December 30, 2025

Best VASP Screening and Risk Assessment Software (2026 Buyer’s Guide)

TRM Team

Best VASP Screening and Risk Assessment Software (2026 Buyer’s Guide)

Key takeaways

Virtual asset service provider (VASP) screening and risk assessment is the process of assessing the risk of a VASP before banks and financial institutions engage with it — and continuously reassessing that risk over time.
VASPs are not all the same. VASPs — and their risk profiles — differ significantly by jurisdiction, licensing, business model, customer base, and strength of anti-money laundering (AML) / Know Your Customer (KYC) controls. Effective screening means systematically unpacking those differences instead of treating all VASPs as though they are the same.
VASP screening and risk assessment must combine off‑chain information with on‑chain intelligence. Strong programs connect entity data (ownership, licensing, products, controls) with blockchain evidence (wallet infrastructure, flows, typologies, cross‑chain behavior) in one framework.
Best-in-class solutions combine blockchain-wide visibility with entity-level screening, continuous monitoring, transparent attribution, and configurable rules — enabling teams to align detection logic to their risk appetite and regulatory obligations.

‍

Why is VASP screening and risk assessment important for compliance teams?

Virtual asset service providers (VASPs) sit at the center of the digital asset economy. They facilitate trading, custody, payments, swaps, bridging, on- and off-ramps, and access to decentralized protocols — often at high volume and across borders.

That centrality makes VASPs essential counterparties. But not all VASPs are the same. Their risk profiles vary widely depending on where they operate, the products they offer, who they serve, and — critically — the robustness of their controls. Effective VASP due diligence is about digging into those differences so you can distinguish well-governed, well-supervised entities from services whose controls, licensing, or risk exposure fall short of regulatory standards.

This is why VASP screening and risk assessment has become foundational for any organization that touches digital assets — from crypto-native businesses to banks, fintechs, corporates, regulators, and investigative teams.

VASP screening and risk assessment is the process of assessing the risk of a VASP before you engage with it — and continuously reassessing that risk over time.

It supports decisions such as:

Should we onboard this exchange, broker, custodian, OTC desk, payment processor, stablecoin partner, or on-ramp?
Should we allow transfers to and from this service?
Should this counterparty require enhanced due diligence?
Should we restrict corridors, assets, chains, or transaction types involving this VASP?
Do we need to offboard — and can we defend that decision?

An effective VASP screening and risk assessment program creates a repeatable way to decide which services you can safely work with, on what terms, and how quickly you need to respond when their risk profile changes.

‍

What does an effective VASP screening and risk assessment framework include?

A robust VASP risk assessment framework typically includes:

1. Inherent risk: What baseline risk does this VASP present?

Inherent risk reflects the baseline level of risk a VASP poses before considering mitigating controls. When assessing inherent risk, compliance teams typically evaluate:

Jurisdictional footprint

Where the VASP is incorporated and headquartered
Which countries it serves customers in
Where licenses or registrations are held
Where key teams, infrastructure, servers, and decision-makers are located
Whether operations touch high-risk, lightly regulated, or sanctioned jurisdictions

Type of crypto exposure

How and where the VASP takes crypto risk on balance sheet
Whether the VASP has any exposure to volatile, illiquid, or thinly traded assets
Interaction with decentralized finance (DeFi) protocols, DAOs, smart contracts, or on-chain lending and staking
Use of intermediaries, nested services, or complex routing structures
How concentration, liquidity, and protocol risk are managed

These factors help establish whether a VASP’s business model inherently carries higher financial crime, sanctions, or operational risk.

2. Control effectiveness: How strong are the VASP’s compliance and risk controls?

Control effectiveness (often referred to as control risk) evaluates whether a VASP’s internal controls sufficiently mitigate its inherent risk. Key areas typically include:

Licensing and regulatory status

Whether the VASP is licensed or registered in all relevant jurisdictions
Which authorities supervise it and for which services (e.g. exchange, custody, brokerage, staking, token issuance)
Whether any licenses have lapsed, been suspended, or been subject to enforcement
The VASP’s ability to provide verifiable evidence of its licensing status and regulatory history

Strength of AML and KYC controls

KYC and customer due diligence policies, including risk-tiered customer due diligence (CDD) and entity due diligence
Sanctions and watchlist screening practices
Fiat and crypto transaction monitoring coverage
Travel Rule compliance
Controls restricting high-risk geographies and counterparties
Adequacy of compliance staffing, training, and independent audits
Record-keeping, suspicious activity report (SAR) / suspicious transaction report (STR) filing practices, and governance alignment with your institution’s standards

This is where traditional due diligence artifacts — policies, procedures, audits, attestations, and supervisory feedback — are typically reviewed.

