The language of digital asset compliance, decoded plainly.

An address label is a tag attached to a blockchain address that records what is known about it, such as the entity that controls it, the service type, or a risk category like sanctioned, scam, or hack. Labels come from public lists, research, investigations, and partner data, and they are the starting point for attribution and risk screening.

Address poisoning is a crypto scam in which an attacker sends a tiny transfer or fake token from an address crafted to resemble one the victim already uses. The goal is to pollute wallet history so the victim later copies the wrong truncated address and sends funds to the attacker.

Adverse media is public negative information about a person, company, wallet operator, or counterparty, including credible news, enforcement actions, litigation, or fraud allegations. Compliance teams use it during onboarding and monitoring to identify risk that may not appear on sanctions, PEP, or blockchain attribution lists.

Alert triage is the first review of a compliance alert, the flag a screening or monitoring system raises when activity matches a rule or risk signal. The analyst decides whether the alert is a false positive to close, needs more investigation, or should be escalated toward a case, customer action, or suspicious activity report.

AML, or anti-money laundering, is the set of laws, controls, and operating procedures used to prevent, detect, and report attempts to disguise criminal proceeds as legitimate funds. In digital assets, AML programs typically combine customer diligence, sanctions screening, transaction monitoring, investigation workflows, and suspicious activity reporting.

AMLR is the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, which moves most AML rules from national transposition into a single rulebook applying directly across member states from July 2027. It covers crypto-asset service providers as obliged entities and sets common customer due diligence, beneficial ownership, and suspicious transaction reporting standards.

Attribution is the process of linking a blockchain address, cluster, transaction pattern, or service to a real-world entity or activity category. It can rely on public labels, proprietary research, heuristics, external intelligence, and observed behavior, and it is the evidence layer behind many sanctions, fraud, and risk-scoring decisions.

Beneficial owner means the natural person who ultimately owns, controls, or benefits from a legal entity or arrangement, even when ownership is held through nominees or other entities. Identifying beneficial owners helps AML programs understand who controls a customer and assess sanctions, corruption, fraud, or other financial-crime exposure.

Blockchain analytics is the practice of collecting, organizing, labeling, and analyzing public blockchain data to understand transactions, entities, risk exposure, and asset flows. It combines node data, indexing, heuristics, attribution research, and external intelligence so compliance, investigation, and risk teams can interpret activity that would otherwise be raw ledger records.

Blockchain forensics is the investigative use of blockchain data to reconstruct what happened in a specific case, such as a hack, scam, ransomware payment, or sanctions evasion. It goes beyond routine analytics by tracing funds step by step, attributing addresses to actors, and preparing evidence that can support asset recovery, law enforcement referrals, or court proceedings.

A bridge is a protocol or service that moves value or messages between blockchains, often by locking, minting, burning, or releasing assets across networks. Bridges can complicate tracing because risk may originate on one chain, pass through bridge contracts, and reappear as a wrapped or native asset elsewhere.

CASP means crypto-asset service provider, the MiCA term for a legal person or undertaking that provides one or more crypto-asset services to clients on a professional basis and is allowed to do so under MiCA. CASPs can include trading platforms, custodians, exchange services, and other regulated crypto-service businesses in the EU.

CDD, or customer due diligence, is the baseline process for identifying a customer, understanding the purpose of the relationship, and assessing financial-crime risk before and during service. It usually includes identity verification, beneficial ownership checks for legal entities, sanctions and PEP screening, customer risk rating, and ongoing monitoring.

Chain hopping is moving funds across several blockchains in quick succession, using bridges, cross-chain swaps, or exchanges, to break the trail investigators follow on a single ledger. It is a common layering technique for hack proceeds and ransomware payments, because each move to a new chain requires another data source to follow.

A cluster is a group of blockchain addresses inferred or known to be controlled by the same actor, service, wallet, or entity. Clustering can use heuristics such as co-spending, change-address behavior, deposit patterns, smart-contract interactions, and research evidence, but strong programs track confidence and avoid treating every inference as certain.

