AI for Cryptocurrency and Digital Assets
Crypto spent a decade as a compliance-light sector and stopped being one. MiCA's transitional periods have closed, licensing is real, and the engineering that matters now is the compliance infrastructure rather than the trading edge.
The interesting technical property of this sector is that the transaction ledger is public, which makes analytics unusually powerful and attribution unusually hard. Everything is visible and almost nothing is identified.
AI for cryptocurrency and digital asset businesses covers blockchain transaction monitoring and clustering, sanctions and illicit finance screening, market surveillance and manipulation detection, KYC and onboarding automation, and the compliance evidence required under MiCA and equivalent regimes.
The compliance regime that arrived
MiCA entered into force in June 2023, stablecoin provisions applied from June 2024, the CASP authorisation regime from December 2024, and the final national transitional periods closed on 1 July 2026. Nineteen e-money token issuers were authorised across eleven member states by early 2026, and no asset-referenced token issuers at all — an authorisation gap that tells you how demanding the regime is in practice.
| Obligation | What it requires | Engineering implication |
|---|---|---|
| AML and travel rule | CDD, monitoring, originator and beneficiary data on transfers | Chain analytics plus identity linkage. The core system. |
| Market abuse surveillance | Real-time monitoring, alerts, periodic reporting | Order book surveillance built for thin, manipulable markets. |
| Custody and segregation | Client assets segregated, reconciled, liability on loss | Reconciliation and proof-of-reserves engineering. |
| Operational resilience | DORA — ICT risk, incident reporting, third-party register | Model providers are third-party ICT dependencies. |
| Governance | Risk framework, conflicts, complaints, outsourcing | Documentation and audit trail rather than modelling. |
| Dual licensing | EMT transfers may require separate payment authorisation | A structural question, not a technical one. |
The travel rule is the hardest engineering problem here
Transmitting originator and beneficiary information alongside transfers requires linking pseudonymous on-chain addresses to identified customers, exchanging that data with counterparty institutions that may use incompatible protocols, and handling transfers to self-hosted wallets where no counterparty exists. It is genuinely difficult, it is not optional, and it is where most crypto compliance programmes actually struggle rather than in monitoring.
Chain analytics, and the attribution problem
Every transaction is visible forever, which is a analyst's dream and a compliance officer's difficulty: visibility is not identity. Clustering addresses into entities and attributing entities to real parties is probabilistic, and treating a probabilistic attribution as a fact is how firms make expensive mistakes.
Clustering heuristics are heuristics
Common-input ownership, change address detection and behavioural fingerprinting are inferences with error rates, and those error rates vary by chain and by wallet software. Every attribution should carry a confidence, and downstream decisions should respect it.
Distance from an illicit source is not guilt
Funds several hops from a sanctioned address may have passed through exchanges, mixers and market makers. Hop-count thresholds are crude and generate both over-blocking and under-detection. Model the path and its plausibility rather than counting steps.
Vendor attribution data is a dependency to manage
Most firms rely on commercial attribution data. You remain accountable for decisions made on it, so understand its methodology, its error characteristics and its update cadence — and be able to explain a decision that rested on it.
Privacy tooling is not evidence of wrongdoing
Treating every privacy-preserving transaction as suspicious generates volume without signal and creates fair-treatment problems. The behavioural pattern matters more than the tool used.
Market surveillance in thin markets
- Manipulation is easier and more visible here. Thin order books, fragmented venues and twenty-four-hour trading make wash trading, spoofing and layering both more feasible and more detectable.
- Cross-venue is where the signal is. Manipulation frequently spans venues, and single-venue surveillance misses most of it by construction.
- On-chain and off-chain must be joined. Deposits and withdrawals around suspicious trading are the corroboration that turns an alert into a case.
- Wash trading distorts your own metrics. Beyond the regulatory obligation, undetected wash trading corrupts every volume-based figure you report.
- Social signal is a real input. Coordinated promotion preceding price movement is a detectable pattern, with obvious care needed about false positives.
Where we are honest about our depth
This is a tier three vertical for us. We have strong general capability in transaction monitoring, graph analytics and surveillance — the underlying engineering is not crypto-specific — and we have less crypto-native operational experience than a specialist chain analytics firm. For the compliance systems engineering we are a good fit; for deep attribution methodology you should also be talking to specialists, and we will say so rather than stretch.
How an engagement runs
Compliance systems first, because that is where the regulatory deadline and the operational risk both are.