3. Residual risk: Is the remaining risk acceptable?

Residual risk represents the level of risk that remains after accounting for control effectiveness. In practice, residual risk determines:

Whether the VASP can be onboarded or maintained as a counterparty
Whether enhanced due diligence is required
What restrictions or conditions apply (for example, corridor limits, asset restrictions, or transaction thresholds)
Whether the relationship aligns with the institution’s risk appetite

A VASP with high inherent risk may still be acceptable if controls are proportionate and effective. Conversely, weak controls can make even moderate inherent risk unacceptable.

4. On-chain risk indicators: What does blockchain activity actually show?

On-chain analytics provide objective risk indicators that materially inform residual risk assessments. Compliance teams typically evaluate:

Direct or indirect exposure to sanctioned entities
Links to hacks, scams, fraud, or laundering typologies
Interaction with high-risk services such as mixers or obfuscation tools
Transaction patterns consistent with structuring, layering, or evasion
Rapid cross-chain movement through bridges and swaps

These indicators help validate — or challenge — conclusions drawn from off-chain due diligence and often surface risk earlier than traditional reviews.

5. Ongoing monitoring and trigger events: How does risk change over time?

Regulators increasingly expect VASP risk assessments to be continuous, not static onboarding snapshots. Ongoing monitoring helps teams identify material changes such as:

New sanctions designations or enforcement actions
Hacks, exploits, or adverse events
Sudden shifts in on-chain behavior or exposure
Emergence of new wallet infrastructure or intermediaries
Changes in jurisdictions, assets, or product offerings

When trigger events occur, risk should be reassessed promptly, decisions updated, and outcomes documented.

The best VASP screening and risk assessment software operationalizes this framework — combining entity due diligence, on-chain risk indicators, continuous monitoring, and defensible documentation in a single platform.

‍

Who needs VASP screening and risk assessment software today?

If you touch digital assets — directly or indirectly — you likely need this capability.

How do crypto-native businesses use VASP screening?

Crypto-native businesses (themselves VASPs) typically screen:

Counterparty VASPs (exchanges, custodians, liquidity venues)
Liquidity and payment rails (OTC desks, payment processors)
Customer wallets, especially for withdrawals and deposits
Nested services and intermediaries, where risk can be hidden in pooled flows

Common users include:

Centralized exchanges and brokerages
Wallet providers and on-/off-ramps
Payment processors and stablecoin issuers
OTC desks and brokerage services

How do banks and traditional financial institutions use VASP risk assessment?

Banks and traditional financial institutions increasingly face VASP exposure through:

Assessing wire transfers with high-risk VASPs
Banking relationships with crypto firms
Custody and trading services
Corporate treasury activity involving stablecoins or tokenized assets
Cross-border payments and remittances with a crypto nexus

They need to evaluate VASPs both as customers and counterparties, and to document decisions for regulators and internal risk committees.

Why do corporations and fintechs need VASP screening?

Non-crypto firms may interact with VASPs through:

Stablecoin payments to suppliers or contractors
Treasury diversification or hedging strategies
Embedded crypto infrastructure or rewards in apps
Payment corridors relying on VASP partners

These organizations need practical and defensible counterparty risk controls that can be explained to boards and supervisors.

How do public sector teams use VASP intelligence?

Regulators, supervisors, and financial intelligence units (FIUs) may use VASP intelligence to:

Monitor market activity and systemic risk trends
Assess supervisory compliance posture across VASPs
Support enforcement, investigations, and policy decisions

Law enforcement and investigative teams use blockchain intelligence to:

Identify VASP involvement in illicit networks
Trace flows through services, bridges, and swaps
Build evidence and support disruption outcomes

‍

What features and capabilities should you look for in VASP screening and risk assessment software?

There are several key criteria to look for when evaluating VASP screening software — or more broadly, a compliance platform that includes VASP screening and monitoring. Use these questions as your checklist.

