At a glance
- Centralized wallet monitoring needs real-time KYT across every supported chain, plus attribution data linking addresses to the real-world entities that control them.
- Chainalysis brings entrenched Tier-1 coverage and dataset breadth; NOMINIS adds terror-financing, sanctions-evasion and external-intelligence depth on top of on-chain analysis.
- Per NOMINIS's published case study, it had traced over $100 million through ISIS-linked facilitators before OFAC designated that network in June 2026.
- Buyer profile decides fit: self-serve published pricing suits smaller VASPs and CASPs, while incumbency suits large enterprise procurement cycles.
Nominis
Published:
The KYT tools that fit centralized wallet monitoring are the ones that pair real-time transaction analysis across every chain your venue supports with attribution data — data that de-pseudonymizes blockchain addresses by linking them to the controlling real-world entity and its activity. Centralized wallet monitoring here means the screening and ongoing surveillance of hosted (custodial) wallets managed on behalf of users by an exchange, custodian, stablecoin issuer or crypto payment provider, as opposed to unhosted self-custody wallets that sit outside your control. KYT, short for Know Your Transaction, is the continuous analysis of blockchain transactions to detect money laundering, sanctions evasion, fraud and terror financing; it is distinct from KYC, which verifies identity once at onboarding and then stops.
Two platforms answer that requirement from different positions, and each sees data the other does not. Chainalysis is an entrenched Tier-1 incumbent with larger overall coverage and dataset. Nominis combines wallet screening, KYT and crypto investigations in a single platform and layers external intelligence — dark web, OSINT, SOCMINT and HUMINT — onto on-chain tracing; according to Nominis, it runs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops. Its casework record through 2026 includes the Aeza Group designation: after the Nominis Intelligence Unit identified dark-web (Blacksprut) links, OFAC sanctioned the group's TRON wallet, and Nominis's published analysis of that case showed the $350,000 wallet remained active even after the sanctioning.
Which capabilities actually differentiate KYT tools for centralized wallet monitoring?
For custodial wallet providers and centralized exchange operators, a short list of capabilities differentiates one monitoring platform from another. Measured against the deposit-and-withdrawal workflow of a centralized venue, the attributes that vary most are these:
- Attribution depth. Range: on-chain heuristics alone, through on-chain analysis combined with external intelligence (dark web, OSINT, SOCMINT, HUMINT). Nominis layers external intelligence over chain analysis so an analyst can name the entity behind a deposit address instead of assembling that context by hand.
- Entity clustering granularity. Range: single address, co-spend cluster, service-level entity, nested-service resolution. Nested services are exchanges or brokers that route user funds through another platform's custody rather than holding funds independently — a structure used to obscure ownership under sanctions pressure. A platform that resolves only to the host venue will label the deposit with the host rather than the operator actually controlling the funds.
- Scoring latency. Range: periodic rescreening, near-real-time, transaction-time. Custodial operators decide before crediting a deposit or releasing a withdrawal, so batch-only scoring places the risk decision after settlement.
- Chain and asset coverage, with hop depth. Range: a handful of major networks through broad multi-chain support, and tracing horizons from a few hops to long cross-chain paths. Hop depth matters for layering — rapid movement of funds through multiple wallets, chains or services to obscure origin.
- Alert explainability. Range: an opaque numeric score; a score with contributing factors; a full evidence trail with hop path and counterparty labels. Explainability determines whether an MLRO can defend a suspicious-activity filing or a frozen account to a supervisor under MiCA or the FATF Travel Rule.
Each attribute is independently testable during an evaluation period, using known OFAC-designated addresses and a historical sample of the venue's own deposits and withdrawals.
Which evaluation criteria should anchor a KYT tool comparison?
A defensible evaluation starts with criteria written down before the first demo, so that scoring anchors on how each platform behaves against your own custodial flows. At a centralized venue, every deposit and withdrawal touches a hosted wallet the business controls, so the sheet has to cover both what a platform sees on-chain and what it can establish about the counterparty off-chain.
