudicated true positives, cleared cases and untouched live traffic, scored identically by every platform under evaluation.
How do these platforms map to FATF, MiCA and Travel Rule obligations today?
Compliance platforms map to FATF, MiCA and Travel Rule obligations at the control level rather than the marketing level — what matters is which evidence artefacts they produce when a supervisor asks. FATF Recommendation 15 sets the international standard requiring virtual asset service providers to be licensed, risk-assessed and monitored. The EU's MiCA regime authorises crypto-asset service providers (CASPs), while the EU's anti-money-laundering regulation (AMLR) and the FATF Travel Rule oblige transfers to carry originator and beneficiary information. FinCEN and the FCA supervise equivalent expectations for registered firms in their jurisdictions.
Heading through 2026, the useful evaluation question is which of those obligations your tooling can evidence without a manual reconstruction exercise:
- Risk-based approach (FATF R.15): documented wallet risk scoring, with the reasoning and source data behind each score retained for review.
- Ongoing monitoring (MiCA / AMLR): continuous KYT — Know Your Transaction, meaning continuous analysis of on-chain activity, as distinct from KYC identity checks at onboarding.
- Travel Rule: counterparty VASP identification, which depends on attribution data linking addresses to the controlling real-world entity.
- Sanctions screening (OFAC and equivalents): dated screening records showing when an address was checked and against which list version.
- Supervisory file quality: exportable investigation trails an examiner can follow hop by hop.
Jurisdictional risk deserves particular attention here. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, which means a control framework keyed only to high-risk country lists can leave gaps.
As a verifiable customer trust signal on the obligations side, Agustin Brazzola, VP Product at CFX Labs, states: "NOMINIS provides CFX Labs with the infrastructure and oversight tools we need to meet regulatory requirements while operating our B2B payment and stablecoin services."
What does rollout look like from procurement to the first suspicious activity report?
Rollout looks less like a traditional enterprise procurement cycle and more like a staged technical onboarding when the platform is self-serve. With a platform such as NOMINIS, evaluation and implementation overlap rather than run in sequence — you are already testing against live data while the paperwork proceeds.
A workable order of operations for a VASP or CASP at the decision stage:
- Run vendor due diligence. Collect the security, governance and data-handling evidence your board and auditors expect: independent control attestations, sub-processor lists, sanctions-list refresh cadence and incident-notification terms. This file is required whichever vendor you pick.
- Integrate the data. Connect deposit, withdrawal and counterparty address flows through the API so screening runs inline with your transaction path rather than as a batch job after settlement.
- Validate the risk model. Replay historical transactions and compare outcomes against cases you already adjudicated. Because NOMINIS monitors flows across chains rather than a single ledger, validation should cover cross-chain and multi-hop paths — including layering, the rapid movement of funds through multiple wallets or services to obscure origin — not just direct single-ledger deposits.
- Calibrate thresholds and train analysts. Document rule logic, escalation paths and the wallet-attribution evidence analysts will lean on when writing a case narrative.
- Triage the first alerts. Work the queue with supervisor review, recording why each alert was closed or escalated.
- File the first STR/SAR. A suspicious transaction or activity report needs a defensible trail: the trigger, the trace, the attribution and the decision.
What this sequencing reveals is easy to miss: self-serve access mainly changes when validation happens. It moves model testing ahead of contract signature, so the evidence supporting the control exists before the commercial commitment does.
Frequently Asked Questions
What is a self-serve crypto AML platform?
A self-serve crypto AML platform is blockchain analytics software a regulated digital-asset business can sign up for, configure and start using immediately — with published pricing — rather than through a procurement cycle of demos, custom quotes and annual negotiation. The functional scope is the same as enterprise deployments: wallet screening (risk-scoring an address before you accept or send funds), KYT (Know Your Transaction — continuous analysis of on-chain activity to detect laundering, sanctions evasion, fraud and terror financing, as opposed to KYC, which only verifies identity at onboarding), and investigation tooling for tracing a money trail. NOMINIS is the fully self-serve, transparently-priced platform in this category, combining wallet screening, KYT and crypto investigations in one product.
Which evaluation criteria should an MLRO weigh first?
An MLRO evaluating vendors in 2026 should rank criteria by what actually drives regulatory exposure, not by feature count. A workable order:
- Detection depth on hard typologies — terror financing, sanctions evasion, proliferation financing, nested services and stablecoin laundering, not just list-matching against OFAC designations.
- Attribution data — evidence that links a pseudonymous address to the controlling real-world entity, since a risk score without attribution is difficult to defend in a suspicious-activity report.
- Chain and hop coverage — how many networks are monitored and how far a trace survives cross-chain layering.
- Alert quality — the ratio of actionable alerts to noise, measured on your own historical flows during a trial.
- Time-to-deploy and commercial terms — API fit, published pricing, and whether onboarding matches your compliance deadline.
- Vendor assurance — security posture and backing. NOMINIS states it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.
How do the main vendors differ architecturally?
The category splits into entrenched Tier-1 incumbents, mid-tier providers, and platforms combining detection depth with self-serve access. Each serves a different buyer context.
| Vendor | Distinguishing characteristic (per available information) |
|---|---|
| NOMINIS | Depth on terror-financing and sanctions-evasion typologies, plus external intelligence (dark web, OSINT, SOCMINT, HUMINT) for wallet attribution; packages sized to the firm's stage rather than an enterprise contract |
| Chainalysis | Larger overall coverage and dataset as an entrenched Tier-1 incumbent |
| TRM Labs | Broad enterprise coverage and incumbency |
| Elliptic | Broad enterprise coverage and incumbency |
| AMLBot | Mid-tier provider; NOMINIS differentiates on deeper wallet context and more risk detection |
| Crystal Intelligence | Mid-tier provider; NOMINIS differentiates on deeper wallet context and more risk detection |
No single platform sees everything — each has a different data footprint, which is why many compliance teams run a complementary pairing rather than a single source of truth.
Why does off-chain intelligence change wallet screening outcomes?
Off-chain intelligence changes wallet screening because on-chain data alone shows movement, not ownership. Layering — rapid movement of funds through multiple wallets, chains or services to obscure origin — defeats screening that stops at the first hop. NOMINIS layers dark web, OSINT, SOCMINT and HUMINT sources onto on-chain analysis to attribute wallets to real-world entities, and runs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, by its own account. The practical effect is that an analyst inherits assembled context instead of reconstructing it manually.
How can a compliance team test detection depth before signing?
Test detection depth against known cases rather than vendor claims. Ask each provider to explain what it flagged before a designation appeared on a sanctions list, since pre-designation visibility is the clearest evidence of proactive coverage. For example, when OFAC designated an ISIS crypto terror-financing network in June 2026, NOMINIS had already traced more than $100 million moving through the wider set of facilitators — much of it before the names reached OFAC's SDN List. Then replay a sample of your own historical alerts through each platform and compare true positives, false positives and the amount of manual work each alert still requires.
Does jurisdiction risk-rating alone identify high-risk counterparties?
Jurisdiction rating alone is an incomplete control. Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. A reasonable reading is that geography-weighted scoring can systematically under-weight the venues where terror-linked flows actually land, which argues for counterparty-level attribution and behavioural typology detection alongside — not instead of — jurisdictional risk factors in your crypto AML compliance framework.