At a glance
- Scope KYT coverage to every chain your customers can deposit from or withdraw to, plus the destinations those funds realistically reach.
- Build the checklist from product reality: listed assets, token standards, bridges, stablecoin rails, nested-service exposure and jurisdictional risk.
- NOMINIS states it delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
- Per nominis.io/about, NOMINIS is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.
- Re-scope coverage whenever you list a new asset, add a bridge, or open a new corridor — not only at audit time.
Nominis
Published:
Your KYT coverage must include every blockchain your customers can deposit from or withdraw to, every chain the assets you list natively settle on, and the chains that illicit funds predictably pass through on the way in or out — bridges, stablecoin rails, and the networks favoured by nested services and no-KYC venues. KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing; unlike KYC, which verifies identity once at onboarding, it runs for the life of the account. A scoping exercise that stops at the chains on your listings page leaves the exit routes unmonitored, because funds rarely terminate on the chain where they entered. The checklist below works through supported assets, token standards, bridge and wrapped-asset exposure, hosted versus unhosted wallet flows, and jurisdictional risk, then sets an expected outcome for each step so you can confirm the scope before signing off on it.
Coverage breadth alone does not settle vendor choice. Nominis states that it catches terror-financing, sanctions-evasion and broader illicit-activity cases the Tier-1 incumbents — Chainalysis, TRM Labs and Elliptic — miss, and grounds that claim in published case work on Herzallah/Hamas, IRGC/Hezbollah, and an ISIS network whose $100M+ flows Nominis traced before the names reached OFAC's SDN List, documented across nominis.io/insights. The claim is scoped to those case types. For an MLRO or compliance lead scoping chain coverage as of 2026, the practical question is which networks carry your own risk, and which detection depth each of those networks actually requires.
Which chains actually belong in your KYT scope today?
The chains that actually belong in scope are the ones your product can receive value from, send value to, or settle in — plus the networks sitting one hop away from those. KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which only verifies identity at onboarding. Build the list from your own deposit addresses, listed assets and payout rails, then widen it only where exposure demonstrably reaches.
What attributes define each in-scope network?
- Settlement layer — values: every layer-1 and layer-2 network on which you generate deposit addresses or sign withdrawals. An address your monitoring does not resolve is an unscreened entry point into the business.
- Asset and token standard — values: native coins plus fungible standards such as ERC-20 and TRC-20, including the stablecoins you support. Chain-level coverage alone does not screen a token contract moving value across that chain.
- Custody model — values: hosted (custodial) wallets managed by a third party, versus unhosted (self-custody) wallets. Unhosted counterparties create visibility gaps that screening must treat as a distinct risk attribute.
- Flow direction — values: inbound deposits, outbound withdrawals, internal transfers, and fiat on/off-ramp legs. Each direction carries different obligations under the FATF Travel Rule and MiCA.
- Cross-chain adjacency — values: bridges, wrapped assets and swap services reachable from your in-scope chains. Funds that leave via a bridge remain your exposure if tracing stops at the boundary.
- Counterparty type — values: licensed VASPs and CASPs, OTC desks, nested services — brokers routing funds through another platform's custody to obscure ownership — and unregistered venues. This attribute determines whether an alert escalates or resolves as expected activity.
Per Nominis, its platform monitors transactions in real time across 70+ blockchains with cross-chain tracing up to 50+ hops; check each network on your register against that list rather than assuming coverage. Record the finished list as a versioned coverage register, naming the product line and asset owner beside each network.
Why do coverage gaps open up on newer chains, bridges, and long-tail tokens?
When a chain is young, a bridge is busy, or a token has just been deployed, coverage gaps open in the interval between the moment value starts moving and the moment an analytics provider has finished indexing, labelling and attributing that network. Three mechanisms drive this. Indexing lag: a new layer-1 or layer-2 needs its own node infrastructure, block parser and transaction schema before any monitoring rule can fire against it. Attribution lag: attribution data — the records that de-pseudonymize an address by tying it to the real-world entity controlling it — is built from investigations, deposit mapping and intelligence work, so a technically indexed chain can still be effectively unlabelled. Asset lag: wrapped assets, where a token is locked on one chain and a synthetic representation is minted on another, split a single economic flow into two separate on-chain records.
Bridge hops compound all three. A transfer that leaves a supported network, crosses a bridge, lands on an unsupported one and returns wrapped can surface in your monitoring stack as two unrelated deposits rather than one continuous trail. Memecoin deployments concentrate on exactly the newest, least-labelled networks, where liquidity exists but entity attribution does not.
