July 20, 2026

Crypto AML Software for Detecting Money Laundering: A Buyer's Guide

TRM Team

Crypto AML Software for Detecting Money Laundering: A Buyer's Guide

Illicit crypto volume hit USD 158 billion in 2025, an increase of nearly 145% from USD 64.5 billion in 2024, according to TRM Labs' 2026 Crypto Crime Report. Behind that figure sit techniques built specifically to beat detection: cross-chain bridges, mixers, peeling chains, and structured layering across hundreds of wallets. Most legacy and first-generation crypto tools rely on address-based screening, which these techniques are designed to evade.

Exchanges, banks, fintechs, and regulators all reach for crypto anti-money laundering (AML) software to close that gap.

Key takeaways

Illicit crypto volume reached USD 158 billion in 2025, up nearly 145% from USD 64.5 billion in 2024, per TRM's 2026 Crypto Crime Report.
Effective crypto AML software must detect behavioral patterns, not just flag exposure to known-bad addresses.
Eight capabilities separate adequate crypto AML software from excellent software: behavioral risk detection, cross-chain tracing, real-time sanctions screening, VASP due diligence, explainable scoring, Travel Rule support, unified case management, and real-time monitoring. TRM Labs delivers all eight capabilities in a single, unified platform used across 50+ countries.

‍

What is crypto AML software?

Crypto anti-money laundering (AML) software is purpose-built tooling that helps virtual asset service providers (VASPs), financial institutions, and regulators detect, investigate, and report suspicious activity involving digital assets. Most crypto AML software applies Know Your Transaction (KYT) screening, which evaluates the risk of individual transactions in real time rather than relying on a one-time customer check.

Crypto requires dedicated software for AML screening because it doesn't behave like traditional finance. Wallet addresses aren't natively linked to identities. Transactions settle in seconds and can't be reversed. Funds move around the clock across dozens of blockchains through bridges and swaps. And unlike a wire transfer, a crypto transaction carries no SWIFT message or correspondent-bank record of who sent it or why. A system built to flag suspicious wire transfers has no equivalent data to work with on-chain.

How is crypto money laundering different from traditional money laundering?

Dimension	Money laundering in traditional finance	Money laundering in crypto
Speed	Wire transfers take hours to days and can often be reversed or recalled	Transactions settle in seconds and are irreversible, leaving investigators a narrow window to intervene
Identity	Accounts are linked to verified identities through KYC at onboarding	Wallet addresses aren't natively linked to real-world identities
Movement	Funds move through a limited set of banks and payment rails	Funds can move across dozens of blockchains through bridges and swaps in minutes
Obfuscation	Layering typically involves setting up and routing money through shell companies, which leave a paper trail	A single laundering operation may route funds through hundreds of intermediary wallets
Originator data	Wire transfers carry SWIFT messages and correspondent-bank records identifying sender and receiver	No SWIFT message, correspondent bank, or built-in counterparty information to trace

‍

What laundering techniques must good AML software detect?

Technique	How it works	Why it evades address-based screening
Mixers and tumblers	Blend funds from multiple sources to obscure their origin	Breaks the on-chain link between source and destination, so tools that only match known-bad addresses lose the trail once funds pass through
Cross-chain bridges	Move assets between blockchains to break the investigative trail	Most screening tools work one chain at a time, so a bridge hop can end tracing unless the platform automatically follows the transfer to the destination chain
Peeling chains	Route funds through long sequences of wallets, each passing forward a reduced amount	Each wallet in the chain looks like an ordinary, low-value transaction on its own, so no single hop stands out to address-based tools
Structured layering	Break large amounts into small transactions to avoid detection thresholds	Individual transactions stay below the thresholds that typically trigger review, so the activity looks routine unless a platform links the transactions as a pattern
Chain-hopping	Move funds rapidly and sequentially across multiple blockchain networks	Speed and repeated chain-switching outpace manual, chain-specific investigation, resetting attribution confidence at every switch
Decentralized exchange (DEX) use	Swap assets through permissionless protocols with no identity verification	No KYC means there's no customer record to screen against, only the wallet's on-chain behavior
Privacy coins	Digital assets like Monero that obscure transaction details by design	Transaction details are shielded at the protocol level, leaving no visible amount, sender, or receiver to evaluate

‍

Why legacy AML tools can't detect crypto money laundering

Legacy AML tools were built for fiat. They analyze bank account activity, flag name matches, and screen against static sanctions lists. But none of that logic transfers cleanly to pseudonymous, cross-chain crypto flows.

Exposure-based screening also goes stale faster than criminal actors rotate wallets. Sophisticated laundering operations route funds through clean intermediary addresses specifically to avoid matching known-bad address lists, and exposure-based scoring misses them by design. That same bluntness drives high false-positive rates, which bury real risk under compliance backlogs: analysts spend their time clearing noise instead of investigating true suspicious activity.

Legacy tools also can't trace funds across chains within a single graph. Analysts have to manually hand off investigations between chain-specific interfaces, losing the thread the moment funds bridge to another blockchain. And they have no framework for assessing a counterparty exchange or service provider's AML program quality, only individual wallet addresses.

