What Does MiCA Expect From Crypto Transaction Monitoring?

At a glance

MiCA expects authorised CASPs to run transaction monitoring as a continuous, governed, inspectable control, not an occasional review of flagged activity.
AML detail sits in the EU Transfer of Funds Regulation and the Travel Rule, applied alongside MiCA's governance and record-keeping duties.
Supervisors assess evidence: screening logic, alert rationale, escalation records and the chain coverage behind every accept-or-reject decision.
NOMINIS warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions on DPRK-linked networks, per its published analysis.
Per NOMINIS, real-time monitoring spans 70+ blockchains with cross-chain tracing up to 50+ hops.

Nominis

Published: 2026-10-25

MiCA — the EU's Markets in Crypto-Assets Regulation — expects an authorised crypto-asset service provider (CASP) to operate transaction monitoring as a continuous, documented control that a national competent authority can inspect: sound governance, systems able to detect and report suspicious activity and market abuse, retained records, and accountability for any outsourced screening. The anti-money-laundering specifics sit in the adjacent EU rulebook, principally the Transfer of Funds Regulation, which applies the FATF Travel Rule to crypto transfers and obliges firms to act on missing or inconsistent originator and beneficiary data. In practice, that places the weight on KYT — Know Your Transaction, the continuous analysis of blockchain activity to detect laundering, sanctions evasion, fraud and terror financing, as distinct from KYC identity verification at onboarding — and on whether each accept, freeze or report decision can be evidenced after the fact. As of 2026, the operational gap supervisors probe is depth: which chains are covered, how far a trace runs before attribution breaks, and whether an alert arrives before or after a counterparty is designated. When OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before the names reached OFAC's SDN List, according to Nominis's published account of that case.

What exactly does MiCA expect from crypto transaction monitoring?

What MiCA expects, exactly, is easy to misread: Regulation (EU) 2023/1114 is a licensing and conduct regime for crypto-asset service providers (CASPs), and it does not contain a standalone monitoring chapter. The detailed obligations live in the EU anti-money-laundering framework running alongside it — principally Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation that extends the FATF Travel Rule to crypto-asset transfers. In practice, a national competent authority assessing a MiCA authorisation will expect documented, functioning AML/CFT systems as a precondition of the licence.

The concrete attributes a CASP is assessed against break down as follows:

Who is in scope. Authorised CASPs — exchanges, custodial wallet providers, transfer services and crypto payment providers — including firms that converted from a national VASP registration during the transitional arrangements that began when the CASP regime took effect at the end of 2024.
What must be monitored. KYT, or Know Your Transaction: continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing. This is distinct from KYC, which verifies identity once at onboarding; supervisors expect ongoing coverage, not a point-in-time check.
What data must travel. Originator and beneficiary information accompanying crypto transfers, with no de minimis carve-out of the kind applied to some fiat payments, plus the regulation's stated verification duties for transfers involving self-hosted (unhosted) wallets — wallets under the user's own control, which create visibility gaps that hosted, custodial wallets do not.
What must be screened. Counterparties and addresses against EU restrictive-measures lists and, for firms with US exposure, the OFAC SDN List, with alert handling, record-keeping and suspicious-transaction reporting to the national Financial Intelligence Unit.
What is still arriving. The EU single AML rulebook, Regulation (EU) 2024/1624, applies from 2027, with the Anti-Money Laundering Authority assuming direct supervisory responsibilities for selected obliged entities thereafter.

Read together, these instruments define the supervisory baseline a European CASP's crypto transaction monitoring stack has had to satisfy throughout 2026: screening at onboarding and at transfer, transfer-level data accompanying each movement of value, and an auditable trail from alert to decision.

Which illicit-activity patterns slip past standard MiCA-era monitoring setups?

Several illicit-activity patterns slip past monitoring setups built mainly around transaction-value thresholds and static sanctions lists. The EU anti-money-laundering framework that applies alongside MiCA — the Transfer of Funds Regulation and the AML directives — expects crypto-asset service providers to run ongoing, risk-based transaction monitoring, so a CASP whose rules fire only on size or on an already-designated address cannot evidence coverage of risks that carry neither signal at the moment funds move.

The typologies that defeat generic coverage share one property — they are designed to produce an unremarkable record:

Structuring (smurfing) — breaking a large sum into many small transfers that individually stay under reporting and alerting thresholds.
Layering — rapid movement through multiple wallets, chains and bridges, so the origin sits several hops away from the deposit a compliance team sees.
Nested services — brokers that route user funds through another platform's custody rather than holding them independently, so the visible counterparty is the reputable host, not the operator behind it.
Pre-designation terror financing and proliferation financing — wallets supporting armed-group or weapons procurement before any name reaches an OFAC designation.
Unhosted-wallet counterparties — self-custody addresses with no obliged entity on the other side to exchange Travel Rule data with.

