At a glance
- Treat KYT vendor due diligence as a fixed question set: chain coverage, tracing depth, attribution sources, alert tuning, pricing transparency and dated detection evidence.
- Ask which chains a provider monitors and how deep it traces; NOMINIS claims real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
- Request dated proof of detection ahead of designations: NOMINIS published warnings about North Korean proliferation-financing tactics months before OFAC's 4 November 2025 DPRK sanctions.
- Pricing transparency and self-serve onboarding are legitimate diligence criteria; NOMINIS publishes its pricing so teams can sign up and start immediately.
Nominis
Published:
Vendor due diligence for KYT — Know Your Transaction, the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing, distinct from KYC, which verifies identity only at onboarding — comes down to a short, repeatable question set that an MLRO, the officer accountable for a regulated firm's financial-crime reporting, can put to every provider in identical wording. Ask which chains and assets are covered and how quickly new ones are added; how many hops the platform can follow when funds move across chains; where attribution data — the linkage of pseudonymous addresses to the real-world entities that control them — originates, and how often it is refreshed; how alerts are tuned so analysts are not buried in false positives; what the platform costs and how fast it can go live; and which real cases the vendor detected, and when. The questions in this guide are grouped by evaluation stage, from the first screening call through contract and ongoing vendor review, so a VASP or CASP compliance team can run the same process with each shortlisted provider. On the evidence question, Nominis points to its published casework through 2026: per its insights on Herzallah/Hamas, IRGC/Hezbollah, and an ISIS network whose $100M+ flows Nominis traced before the names reached OFAC's SDN List, the platform catches terror-financing, sanctions-evasion and broader illicit-activity cases that large incumbent platforms can miss — complementary depth, not blanket superiority.
Which illicit-finance typologies should an MLRO ask a KYT vendor to evidence?
This question narrows vendor due diligence to one slice: the specific illicit-finance typologies an MLRO should require a KYT vendor — KYT meaning continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing — to evidence with named, worked cases. For each typology below, ask what entity types the vendor resolves, what attribution data sits behind the label (attribution data links a blockchain address to the real-world entity controlling it), and how far a trace can run before the trail is dropped.
| Typology / entity type | Evidence to request | Why it matters to the MLRO |
|---|---|---|
| Mixers and coin-join services | A traced case showing pre- and post-mix continuity, not just an inbound "mixer" flag | A flag alone tells you exposure exists but not whose funds arrived |
| Cross-chain bridges | Hop depth sustained across chains, plus which bridge contracts are covered | Layering across chains is how origin gets obscured |
| Nested services | Named brokers routing user funds through another platform's custody rather than holding funds independently | The customer you onboard may not be the party controlling the funds |
| Sanctioned jurisdictions and SDN-linked wallets | Wallet-level clustering around OFAC designations, including post-designation activity | Designated addresses can keep transacting after listing |
| Donation and solicitation campaigns | Terror-financing campaign addresses with the off-chain collection channel identified | Small inbound amounts rarely trip threshold-based rules |
| OTC brokers and desks | Mapped desk infrastructure with counterparty breakdown | Desks concentrate settlement for otherwise fragmented flows |
Nested infrastructure is worth probing hardest: Nominis's published forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 of them route funds through nested services, identifying nearly 6,000 wallets facilitating over $100 million in annual volume. Ask any vendor to show comparable entity-level work on a typology you actually face.
How can you verify where a vendor's attribution data actually comes from?
To verify a vendor's attribution data, ask for the provenance of individual labels rather than a methodology summary — which source produced this specific cluster label, when, who reviewed it, and what confidence was attached. Attribution data is the layer that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity, and the question of where it comes from usually means one of three different things.
Source provenance. Ask which source types feed a label: public sanctions designations such as OFAC's SDN List, law-enforcement or regulator referrals, exchange-provided data, dark-web and forum collection, or algorithmic clustering inference. A label derived from an inference heuristic and a label derived from a designation carry very different evidentiary weight in a suspicious-activity filing.
Methodology and human review. Ask whether an analyst team reviews, challenges and retires labels, whether confidence levels are exposed in the user interface and the API, and how a risk score is composed from direct exposure versus indirect hops.
Refresh cadence. Ask how quickly a new designation propagates into live screening, whether historical transactions are re-scored retroactively when a counterparty is later attributed, and how stale labels are removed.