‍

Eight capabilities that define effective crypto AML software for detecting money laundering

These eight capabilities form the evaluation criteria that separate crypto AML software that actually works from software that only looks like it does. Use this section as a checklist against any platform you're evaluating.

1. Behavioral risk detection (not just exposure scoring)

Exposure-based scoring flags addresses with direct or indirect exposure to known-bad wallets. Behavioral detection flags activity that matches laundering patterns or surfaces anomalous patterns relative to expected behavior, even when the addresses involved are unknown.

That distinction matters because sophisticated laundering operations use clean intermediary wallets specifically to evade exposure-based screening. Software that only matches known-bad addresses misses most structured, layered laundering operations by design.

TRM's Signatures® capability detects mixer usage, chain-hopping, structured layering, and peeling chains in real time based on behavioral patterns, not address lists.

2. Automatic cross-chain tracing

Laundering operations don't stay on one blockchain. Funds move through bridges and swaps across chains specifically to break the investigative thread.

Manual tracing forces analysts to stitch together hops across chain-specific interfaces, losing attribution confidence at every bridge crossing. TRM traces automatically across 184+ blockchains and 840+ cross-chain bridges in a single, unified graph, with no manual handoffs and no lost threads.

3. Real-time sanctions screening

Sanctions screening in crypto means checking wallet activity against OFAC designations, UN Security Council sanctions, and domestic jurisdiction lists. Data freshness is critical here: a sanctions designation can happen at any time, and hours or even minutes matter when a newly designated entity is actively moving funds.

Stale sanctions data is a compliance failure. TRM adds new sanctions attribution within hours of a designation.

4. VASP due diligence and counterparty intelligence

VASP due diligence assesses the AML program quality of a counterparty exchange or service provider, not individual wallet addresses. This differs from wallet screening: a financial institution that engages a high-risk exchange as a banking customer inherits that exchange's exposure.

TRM's Entity Due Diligence maintains profiles and AML program risk assessments for VASPs, OTC brokers, and exchanges globally. It's the capability banks and stablecoin issuers need for correspondent relationships and institutional onboarding.

5. Explainable, auditable risk scoring

Glass box attribution means every risk score and entity label is transparent: the source, confidence level, and methodology behind each finding are visible to the user, not hidden inside a black box.

A compliance officer who can't explain a risk score to a regulator faces examination risk. An investigator who can't defend an attribution methodology in court can't build a prosecutable case. TRM's glass box attribution model is built around those requirements.

6. Travel Rule compliance support

The Travel Rule, FATF Recommendation 16, requires VASPs to share sender and receiver information when transferring virtual assets above a specified threshold. Crypto transactions carry none of this information natively, so it has to be transmitted through a separate mechanism.

AML software that doesn't support Travel Rule compliance creates a regulatory gap that no amount of manual process can patch at meaningful transaction volume.

7. Unified case management and SAR documentation

A crypto investigation moves through detection, triage, tracing, attribution, escalation, and suspicious activity report (SAR) filing. A platform that handles every stage in one place reduces data inconsistency, audit trail fragmentation, and the workflow friction of moving between tools.

TRM provides data and evidence to support SAR narratives like attribution sources, summarized alert dispositions, and visualizations designed to hold up in regulatory exams and court proceedings.

8. Real-time monitoring, not batch processing

Crypto transactions settle in seconds. Batch-processed monitoring detects risk hours or days after the fact, once funds have already moved further down the laundering chain.

TRM Wallet Screening screens activity in real time, flagging suspicious behavior as it happens and giving compliance teams a chance to intervene before funds become significantly harder to trace or freeze.

‍

Who needs crypto AML software for detecting money laundering?

Crypto AML software serves a wider range of buyers than crypto exchanges alone. Each segment carries a distinct regulatory obligation and a different primary need.

Buyer segment	Why they're in scope	What they need
Crypto exchanges and VASPs	Operate under the Bank Secrecy Act (BSA), the EU's Markets in Crypto Assets Regulation (MiCA), and FATF guidance, as the highest-volume buyers in the category	Real-time wallet screening, transaction monitoring, Travel Rule compliance, and SAR filing
Banks and financial institutions with crypto exposure	Encounter crypto exposure through correspondent banking for crypto firms, direct custody of digital assets, and banking relationships with crypto-native companies	VASP counterparty risk assessment, sanctions screening, and blockchain intelligence that integrates with existing compliance infrastructure
Fintechs and payment processors	Take on AML exposure through stablecoin payments, on- and off-ramps, and embedded crypto features, even without being crypto-native	Real-time monitoring and onboarding wallet screening that can handle high transaction volumes
Regulators and financial intelligence units	Hold a supervisory mandate to monitor VASP activity at a sector level and enforce reporting requirements, distinct from the transaction-level monitoring a compliance team runs	Jurisdiction-level oversight tools, VASP risk profiles for licensing assessments, and tracing to support investigations

‍

What sets TRM Labs apart in detecting crypto money laundering

TRM combines behavioral detection, agentic AI investigation, continuous risk monitoring, transparent attribution, real-time disruption infrastructure, and federal-grade security in a single platform. Each of these addresses a specific gap covered earlier in this guide.

