Chainalysis

The removal test here is the exact inverse of CipherOwl's and the comparison is the clearest way to see this company. Strip the models from a young blockchain analytics vendor and you are left with public ledger data anyone can download for nothing.

Strip them from Chainalysis and you are left with a decade of proprietary attribution, the mapping of addresses to identified real world entities, assembled through investigations, exchange relationships and government work, which is an asset nobody else holds and which most of the industry relies on.

Clustering and entity resolution are genuine machine learning and risk scoring detects laundering patterns, so this is not a rules engine, but the newer explicitly artificial intelligence layer, an investigator triage tool and a blockchain intelligence agent, is in phased rollout rather than established. The moat is data and coverage rather than models, which is the NICE Actimize and SAS position.

The investigative products keep humans central by design, since the tracing tool exists to let an analyst visualise and follow funds, and the newer triage capability is framed as extending that work to investigators without deep technical expertise by accelerating early steps rather than replacing judgement. A compliance dashboard gives teams a unified view of their own monitoring posture. Against that sits a significant escalation.

A partnership connecting the transaction monitoring intelligence to an automated compliance engine enables deterministic on chain enforcement of policies over transfers, mints, redemptions and withdrawals, which means funds blocked by code executing on a risk score with no person in the loop and no opportunity to intervene before the fact. Nothing published describes a threshold, override or review path around that enforcement.

No accuracy figure, false positive rate, clustering precision or attribution confidence measure is published for any component. The certification programme is a real if indirect quality mechanism, since training investigators and compliance officers to interpret outputs correctly addresses one half of the risk, but it teaches use rather than establishing correctness.

Outputs have been examined in criminal proceedings, which is external scrutiny of an unusually demanding kind and points both ways: findings have supported prosecutions and the methodology behind them has been challenged by opposing experts. Publishing an error profile would settle more than a decade of case outcomes can.

The strongest evidence surface in this index. More than a thousand customers across over 70 countries span financial institutions, exchanges, regulators, tax authorities, law enforcement, consumer brands and web3 developers, and named customers include a major global bank, the three largest exchanges, a payments company, an enterprise software company and multiple federal agencies. More than 45 regulators use the tooling.

The outcome figure is one no competitor can approach: customers are stated to have recovered or frozen in excess of 34 billion dollars in illicit assets. Individual cases are documented publicly and independently, including the largest exchange collapse, a darknet marketplace takedown, a multibillion dollar exchange hack that ended in arrests, and a pipeline ransomware payment traced and partially recovered. Non dilutive growth financing was secured in 2025 against accelerated recurring revenue growth.

Network derived intelligence is stated as a strength, with insights drawn from more than 500 web3, banking and government participants feeding the platform, and that is precisely the arrangement this axis exists to interrogate. An exchange that identifies a customer through its own onboarding contributes knowledge that improves attribution used by every other customer including its competitors, and a government investigation informs commercial screening.

That may well be the correct design for a shared financial crime utility, and it is disclosed as a benefit rather than governed as a boundary. Nothing states what contribution is expected, whether it can be declined, or how enquiry activity by one institution is separated from what others can see.

No retention schedule, subprocessor list or data processing terms were located, and the privacy question here is larger than for any peer because of what the core asset is. The source ledgers are public and pseudonymous, so no new store of private records is created by observing them, but the company's central capability is attribution, linking addresses to identified entities and ultimately to people, and its attribution database is the largest deanonymisation asset of its kind in existence. Nothing published describes how an attribution is established, what confidence attaches to it, how long it persists, or what happens to one later found to be wrong.

Enterprise grade security is described rather than certified, with fault tolerance, encryption and vulnerability management named as practices, and no attestation, certification, trust centre or enumerated framework was located in accessible material.

That is a conspicuous absence for a vendor serving federal law enforcement, tax and securities agencies, all of which impose their own assurance requirements on suppliers, which means the assessments almost certainly exist and are not published. A commercial buyer therefore cannot rely on any of it.

