Scorechain

This grade is low by the vendor's own design choice, which is worth stating plainly. Attribution work behind the platform is substantial and algorithmic, clustering more than 500 million addresses into entities and identifying over 1,800 virtual asset service providers, which is not achievable manually.

But the company positions itself explicitly against inference, promising analytics without opaque or black box logic and arguing that institutions must understand how risk is assessed, so the visible product is a configurable engine of more than 300 named risk scenarios and sanctions screening rather than a model. The transparency stance and a high centrality grade are in tension here, and the company has chosen transparency.

The oversight position follows from the product philosophy and is stated as principle: institutions need to understand how risk is assessed and retain control over analytical decisions. In practice that means risk rules, sanctions lists and reporting templates are configured by the customer to match its own regime rather than inherited from the vendor, and an investigation tool supports analysts working cases rather than replacing them. The platform informs decisions and does not make them. What is not described is any automated blocking or screening threshold behaviour where the interface is used inline at transaction time.

Inspectability is offered as the answer on this axis and it is a real one, since a compliance officer can examine which of more than 300 named risk scenarios fired and why, rather than accepting an unexplained score, and the company states that effective crypto risk analysis must be transparent, explainable and adaptable. Configurability extends that, letting an institution tune thresholds to its own risk appetite and defend them to its supervisor.

What is absent is measurement: no accuracy, false positive rate, attribution confidence or validation result is published, and the confidence attached to any given entity attribution is what determines whether a flag is sound.

Scale is documented on several independent dimensions: more than 350 companies as customers across over 45 countries, more than 500 million addresses under management, over 1,800 virtual asset service providers attributed, and more than 150 licences established. The company has operated since 2015, making it one of the longest running vendors in this index.

Institutional validation is strong, with a joint service offering run with a Big Four firm's German practice since 2021 for entities obliged under German money laundering law, membership of the national bankers' association, partnership listing with a major stablecoin issuer, and a donated deployment to a United Nations agency's national committee for monitoring crypto donations.

No data boundary statement was located, and the question is specific here. The company's central asset is an attribution database covering more than 500 million addresses and 1,800 service providers, and databases of that kind grow partly from what customers investigate and confirm.

Nothing states whether one institution's investigative work, entity labels or risk determinations feed the attribution layer served to others, whether contribution is optional, or what happens to case data when a customer leaves.

Two specific commitments are published rather than implied: data handling aligned to the European data protection regime, and processing on a private cloud hosted within the European Union, which together answer the residency and framework questions that most vendors leave open. The material handled is transaction and address data alongside investigation case files, and where analysis attributes addresses to identified persons it becomes personal data under exactly the regime cited. Held at B because no data processing agreement, retention schedule or subprocessor list was located.

The company states it aligns with recognised industry security standards without naming any, which is the weaker form of this claim, and no attestation, certification, audit report or trust centre was located. That sits oddly beside an otherwise unusually specific disclosure posture, since the same material names hosting arrangement, data protection regime and half a dozen regulatory instruments precisely, and leaves the assurance framework generic.

This is the deepest regulatory disclosure in the index. Named instruments and authorities include the European crypto asset markets regulation with its effective date and its transitional deadline, the Luxembourg financial supervisor by name, the international financial action task force, successive European money laundering directives including the fifth by number, the German money laundering act with its commencement date, and the United States sanctions and financial crimes enforcement authorities.

Regulated categories are used precisely, covering crypto asset service providers, virtual asset service providers, financial intelligence units, suspicious activity reporting and know your transaction obligations. Crucially the platform is configurable by regime, so rules and reporting templates match whichever framework the customer operates under.

The transparency stance is a governance argument and a substantive one in this category. Crypto risk scoring can freeze assets or close accounts on the strength of a number, the dominant vendors in the field generate those numbers proprietarily, and this company's insistence on inspectable and configurable analytics means an institution can explain a decision rather than merely relay it. That materially improves what a customer can be told.

The limit is inherent to address level risk analysis and is not addressed: exposure is assessed through proximity in the transaction graph, so an address several hops from a sanctioned entity inherits risk it did not choose, and no testing, threshold rationale or analysis of who that catches is published.

No guarantee, indemnity or correction process was located. The institution is well positioned because inspectable analytics let it reconstruct and justify any determination it made. The wallet holder is not: someone whose address is scored as high risk may find transactions rejected or an account closed by an exchange, will not be told which scenario fired or which counterparty two hops away caused it, and has no described route to contest an attribution or have a corrected label propagate to the institutions that already acted on it.

External dependencies are named where they matter most for this product: sanctions screening runs against the United States, European and United Nations lists, which are the sources whose currency determines whether a screen is valid, and supported blockchains are enumerated individually rather than described as broad coverage. The risk scenario library is the company's own. What is not disclosed is any upstream node infrastructure, data provider or attribution partner, and no subprocessor list appears despite the stated hosting arrangement.

The company describes an interface first approach, with a dedicated sanctions screening interface for instant address checks alongside the analytics and investigation products, which suits both batch compliance review and inline transaction screening. Breadth of chain coverage past 100 blockchains is itself an integration achievement given how differently each ledger exposes data. A browser wallet integration extends screening to individual transfers. No named core banking, exchange or compliance platform appears and no developer documentation was located.

The company states plainly that it operates a private cloud hosted in the European Union, which is more than the large majority of vendors in this index publish and directly answers the question a European institution asks first. It also states the platform was designed to meet the European crypto asset regime's requirements from the outset.

Held at B because no hosting provider is named, no alternative region is offered for customers outside Europe despite a customer base spanning the Americas and Asia, and no on premise option is described.

No price list, packaging or basis of charge was located. One indirect figure exists: a donated deployment giving full analytics across all supported blockchains plus the investigation tool was valued at 30,000 euros, which indicates the order of magnitude for a complete suite without being a published price. Nothing states whether charge scales with addresses screened, transaction volume, blockchains covered or seats.

Buyer coverage is exceptionally wide and traditional finance leads it, spanning banks, brokers, hedge funds, over the counter desks, asset managers and payment providers entering digital assets, alongside exchanges, wallets, decentralised finance and tokenisation platforms, regulators, law enforcement agencies and professional firms.

Technical coverage matches it at more than 100 blockchains, with named support running from Bitcoin including payment channel detection through Ethereum and its token standards to several alternative ledgers, and extending to stablecoins, decentralised finance and real world asset tokenisation. Geographic reach spans Europe, the Americas and Asia across more than 45 countries.