1. Does it provide entity-level due diligence, not just address checks?

A VASP is not a single wallet. It is an entity with:

Multiple infrastructure clusters
Different business lines and jurisdictions
Changing ownership and controls
Relationships with other services

Best-in-class VASP screening platforms support entity screening and monitoring, so you can assess counterparties as real-world organizations rather than isolated addresses.

TRM supports this through entity due diligence workflows that connect off-chain context to on-chain exposure and behavioral patterns, enabling structured “Know Your VASP” and counterparty assessments.

2. Does it offer expanded attribution to uncover networks, not just basic address-level checks?

Illicit actors and high-risk VASPs often leverage complex wallet infrastructures and intermediaries. Your tool should:

Cluster wallets into entities where possible
Distinguish between direct ownership, service exposure, and incidental interaction
Expand attribution beyond obvious labels to uncover broader networks and facilitators

TRM combines proprietary heuristics, primary threat intelligence, and VASP engagement to enrich attribution — allowing teams to see beyond one-off addresses and understand the networks around a VASP.

3. Does it offer broad blockchain-wide coverage with consistent functionality?

Inconsistent chain support is a hidden risk. If key features work on some chains but not others, your coverage will be uneven — and your program will have blind spots. Look for:

Broad multi-chain coverage, including major and emerging networks
Standardized features across supported chains (exposure scoring, behavioral analytics, cross-chain tracing)
Fast addition of emerging chains that matter to your risk profile

TRM supports tracing and alert triage across a rapidly growing set of blockchains, so teams can act quickly as new networks emerge. Coverage is standardized across Standard and Enhanced tiers, so you get consistent, predictable functionality from chain to chain.

4. Does it support continuous monitoring and proactive risk detection?

VASP screening should not be a one-time onboarding check. Strong solutions:

Continuously monitor entity and wallet activity
Detect changes in risk (for example, new sanctions exposure or links to emerging typologies)
Add new designations and risk categories quickly as the threat landscape evolves

TRM has dedicated intelligence teams working to update risk as new intelligence emerges, supported by advanced analytics and heuristics that enable us to scale attribution, fast.

5. Is the risk scoring explainable and evidence-backed?

Compliance teams cannot rely on “black box” scores. You need to understand:

What drove the score (including categories, exposures, behaviors)
The strength of the underlying evidence
Whether the risk is current, historical, direct, or indirect

TRM uses “glass box” attribution, providing confidence scores and, where possible, links to underlying evidence, along with the option to request attribution source reports for deeper detail.

6. Can you configure thresholds and monitoring logic to match your risk appetite?

Organizations differ in risk tolerance and regulatory obligations. A strong platform should support:

Configurable thresholds by risk tier
Different logic for onboarding versus transaction decisioning
Rules tuned to your corridors, products, and jurisdictions
The ability to reduce false positives without creating blind spots

TRM’s configurable risk engine allows organizations to align detection with their own definitions of low, medium, high, and severe risk across 150+ risk categories.

7. Will it scale operationally and technically as your crypto exposure grows?

Practical scaling means:

Screening at high volume via UI and APIs
Low-latency results for operational decisioning
Stability under peak transaction load
Controls that operate across business units and geographies

TRM’s Wallet Screening API, for example, returns enriched risk data per address while maintaining low-latency performance, supporting production-grade onboarding and transaction flows.

8. Does it offer training, guidance, and expert support?

Because VASP screening sits at the intersection of regulation, risk, and blockchain intelligence, teams need:

Training on crypto-specific risk and VASP typologies
Guidance on how to interpret entity and wallet risk
Best practices for integrating VASP screening into wider AML programs

The best VASP screening and risk awareness software providers do not provide software alone, but also robust training and customer support programs. Through TRM Academy, TRM offers learning paths and certifications for compliance professionals, including content on entity screening, crypto compliance, and investigative methodology — helping teams build real-world skills, not just buy software.

‍

What kinds of risks can VASP screening and risk assessment software help you prevent?

VASP screening and risk assessment software helps financial institutions, VASPs, and other organizations prevent a range of regulatory, operational, and financial risks tied to interacting — directly or indirectly — with high-risk or non-compliant services.