Regulatory grounding is as strong as it gets for a technology supplier, and it is evidenced rather than claimed. More than 45 regulators use the tooling, government customers include federal investigative, drug enforcement, tax and securities agencies, and the free sanctions interface names the sanctions authority whose designations it returns, which is a specific instrument rather than a general compliance claim.

Virtual asset service provider risk scoring is built around the supervisory framework governing those entities. The certification programme trains regulators themselves, which places the company inside the supervisory apparatus rather than merely compliant with it. Ninth A on this axis.

The two exposures recorded for CipherOwl apply here with far greater consequence, because market position removes the corrective that competition would otherwise provide. An attribution error at this company propagates across the industry simultaneously, since its labels are the de facto standard used by most major exchanges, so a wrongly tainted address is refused everywhere at once rather than at one venue.

Risk propagation by proximity means a person who received funds several hops from a flagged source inherits that risk without knowledge or ability to avoid it. The methodology behind attributions has been contested by defence experts in criminal proceedings, which is genuine adversarial testing and cuts both ways. No error rate, attribution confidence measure, coverage disclosure or correction mechanism was located.

No guarantee, indemnity or falsifiable accuracy commitment was located, and the position of the affected party is weaker here than anywhere else in this lane precisely because of market dominance. A person or business whose address is attributed to an illicit entity, or flagged through proximity to one, is not told, cannot see the evidence, and has no described route to challenge the finding, and because these attributions are the industry standard there is no alternative provider whose different view would provide practical redress. The institution is well served: findings support prosecutions and satisfy examiners. The subject of a finding has nothing.

The primary data source is inherently transparent, since public ledgers are the substrate and anyone can verify their contents independently. Beyond that the chain is partly named: intelligence is stated to draw on more than 500 web3, banking and government participants, acquired capabilities in threat prevention and fraud detection are identified as such, and the automated compliance engine partner is named.

What is not disclosed is the attribution layer itself, which is the component that actually determines outcomes, with no statement of which sources establish that an address belongs to a named entity, how those sources are weighted, or what proportion of attributions derive from customer contribution rather than from the company's own research.

Integration reaches the whole ecosystem rather than one institution's stack. Interfaces span the full product line, a compliance dashboard consolidates monitoring across products, and a partnership with an automated compliance engine embeds the risk intelligence directly into on chain policy enforcement across transfers, mints, redemptions and withdrawals. The free public sanctions interface means even parties with no commercial relationship connect to the platform. The certification programme functions as distribution in its own right, since compliance officers and regulators trained on this tooling carry it into every institution they subsequently work for.

No hosting provider, region selection, residency commitment or private deployment option was located. Exposure is moderated because the analysed ledger data is public, but institutional customers across more than 70 countries submit their own enquiry and case material, and government agencies in particular operate under classification and jurisdictional handling requirements that a published residency position would normally address. Nothing does.

Enterprise pricing is not published and every commercial product sits behind a negotiated contract. What lifts this above the floor is a genuine and unusual access commitment: the sanctions screening interface is publicly hosted, free and requires no commercial licence, returning whether an address is identified as sanctioned by the relevant authorities.

That makes the single most basic compliance check available to any developer or small business at zero cost, which is a substantive act rather than a marketing gesture, and it is the kind of published commitment this axis exists to recognise even though no rate appears anywhere.

Coverage is the widest in this category on every dimension. Institution types run from banks and exchanges through custodians, funds and decentralised protocols to law enforcement agencies, tax authorities, financial regulators and consumer brands, across more than 70 countries.

Product coverage matches it, spanning investigation and fund tracing, real time transaction monitoring, address and sanctions screening, virtual asset service provider risk assessment, stablecoin specific risk, market intelligence, web3 threat prevention and consumer fraud. A certification programme extends reach further by training compliance officers, investigators and regulators on the tooling itself.