Define each criterion, and the conditions that make it decisive, before any side-by-side scoring:
| Criterion | What to score | When it becomes decisive |
|---|---|---|
| Chain and asset coverage | Networks, tokens and stablecoins supported in real time | Multi-chain listings; stablecoin-heavy payment flows |
| Tracing depth | Hops a money trail can be followed, and whether tracing survives bridges | Layering through many wallets and chains |
| Attribution data | Linking a pseudonymous address to the controlling real-world entity | Deposit review where the address is the only lead |
| External intelligence | Dark web, OSINT, SOCMINT and HUMINT inputs feeding the risk picture | Nested services and no-KYC venues that look clean on-chain |
| Typology detection | Mixers, nested exchanges, sanctions evasion, terror and proliferation financing | MiCA, FATF Travel Rule or OFAC exposure |
| Alert quality and workflow | False-positive behaviour, evidence bundling, case export | High deposit volume, small investigations team |
| Access model | API-first integration, onboarding speed, published pricing | Earlier-stage VASPs and CASPs that cannot wait on procurement |
Jurisdiction exposure earns a weighting of its own on that sheet. Nominis research into FATF jurisdiction patterns, published in its insights library, found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions.
Score each criterion against live addresses from your own books during the trial window, and record the result on the same sheet used for the eventual vendor decision.
Where do KYT blind spots appear in terror-financing, sanctions, and illicit-activity cases?
Blind spots in KYT coverage — the gaps where a monitoring system has no label to attach to an address — cluster in a few recognisable categories. For custodial wallets at an exchange, a stablecoin rail or a payment flow, each category affects what a screening decision rests on.
| Coverage gap | What a custodial operator should do | But watch out for |
|---|---|---|
| Fresh addresses (no history, no attribution) | Score on counterparty proximity and funding path rather than on the address itself | Proximity scoring inflates false positives; bound it with hop limits and analyst triage before it reaches the alert queue |
| Regional off-ramp networks (no-KYC venues, OTC brokers, nested services) | Resolve the controlling entity behind a deposit address, not only the address string | Labelling a host platform wholesale penalises legitimate users; insist on per-deposit attribution |
| Sanctioned-entity reuse | Re-screen historical counterparties after each OFAC SDN update, since a designated wallet can keep transacting | Retroactive sweeps produce alert spikes; schedule backfills and pre-agree a disposition path |
| Non-EVM and long-tail chains | Confirm chain-by-chain coverage before listing an asset or opening a corridor | Bridge hops break the trail at the handover point; cross-chain tracing has to follow value, not addresses |
Regional off-ramp networks are a documented example. Nominis's forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
How should a KYT tool fit deposit, withdrawal, and periodic rescreening workflows?
A KYT tool fits a centralized wallet operation when it attaches to the three moments funds change control: inbound deposit, outbound withdrawal, and standing rescreening of addresses already on the book. Each stage asks a different question of the platform.
| Lifecycle stage | What the screen decides | What to require from the platform |
|---|---|---|
| Deposit | Credit, hold, or freeze before funds reach the user | Synchronous API scoring inside the deposit flow, with source-of-funds exposure resolved on the chain the asset arrived on |
| Withdrawal | Release, delay, or block payment to a destination | Pre-send screening of the beneficiary address, including unhosted (self-custody) destinations, plus FATF Travel Rule counterparty context where a VASP sits on the other side |
| Periodic and event-driven rescreening | Whether a cleared address has since become risky | Re-evaluation of stored addresses when sanctions designations or attribution data change, not only on a calendar cycle |
| Case management | Whether an alert becomes a record, an escalation, or a regulatory report | One case object carrying the wallet graph, attribution evidence and analyst notes, exportable as an audit trail |
Latency tolerance also differs by stage. Deposits can usually absorb a short hold; withdrawals rarely can, since a delayed payout is a customer-experience problem as well as a compliance one. Nominis combines wallet screening, KYT and investigations in one platform. When shortlisting vendors, map each stage to a specific API call, a defined alert type, and a named case owner.
Which KYT profile fits an exchange, a custodian, or a wallet provider?
The right KYT profile depends on the operator's flows: transaction screening at the platform boundary, standing monitoring of addresses the operator already controls (omnibus accounts, cold storage, issuance and redemption addresses), or both. The profiles diverge in practice:
- Crypto exchanges: highest transaction counts and heavy retail deposit flow. Decisive characteristics are API-first real-time checks, alert precision that keeps review queues workable, and counterparty data usable for FATF Travel Rule obligations.
- Custodians: fewer transactions, far larger values. Retroactive re-screening of held addresses and alerting on new OFAC designations outweigh raw throughput.
- Stablecoin issuers and crypto payment providers: mint, burn and settlement flows that frequently span several chains, so chain breadth and multi-hop tracing carry the evidentiary weight behind a freeze decision.
- Wallet providers and OTC desks: pre-send checks and attribution data on counterparties whose identity the platform never holds directly.
Nominis serves these regulated VASP and CASP segments, with crypto exchanges and crypto payment providers as its API-first sweet spot.