Regulatory scope and gap assessment
Which regime applies, what your authorisation requires, and what evidence you currently cannot produce.
Data foundation
On-chain, order book, customer and fiat rail data joined, with attribution confidence carried through rather than discarded.
Build
Transaction monitoring, screening or surveillance, with explanations and confidence surfaced to investigators.
Shadow running and calibration
Against current alerting, tuned to investigative capacity, with recall measured on known cases.
Deployment and evidence
Monitoring, audit trail, third-party register entries and the reporting your authorisation requires.
What you receive
Compliance systems that satisfy a licensing regime, built on data that is honest about uncertainty.
Regulatory gap assessment
What your authorisation requires versus what you can currently evidence.
Transaction monitoring
On-chain and off-chain joined, with attribution confidence carried into every decision.
Screening and travel rule support
Sanctions and illicit finance screening, with counterparty data exchange handled.
Market surveillance
Cross-venue manipulation detection built for thin, fragmented markets.
Explainable alerts
Reasons and confidence an investigator can write into a case file.
Audit trail and reporting
Evidence in the form your regulator and your auditors expect.
Is this the right starting point?
Worth being direct. There are situations in crypto and digital assets where custom AI work is the wrong spend, and those are listed rather than buried.
Worth doing if
- You are authorised or seeking authorisation and your compliance systems are manual.
- Transaction monitoring generates alerts nobody can investigate properly.
- Travel rule compliance is partially implemented and you know where the gaps are.
- Market surveillance is single-venue and manipulation spans venues.
- Onboarding throughput is limiting growth and KYC is manual.
Do something else if
- You want trading alpha. See our position on that under capital markets.
- You want to minimise compliance rather than satisfy it. That is not an engagement we take.
- You need deep attribution methodology. Specialists will serve you better and we will say so.
- The business model depends on a regulatory position that has now closed.
Frequently asked questions
Marked up with FAQPage schema so these answers can surface directly in search results and inside AI assistant responses.
What does MiCA actually require of us now?
Authorisation as a crypto-asset service provider with capital, governance, custody segregation, AML and travel rule compliance, market abuse surveillance, complaints handling and DORA operational resilience. The final national transitional periods closed on 1 July 2026, so the grandfathering routes are gone. The authorisation gap is instructive — nineteen e-money token issuers authorised by early 2026 and no asset-referenced token issuers at all.
Why is the travel rule so hard?
Because it requires linking pseudonymous addresses to identified customers, exchanging that data with counterparty institutions using potentially incompatible protocols, and handling transfers to self-hosted wallets where no counterparty exists to exchange with. It is genuinely difficult engineering rather than a configuration exercise, and it is where crypto compliance programmes most often fall short — more often than in monitoring, which gets more attention.
How reliable is address attribution?
Probabilistic, with error rates that vary by chain and wallet software. Clustering heuristics — common input ownership, change detection, behavioural fingerprinting — are inferences rather than facts, and commercial attribution data has its own methodology and error characteristics you remain accountable for. Carry confidence through to the decision, and be able to explain any decision that rested on an attribution.
Should we block funds that touched a mixer?
Hop-count rules are crude in both directions, over-blocking legitimate users and missing sophisticated laundering. Funds several hops from an illicit source may have passed through exchanges and market makers entirely legitimately. Model the path and its plausibility rather than counting steps, and treat privacy tooling as one signal among several rather than as evidence in itself.
Are you the right supplier for us?
For compliance systems engineering — transaction monitoring, surveillance, data infrastructure, alert quality — yes, and the underlying engineering is not crypto-specific. For deep chain attribution methodology, a specialist analytics firm will serve you better and we would say so in the first conversation rather than stretch into it. This is a tier three vertical for us and we would rather be useful in a defined part than oversell the whole.
Related verticals
Organisations in crypto and digital assets usually share data, buyers or regulators with these. All fourteen are listed on the Financial Services & Insurance page.
AI for Payments Companies
Real-time fraud, authorisation optimisation, merchant risk and disputes — engineering under a latency budget.
Read more →AI for RegTech Companies
Screening, surveillance, regulatory change monitoring — plus the validation evidence your customers need.
Read more →AI for Fintech Companies
Fraud, onboarding, credit decisioning — plus the compliance evidence your banking partner will require.
Read more →Tell us what the problem looks like.
Thirty minutes, no charge, no deck. We will tell you whether this is an AI problem, a data problem, or a process problem — and we will say when the honest answer is to buy something rather than build it.