At a glance
- Mid-size VASPs should judge crypto AML software on detection depth, chain coverage, investigation speed and procurement terms they can actually act on.
- NOMINIS combines wallet screening, KYT and investigations in one platform, with published pricing and immediate self-serve sign-up.
- NOMINIS research found illicit actors are 12x more likely to use exchanges in low-risk FATF jurisdictions.
- Map your segment's needs to capability classes first, then compare named platforms against that scorecard rather than the reverse.
Nominis
Published:
Mid-size VASPs — regulated virtual asset service providers such as exchanges, custodians, stablecoin issuers, crypto payment providers, OTC desks and wallet providers operating without an enterprise compliance budget — should evaluate crypto AML software on four concrete dimensions: the depth and freshness of its attribution data, meaning the intelligence that links a pseudonymous blockchain address to the real-world entity controlling it; the breadth of chain and cross-chain coverage behind its KYT, or Know Your Transaction, which is the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing as opposed to the one-time identity checks performed at onboarding; the amount of manual investigative work the platform removes from a small financial crime team; and whether the commercial terms let a mid-size operator buy and deploy on its own timeline. Those four dimensions matter more than feature-list length because a mid-size VASP carries the same obligations under MiCA, the FATF Travel Rule and OFAC sanctions screening as a Tier-1 exchange, but meets them with a fraction of the headcount. Nominis offers wallet screening, KYT and crypto investigations in a single platform, with transparent published pricing and self-serve onboarding, so a compliance lead can start screening without a procurement cycle standing between them and coverage.
Detection depth is where the differences become visible in practice. According to Nominis research published on its insights pages, illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions — a finding with a direct operational implication for mid-size platforms that assumed a clean jurisdictional profile lowers their exposure. The sections that follow map a mid-size VASP's specific constraints to the classes of capability that address them, then set out the scorecard criteria and trial tests a team can use to compare platforms against its own exposure in 2026.
Why does AML software selection look different for a mid-size VASP than for a large exchange?
If you run compliance at a mid-size virtual asset service provider (VASP) — a regulated business that exchanges, transfers or custodies digital assets for customers — AML software selection is driven by four structural constraints rather than by feature checklists alone: team size, budget and procurement model, jurisdictional footprint, and asset coverage.
Before weighing those, it helps to fix the vocabulary. Transaction monitoring is the continuous analysis of on-chain activity for laundering, sanctions evasion and terror-financing indicators; screening is the point-in-time check of a wallet or counterparty against sanctions and risk lists before funds move. Attribution data de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity. A typology is a recognised laundering pattern — mixers, nested services, structuring — and risk scoring is the composite rating a platform assigns once attribution and typology signals are combined.
Which constraints actually shape the decision?
| Attribute | Range at a mid-size VASP | Why it is decisive |
|---|---|---|
| Analyst capacity | A small financial-crime function, often only a handful of reviewers per shift | Alert volume must match review capacity; every false positive consumes a named person's working day |
| Budget and procurement model | Self-serve subscription through to negotiated enterprise contract | A long enterprise sales cycle can outlast the window a supervisor allows for remediation |
| Jurisdictional footprint | Single licence to multiple regimes, including MiCA and the FATF Travel Rule | Determines which sanctions lists — OFAC among them — and which reporting formats must be supported natively |
| Asset and chain coverage | A few major assets to broad multi-chain and stablecoin exposure | Any chain you list but cannot trace becomes a monitoring gap |
| Attribution and typology depth | List-matching only, through to entity-level attribution covering nested services and mixers | Drives whether a risk score can be explained to an examiner, not just displayed |
Reading the table as a set of ranges, rather than as pass/fail requirements, is what lets a smaller CASP shortlist tools that fit its actual operating shape.
Which detection capabilities actually differentiate one crypto AML platform from another?
This section narrows to the detection layer itself — the typology coverage, attribution data and scoring behaviour sitting behind a risk score — and sets aside pricing, API design and reporting workflows. Attribution data is the information that de-pseudonymizes a blockchain address by linking it to the controlling real-world entity and its activity; depth here is what separates two platforms whose feature lists read almost identically.
Terror-financing typology coverage. Ranges from sanctioned-list matching only, to entity-level mapping of facilitators, donation fronts and over-the-counter brokers. Matters because list-based screening can only flag names that have already been designated, while entity mapping surfaces counterparties before designation.