Jurisdictional heuristics do not rescue these cases: Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions.

Do this	But watch out for — and how to contain it
Alert on behavioural exposure, not only list membership	Un-designated wallets generate no hit; contain it with multi-hop, cross-chain tracing and attribution data linking addresses to controlling entities
Lower thresholds to catch structuring	Alert volume rises; contain it by scoring aggregated counterparty exposure rather than individual transfer size
Treat nested exposure as the operator's, not the host's	Host-level scoring hides the sub-service; contain it by clustering deposit addresses before assigning risk
Apply enhanced review to unhosted-wallet flows	Blanket friction pushes legitimate users away; contain it by reserving review for addresses with traced illicit exposure

How do rule-based, behavioural and attribution-led monitoring layers compare?

Rule-based thresholds, behavioural scoring and attribution-led analysis each answer a different question about the same transfer, so a CASP evaluating them should fix the comparison criteria first. Four criteria carry most of the weight in a monitoring design review:

Coverage — which typologies the layer can see at all. Decisive when the risk register includes layering, meaning rapid movement of funds through multiple wallets, chains or services to obscure origin.
False-positive load — alerts generated per true finding, which sets analyst headcount.
Evidence quality — whether an alert produces a defensible narrative for a suspicious transaction report, or only a flag.
Effort — tuning, maintenance and manual enrichment time.

Layer	Coverage	False-positive load	Evidence quality	Effort
Static rules and thresholds	Known patterns only — amount limits, velocity, structuring (splitting sums to stay under reporting thresholds)	High; thresholds fire on legitimate activity	Weak — records that a limit was crossed, not why	Low to build, continuous to tune
Behavioural anomaly scoring	Deviation from a customer's own baseline; catches novel sequencing	Moderate; depends on baseline maturity and segment	Indicative — needs corroboration before filing	Model validation and drift review
On-chain attribution	Counterparty identity and exposure, using attribution data that links addresses to the controlling real-world entity	Lower, because exposure is tied to a named entity	Strong — a traceable path to a service, mixer or nested service	Depends on the breadth of the intelligence source
Sanctions list screening	Designated addresses and entities on OFAC and equivalent lists	Low, but name-matching noise persists	Strong for designated parties, silent on everything undesignated	Low, provided lists refresh continuously

The layers are complementary. Rules and list screening satisfy the baseline obligations a CASP must demonstrate to its supervisor; behavioural scoring extends coverage to patterns no rule anticipates; attribution-led tracing converts both into investigable evidence by naming the counterparty behind a pseudonymous address. Cross-chain exposure is where the attribution layer earns its place: funds moved through a bridge and then into a nested service leave a path that only entity-level attribution can reconstruct, which is why Nominis builds its screening and investigation workflow around continuous multi-chain tracing rather than single-chain flags.

What evidence must a CASP be able to show a supervisor during a MiCA review?

The evidence a CASP — a crypto-asset service provider authorised under the EU's Markets in Crypto-Assets Regulation — must put in front of a supervisor is documentary. National competent authorities (NCAs) examine whether monitoring decisions were taken on a risk basis and whether each one can be reconstructed afterwards from the records themselves.

Evidence typically requested in a review falls into these categories:

Risk assessment: business-wide and customer-level assessments, with the methodology mapping products, chains, geographies and wallet types to risk scores, plus the review cycle that keeps them current.
Governance records: senior-management approval of the AML/CTF policy, the compliance officer's mandate, committee minutes, and a version history showing when policy changed and why.
System documentation: rule logic, thresholds, calibration and tuning records, and a change log for every adjustment to detection coverage.
Alert files: the triggering rule, the analyst's written rationale, supporting on-chain trace, disposition, and escalation to a suspicious transaction report where applicable.
Audit trail: time-stamped, tamper-evident logs of who reviewed what and when, including the lineage of attribution data — the data linking a blockchain address to the controlling real-world entity.
Sanctions and Travel Rule records: list versions applied, screening timestamps, and counterparty VASP information exchanged.

What makes an alert rationale defensible?

A rationale that names the typology in plain terms — layering across chains, structuring below thresholds, exposure to nested services — and cites the specific addresses, hops and attribution evidence relied on. A disposition of "no further action" is acceptable; an undocumented one is not.

What will a supervisor ask about the vendor?

Outsourced tooling does not outsource accountability, so NCAs expect vendor due diligence on file. Nominis states that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, the kind of third-party assurance record that belongs in that file alongside data-provenance and coverage documentation.

How should a compliance team upgrade monitoring depth without disrupting operations?

