The language of digital asset compliance, decoded plainly.

Address poisoning is a crypto scam in which an attacker sends a tiny transfer or fake token from an address crafted to resemble one the victim already uses. The goal is to pollute wallet history so the victim later copies the wrong truncated address and sends funds to the attacker.

Adverse media is public negative information about a person, company, wallet operator, or counterparty, including credible news, enforcement actions, litigation, or fraud allegations. Compliance teams use it during onboarding and monitoring to identify risk that may not appear on sanctions, PEP, or blockchain attribution lists.

AML, or anti-money laundering, is the set of laws, controls, and operating procedures used to prevent, detect, and report attempts to disguise criminal proceeds as legitimate funds. In digital assets, AML programs typically combine customer diligence, sanctions screening, transaction monitoring, investigation workflows, and suspicious activity reporting.

Attribution is the process of linking a blockchain address, cluster, transaction pattern, or service to a real-world entity or activity category. It can rely on public labels, proprietary research, heuristics, external intelligence, and observed behavior, and it is the evidence layer behind many sanctions, fraud, and risk-scoring decisions.

Beneficial owner means the natural person who ultimately owns, controls, or benefits from a legal entity or arrangement, even when ownership is held through nominees or other entities. Identifying beneficial owners helps AML programs understand who controls a customer and assess sanctions, corruption, fraud, or other financial-crime exposure.

Blockchain analytics is the practice of collecting, organizing, labeling, and analyzing public blockchain data to understand transactions, entities, risk exposure, and asset flows. It combines node data, indexing, heuristics, attribution research, and external intelligence so compliance, investigation, and risk teams can interpret activity that would otherwise be raw ledger records.

A bridge is a protocol or service that moves value or messages between blockchains, often by locking, minting, burning, or releasing assets across networks. Bridges can complicate tracing because risk may originate on one chain, pass through bridge contracts, and reappear as a wrapped or native asset elsewhere.

CASP means crypto-asset service provider, the MiCA term for a legal person or undertaking that provides one or more crypto-asset services to clients on a professional basis and is allowed to do so under MiCA. CASPs can include trading platforms, custodians, exchange services, and other regulated crypto-service businesses in the EU.

CDD, or customer due diligence, is the baseline process for identifying a customer, understanding the purpose of the relationship, and assessing financial-crime risk before and during service. It usually includes identity verification, beneficial ownership checks for legal entities, sanctions and PEP screening, customer risk rating, and ongoing monitoring.

A cluster is a group of blockchain addresses inferred or known to be controlled by the same actor, service, wallet, or entity. Clustering can use heuristics such as co-spending, change-address behavior, deposit patterns, smart-contract interactions, and research evidence, but strong programs track confidence and avoid treating every inference as certain.

A counterparty is the other side of a transaction or relationship. In crypto compliance, it may be a wallet address, exchange account, smart contract, merchant, customer, or known entity that sends, receives, holds, or controls value in a transfer. Screening counterparties helps assess whether activity touches prohibited or higher-risk actors.

A custodian is an entity that holds digital assets or controls private keys on behalf of clients. Crypto custodians may offer safekeeping, settlement, governance, staking, or reporting services, and their regulatory obligations depend on jurisdiction, client type, asset type, and whether they also provide exchange, brokerage, payments, or other financial services.

DeFi, or decentralized finance, refers to financial applications that run through smart contracts rather than a traditional intermediary. DeFi protocols can support trading, lending, borrowing, derivatives, asset management, and yield strategies, but compliance analysis still has to evaluate administrators, front ends, liquidity pools, governance, counterparties, and the movement of funds.

EDD, or enhanced due diligence, is additional review applied when a customer, counterparty, geography, product, transaction, or ownership structure presents higher financial-crime risk. It can include deeper identity verification, source-of-funds and source-of-wealth checks, adverse media review, senior approval, tighter limits, and more frequent ongoing monitoring.

Exposure describes how closely an address, customer, or transaction is connected to a risk source. Direct exposure usually means funds moved to or from the risk source itself. Indirect exposure means the connection passes through one or more intermediate addresses, services, pools, bridges, or hops before reaching the reviewed activity.