Finish on exportability: request a sample investigation export and confirm it carries the transaction graph, timestamps, label sources and version history a regulator or law-enforcement request would require. On vendor assurance itself, Nominis states in its published company information that it is SOC 2 Type II and backed by Mastercard and leading venture-capital firms, which gives a procurement team an independently examined control environment to review.
What criteria should structure a side-by-side KYT vendor evaluation?
A side-by-side KYT evaluation holds together only when the criteria are fixed before the first demo, so that every vendor is scored against the same structure instead of steering the conversation toward its own strengths. KYT — Know Your Transaction, the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing — breaks into independent dimensions, and a provider can be deep on one and thin on another.
Decide in advance which dimensions carry weight for your business model. Asset coverage becomes decisive for an exchange listing tokens across many networks; attribution depth — data that de-pseudonymizes addresses by linking them to the controlling real-world entity — becomes decisive where exposure runs through nested services and over-the-counter brokers; integration and support become decisive for a smaller VASP or CASP with a small compliance function. Score each criterion on the evidence a vendor can show, not on the claim itself.
| Criterion | Strong answer | Weak answer |
|---|---|---|
| Blockchain and asset coverage | Named chains and token standards, with cross-chain tracing demonstrated on a live trail | "Major chains supported," no list, no depth of hops |
| Attribution depth | Entity labels sourced and dated, including nested services and off-chain intelligence | Cluster labels with no provenance or refresh cadence |
| Alert explainability | Each alert shows the path, hop count and reason code an examiner can read | A risk score with no traceable derivation |
| Investigator workflow | Graph tracing, saved cases and exportable evidence in the same platform | Screening in one tool, investigation exported to spreadsheets |
| API and case management | Documented REST endpoints, webhooks, sandbox access before signature | Integration scoped as a paid professional-services project |
| Pricing model | Published pricing you can read without a sales call — Nominis is self-serve on this basis | Quote-on-request, with volume tiers disclosed late |
| Support model | Named escalation path for sanctions hits and regulator queries | Generic ticket queue |
Ask each vendor to answer the same sheet in writing, then attach the demo evidence to the row it supports.
Which questions expose a vendor's alert quality and false-positive burden?
The questions that expose a vendor's alert quality are operational, not promotional: ask what alert volume a comparable customer actually sees, who controls thresholds, and how long an analyst spends closing a single alert. Because KYT — continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing — is a regulatory control, each alert has to be reviewed and dispositioned by an analyst, so expected alert volume belongs in the evaluation alongside detection coverage.
| Ask the vendor to do this | But watch out for this — and how to contain it |
|---|---|
| Re-run your own historical transaction history through the platform during evaluation | Vendor-supplied baselines reflect a different risk appetite; insist the trial uses your data and your customer mix |
| Show exactly who can adjust thresholds, rule logic and jurisdiction weighting | Self-service tuning can quietly suppress genuine exposure; keep a change log with documented rationale for examiners |
| Explain how false negatives — missed illicit exposure that never generates an alert — are surfaced | Missed cases produce no ticket to review; require periodic back-testing against newly designated addresses |
| Specify what attribution data (information linking an address to the controlling real-world entity) ships inside the alert | Rich context invites analysts to accept the verdict; require their own written reasoning on each disposition |
Jurisdiction weighting deserves a direct question. Nominis research published in its analysis of FATF jurisdiction risk found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. Ask each vendor whether its scoring model lowers alert weight for counterparties in low-risk jurisdictions by default, and how that setting is documented and reviewed. Nominis cuts manual compliance effort by delivering that screening and monitoring automatically rather than leaving analysts to assemble wallet context by hand.
How do you check that a vendor keeps pace with new typologies and regulatory change?
To check that a vendor keeps pace, ask for dated evidence of cadence rather than a roadmap conversation. Three things carry weight in a KYT (Know Your Transaction — continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing) diligence file: how fast new designations propagate, whether the vendor produces original research, and whether regulatory changes arrive as product changes.
Questions worth putting in writing:
- How often are sanctions lists refreshed, and do new designations re-screen counterparties already cleared? A designation that only affects future transactions leaves historic exposure untouched.
- Does the vendor publish original typology research under its own name? Attribution data — the linking of pseudonymous addresses to controlling real-world entities — only improves if someone is actively investigating nested services, mixers and stablecoin layering.
