Merkle Science

Risk scores come from how wallets behave rather than from membership of a known bad list, with machine learning tracking suspicious activity and Onchain Pulse scoring ecosystem risk. What would survive their removal is a list of illicit addresses, the very product this company positions itself against.

Compass screens automatically before a relationship begins and again across existing customers, with real time scores produced without human involvement. An institution can define its own risky patterns through the behavioral rule engine, but at decision time no confidence indication or review threshold accompanies a flag.

Blacklists can be audited by reading them, while a predictive engine needs a hit rate, and none is given across customers: no accuracy, precision or false positive figure, and no account of validation or of monitoring as laundering techniques shift. What exists is rule level auditability, with Finoa exporting rule changelogs and tracking which rules generate the most alerts, plus one engagement in which StraitsX judged over 90 percent of flagged entities likely linked to mule laundering.

StraitsX, a digital financial services provider, used Merkle Science's behavior based analysis to find more than 250 previously unknown consolidation wallets behind coordinated stablecoin withdrawals, judged over 90 percent of flagged entities likely linked to money mule laundering and cut manual investigation time by about 80 percent. The engagement followed a stated method, from defining the mule pattern through wallet clustering to risk scoring. Finoa, a crypto custodian, reports less manual work from the dashboard and rule engine, and Dean Carlson of Susquehanna is quoted on predictive monitoring.

Intelligence accumulated through one exchange's monitoring can strengthen the crypto crime database sold to its competitors, since behavioral models improve with exposure. The privacy policy is silent on model training, and a customer's ability to keep its investigation activity out of the shared database is not addressed.

Account details and cryptocurrency addresses are associated with public ledger information under a privacy policy that names customers, yet it sets no retention periods, carries no update date and describes no access, correction or deletion rights. Identifying the people behind addresses is Tracker's stated purpose, which makes those identifications the sensitive output.

Auditors go unnamed, and a General Data Protection Regulation compliance certification listed beside the two is not a recognized credential. ISO 27001 certification has been held since August 2021, scoped to the design, development and release of its monitoring and investigation products, and a SOC 2 Type II report since March 2023.

Products map onto anti money laundering, know your customer and counter terrorist financing rules, with compliance under the European Union's Markets in Crypto Assets Regulation named and an Institute training compliance teams and investigators. Verification of those mappings is left to the buyer, and no register entry appears.

Predicting risk from behavior means flagging addresses that have done nothing identifiably wrong, a different kind of error from a list match, on top of attribution mistakes and risk spreading to parties several hops away. How often that inference lands on an innocent party is not measured in anything published.

Graph analysis gives the institution forensic evidence it can check against the public ledger and contest. A person flagged by behavioral prediction may never have touched anything illicit and is not told the flag exists, with no published correction route or statement of what the vendor owes when a prediction proves unfounded.

Public ledgers anyone can verify are the primary input and the behavioral engine is built in house. Other law enforcement lists, any model provider for the analytics and a subprocessor list go unnamed, though sanctions data from the Office of Foreign Assets Control (OFAC) is named among screening sources.

21 Analytics documents Merkle Science as a configurable risk provider in its Travel Rule software, a link verifiable in another platform's documentation. Compass, Tracker and KYBB cover monitoring, investigation and due diligence with tracing across more than 200 bridges, while institution side systems and public developer documentation are absent from its own site.

Where the platform is hosted, and under what residency commitment, is unpublished, and the privacy policy names no storage or transfer location. Exchanges, banks and government agencies each carry their own rules on where investigation data may sit.

Booking a demonstration is the only way in, with no pricing, packaging or charging basis published. Whether charges fall per address screened, per transaction monitored or per seat is not indicated.

Crypto asset businesses, trading firms and blockchain foundations are addressed alongside banks, government agencies and law enforcement, with regulation covered across Asia, Europe and the United States. Banks appear without a named bank customer.