False positive rate is the share of alerts, matches, or risk flags that prove not to be true issues after review. In compliance operations, a high false positive rate can drain analyst time and create customer friction, but lowering it must not come at the cost of missing real suspicious or sanctioned activity.

FATF, the Financial Action Task Force, is the intergovernmental standard-setter for anti-money laundering, counter-terrorist financing, and counter-proliferation financing controls. Its Recommendations are not statutes by themselves, but countries use them to build laws, supervisory expectations, and guidance for financial institutions, VASPs, and other covered businesses.

FinCEN is the Financial Crimes Enforcement Network, a bureau of the U.S. Treasury that administers and enforces the Bank Secrecy Act. It receives and analyzes reports such as SARs and CTRs, issues rules and guidance, supports law enforcement, and supervises covered financial institutions including money services businesses.

Freeze authority is the power, usually built into a token contract or platform control system, to prevent specified assets from moving. Stablecoin and token issuers may use freeze, block, or reject controls to comply with lawful orders, sanctions obligations, or program rules, but the authority depends on contract design and applicable law.

The GENIUS Act is the U.S. federal framework for payment stablecoins enacted to govern permitted payment stablecoin issuers, reserves, supervision, and related risk controls. For compliance teams, its importance is that PPSIs are treated as financial institutions for Bank Secrecy Act purposes and are subject to AML, sanctions, customer identification, and due diligence obligations.

A heuristic is a rule of thumb used to infer meaning from blockchain behavior when direct identity evidence is unavailable. Examples include common-input ownership, change-address detection, peel-chain patterns, or repeated deposit behavior. Heuristics can be useful, but they should be paired with confidence levels and reviewed against contrary evidence.

IVMS101, or InterVASP Messaging Standard 101, is a data model for exchanging originator and beneficiary information between virtual asset service providers. It supports Travel Rule compliance by standardizing fields such as names, account identifiers, addresses, and customer information, but it is a messaging standard rather than a legal rule.

KYB, or know your business, is the due diligence process for legal-entity customers. It verifies the company, its registration and operating status, beneficial owners, directors or control persons, business activity, and risk profile. KYB helps institutions understand who controls an entity and whether the relationship creates AML or sanctions exposure.

KYC, or know your customer, is the process of identifying and verifying a customer before and during a financial relationship. It usually includes identity evidence, sanctions and PEP screening, customer risk rating, and ongoing updates. KYC establishes who the customer is; KYT and transaction monitoring evaluate what they do.

KYT, or know your transaction, is the process of screening and monitoring transactions to understand source, destination, behavior, and risk indicators. In crypto, KYT often includes wallet and counterparty screening, exposure analysis, typology detection, sanctions checks, and alerts for activity that may require investigation or reporting.

Lazarus Group is a North Korean state-sponsored cyber threat actor associated by governments and investigators with cyber intrusions, crypto theft, and laundering activity. In crypto compliance, references to Lazarus usually involve sanctions exposure, stolen funds tracing, cross-chain movement, mixers, bridges, and attempts to cash out through services.

MiCA, the Markets in Crypto-Assets Regulation, is the EU framework for crypto-asset issuers and crypto-asset service providers where existing financial-services law does not already apply. It covers authorization, supervision, disclosure, conduct, market abuse, and specific rules for asset-referenced tokens, e-money tokens, and CASPs.

A mixer or tumbler is a service, protocol, or wallet feature that combines funds from multiple users and redistributes them to make tracing harder. Some mixers are privacy tools, while others are used in laundering typologies; compliance analysis focuses on exposure, intent indicators, sanctions status, and surrounding transaction behavior.

MSB means money services business, a U.S. Bank Secrecy Act category administered by FinCEN. It includes activities such as money transmission, currency dealing or exchange, check cashing, and issuing or selling money orders or travelers checks. Crypto businesses may be MSBs when they accept and transmit value.

OFAC is the U.S. Treasury Office of Foreign Assets Control, which administers and enforces U.S. economic and trade sanctions. For digital assets, OFAC can identify sanctioned persons, entities, and associated wallet addresses on the SDN List, but listed addresses may not be exhaustive.

