An investor explains that their subscription money comes from selling cryptocurrency. Their identity documents are valid, their name produces no unresolved screening matches, and the payment arrives from an account in their name. The compliance team still needs to assess the explanation for how that wealth was acquired.

On-chain AML analysis can help examine the crypto transaction history behind the payment. It combines blockchain records with information about addresses, services and known activity to identify potentially relevant connections. That evidence adds to the customer file. A transaction graph cannot, by itself, establish the investor's identity or explain the economic origin of their wealth.

For firms in investment services, the practical challenge is knowing which questions each kind of evidence can answer, and where another source is needed.

What on-chain AML analysis actually does

On public blockchains, analysts can examine transfers between addresses, their timing and amounts, and interactions with services or smart contracts. Software turns those records into a transaction graph: a map of movements and connections.

The interpretation adds further layers. Clustering groups addresses believed to share control. Attribution connects an address or cluster to a named service or actor using evidence beyond the ledger, such as information obtained from an exchange, investigative material or public records. Those are distinct analytical steps, and their reliability needs separate consideration. Chainalysis explains this distinction in its wallet attribution methodology.

An exchange label, for example, may identify the service controlling the keys without identifying the customer whose funds moved through it. A line between two addresses shows a transfer; identifying the people behind those addresses requires further evidence.

A transaction trail and a customer file answer different questions

Conventional AML work already includes transaction monitoring. The difference with blockchain analytics lies in the records available and the methods used to interpret them. Customer due diligence, ownership analysis and screening remain relevant when the assets move on a blockchain. FATF applies relevant financial-institution measures to virtual asset service providers through its standards. FATF's virtual asset guidance.

In the opening example, an exchange withdrawal may explain the immediate source of the bank payment. It does not establish how the investor acquired the crypto originally. That distinction is particularly useful in knowing your investor, where the explanation may involve several entities or years of investment activity.

Direct and indirect exposure need context

Direct exposure generally describes a transfer involving an identified counterparty. Indirect exposure describes a connection through intermediate addresses. An analytical provider's definitions and tracing assumptions determine how these relationships are measured; Chainalysis, for example, explains that its indirect tracing stops at services where the onward customer-level movement usually cannot be established from blockchain records alone. Chainalysis, indirect exposure.

Consider an illustrative alert connecting an investor's wallet to an address associated with a theft, several transfers earlier. The reviewer needs the amounts, dates, intervening services and confidence in the label. An exposure percentage without that context cannot explain whether the connection is meaningful to this investor or this payment.

A tool's risk score is an analytical output. The firm's assessment must establish what the underlying evidence supports and whether any legal restriction applies. OFAC's virtual currency guidance recommends examining historical connections to newly listed addresses and recognises that unlisted addresses may create sanctions risk depending on the transactions involved. OFAC guidance, October 2021.

The discipline resembles resolving false positives in AML screening: retain the evidence and reasoning behind the decision, rather than recording only the alert's colour or score.

Where the transaction graph becomes incomplete

Visibility varies by network, asset and service. A transfer into a custodial platform may lead to activity recorded on its internal systems rather than on a public ledger. An address label can become outdated, while clustering methods can produce errors.

FATF explicitly identifies limitations in blockchain analytics concerning coverage, timeliness, accuracy and reliability. It also notes that vendors do not all cover the same virtual assets. FATF guidance, paragraphs 39 and 234.

Cross-chain activity adds another difficulty. A bridge moves value between networks, so analysis confined to one chain may show only part of the route. Mixers and some other services can further complicate reconstruction. In remarks on its DeFi assessment, the US Treasury describes criminals using bridges, mixers and liquidity pools in laundering activity; these mechanisms also have legitimate uses, so their presence requires context. US Treasury, April 2023.

The reviewer should therefore distinguish an observed transfer from an inferred connection, and an unknown address from one positively associated with illicit activity. A missing label leaves a gap in knowledge.

The Travel Rule supplies a different kind of information

The Travel Rule concerns information about the parties to a transfer. Blockchain analytics examines activity and relationships on the ledger. One can support the other, but a transaction hash does not contain all the identity information a regulated firm may be required to obtain and transmit.

In the UK, the requirements for cryptoasset businesses to collect, verify and share transfer information took effect on 1 September 2023. The FCA also makes clear that using a third-party supplier leaves the firm's compliance responsibility in place. Requirements and implementation differ across jurisdictions. FCA Travel Rule expectations, updated February 2026.

Bringing the evidence into an investment decision

For the illustrative investor, a useful assessment would reconcile the subscription payment with exchange records, connect relevant wallets to the investor where evidence permits, examine material transaction concerns and test the stated source of wealth. Any gap should lead to a specific follow-up request, rather than an assumption that the whole explanation is either verified or discredited.

Record the chain, addresses, analysis date, provider coverage and unresolved limitations. Those details make later reassessment possible if new information changes an attribution or the investor's risk profile. This connects naturally to the firm's KYC periodic review process.

Steward's investment-services perspective starts with that complete customer record: identity, ownership, screening and the evidence supporting a compliance decision. Where specialist blockchain analysis is relevant, its findings need to be assessed alongside that record, with a clear account of what they establish and what remains unresolved.