The co-spend heuristic, also called the common-input-ownership heuristic, assumes that all input addresses spent together in one Bitcoin-style transaction are controlled by the same owner, because signing requires each input's private key. It is the foundational technique for clustering addresses on UTXO blockchains into wallets and entities.

CoinJoin is a privacy technique for Bitcoin-style blockchains in which several users combine their inputs into one transaction and receive equal-sized outputs, so observers cannot easily tell which output belongs to which input. It is used by privacy-focused wallets and sometimes to launder proceeds, so compliance teams evaluate it in context.

A counterparty is the other side of a transaction or relationship. In crypto compliance, it may be a wallet address, exchange account, smart contract, merchant, customer, or known entity that sends, receives, holds, or controls value in a transfer. Screening counterparties helps assess whether activity touches prohibited or higher-risk actors.

A custodian is an entity that holds digital assets or controls private keys on behalf of clients. Crypto custodians may offer safekeeping, settlement, governance, staking, or reporting services, and their regulatory obligations depend on jurisdiction, client type, asset type, and whether they also provide exchange, brokerage, payments, or other financial services.

DeFi, or decentralized finance, refers to financial applications that run through smart contracts rather than a traditional intermediary. DeFi protocols can support trading, lending, borrowing, derivatives, asset management, and yield strategies, but compliance analysis still has to evaluate administrators, front ends, liquidity pools, governance, counterparties, and the movement of funds.

EDD, or enhanced due diligence, is additional review applied when a customer, counterparty, geography, product, transaction, or ownership structure presents higher financial-crime risk. It can include deeper identity verification, source-of-funds and source-of-wealth checks, adverse media review, senior approval, tighter limits, and more frequent ongoing monitoring.

In blockchain analytics, an entity is the real-world organization, service, or actor behind one or more addresses, such as an exchange, payment processor, mixer, or scam operation. Analysts attribute addresses to entities so that activity can be understood and screened at the level of who controls the funds, not one address at a time.

Entity exposure is the most value that could have moved between a reviewed address and one specific entity, such as an exchange or scam network, across every path connecting them. Each transfer counts once, even when several paths share it or the same funds appear under several risk categories, so overlapping evidence does not inflate the amount.

Exposure describes how closely an address, customer, or transaction is connected to a risk source, measured separately for funds sent and received. In CipherOwl results, direct risk means the address itself carries a risk label, at zero hops. Indirect exposure means it reached a risk source through transactions: one hop for a direct counterparty, more hops for each intermediary.

Exposure direction says which way funds moved relative to the reviewed address. Receive exposure covers value that arrived from a risk source, directly or through intermediaries, and signals that incoming funds may be tainted. Send exposure covers value sent toward a risk source, which can indicate payments to a sanctioned party, scam, or illicit service.

False positive rate is the share of alerts, matches, or risk flags that prove not to be true issues after review. In compliance operations, a high false positive rate can drain analyst time and create customer friction, but lowering it must not come at the cost of missing real suspicious or sanctioned activity.

FATF, the Financial Action Task Force, is the intergovernmental standard-setter for anti-money laundering, counter-terrorist financing, and counter-proliferation financing controls. Its Recommendations are not statutes by themselves, but countries use them to build laws, supervisory expectations, and guidance for financial institutions, VASPs, and other covered businesses.

The FCA, or Financial Conduct Authority, is the UK regulator that supervises cryptoasset exchange providers and custodian wallet providers for anti-money laundering compliance. Firms carrying on these activities in the UK must register with the FCA under the Money Laundering Regulations 2017 and meet requirements on due diligence, monitoring, and the UK Travel Rule.

FinCEN is the Financial Crimes Enforcement Network, a bureau of the U.S. Treasury that administers and enforces the Bank Secrecy Act. It receives and analyzes reports such as SARs and CTRs, issues rules and guidance, supports law enforcement, and supervises covered financial institutions including money services businesses.

Freeze authority is the power, usually built into a token contract or platform control system, to prevent specified assets from moving. Stablecoin and token issuers may use freeze, block, or reject controls to comply with lawful orders, sanctions obligations, or program rules, but the authority depends on contract design and applicable law.