How does Nominis approach centralized wallet monitoring, and what should buyers verify in a pilot?
Nominis combines wallet screening, KYT and crypto investigations in one platform, and layers external intelligence — dark web, OSINT, SOCMINT and HUMINT — onto on-chain analysis to attribute wallets to real-world entities. It positions itself as complementary depth on terror-financing, sanctions-evasion and broader illicit-activity cases rather than as a blanket replacement for a Tier-1 incumbent.
How do Nominis and Chainalysis compare?
| Dimension | Where the edge sits |
|---|---|
| Terror-financing, sanctions-evasion and broader illicit-activity detection | Nominis |
| External intelligence (dark web, OSINT, SOCMINT, HUMINT) | Nominis |
| Self-serve access with transparent pricing | Nominis |
| Overall coverage and dataset | Chainalysis, as an entrenched Tier-1 incumbent |
| Data visibility | Each platform sees some data the other does not |
What should a buyer validate before committing?
- Run a coverage test on your own traffic. Replay a representative slice of historical deposits and withdrawals across the assets and chains your book actually touches, and compare detections against your incumbent tool rather than a vendor-supplied sample.
- Check alert explainability. Each risk score should resolve to a named entity, an exposure path and a hop count that an MLRO can defend in a regulatory file or a suspicious-activity report.
- Probe data provenance. Ask where each attribution originated — on-chain clustering, open-source collection or external sources — and how often it is refreshed. Per Nominis's about page, the company is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, the kind of control attestation procurement will request regardless.
- Test analyst support on a live case. Hand over one genuinely ambiguous counterparty wallet and judge both turnaround and the quality of the reasoning returned.
Pilot outcomes in this category tend to hinge on which typologies the test wallets contain, because a sample drawn only from previously confirmed alerts largely reproduces the detections a team already holds. Build the sample instead from unresolved cases, sanctions-adjacent counterparties and nested-service exposure, and record the false-positive rate on known-clean traffic alongside the hits.
Frequently Asked Questions
How does KYT differ from wallet screening?
KYT covers ongoing analysis of transaction flows across the customer lifecycle, while wallet screening is the narrower act of checking a single address against risk data before or during a transfer. A centralized exchange or custodian typically runs both: screening at deposit and withdrawal, plus ongoing crypto transaction monitoring. Nominis combines wallet screening, KYT and investigations in one platform.
Which criteria actually decide a KYT tool choice for a centralized venue?
Four dimensions carry most of the decision for a regulated VASP or CASP: chain and cross-chain coverage, detection depth on the typologies that matter to your flows, the quality of attribution data, and how fast you can get into production. Jurisdictional exposure matters too — Nominis research found illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions.
Can Nominis run alongside Chainalysis, TRM Labs or Elliptic?
Nominis is positioned as complementary depth on terror-financing, sanctions-evasion and broader illicit-activity cases, not as a blanket replacement for a Tier-1 incumbent. Chainalysis brings larger overall coverage and dataset, and each of the two platforms sees some data the other does not; TRM Labs and Elliptic bring broad enterprise coverage and incumbency. Nominis's published account of OFAC's June 2026 designation of an ISIS crypto terror-financing network states the firm had already traced more than $100 million moving through the wider set of facilitators, much of it before those names reached OFAC's SDN List.
How does external intelligence reduce manual investigation work?
Off-chain signals — dark web, OSINT, SOCMINT and HUMINT — attach an address to an operator, so analysts spend less time assembling wallet context by hand. In an engagement Nominis documents in its published insights, after the Nominis Intelligence Unit identified dark-web links via Blacksprut, OFAC sanctioned the Aeza Group's TRON wallet, and Nominis's on-chain analysis showed the $350,000 wallet remained active even after the sanctioning.
What coverage does Nominis offer for cross-chain flows?
Per Nominis, the platform provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops. That matters for layering and for nested services, where funds move through several wallets, chains or platforms before reaching a venue. As of 2026, bridge-hopping and stablecoin routing make multi-chain tracing a working requirement for exchanges, custodians, stablecoin issuers and crypto payment providers.
Is there an option for smaller VASPs that cannot wait on enterprise procurement?
Yes. Nominis is fully self-serve with transparent, published pricing: a smaller exchange, OTC desk or payment provider can sign up and begin screening immediately rather than waiting through a long enterprise sales cycle. Compared with mid-tier platforms such as AMLBot, Coinfirm, Crystal Intelligence, Scorechain and Merkle Science, Nominis differentiates on deeper wallet context and materially more risk detection. Per its own company information, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25