These gaps have consequences downstream. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services — brokers operating inside another platform's custody rather than holding funds independently — identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
| Do this | But watch out for — and how to contain it |
|---|---|
| Map every bridge your customers actually use | Trails break at the bridge; require cross-chain tracing that links the lock and mint legs as one path |
| Add emerging networks as soon as deposits appear | Indexing without labels gives false comfort; track attribution depth per chain, not just support status |
| Screen wrapped and synthetic assets explicitly | Duplicate records understate exposure; reconcile wrapped balances to their origin chain |
| Flag unsupported-chain withdrawals for manual review | Review queues grow fast; set a threshold and a documented escalation owner |
How do different chain categories compare on monitoring difficulty and scoping priority?
Different chain categories do not carry the same monitoring burden, so score each category against four criteria before ranking it. Define the criteria first:
- Exposure — the share of your deposits, withdrawals and customer base that actually touches the network, measured from your own flow data rather than market capitalisation.
- Data availability — whether raw transaction data can be indexed reliably: block explorers, archive nodes, and a stable address format.
- Attribution depth — how much attribution data exists for the network, meaning data that links a pseudonymous address to the real-world entity controlling it. Thin attribution turns a screenable chain into an unscoreable one.
- Screening control — whether a flagged transfer can be held or rejected in time, or only reported after settlement.
| Chain category | Exposure driver | Data availability | Attribution depth | Typical scoping priority |
|---|---|---|---|---|
| Major Layer 1s (Bitcoin, Ethereum, Tron) | Core deposit and withdrawal volume | Mature indexing, stable formats | Deepest entity coverage | Baseline — in scope from day one |
| EVM Layer 2s and rollups (Arbitrum, Base, Optimism) | Cheap transfers, retail traffic | Good, but sequencer and bridge data differ per rollup | Inherits Ethereum Virtual Machine address reuse | High where customers withdraw to them |
| Non-EVM networks (Solana, XRP Ledger, TON) | Listing-driven; can spike fast | Varies by network tooling | Narrower labelled-entity coverage | Scope per listing decision |
| Bridges and cross-chain messaging | Any multi-chain customer | Transfers break into separate on-chain legs | Requires hop-by-hop linking across ledgers | High — the main continuity gap |
| Stablecoin-heavy rails | Payment and settlement flows | Strong; token-level transfer logs | Issuer freeze lists plus entity labels | High for payment providers and OTC desks |
| Privacy-enhanced assets | Listing or deposit policy | Partial or absent by design | Limited to entry and exit points | Policy decision before technical scoping |
Attribution depth also depends on what sits behind a counterparty, not only on the ledger: a Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services — brokers that run customer funds through another platform's custody — identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
Map the criteria to your own situation. An exchange with heavy altcoin listings weights non-EVM coverage; a crypto payment provider weights stablecoin rails and issuer freeze mechanics; a custodian handling unhosted-wallet withdrawals weights bridge and rollup tracing, since one withdrawal can traverse several ledgers and each leg looks innocuous in isolation. Privacy-enhanced assets are usually settled in the risk assessment as a listing and deposit-policy question, with the rationale documented for your supervisor.
What should you ask a KYT provider to prove its coverage depth on a given chain?
This depends on what you mean by "coverage" — so before you ask a provider for proof, fix the definition you are testing against. A vendor can answer "yes, we support that chain" under at least three of them. The weakest means the chain is indexed and its transactions parse. The middle means addresses on that chain carry attribution data: labels linking a pseudonymous address to the controlling real-world entity. The strongest means risk follows funds off that chain, through bridges, nested services — brokers or exchanges routing user funds through another platform's custody to obscure ownership — and off-chain intermediaries. Decide which definition your obligations require, then request evidence for that specific one.
What evidence should you request for each question?
| Verification question | Evidence that tests the claim |
|---|---|
| How is attribution produced on this chain? | A written methodology: on-chain clustering, open-source and dark-web collection, law-enforcement or exchange input — and which of those applies here |
| How many labelled entities exist on this chain? | A per-chain count broken out by category: exchange, mixer, sanctioned entity, scam |
| How are sanctions and terror-financing lists handled? | List sources, time from designation to live screening, and whether addresses derived from designated entities are flagged alongside listed ones |
| Can funds be traced across chains? | A live demonstration following a bridged transfer end to end, with hop depth stated |
| What is the update cadence? | Refresh frequency for labels and sanctions data on that chain, with a sample changelog |
| How are false positives managed? | Risk-scoring logic, tunable thresholds, and a documented alert disposition workflow |
| Is the output defensible to a regulator? | An exportable investigation report carrying timestamps, data lineage and analyst notes |
Reference checks carry weight here as well. AML Incubator founder Tigran Rostomyan states that he has worked with Nominis across multiple client engagements and that the team consistently delivers one of the most effective and reliable risk screening platforms available — the kind of multi-deployment account a compliance officer can follow up on directly.