Fund tracing follows specific funds from a source, such as a hacked wallet or scam deposit, through intermediate transactions to where they ended up. Unlike screening, which shows that an address is connected to a risk source, tracing respects transaction order and amounts to show which value actually moved, the evidence investigators need for recovery or court.

The GENIUS Act is the U.S. federal framework for payment stablecoins enacted to govern permitted payment stablecoin issuers, reserves, supervision, and related risk controls. For compliance teams, its importance is that PPSIs are treated as financial institutions for Bank Secrecy Act purposes and are subject to AML, sanctions, customer identification, and due diligence obligations.

A heuristic is a rule of thumb used to infer meaning from blockchain behavior when direct identity evidence is unavailable. Examples include common-input ownership, change-address detection, peel-chain patterns, or repeated deposit behavior. Heuristics can be useful, but they should be paired with confidence levels and reviewed against contrary evidence.

Hops count the transaction steps between a reviewed address and a risk source. Zero hops means the address itself carries the risk label, one hop means it transacted directly with the risk source, and each additional hop adds an intermediary address. Hop count is the simplest measure of how close an exposure is.

IVMS101, or InterVASP Messaging Standard 101, is a data model for exchanging originator and beneficiary information between virtual asset service providers. It supports Travel Rule compliance by standardizing fields such as names, account identifiers, addresses, and customer information, but it is a messaging standard rather than a legal rule.

The Japan FSA, or Financial Services Agency, regulates crypto-asset exchange service providers, which must register under the Payment Services Act before serving customers in Japan. Registered providers also carry AML obligations under the Act on Prevention of Transfer of Criminal Proceeds, including customer verification, suspicious transaction reporting, and the Travel Rule.

KYB, or know your business, is the due diligence process for legal-entity customers. It verifies the company, its registration and operating status, beneficial owners, directors or control persons, business activity, and risk profile. KYB helps institutions understand who controls an entity and whether the relationship creates AML or sanctions exposure.

KYC, or know your customer, is the process of identifying and verifying a customer before and during a financial relationship. It usually includes identity evidence, sanctions and PEP screening, customer risk rating, and ongoing updates. KYC establishes who the customer is; KYT and transaction monitoring evaluate what they do.

KYT, or know your transaction, is the process of screening and monitoring transactions to understand source, destination, behavior, and risk indicators. In crypto, KYT often includes wallet and counterparty screening, exposure analysis, typology detection, sanctions checks, and alerts for activity that may require investigation or reporting.

Layering is the stage of money laundering in which criminal proceeds are moved through a series of transactions to distance them from their source, after placement and before integration. In crypto, layering can use many hops, mixers, bridges, chain hopping, peel chains, and rapid swaps between assets to make the path harder to follow.

Lazarus Group is a North Korean state-sponsored cyber threat actor associated by governments and investigators with cyber intrusions, crypto theft, and laundering activity. In crypto compliance, references to Lazarus usually involve sanctions exposure, stolen funds tracing, cross-chain movement, mixers, bridges, and attempts to cash out through services.

MAS, the Monetary Authority of Singapore, is Singapore's central bank and financial regulator. It licenses digital payment token service providers under the Payment Services Act 2019 and sets their AML and counter-terrorist financing obligations in Notice PSN02, including customer due diligence, transaction monitoring, the Travel Rule, and suspicious transaction reporting.

MiCA, the Markets in Crypto-Assets Regulation, is the EU framework for crypto-asset issuers and crypto-asset service providers where existing financial-services law does not already apply. It covers authorization, supervision, disclosure, conduct, market abuse, and specific rules for asset-referenced tokens, e-money tokens, and CASPs.

A mixer or tumbler is a service, protocol, or wallet feature that combines funds from multiple users and redistributes them to make tracing harder. Some mixers are privacy tools, while others are used in laundering typologies; compliance analysis focuses on exposure, intent indicators, sanctions status, and surrounding transaction behavior.