Reducing direct exposure to high-risk or non-compliant VASPs

Screening helps you avoid:

Onboarding VASPs that are sanctioned, unlicensed, or operating in prohibited jurisdictions
Processing deposits or withdrawals involving VASPs with known exposure to serious illicit activity
Partnering with VASPs whose on-chain behavior is inconsistent with their stated compliance posture

Mitigating indirect exposure through intermediaries and nested services

Effective tools help you see:

Multi-hop exposure to high-risk VASPs via nested services, OTCs, or payment processors
Exposure to laundering typologies routed through apparently “clean” intermediaries
Downstream residual exposure that may still be material to your risk appetite

Reducing reputational and regulatory enforcement risk

Failure to manage VASP risk can lead to:

Supervisory findings, remediation plans, or license conditions
Enforcement actions and monetary penalties
Reputational damage with regulators, partners, and customers

A VASP screening program with strong documentation and auditability provides the backbone for defensible risk-based decisions.

Preventing facilitation of money laundering and financial crime

Even if a VASP is not sanctioned, it may:

Have significant links to high-risk jurisdictions
Show strong ties to known threat actors or typologies
Display behavioral patterns consistent with laundering or evasion

Behavior- and exposure-based VASP screening helps surface elevated-risk counterparties before exposure becomes material.

Addressing control gaps and auditability risk

If an institution cannot demonstrate how it screened VASPs, what evidence it relied on, or how it documented decisions, it risks findings during supervisory exams.

VASP screening platforms with unified views and audit trails:

Show who reviewed what, when, and why
Provide consistent methodology for assessing counterparties
Make it easier to respond to regulator questions about VASP exposure

Reducing false negatives and false positives

The best VASP screening software improves both sides of the equation:

False negatives: By expanding attribution, adding behavioral analytics, and tracing across chains and intermediaries
False positives: By providing configurable thresholds, richer entity context, and explainable outputs that support fast triage

‍

What VASP risk typologies should your software help you detect?

Your VASP screening and risk assessment software should provide intelligence that helps you detect, flag, and confidently react to the risk categories that matter most to your organization.

How should you detect sanctions exposure and evasion pathways?

Your system should surface:

Direct interaction with sanctioned entities or wallets
Indirect exposure via nested services or intermediaries
Cross-chain evasion patterns that obscure source or destination
Rapid movement through swaps and bridges intended to “break” traceability

How should you identify hacks and exploit-related exposure?

Look for capabilities to detect:

Inbound flows from hacked or exploited funds
Rapid distribution into many wallets (splitting or splintering)
Bridging and swapping behavior typical of laundering
Attempts to cash out through higher-risk venues

How should you flag scam and fraud networks?

Key patterns include:

Exposure to scam clusters and fraud typologies
Coordinated behavior across multiple wallets and services
Use of intermediaries to obscure beneficiary identity
Repeated inbound from high-risk sources paired with fast outbound movement

How should you capture obfuscation and layering behavior?

You should be able to detect:

Use of mixers and obfuscation tools
Peel chains and structured withdrawals
High-velocity “in then out” flows
Complex transaction graphs designed to increase analyst workload

How should you identify high-risk intermediary services and nested VASPs?

Your software should help you see:

VASPs that act as conduits for other services
Nested routing where KYC responsibility is unclear
Services that mask true origin or destination behind pooled flows
Multi-layer intermediation undermining counterparty clarity

The best VASP screening and risk assessment software doesn’t just label these risks. It helps you see them clearly, prioritize them correctly, and document your decisions.

‍

Why is TRM Labs the best software for VASP screening and risk assessment in 2026?

The best solution in this category isn’t necessarily the one with the longest feature list. The true measurement of a VASP screening and risk assessment platform’s efficacy is in whether it helps real compliance teams:

Detect meaningful risk early
Reduce noise and false positives
Make consistent decisions at scale
Investigate quickly when risk escalates
Document outcomes in a way that stands up to regulatory and internal scrutiny

TRM is purpose-built for those outcomes and is used by financial institutions, VASPs, and public sector agencies worldwide to manage crypto-related AML and VASP risk.

Entity-level due diligence screening

TRM helps teams assess VASPs as entities — not just as collections of addresses — by providing:

Clear understanding of jurisdictional and operational context
Entity-level risk scoring informed by blockchain intelligence
Entity-level view of on-chain flows by counterparties, risk categories and more

This provides compliance teams with the off-chain context they need to assess a VASP's on-chain risk profile — all in one unified platform.

