Onchain compliance terms

Address

A destination funds can be sent to. Anyone can create one for free, and nothing about it identifies a person.

Private key

The secret that authorises spending from an address. Whoever holds it controls the funds, which is why control and ownership are not the same question.

Wallet

Software that manages private keys. One wallet usually sits behind many addresses, so a customer with one wallet may appear on the chain as hundreds.

Transfer

Value moving from one address to another. The industry also says transaction, which on some chains means a single signed operation that can contain several transfers.

Counterparty

The other side of a transfer. In an investigation it usually means the service or entity attributed to the address at that end.

Attribution

A label saying who an address belongs to. Always an inference somebody made and published, with a date and a strength behind it.

Cluster

A group of addresses an analytics firm believes share one owner, inferred from spending behaviour. Two firms will draw different boundaries around the same funds.

Exposure

How much of the value reaching an address can be traced back to a category of concern, and how many steps away it sits. Direct exposure is a transfer from the source. Indirect exposure has passed through something else first.

Custody and keys

Public key

The half of a key pair that can be shared. An address is derived from it. Knowing it lets you send funds to someone and never lets you spend theirs.

Self-custody

The customer holds their own keys. Also called unhosted. Nobody else can freeze or reverse a transfer, which is why a declared self-custody wallet behaves differently from a declared exchange account in an investigation.

Cold storage

Keys kept offline, usually on dedicated hardware. Relevant to an investigation mainly as an explanation for long dormancy followed by sudden movement.

Smart contract

Code holding funds and releasing them under rules fixed in advance. There may be no person able to move them, which matters when you are trying to establish who controls an address.

KYC

Know your customer. Establishing who a person or business is, and keeping that current. Its subject is the customer.

KYT

Know your transaction. Screening onchain activity for exposure to categories of concern. Its subject is an address. Nothing connects it to KYC until a customer declares a wallet.

Sanctions screening

Checking a name or an address against published sanctions lists. A screen that no list answered is unavailable, which is a different finding from clean.

PEP

Politically exposed person. Someone holding or close to a prominent public function. A PEP match is a reason for closer scrutiny rather than a finding of wrongdoing.

False positive

An alert that turns out to have an innocent explanation. Most alerts are false positives, and closing one correctly still means recording why.

Typology

A recognised pattern of financial crime, described well enough to be matched against a case. Structuring and layering are typologies.

Structuring

Breaking an amount into smaller pieces to stay under a reporting threshold. The pattern is the deliberate avoidance, not the size of any single transfer.

Layering

Moving funds through a chain of hops to obscure where they came from. Onchain this often looks like rapid movement with no economic purpose.

Mixer

A service that pools funds from many users and pays out so the link between deposit and withdrawal is broken. Some are sanctioned. Privacy is a legitimate reason to use one, which is why mixer exposure on its own settles nothing.

Mule

An account used to move someone else's proceeds, sometimes knowingly and sometimes not. The account holder is often a victim as well.

Services and instruments

Stablecoin

A token designed to hold a fixed value against a currency, usually the US dollar. The dominant instrument in onchain payments, and the reason volume can be large without price volatility explaining it.

DeFi

Decentralised finance. Lending, trading and yield products run by smart contracts rather than by a company. Usually no customer records exist to request, because there is nobody holding them.

DEX

A decentralised exchange. Swaps happen through a contract, so there is no account and no counterparty to identify beyond the addresses involved.

Privacy coin

An asset whose chain conceals amounts, parties or both by design. Tracing works differently or not at all, so exposure analysis that assumes a transparent ledger does not apply.

Bridge

A service moving value between chains. Funds entering one side and leaving the other break a single-chain trace, and reconstructing the link is a separate piece of work.

Blockchain analytics

The firms producing attribution, clustering and exposure data, and the practice itself. Their output is evidence, with a date and a method behind it.

VASP

Virtual asset service provider. The regulatory term for a business that exchanges, transfers or holds virtual assets for others.

MLRO

Money laundering reporting officer. The named individual accountable for the firm's reporting, personally liable in most regimes. Nothing reaches a regulator without them.

UMR

Unusual matter report. An internal escalation raised when something does not look right, before anyone has decided whether it is reportable. Stays inside the firm.

SMR

Suspicious matter report. The filing made to the regulator once suspicion is formed. In other jurisdictions the same thing is called a SAR, a suspicious activity report.

Travel Rule

The requirement to send identifying information about the sender and recipient alongside a transfer above a threshold. Named after the older rule it extends to virtual assets.

SOP

Standard operating procedure. The firm's written instructions for how a given situation is handled. What makes two analysts reach the same decision on the same facts.

Bodies and frameworks

FATF

The Financial Action Task Force. Sets the international AML standards that national regimes implement, including the recommendations that define a VASP and extend the Travel Rule to virtual assets.

AUSTRAC

Australia's AML/CTF regulator and financial intelligence unit. Reporting entities enrol with it, report to it and are supervised by it.

FinCEN

The equivalent United States bureau. Its reports are SARs rather than SMRs, which is the main reason both acronyms circulate in the same conversation.

Enhanced due diligence

The deeper checks applied where risk is higher, including after a report has been made about a customer you continue to serve. What it involves is set by your own programme.

Tipping off

Telling a customer, or letting them infer, that they have been reported or are under suspicion. A separate offence in most regimes, and the reason there are questions you cannot ask once suspicion has formed.