MSB means money services business, a U.S. Bank Secrecy Act category administered by FinCEN. It includes activities such as money transmission, currency dealing or exchange, check cashing, and issuing or selling money orders or travelers checks. Crypto businesses may be MSBs when they accept and transmit value.

OFAC is the U.S. Treasury Office of Foreign Assets Control, which administers and enforces U.S. economic and trade sanctions. For digital assets, OFAC can identify sanctioned persons, entities, and associated wallet addresses on the SDN List, but listed addresses may not be exhaustive.

The OFAC 50 Percent Rule treats any entity owned 50 percent or more, directly or indirectly, by one or more sanctioned persons as blocked, even if the entity is not named on the SDN List itself. For crypto compliance, it means screening has to consider ownership and control, not just listed names and wallet addresses.

OFSI, the Office of Financial Sanctions Implementation, is the part of HM Treasury that implements and enforces UK financial sanctions, including for cryptoassets. Its July 2025 Cryptoassets Threat Assessment is one of the few official documents that explicitly defines direct and indirect exposure and sets a minimum hop depth for screening.

A peel chain is a transaction pattern in which a large balance is repeatedly split, with small amounts peeled off to new destinations while the remainder moves to a change-like address. Investigators use the pattern to follow laundering, cash-out, or operational flows, but it should be interpreted with context.

PEP means politically exposed person: someone entrusted with a prominent public function, as well as certain family members or close associates depending on the rule set. PEP status is not evidence of wrongdoing; it signals higher corruption, bribery, or misuse-of-office risk that usually requires enhanced due diligence.

Pig butchering is a long-con investment scam in which criminals build trust through messaging, dating, social media, or wrong-number contact before steering the victim into a fake crypto or investment platform. Victims are encouraged to deposit more over time, then withdrawals are blocked and funds are stolen.

PPSI means permitted payment stablecoin issuer under the U.S. GENIUS Act framework. A PPSI is authorized to issue payment stablecoins and is treated as a financial institution for Bank Secrecy Act purposes, bringing AML, sanctions, customer identification, due diligence, recordkeeping, monitoring, and suspicious-activity reporting expectations into the issuer program.

Proof of reserves is a crypto transparency practice meant to show that an exchange, custodian, or issuer controls assets that support customer balances or issued tokens. It can use attestations, wallet disclosures, Merkle proofs, or other procedures, but it is not automatically equivalent to a financial statement audit or proof of solvency.

Provenance is the history of where an asset came from and how it moved before reaching its current holder. In blockchain analysis, provenance can include transaction paths, prior owners or clusters, service touchpoints, bridge movements, and links to illicit, sanctioned, stolen, or otherwise relevant sources.

Risk propagation, often called taint analysis, is how risk spreads from a labeled risk source to other addresses through the transaction graph. When a risky address sends a meaningful amount to another address, that address inherits indirect exposure, which can pass on again, hop by hop, until policy limits on amount or distance stop it.

Risk scoring is the process of assigning a risk level to an address, transaction, entity, or customer based on evidence and policy rules. Good scores are explainable: analysts should be able to see the labels, exposure, typologies, thresholds, and confidence behind the result rather than only a black-box number.

A risk source is an address or entity that is risky in its own right, such as a sanctioned party, darknet market, ransomware operator, scam network, or wallet holding stolen funds. Exposure is measured from risk sources: they carry direct risk through their labels, and other addresses gain indirect exposure by transacting with them or their intermediaries.

A risk taxonomy is the structured list of risk categories a screening program uses to classify addresses and activity, such as sanctions, scams, ransomware, darknet markets, hacks, and gambling. A detailed taxonomy lets compliance teams set different policies per category and explain exactly which kind of risk triggered a result.

Sanctions screening is the process of checking customers, counterparties, wallet addresses, entities, and transactions against sanctions lists and related ownership or control rules. In crypto, it includes direct list matches and often address exposure analysis, because sanctioned actors may use new addresses, intermediaries, mixers, or services.