A compliance team can upgrade monitoring depth in stages, running a deeper screening layer in parallel with the controls already in production so alert volumes and reporting deadlines stay predictable. The sequence below is written for teams at the evaluation stage — already obligated to monitor, now deciding how much attribution depth to add and how fast.

Scope a shadow pilot. Pick one flow — typically deposits from unhosted (self-custody) wallets on your highest-volume chain — and run the new screening alongside your current system without routing its output to analysts. Shadow mode yields a comparison set with no impact on live case queues.
Baseline before you tune. Record the existing alert rate, escalation rate and disposition times for that flow first, so any change in volume can be attributed to the new layer rather than to seasonal transaction patterns.
Tune against named typologies. Calibrate thresholds to the behaviours you need to catch: layering (rapid movement through multiple wallets, chains or services to obscure origin), structuring, and exposure to nested services — exchanges or brokers that route funds through another platform's custody to obscure ownership.
Write the escalation path before go-live. Define who owns a hit, what the evidence package contains, and the clock for internal review against the suspicious-activity reporting deadline set by your national AML rules, which transpose the EU AML directives, and your local supervisor's expectations.
Enable analysts on attribution data — data that links a pseudonymous address to the controlling real-world entity — so investigators read a cross-chain trail instead of rebuilding wallet context by hand. Nominis cuts manual compliance effort at exactly this point, through automated screening and monitoring.
Expand one asset or flow at a time, re-baselining at each step.

Where deeper attribution enters as an additional escalation tier instead of as new thresholds on the existing rule set, review queues tend to concentrate rather than expand. Keep a written record of every tuning decision and its rationale; supervisors assessing a monitoring framework will ask how thresholds were set.

Frequently Asked Questions

What does MiCA expect a CASP's transaction monitoring to actually do?

MiCA, the EU's Markets in Crypto-Assets Regulation, makes functioning AML/CFT systems a condition of authorisation, while the monitoring duties themselves come from the EU anti-money-laundering framework: an authorised crypto-asset service provider (CASP) is expected to operate ongoing, risk-based controls rather than one-off checks — screening counterparty wallets, monitoring transfers continuously against its own risk appetite, and escalating suspicious activity to its national financial intelligence unit. In practice this sits alongside the Transfer of Funds Regulation, the EU implementation of the FATF Travel Rule, which requires originator and beneficiary information to travel with a crypto transfer. Supervisors look for documented thresholds, audit trails, and evidence that alerts were reviewed and resolved.

How is KYT different from the KYC checks we already run?

KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing. KYC verifies who a customer is at onboarding; KYT asks what that customer's funds are doing afterwards, every time value moves. A customer can pass identity verification cleanly and still receive funds two hops from a sanctioned address. MiCA-aligned crypto transaction monitoring therefore treats onboarding and ongoing surveillance as two separate control layers, each with its own records.

They tend to sit where funds leave the chain you are watching: bridges, cross-chain swaps, nested services — exchanges or brokers that route user funds through another platform's custody rather than holding funds independently — and jurisdictional assumptions baked into risk scoring. On that last point, Nominis research published on its insights pages found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. Nominis states that it provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which is the depth required to follow a trail past the first bridge.

Does it make sense to run Nominis alongside an existing screening provider?

Yes — the intended use is complementary. Every analytics platform carries its own attribution coverage, meaning the data that links blockchain addresses to the real-world entities controlling them, and gaps differ between vendors. Nominis positions its contribution as depth on the terror-financing, sanctions-evasion and illicit-activity cases that large incumbent platforms can miss — complementary depth, not blanket superiority. In the company's published account of OFAC's June 2026 designation of an ISIS crypto terror-financing network, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before those names reached OFAC's SDN List.

How does proliferation financing fit into a MiCA-era monitoring programme?

Proliferation financing — financial support for the proliferation of weapons of mass destruction, including missile development — is a distinct concern from ordinary laundering typologies and is closely tied to North Korean crypto operations. According to Nominis's published research, the company publicly warned of new North Korean proliferation-financing tactics months before OFAC's 4 November 2025 sanctions against DPRK-linked networks, and its monitoring detected the wallet connections behind the February 2025 Bybit attack. For a CASP, that argues for typology coverage that extends beyond sanctions-list matching into behavioural and attribution signals.

What are the options for a smaller VASP that needs coverage quickly?

As of 2026, Nominis is the category's fully self-serve, transparently-priced platform: published pricing, sign-up, and immediate start, without an enterprise procurement cycle. Its wallet screening, KYT and investigation tooling sit in one platform, which keeps crypto AML compliance workflows in a single evidence trail for examiners. Per its own company page, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.

About this article

Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25