Best-in-class attribution for comprehensive risk profiling

TRM clusters wallets into entities using on‑chain heuristics, primary intelligence, and direct engagement with VASPs, so you can see who you’re actually transacting with — not just a list of addresses. It also distinguishes between direct ownership, service exposure, and incidental interactions, helping you tell whether a VASP is actively facilitating risk or is only tangentially connected.

Crucially, TRM expands attribution beyond obvious labels to surface broader networks and facilitators: intermediaries, nested services, and repeat counterparties that form the infrastructure of illicit activity. This gives compliance teams the context they need to make risk decisions on entire VASP networks, not just single wallet addresses.

Fast and comprehensive blockchain coverage

As the digital asset ecosystem rapidly evolves, compliance teams, investigators, and analysts need fast and actionable coverage of emerging blockchains to detect and trace illicit activity.

TRM is setting a new standard for both speed and robustness of blockchain coverage. We can rapidly add new blockchain coverage because we’ve standardized our support across two tiers: Standard and Enhanced. This ensures every chain we launch supports customer outcomes and includes consistent functionality, so you don’t have to guess what’s supported from chain to chain.

Continuous monitoring and proactive risk detection

VASP screening should not be a one-time onboarding check. Strong solutions should support continuously updating attribution and risk profiling to reflect the latest on-chain realities. TRM has developed both the systems and expertise to ensure our attribution can be updated at speed and scale. For example, TRM adds new sanctions designations in hours — not days — ensuring fast and reliable detection to support continuous compliance against changing global sanctions lists.

Auditability and defensibility

TRM is designed for explainable, evidence-backed decisions:

Transparent risk drivers and scoring components
“Glass box” attribution with confidence scores and, where possible, links to supporting evidence
Decision history tied to entities, alerts, and analysts
Investigation-ready outputs for escalation, reporting, and regulatory engagement

This helps teams stand behind their decisions in external audits, regulatory inspections, and internal governance forums.

Configurable rules and thresholds to match your risk appetite

Organizations differ in risk tolerance: one firm might require zero-tolerance for any indirect links to sanctioned actors and automatically block those transactions, while another might review indirect sanctions exposure and make decisions on a case-by-case basis. A best-in-class solution should allow you to configure risk thresholds and alerting logic, and enable you to tailor rules in alignment with your compliance program as part of a risk-based approach.

TRM’s fully configurable risk engine puts your risk appetite at the center of every decision, allowing you to tailor risk rules across 150+ configurable scenarios and dozens of granular categories spanning sanctions, terrorist financing, CSAM, scams, darknet markets, and more. By calibrating severity for ownership, counterparty, and indirect exposure, you can align alerts to your policies and jurisdictions, cut false positives, and surface the risks that matter most — across chains, at scale, and in real time

Scalability and performance: High-volume and cross-chain flows

As crypto adoption grows and global transaction volumes surge, your VASP screening and risk assessment software must scale accordingly. It should handle high screening volume, support bulk screening (e.g. onboarding large user sets), and avoid latency that undermines real-time decision-making.

TRM’s platform processes petabytes of blockchain data across dozens of blockchains and answers 500+ customer queries per minute with ultra-low latency.

Expert guidance, training, and compliance support

Through our training arm — TRM Academy — TRM offers courses in crypto compliance, investigative methodology, entity screening, and risk analysis — helping compliance teams build real-world skills and not just rely on software.

‍

What steps should you take to implement a VASP screening and risk assessment program?

A strong tool only becomes valuable when it is embedded into a real operating model. Here is a practical implementation roadmap for compliance teams.

Step 1: Where does your organization interact with VASPs?

Map your touchpoints:

Onboarding counterparties and partners
Processing deposits and withdrawals
Routing payments and remittances
Using liquidity venues and OTC desks
Partnering with custody or infrastructure providers
Interacting with DeFi or cross-chain services

This ensures your screening program covers actual exposure, not just a theoretical list.

Step 2: What are your compliance obligations and risk appetite?

Clarify:

Which jurisdictions and regulatory frameworks apply
Your tolerance for direct and indirect exposure (by typology, geography, or chain)
Escalation triggers and approval authority
Documentation standards and retention requirements

Risk appetite is what converts data into actionable decisions.

Step 3: What does your VASP risk tiering and decision policy look like?