SAR means suspicious activity report, a confidential filing that certain U.S. financial institutions submit to FinCEN when they detect activity that may involve money laundering, fraud, sanctions evasion, or other reportable suspicious conduct. Outside the United States, similar reports are often called suspicious transaction reports, or STRs.

The SDN List, or Specially Designated Nationals and Blocked Persons List, is OFAC's public list of individuals, companies, and other parties whose property is blocked under U.S. sanctions. It is unusual among sanctions lists in publishing cryptocurrency wallet addresses for some designated parties, in machine-readable formats that screening systems can load directly.

The SFC, or Securities and Futures Commission, licenses and supervises virtual asset trading platforms in Hong Kong under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Its AML guideline for licensed virtual asset service providers, in force since 1 June 2023, sets requirements for due diligence, wallet screening, Travel Rule compliance, and suspicious transaction reporting.

Source of funds means the origin of the specific money or assets used in a transaction, deposit, investment, or transfer. It asks where these funds came from, such as salary, sale proceeds, loan funds, trading activity, mining revenue, or wallet history, and is distinct from broader source-of-wealth analysis.

Source of wealth means how a person or entity accumulated overall wealth over time, not just the origin of one transaction. It can include business ownership, inheritance, employment income, investments, asset sales, or other lawful activity, and is commonly reviewed in enhanced due diligence for higher-risk customers.

SR 11-7 is U.S. banking supervisory guidance on model risk management issued by the Federal Reserve and OCC in 2011. It expects banks to manage model risk through governance, inventory, validation, performance monitoring, controls, and documentation. It is often relevant when automated analytics or AI influence risk decisions.

A stablecoin is a digital asset designed to maintain a stable value relative to a reference asset, commonly a fiat currency such as the U.S. dollar. Designs vary: some are backed by reserves, some use crypto collateral, and some use algorithmic mechanisms, so risk analysis depends on structure and issuer controls.

TFR is the EU Transfer of Funds Regulation, Regulation (EU) 2023/1113, which applies the Travel Rule to crypto-asset transfers. Since 30 December 2024, crypto-asset service providers must send originator and beneficiary information with every transfer, with no minimum amount, and verify ownership of self-hosted addresses for transfers above EUR 1,000.

Transaction monitoring is the ongoing review of customer and counterparty activity to detect unusual, suspicious, prohibited, or policy-violating behavior after onboarding. In digital assets, it can combine blockchain analytics, rules, typology detection, sanctions and exposure signals, customer profiles, and case workflows for investigation and reporting.

The Travel Rule is the application of FATF Recommendation 16 and local implementing rules to qualifying transfers, requiring originator and beneficiary information to accompany or be exchanged around a payment or virtual-asset transfer. Thresholds, required fields, and technical messaging methods vary by jurisdiction.

A typology is a recognized pattern of financial crime that describes how a particular scheme moves or disguises funds, such as pig butchering, peel chains, address poisoning, or laundering through mixers. Regulators and investigators publish typologies so that monitoring rules, risk scoring, and analyst reviews can look for behavior, not only for known bad addresses.

An unhosted wallet, also called a self-hosted or non-custodial wallet, is a crypto wallet whose private keys are held by the user rather than by an exchange or other regulated service provider. Because no intermediary performs customer checks on it, transfers to or from unhosted wallets are a common trigger for extra due diligence.

UTXO stands for unspent transaction output, the unit of value that Bitcoin and similar blockchains use instead of account balances. Each transaction consumes earlier outputs as inputs and creates new outputs, often including change back to the sender, and an address's balance is simply the sum of its unspent outputs.

VARA, the Virtual Assets Regulatory Authority, is Dubai's dedicated regulator for virtual asset activities, established in 2022. It licenses and supervises virtual asset service providers across Dubai outside the DIFC financial free zone, and its rulebooks set AML, sanctions screening, and Travel Rule obligations alongside UAE federal anti-money laundering law.

VASP means virtual asset service provider, the FATF term for a person or business that conducts covered virtual-asset activities for or on behalf of another person. Covered activities include exchange, transfer, safekeeping or administration, and certain financial services related to issuing or selling virtual assets.