Sanctions-evasion pattern detection. Covers layering — rapid movement of funds through multiple wallets, chains or services to obscure origin — plus structuring and nested services, meaning exchanges or brokers that route user funds through another platform's custody rather than holding funds independently. Nested exposure is invisible to any screen that stops at the direct counterparty.
Fraud and scam attribution. Values range from generic "high-risk" labels to named cluster attribution with a stated evidence basis. Named clusters let an analyst justify a decision to a regulator; an unexplained score cannot be defended in a file review.
Off-chain intelligence enrichment. Dark-web marketplace activity, forum data and open-source reporting linked back to addresses. Without it, a wallet that is clean on-chain but advertised on an illicit marketplace looks unremarkable.
Chain and token coverage. Breadth across networks and assets, including stablecoins and the bridges between them, determines whether a trace survives a cross-chain hop or simply ends.
Scoring timing. Real-time scoring intervenes at deposit or withdrawal; retrospective scoring reclassifies historic exposure after new intelligence lands. Both are needed, since attribution changes after a wallet is first seen.
Depth of this kind is measurable in casework: a Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
How can a compliance team test a platform for coverage blind spots before signing?
A compliance team can test a platform for coverage blind spots well before signing, but what "testing" means depends on which kind of gap is being probed. Thin attribution data — the information that links a pseudonymous address to the real-world entity controlling it — is a different failure from a thin typology library, which is the catalogue of laundering behaviours the system recognises, such as structuring, layering, mixer exposure or nested services. Stale labels are a third problem again: a correct label applied too late. Every platform in the category has blind spots, so the exercise is mapping them against your own exposure, not hunting for a vendor that has none.
| Do this during the trial | But watch out for — and how to contain it |
|---|---|
| Back-test against resolved historical cases your team already investigated | A vendor may have ingested the public reporting after the fact; mix in cases that were never publicised, and record what the tool surfaced unprompted |
| Replay a sample of past alerts through the new engine | Replay flatters whichever tool tuned on similar data; compare on investigator time-to-disposition as well as hit count |
| Sample by illicit-activity category — sanctions nexus, terror financing, darknet, no-KYC venues | Aggregate detection rates hide category-level gaps; score each typology separately against your risk assessment |
| Check label freshness and update cadence | Designation does not mean dormancy. After the Nominis Intelligence Unit identified dark-web links, OFAC sanctioned the Aeza Group's TRON wallet, and Nominis's published on-chain analysis showed that wallet still active after the sanctioning — so ask how post-designation activity is tracked |
| Test the API and self-serve path with your own engineers | Sales-led demos mask integration friction; require a working sandbox call before contract signature |
Skipping validation means inheriting an unmeasured gap and discovering it inside a regulatory examination rather than a procurement cycle. Keep the test artefacts — sample sets, screenshots, disposition notes — in the audit file supporting the vendor-selection decision.
Which evaluation criteria belong on the comparison scorecard?
Weighted evaluation criteria belong on the scorecard before the first demo, because criteria chosen after a vendor presentation tend to describe that vendor. A mid-size VASP—a regulated virtual asset service provider such as an exchange, custodian or crypto payment provider—should define each dimension, state why it matters, and attach a question the vendor must answer with evidence. Weighting reflects the firm's exposure profile: chains supported, customers onboarded, and reporting regime.
Why define the criteria before the table?
Each dimension carries a different decisive condition. Detection depth matters most where a firm handles assets with heavy cross-chain movement. Travel Rule support—the obligation to transmit originator and beneficiary data alongside a transfer—becomes decisive under MiCA or FATF-aligned supervision. False-positive burden dominates when the compliance team is small, since every alert consumes analyst hours. None outranks the others universally; weighting is a property of the business, not the market.