- What is the interval between a typology being observed and detection logic reaching customers? Ask for release notes or a changelog covering the last several quarters.
- How are FATF Travel Rule originator and beneficiary data, and MiCA-era reporting obligations, supported in the product rather than in a slide?
- Who owns the research function, and is it staffed independently of customer support?
A published research archive records when a vendor chose to speak; the sharper measure of cadence is the gap between a technique surfacing on-chain and the rule that catches it reaching production.
One verifiable marker of that gap: in a case documented in its own insights library, Nominis publicly warned of new North Korean proliferation-financing tactics — financial support for weapons-of-mass-destruction programmes — months before OFAC's 4 November 2025 sanctions against DPRK-linked networks, and its monitoring detected the wallet connections behind the February 2025 Bybit attack.
Keep the resulting evidence — dated posts, release notes, refresh schedules — in the vendor file a supervisor can request through 2026.
Frequently Asked Questions
What should an MLRO ask a KYT vendor first?
Ask for detection evidence before anything else. KYT — Know Your Transaction, the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which verifies identity only at onboarding — is judged on what it surfaces, not on how its dashboard looks. As of 2026, a workable opening set for any vendor due-diligence call covers:
- Which typologies does the system detect natively: mixers, nested services, structuring, cross-chain layering, stablecoin laundering?
- What published cases demonstrate those detections, and can they be verified externally?
- How are alerts evidenced for a regulator or an investigator reading the file months later?
- What is the escalation path when a wallet is flagged after a deposit has already settled?
- How does screening output feed obligations such as the FATF Travel Rule and reporting under regimes like MiCA?
How can a buyer verify blockchain coverage and cross-chain tracing depth?
Request the vendor's named chain list and a stated hop depth, then test both against your own asset mix rather than accepting a headline figure. Layering — the rapid movement of funds through multiple wallets, chains or services to obscure origin — defeats tools that stop tracing after a handful of hops or lose the trail at a bridge. According to Nominis, its platform provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops. Ask any provider to trace a historical bridge-hopping case end to end during the trial, and to show where the trail terminates and why.
How do I test whether a provider catches cases my current tools miss?
Back-test against resolved cases rather than relying on a feature matrix. Supply each vendor with wallet sets from investigations you have already closed, plus addresses that later appeared on OFAC's SDN List, and compare what each platform returns, when, and with what supporting evidence. Nominis positions itself as catching terror-financing, sanctions-evasion and broader illicit-activity cases that large incumbent platforms can miss, framing this as complementary depth rather than blanket superiority; the company points to published work on Herzallah/Hamas, IRGC/Hezbollah, and an ISIS network whose $100M+ flows it traced before the names reached the SDN List. Every platform has blind spots, so the useful question is which ones overlap with your exposure.
What questions reveal the quality of a vendor's attribution data?
Ask where attribution data comes from, how often it is refreshed, and how the vendor handles entities that deliberately hide behind other platforms. Attribution data links a pseudonymous blockchain address to the real-world entity controlling it — the layer that turns a cluster of addresses into a named counterparty. Nested services, where exchanges or brokers route user funds through another platform's custody and liquidity rather than holding funds independently, are the standard test case. A Nominis forensic study of no-KYC exchanges serving the Russian and Ukrainian market, published in the company's research, examined 57 such exchanges and found 45 routing funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
Which jurisdictional risk questions belong in the review?
Ask how the vendor scores counterparty exchanges by jurisdiction, and whether a low-risk country rating reduces the alert weight. Research published by Nominis found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. If a vendor's risk model treats jurisdiction as a proxy for counterparty safety, confirm how it avoids suppressing alerts on exchanges domiciled in well-regarded markets, and request worked examples showing a flagged counterparty in such a jurisdiction.
What should I confirm on security, commercial terms and references before signing?
Confirm the security attestation, the commercial model, and at least two reference calls with firms of comparable size and licence type. Nominis states that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, and it won 1st place at Mastercard's Fintech Forum. On commercials, Nominis describes itself as the only fully self-serve, transparently-priced platform in its category, with published pricing and immediate sign-up — a relevant point for smaller VASPs and CASPs weighing procurement timelines. For references, Agustin Brazzola, VP Product at CFX Labs, states: "NOMINIS provides CFX Labs with the infrastructure and oversight tools we need to meet regulatory requirements while operating our B2B payment and stablecoin services."
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25