A peel chain is a transaction pattern in which a large balance is repeatedly split, with small amounts peeled off to new destinations while the remainder moves to a change-like address. Investigators use the pattern to follow laundering, cash-out, or operational flows, but it should be interpreted with context.

PEP means politically exposed person: someone entrusted with a prominent public function, as well as certain family members or close associates depending on the rule set. PEP status is not evidence of wrongdoing; it signals higher corruption, bribery, or misuse-of-office risk that usually requires enhanced due diligence.

Pig butchering is a long-con investment scam in which criminals build trust through messaging, dating, social media, or wrong-number contact before steering the victim into a fake crypto or investment platform. Victims are encouraged to deposit more over time, then withdrawals are blocked and funds are stolen.

PPSI means permitted payment stablecoin issuer under the U.S. GENIUS Act framework. A PPSI is authorized to issue payment stablecoins and is treated as a financial institution for Bank Secrecy Act purposes, bringing AML, sanctions, customer identification, due diligence, recordkeeping, monitoring, and suspicious-activity reporting expectations into the issuer program.

Proof of reserves is a crypto transparency practice meant to show that an exchange, custodian, or issuer controls assets that support customer balances or issued tokens. It can use attestations, wallet disclosures, Merkle proofs, or other procedures, but it is not automatically equivalent to a financial statement audit or proof of solvency.

Provenance is the history of where an asset came from and how it moved before reaching its current holder. In blockchain analysis, provenance can include transaction paths, prior owners or clusters, service touchpoints, bridge movements, and links to illicit, sanctioned, stolen, or otherwise relevant sources.

Risk scoring is the process of assigning a risk level to an address, transaction, entity, or customer based on evidence and policy rules. Good scores are explainable: analysts should be able to see the labels, exposure, typologies, thresholds, and confidence behind the result rather than only a black-box number.

Sanctions screening is the process of checking customers, counterparties, wallet addresses, entities, and transactions against sanctions lists and related ownership or control rules. In crypto, it includes direct list matches and often address exposure analysis, because sanctioned actors may use new addresses, intermediaries, mixers, or services.

SAR means suspicious activity report, a confidential filing that certain U.S. financial institutions submit to FinCEN when they detect activity that may involve money laundering, fraud, sanctions evasion, or other reportable suspicious conduct. Outside the United States, similar reports are often called suspicious transaction reports, or STRs.

Source of funds means the origin of the specific money or assets used in a transaction, deposit, investment, or transfer. It asks where these funds came from, such as salary, sale proceeds, loan funds, trading activity, mining revenue, or wallet history, and is distinct from broader source-of-wealth analysis.

Source of wealth means how a person or entity accumulated overall wealth over time, not just the origin of one transaction. It can include business ownership, inheritance, employment income, investments, asset sales, or other lawful activity, and is commonly reviewed in enhanced due diligence for higher-risk customers.

SR 11-7 is U.S. banking supervisory guidance on model risk management issued by the Federal Reserve and OCC in 2011. It expects banks to manage model risk through governance, inventory, validation, performance monitoring, controls, and documentation. It is often relevant when automated analytics or AI influence risk decisions.

A stablecoin is a digital asset designed to maintain a stable value relative to a reference asset, commonly a fiat currency such as the U.S. dollar. Designs vary: some are backed by reserves, some use crypto collateral, and some use algorithmic mechanisms, so risk analysis depends on structure and issuer controls.

Transaction monitoring is the ongoing review of customer and counterparty activity to detect unusual, suspicious, prohibited, or policy-violating behavior after onboarding. In digital assets, it can combine blockchain analytics, rules, typology detection, sanctions and exposure signals, customer profiles, and case workflows for investigation and reporting.

The Travel Rule is the application of FATF Recommendation 16 and local implementing rules to qualifying transfers, requiring originator and beneficiary information to accompany or be exchanged around a payment or virtual-asset transfer. Thresholds, required fields, and technical messaging methods vary by jurisdiction.

VASP means virtual asset service provider, the FATF term for a person or business that conducts covered virtual-asset activities for or on behalf of another person. Covered activities include exchange, transfer, safekeeping or administration, and certain financial services related to issuing or selling virtual assets.