Define:

Risk tiers (e.g. low, medium, high, severe)
Required evidence for each tier
Actions attached to each tier (approve, enhanced due diligence, restrict, offboard)
How to handle exceptions and overrides — and how they are documented

Consistency in tiering and actions is essential for audits and internal alignment.

Step 4: How will you run ongoing monitoring?

Decide:

What changes should trigger alerts (risk score shifts, new typology exposure, new wallet clusters, new sanctions or enforcement events)
How alerts are routed and owned
Case handling, SLA expectations, and closure criteria
How decisions are communicated to stakeholders and product teams

Step 5: How will you test and tune before full launch?

Before going live at scale:

Run a pilot across a representative set of counterparties
Validate alert quality and operational impact
Tune thresholds, typology logic, and watchlists to reduce noise
Document the rationale for your chosen settings and any trade-offs

Step 6: How will you train teams to use the system consistently?

Training should cover:

How to interpret entity risk scores and wallet attribution
How to triage alerts and conduct investigations
How to document decisions in an audit-ready way
How to communicate outcomes clearly to business stakeholders

Step 7: How will you maintain oversight as regulation and typologies evolve?

As crypto regulation evolves and illicit actors adapt, you should:

Periodically review and update screening rules and thresholds
Refresh VASP risk assessments based on new intelligence
Monitor regulatory developments and adjust your program as expectations shift

A disciplined, iterative approach ensures VASP screening becomes not just a checkbox, but a core part of a comprehensive crypto compliance program.

‍

Frequently asked questions (FAQs)

1. What is VASP screening?

VASP screening is the process of assessing the risk of a virtual asset service provider (VASP) before engaging with it, and continuously monitoring that risk over time using both off-chain due diligence and on-chain blockchain intelligence.

2. What is the difference between VASP screening and wallet screening?

Wallet screening evaluates the risk of a specific blockchain address. VASP screening evaluates an entity — including its wallet infrastructure, services, jurisdictions, exposure, and behavioral patterns — so you can make counterparty decisions that are defensible to regulators and risk committees.

3. What is the difference between direct and indirect risk?

Direct risk is exposure that involves a VASP or wallet you are dealing with immediately — for example, when you bank a VASP as a customer, route payments directly through their infrastructure, or receive funds straight from a high‑risk wallet. It’s usually easier to see and explain, and regulators will expect you to have a clear view of it.

Indirect risk is exposure that reaches you through intermediaries — such as nested services, payment processors, OTC desks, or long multi‑hop chains of wallets and bridges. Even if you never touch a high‑risk VASP or wallet directly, you may still have meaningful indirect exposure if your counterparties are repeatedly interacting with them.

An effective VASP screening and risk assessment program needs to account for both: direct risk to the VASPs and wallets you touch, and indirect risk that flows through the network around them.

4. What are nested services?

Nested services are VASPs or other crypto services that operate through another VASP’s infrastructure rather than directly interfacing with the blockchain themselves. Instead of running their own wallets or nodes, they “nest” inside a larger platform — for example, a smaller exchange or broker using a bigger exchange’s omnibus wallets or payment rails behind the scenes.

For compliance teams, nested services matter because they can:

Obscure who actually owns the relationship with the end customer
Create indirect exposure to higher‑risk or lightly supervised services sitting behind an apparently well‑run VASP
Complicate questions of responsibility (who is performing KYC, filing SARs/STRs, and managing sanctions exposure)

An effective VASP screening and risk assessment program should therefore look for signs of nesting within wallet infrastructure and entity networks, so you can understand not just your immediate counterparty, but also the services and risks they may be carrying on behalf of others.

5. Can TRM be used for regulatory reporting and compliance audits?

Yes. TRM’s platform provides timestamped logs, transparent scoring, and investigation history — all of which support suspicious activity reports (SARs), internal audits, and regulator requests.

6. Does TRM support compliance across multiple jurisdictions?

TRM maintains alignment with regulatory frameworks globally, including the US Bank Secrecy Act, EU MiCA, FATF standards, and jurisdiction-specific AML rules across Asia, the Middle East, and Latin America.

7. How can I evaluate if TRM is the right fit for my organization?

The best way is to request a custom demo. TRM will walk your team through real use cases aligned with your risk profile, tech stack, and jurisdictional requirements.