Wallet Audit

A crypto wallet audit is a structured compliance review of a blockchain address's on-chain transaction history. Using blockchain analytics tools, it traces fund flows to known entity clusters — exchanges, mixers, darknet markets, ransomware wallets, and OFAC-sanctioned addresses — and returns a risk score with a category breakdown.

VASPs use wallet audits to fulfil transaction monitoring obligations under FATF Recommendation 15. Individuals use them to understand the risk profile of funds they are about to receive or have already received. The output guides compliance decisions: proceed with standard monitoring, apply enhanced due diligence, or block the transaction and file a suspicious activity report.

An automated wallet audit via API returns results in under two seconds for most standard addresses. Manual dashboard audits take 2–5 minutes per address, including reading the category breakdown. Complex forensic audits — tracing fund flows across multiple hops, chains, and entity types — can take hours to days for trained analysts.

For VASP compliance purposes, real-time API integration is the practical standard. Manual checks cannot scale to hundreds or thousands of transactions per day without creating systematic coverage gaps and audit trail weaknesses.

Risk scores are vendor-specific probability-weighted indicators of exposure to illicit activity — not verdicts of guilt. Scores are not standardised across providers: a 55/100 on Chainalysis is not comparable to a 55/100 on TRM Labs.

What matters is the category breakdown behind the score. A wallet scoring 70 due to indirect P2P exposure at four hops requires a very different response from a wallet scoring 70 due to direct mixer interaction. Always read the category breakdown first. The score is a summary; the breakdown is the actionable information.

No — they are complementary but distinct. KYC (Know Your Customer) verifies the identity of the person behind a wallet: collecting documents, matching them to a human or legal entity, and screening against sanctions lists at the identity level. A wallet audit assesses the on-chain transaction history of the address itself — regardless of who controls it.

A verified KYC customer can still transact through mixers or receive ransomware proceeds. A wallet audit catches those fund-flow risks. Effective compliance programmes run both: KYC at onboarding to establish identity, ongoing wallet audits at the transaction level to monitor fund-flow risk throughout the relationship.

First, request the specific exposure category in writing. Ask whether it is sanctions, mixer, darknet, or another category — and at what hop distance. "Compliance system" alone is not an adequate explanation from a regulated entity.

Second, gather source-of-funds documentation relevant to the category flagged: exchange withdrawal records, bank statements, or OTC desk receipts. Third, run the address through a second analytics tool to verify whether the flag appears credible. If outputs diverge significantly between vendors, submit a formal dispute with your evidence. Most exchanges clear legitimate false positives within 5–10 business days when clear documentation is provided.

Yes — false positives are an inherent feature of probabilistic heuristic clustering. Common scenarios: CoinJoin users whose privacy technique superficially resembles mixer activity; users withdrawing from large exchange hot wallets shared across thousands of customers (any illicit depositor to that exchange contributes indirect exposure to all withdrawers); and addresses in clusters that have been recently re-attributed to a newly-identified illicit entity without any change to the user's own on-chain activity.

This is why human analyst review before adverse action — not automated blocking on all medium scores — is the expected compliance standard. Tracking and reducing your false positive rate quarterly is a marker of a mature wallet audit programme.

For transactional relationships: audit in real time at every deposit and withdrawal. A wallet clean today can interact with a sanctioned entity tomorrow — onboarding-only audits miss all post-signup activity.

For existing user wallets: periodic batch re-auditing is standard — quarterly minimum for standard-risk users, more frequently for high-value accounts. Analytics providers update entity databases continuously; a previously-neutral address can be re-attributed to a newly-identified illicit cluster without any new on-chain activity from the user. Documenting each re-audit run demonstrates the ongoing monitoring obligation required by FATF Recommendation 15.

Match the tool to your primary blockchain exposure, transaction volume, and integration needs. Chainalysis KYT is the market leader for large exchanges needing forensic quality and regulatory defensibility. Elliptic Navigator is stronger for DeFi and cross-chain protocols. TRM Labs covers 30+ chains at competitive pricing, making it a good fit for mid-market VASPs with diverse asset mixes. Crystal Blockchain is well-suited for Bitcoin-focused European VASPs with EU compliance reporting requirements.

Before committing, run a test batch through your shortlisted vendors and compare the category breakdowns on addresses with known profiles. Vendors who publish detailed methodology documentation tend to produce more defensible outputs in regulatory and legal contexts.

No — the type of wallet (hardware, software, custodial, or self-custody) has no effect on audit results. Risk scores are based entirely on on-chain transaction history. What wallet software you use to sign transactions is invisible to the blockchain; only the addresses and fund flows are visible.

What custody type does affect is regulatory treatment of the transfer itself. Transactions to or from unhosted (self-custody) wallets trigger additional obligations in many jurisdictions — VASPs typically must collect proof the customer controls the unhosted wallet and apply enhanced due diligence above the Travel Rule threshold. This is a parallel obligation to the wallet audit, not a replacement for it.