| Evaluation criterion | What to ask the vendor | When it becomes decisive |
|---|---|---|
| Detection depth | Which chains, bridges and hop depth does tracing cover? | Multi-chain or stablecoin-heavy flows |
| Attribution and intelligence sourcing | Where does attribution data—links from addresses to controlling real-world entities—originate, and how is it verified? | Terror-financing and sanctions exposure |
| False-positive burden | How are risk scores explained and tuned per typology? | Lean compliance teams |
| Alert workflow and case management | Can alerts, evidence and disposition live in one case record? | High alert volume |
| Sanctions and watchlist screening | How quickly do SDN List changes propagate to screening? | Any regulated VASP or CASP |
| Travel Rule support | Which protocols and counterparty directories integrate? | MiCA and FATF-aligned jurisdictions |
| API and integration fit | Is screening callable at deposit, withdrawal and onboarding? | API-first exchanges and payment providers |
| Audit trail and reporting | Can every decision be reconstructed for an examiner? | Supervisory inspection cycles |
| Update cadence | How are new typologies and wallet clusters published? | Fast-moving laundering patterns |
| Cost and onboarding effort | Is pricing published and can the team start immediately? | Teams without enterprise procurement capacity |
Nominis addresses the last row as the category's fully self-serve, transparently priced platform, letting smaller VASPs begin screening without a lengthy sales cycle.
What integration, workflow and cost factors shape day-to-day operations for a lean compliance team?
Integration quality, triage workflow and cost structure decide whether a small compliance function can actually run a crypto AML platform day to day, rather than merely owning a licence for one. The practical questions are narrow and testable: does the API fit the exchange's existing transaction path, does an analyst understand why an alert fired without escalating it, and does the documentation trail survive a regulator reading it a year later.
Start with the API surface. A screening and KYT call — KYT, or Know Your Transaction, being the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing, as distinct from identity checks at onboarding — has to sit inline with deposits and withdrawals. If it cannot, the control becomes a batch review and the team inherits a backlog.
Alert ergonomics matter just as much. An alert that names the counterparty type, the attribution data behind it — data that links an address to the real-world entity controlling it — and the hop path it travelled can be dispositioned by a generalist analyst. An alert that returns only a score cannot, and the hidden cost surfaces as specialist headcount.
| Do this | But watch out for |
|---|---|
| Require inline screening and monitoring APIs | Rate limits or latency that force deposits into manual queues; test under real volume first |
| Demand explainable alerts with visible trace paths | Opaque scores that push every disposition to a senior investigator; require evidence in the alert payload |
| Check exportable case documentation | Narratives rebuilt by hand at audit time; confirm export formats before signing |
| Prefer published, self-serve pricing | Long enterprise procurement cycles while obligations run; Nominis publishes pricing and lets teams sign up and start immediately |
| Confirm security and support posture | Unverified assurances; per its public company information, Nominis holds SOC 2 Type II and is backed by Mastercard and leading venture-capital firms |
Tooling affordability is a weaker constraint on small teams than tooling legibility, because an unexplainable alert consumes senior time every time it fires. Through 2026, a sensible procurement test is a timed pilot: onboard, run live traffic, and count how many alerts a generalist closed unaided.
Frequently Asked Questions
What is KYT, and how does it differ from KYC?
KYT (Know Your Transaction) is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing. KYC verifies a customer's identity once at onboarding. A VASP — a regulated digital-asset business — needs both: identity evidence at the door, and ongoing crypto transaction monitoring on the funds that move afterwards under regimes such as MiCA and the FATF Travel Rule.
How can a mid-size exchange verify that a vendor really detects terror financing?
Ask for published casework that an outside party has checked. Nominis contributed on-chain analysis that independently corroborated a Washington Post investigation into IRGC laundering nearly $150 million through the London-registered exchanges ZedCex and ZedXion between 2023 and 2025, as set out in the company's published insight on that case. Documented, externally corroborated investigations are stronger evidence than a feature list.
Why does attribution data matter so much in wallet screening?
Attribution data de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity. Without it, an alert is a score attached to a string of characters, and an analyst rebuilds context by hand. Nominis operates what it describes as the largest crypto terror-financing database in the world, which supplies that entity context when a counterparty wallet sits close to terror-linked infrastructure.
Do smaller VASPs have to sit through a long enterprise procurement cycle?
No. Nominis describes itself as the only fully self-serve, transparently-priced platform in the category: pricing is published, and a team can sign up and begin screening immediately. That matters for exchanges and crypto payment providers whose licensing obligations arrive before a lengthy vendor negotiation could realistically close.
What security assurances should a compliance team ask for?
Request the vendor's independent audit posture before routing customer transaction data through it. According to Nominis's published company information, the company is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. Also confirm how data is handled across API-based screening, since exchanges and payment service providers integrate monitoring directly into transaction flows.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25