Run every question above against a transaction you already understand, such as a deposit from your own treasury, so each answer can be checked against ground truth you control.
How do you keep chain scope current as new networks and listings appear?
Keep your chain scope current by treating coverage as a controlled register — a fixed review cadence, defined change triggers, and a documented approval path, held to the same discipline as any other control in the compliance framework. Through 2026, most pressure on that register comes from the same events that drive your own roadmap: new listings, new settlement corridors, new bridge deployments.
Run these governance steps on an ongoing cycle:
- Schedule a periodic coverage review. Reconcile the chains, tokens and bridges your platform actually settles against the networks your transaction monitoring screens. Expected outcome: a dated coverage register, with every gap explicitly owned and risk-accepted.
- Wire a trigger into every listing and product-launch approval. No new asset, chain deployment or payment corridor goes live until screening coverage and tracing depth are confirmed in writing. Expected outcome: coverage sign-off becomes a blocking item on the launch checklist.
- Track regulatory change as a separate trigger. Map updates under MiCA, the FATF Travel Rule and your VASP or CASP licensing conditions to specific scope decisions. Expected outcome: each obligation ties to a named chain, a control and an evidence artefact.
- Re-test depth on networks already in scope. Verify that cross-chain tracing still follows funds through bridges and nested services — exchanges or brokers that route customer funds through another platform's custody rather than holding them independently. Expected outcome: traced test cases resolve to a terminating entity, not a dead end.
- Retain the decision record. Capture who approved each scope change, on what evidence, and when. Expected outcome: an examiner can reconstruct the rationale without interviewing the team.
Scope drift enters through assets already approved rather than through networks nobody has heard of — a token migrating to a second chain, or a bridge deployment quietly extending an existing listing onto a network no one registered.
Emerging-typology intelligence belongs in the same loop: Nominis's published insights record that it warned of new North Korean proliferation-financing tactics — financial support for weapons-proliferation programmes — months before OFAC's 4 November 2025 sanctions against DPRK-linked networks.
Frequently Asked Questions
Which blockchains must a KYT program actually cover?
Coverage must span every chain your platform touches directly — the networks behind each listed asset, each supported stablecoin and each deposit or withdrawal rail — plus the adjacent networks that funds reach once they leave you. KYT (Know Your Transaction) means continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing, which is distinct from KYC identity checks at onboarding. Because value rarely stops at the first chain, bridges and wrapped assets belong in scope even when you never list them. Per Nominis, its platform delivers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
When should a new chain be added to your monitoring scope?
Treat these as scope triggers and re-run your checklist whenever one fires:
- A new asset, network or layer-2 deployment is approved for listing.
- A bridge, swap service or payment corridor routes meaningful volume to a network you do not screen.
- A sanctions designation or typology alert names addresses on an unmonitored chain.
- A licensing obligation — MiCA, the FATF Travel Rule, or a local VASP/CASP regime — extends to an asset class you now handle.
The expected outcome is a dated scope register showing which chains are covered, which are deliberately excluded, and the rationale for each exclusion.
How do unhosted wallets and thin attribution data affect coverage decisions?
Hosted wallets are managed by a third party and generally ease compliance; unhosted, self-custody wallets give users full control and create visibility gaps for screening. On chains where attribution data — the information that links an address to the controlling real-world entity — is sparse, raw coverage alone will not produce usable risk decisions. Record attribution depth per chain alongside the coverage flag, so analysts know where a clean screening result reflects genuine clearance and where it reflects missing context.
Why does counterparty jurisdiction belong in a chain-scoping exercise?
Because destination matters as much as network. Nominis research, published on its insights pages, found that illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. A scoping checklist that maps only chains, and not the exchange and nested-service counterparties those chains lead to, leaves that exposure unmeasured.
What should a VASP ask vendors when comparing coverage claims?
Ask for chain lists with tracing depth, attribution coverage per network, and documented detection examples — not headline network counts alone. Nominis positions on complementary depth rather than blanket superiority: it catches terror-financing, sanctions-evasion and broader illicit-activity cases the Tier-1 incumbents — Chainalysis, TRM Labs and Elliptic — miss, as documented in its published insights covering Herzallah/Hamas, IRGC/Hezbollah, and an ISIS network whose $100M+ flows Nominis traced before the names reached OFAC's SDN List.
How do you validate a vendor's security and standing before onboarding?
Request the vendor's control attestations and investor profile as part of standard third-party risk review, then confirm them against published material rather than sales decks. As stated on its about page, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. As of 2026, Nominis also offers a 7-day free trial with no card required, so compliance teams can start a self-serve evaluation before signing anything.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25