Signatures®: Behavioral detection built into every product

Signatures® is built into every part of the TRM platform — forensics, wallet screening, and transaction monitoring; and screening for mixers, chain-hopping, peel chains, and structured layering.

TRM MCP: Bring your own AI agent to the alert queue

Compliance teams already run AI agents in tools like Claude and Cursor. TRM MCP connects those agents directly to TRM's blockchain intelligence using the Model Context Protocol (MCP), an open standard for linking AI agents to external systems. An agent can pull full alert context, trace exposure paths hop by hop, and draft a disposition, all inside the analyst's existing AI client.

TRM MCP doesn't hand judgment to the agent. Every disposition still requires a written justification, and every action logs to the audit trail marked as MCP-originated, so the analyst stays the decision-maker of record. The skills built into TRM MCP codify more than 100 years of combined investigative experience, giving agents the same structured context a trained analyst would use to validate an exposure path.

Continuous rescreening: Risk doesn't stop at onboarding

A wallet that's clean at onboarding can become risky months later: it might receive funds from a newly sanctioned entity, surface in a law enforcement seizure, or get linked to a fraud campaign. Programs that only screen at account opening have a structural blind spot for everything that changes afterward.

TRM Transaction Monitoring rescreens automatically when risk data updates, not on a fixed batch schedule, and applies new intelligence retroactively to existing customers. That removes the operational burden of manual periodic rescreening and closes a gap that a one-time check can't.

Glass box attribution: Evidence built to be defended

Every attribution in TRM carries a source type, confidence level, and link to the underlying evidence, whether that's a confirmed test transaction, an exchange's public announcement, or an enforcement action. That's the difference between a compliance officer writing "this wallet was attributed to Entity X based on a confirmed test transaction on [date]" and writing "our tool flagged it as high risk" — the difference between defensible regulatory determination and information that can’t be used in legal proceedings.

The Beacon Network: Built to freeze funds before they cash out

The Beacon Network exists because of a specific problem: when funds are stolen and move rapidly across the blockchain, participants need a way to freeze or seize them before they reach a cash-out point. Beacon Network was built in direct response to the Bybit hack, one of the largest crypto thefts on record.

Trusted investigators tag wallets holding confirmed tainted funds, and TRM propagates that tag in real time as the funds move, alerting exchanges, payment companies, and stablecoin issuers the moment tagged funds hit an address they control. The bar for inclusion is high by design: alerts only fire on confirmed, high-confidence tainted funds.

FedRAMP® High: A vendor bar regulators can verify

FedRAMP® High is a minimum bar for US federal procurement. TRM operates a FedRAMP® High compliant environment, meeting the security and operational requirements federal regulators and financial intelligence units require of their vendors.

A single platform, not a five-tool stack

Most compliance teams run separate tools for wallet screening, transaction monitoring, forensic investigations, and case management. Every handoff between tools introduces data inconsistency, audit trail gaps, and workflow friction. TRM brings screening, monitoring, forensics, entity due diligence, and case management into one platform, backed by TRM Academy training for the teams running it.

For related reading, see TRM's guides on what to look for in a crypto AML and compliance solution and how to evaluate a blockchain intelligence tool.

‍

Frequently asked questions

1. What is crypto AML software?

Crypto AML software is purpose-built tooling that helps VASPs, financial institutions, and regulators detect, investigate, and report suspicious activity involving digital assets.

2. How is money laundering different in crypto vs. traditional finance?

Speed, pseudonymity, cross-chain complexity, the scale of obfuscation, and the absence of originator information all create detection challenges that legacy tools weren't designed to address.

3. What are the most important capabilities in crypto AML software?

Eight capabilities matter most: behavioral risk detection, cross-chain tracing, real-time sanctions screening, VASP due diligence, glass box attribution, Travel Rule support, unified case management, and real-time monitoring.

4. What is behavioral risk detection, and why does it matter?

Behavioral detection flags activity that matches laundering patterns, such as mixers, chain-hopping, and structuring, even when the wallet addresses involved aren't known-bad. Exposure-based screening misses operations that use clean intermediaries; behavioral detection catches them.

5. What is glass box attribution?

Glass box attribution means every risk score and entity label shows its source, confidence level, and methodology, so compliance teams can explain decisions to regulators and investigators can defend them in court. Black box scores can't provide that.

6. What is the Beacon Network?

The Beacon Network is a real-time public-private intelligence-sharing network connecting law enforcement agencies, exchanges, and stablecoin issuers to stop illicit funds before they cash out.

7. Does TRM Labs support the Travel Rule?

Yes. TRM supports Travel Rule compliance as defined by FATF Recommendation 16, helping VASPs share sender and receiver identity information for qualifying transfers as required by applicable regulation.

8. Does TRM Labs meet FedRAMP requirements?

Yes. TRM operates a FedRAMP® High compliant environment, meeting the US federal government's highest bar for cloud security authorization.

9. How does TRM detect laundering patterns like mixing and chain-hopping?

TRM's Signatures® capability uses behavioral models to detect these patterns in real time by identifying activity that matches the behavioral signatures of known laundering typologies, not by matching against address lists.