Find the infrastructure behind the designation.
Resolve aliases, companies, financial activity, and controlled infrastructure so your team can detect evasion and support enforcement.
Problem
The list never shows everything.
A designation names only what authorities have confirmed.
Aliases, controlled entities, and financial infrastructure may sit outside the published record when an action is announced.
Targets rebrand over the same rails.
A new company name or website can mask continued use of the same operators, wallets, and services.
Sanctioned actors operate financial infrastructure.
Front companies and exchange-branded services can make state-linked activity look like ordinary commercial flow.
~$1B
Observed IRGC-linked flows
Activity routed through Zedcex infrastructure from 2023 through 2025.
Source: TRM Labs · How Two UK-Registered Companies Moved Over a Billion for the IRGC
87%
Infrastructure concentration
Share of Zedcex volume linked to IRGC-associated activity in 2024.
Source: TRM Labs · How Two UK-Registered Companies Moved Over a Billion for the IRGC
What is Ardence?
Ardence is an AI investigation platform built for all-source intelligence. For sanctions work, teams can connect designations, ownership, infrastructure, and financial activity to reveal the wider network and assess exposure.
How it works
See the network beyond the sanctions list.
Resolve
Start with the authority's designation and resolve legal names, trading names, local-script aliases, identifiers, and entity context before searching wider.
- Match names and aliases to the correct entity record
- Attach the designation source and published identifiers
- Separate confirmed matches from records that need analyst review
Test
Compare the operation before and after a claimed sale, rebrand, or re-registration. Shared infrastructure and financial behavior can test whether activity continued.
- Compare websites, domains, accounts, wallets, and service patterns
- Review public ownership and corporate change records
- Document the evidence supporting continuity or a genuine change
Control
A listed entity may operate through front companies, nominees, and shared infrastructure. Combine ownership and operational signals before reaching a control assessment.
- Trace ownership and management across related companies
- Compare directors, assets, infrastructure, and financial activity
- Apply the relevant ownership or control rule to the evidenced network
Expose
The published address or account may be one part of the target's financial footprint. Keep the authority's identifier distinct from attributed related activity.
- Identify related wallets, services, counterparties, and transaction paths
- Trace exposure to customers, institutions, and jurisdictions
- Prepare the evidence for screening, investigation, blocking, or enforcement decisions
Resolve
Start with the authority's designation and resolve legal names, trading names, local-script aliases, identifiers, and entity context before searching wider.
- Match names and aliases to the correct entity record
- Attach the designation source and published identifiers
- Separate confirmed matches from records that need analyst review
Test
Compare the operation before and after a claimed sale, rebrand, or re-registration. Shared infrastructure and financial behavior can test whether activity continued.
- Compare websites, domains, accounts, wallets, and service patterns
- Review public ownership and corporate change records
- Document the evidence supporting continuity or a genuine change
Control
A listed entity may operate through front companies, nominees, and shared infrastructure. Combine ownership and operational signals before reaching a control assessment.
- Trace ownership and management across related companies
- Compare directors, assets, infrastructure, and financial activity
- Apply the relevant ownership or control rule to the evidenced network
Expose
The published address or account may be one part of the target's financial footprint. Keep the authority's identifier distinct from attributed related activity.
- Identify related wallets, services, counterparties, and transaction paths
- Trace exposure to customers, institutions, and jurisdictions
- Prepare the evidence for screening, investigation, blocking, or enforcement decisions
Intelligence
Intelligence built for sanctions enforcement.
Sanctions and entity intelligence
Reveal the network beyond the published name.
Connect designations, aliases, organizations, ownership, infrastructure, and prior actions around the wider target network.
Blockchain intelligence
Find the financial network behind the designee.
Trace attributed wallets, transaction paths, counterparties, and services that may remain active after a designation.
All-source intelligence
Dozens of data partners. One investigation platform.
Ardence brings intelligence from TRM and specialized data providers into one investigation under a single Ardence contract.¹
Use Ardence to analyse company and ownership records, websites and infrastructure data alongside the authority's published designations. Commercial partner intelligence and open-source information help teams test links between a target, its front companies and its wider operations, subject to each source's permitted-use and disclosure restrictions.
¹ Provider availability varies by customer and jurisdiction. Supplemental terms may apply.
Services
Expert support and training for sanctions teams.
- Learn more
Investigative support
Work with TRM specialists to investigate attributed wallets, financial exposure, and activity linked to a sanctions target. Keep the supporting analysis available for your team's enforcement or referral decision.
- Learn more
TRM Academy
Build skills in blockchain investigations and sanctions exposure analysis through TRM training, courses, and certifications. Apply those skills to the financial networks behind a target.
- Learn more
Compliance Advisory
Work with former practitioners on sanctions risk assessments, indirect exposure analysis, and controls grounded in TRM intelligence. Receive a defined work product your team can apply to its program.
Community
Connect with the network tackling sanctions evasion.
- Learn more
Resolve: Threat Finance
Get hands-on training and connect with mission practitioners at Resolve: Threat Finance, a dedicated mission track focused on the challenges your team faces.
- Learn more
Resolve: Compliance & Supervision
Get hands-on training and connect with mission practitioners at Resolve: Compliance & Supervision, a dedicated mission track focused on the challenges your team faces.
Disruption Sprints
Recurring events that bring sanctions investigators, compliance teams, and partners together to work live cases and carry out coordinated disruptions of sanctions evasion networks. Participants act on the findings within their own authority.
Questions
FAQ
Start with a designation, person, company, alias, website, address, transaction, or counterparty. TRM helps your team test how those signals relate without treating every match as confirmed attribution.
Yes. Forensics can help identify attributed wallets, services, and transaction paths associated with the listed entity. TRM keeps its attribution separate from the authority's published record so analysts can review the basis for each finding.
Ardence brings blockchain intelligence from Forensics into a broader investigation alongside other evidence. Forensics provides a dedicated platform for deeper crypto tracing and analysis.
No. TRM supplies intelligence, attribution, and documented reasoning. Sanctioning authorities make designation decisions, and regulated institutions apply their own legal obligations, policies, and controls.
Sanctions enforcement focuses on identifying and documenting the networks supporting sanctioned actors. Sanctions compliance focuses on how regulated institutions screen customers and transactions and manage their exposure under the regimes that apply. TRM supports both by connecting designations with entity, ownership, infrastructure, and blockchain intelligence.
Insights
Insights on sanctions evasion.
How two UK-registered companies moved over a billion in stablecoins for the IRGC
Corporate records and financial activity show how exchange-branded infrastructure supported a sanctioned actor.
Four ways TRM improves compliance in the modern sanctions enforcement era
How list coverage, attribution, response time, and entity context support sanctions controls.
Detecting five common sanctions evasion techniques
A practical review of rebranding, fresh addresses, cross-chain movement, facilitators, and location masking.
