TRM Labs

First party attribution mapping more than forty categories of illicit activity is the defensible asset, more than the architecture. Machine learning drives clustering, cross chain tracing and investigative agents, but an attributed graph and rules driven screening would remain without it.

The Co Case agent is built to speed up an investigator's judgment rather than replace it, and Ardence leaves the conclusion with the investigator, with every finding linked to its source. When a team's own agents work alerts through the MCP server, every disposition needs a written justification and each action is logged as agent originated. Institutions author their own monitoring rules, and case management assigns an owner and shows what triggered each alert through to closure.

Every output carries its source and a confidence level, so an examiner can interrogate a single decision, and release notes and a technical blog explain method. Model documentation, a drift monitoring cadence and a validation package fit for SR 26 2 are absent.

Case studies end in public legal outcomes with named parties, such as a $15 million forfeiture from a fentanyl vendor worked with Homeland Security Investigations and a Royal Thai Police investigation that ended in a 28 year prison sentence. More than 600 government agencies and financial institutions use the platform, and an annual crypto crime report traces its figures to a stated method.

Investigation data, tipline reports and screening queries could shape attribution served to other customers or train the investigative agents, and no published statement says whether they do. Compliance certifications and privacy framework membership leave that open.

Its privacy policy, last updated September 1, 2023, defers client data handling to contracts and gives no retention period, alongside Data Privacy Framework membership. Public blockchain records make the core input lighter than identity heavy screening, but customer identifiers enter once a bank runs due diligence on its own records.

Certificate dates and audit periods are not shown, but the set is broad. SOC 2 Type II reports and executive summaries of the annual third party penetration test come on request, and ISO 27001, ISO 27701 and UK Cyber Essentials Plus certificates are available through a Drata trust center. Federal agencies reach the platform under a FedRAMP High authorization granted in December 2024 through the Palantir Federal Cloud Service listing.

Supervised institutions and the supervisors who examine them buy the same platform, and its intelligence has supported sanctions designations, a dual position disclosed openly. Former federal prosecutors and Treasury financial intelligence staff in leadership make the provenance legible, and TRM holds no financial license.

Attribution accuracy, false positive rates and an independent audit of the method are not published. That evidence matters because an attribution can freeze funds, close an account or support a prosecution against someone with no relationship to TRM.

A correction route for the owner of a wrongly attributed address, an accuracy guarantee and an error rate are not published, though funds can be frozen on a label the owner cannot see. What TRM does offer is a basis to challenge: traces are built to be defended or attacked in court, every attribution shows its source and confidence score, and reviewers can retrace the methods and human decisions behind an Ardence finding.

The model providers behind TRM's own agents and a subprocessor list are not named. Attribution is first party and threat research proprietary, and Ardence adds a data network of more than 60 named partners, ComplyAdvantage, Bitsight and DarkOwl among them.

Exchange, core banking and case management integrations are not named. One application programming interface delivers TRM's intelligence at an average latency under 500 milliseconds, bulk data feeds are offered, and the MCP server lets a team's own agents, in Claude Code, Google Gemini, OpenAI Codex or a custom build, pull alert context and record dispositions. Beacon Network alerts virtual asset providers when flagged funds arrive.

Classified networks are supported through a separate government environment, a genuine boundary for defense and intelligence work. Commercial data sits in geographically dispersed data centers with no named regions, and in country options are not enumerated.

Pricing runs through a demo request, and a return on investment calculator for law enforcement aids costing without giving a price. Compliance360 is sold as one end to end package for compliance teams rather than as itemized tools.

Law enforcement, national security, financial services, enterprise security, and regulators and revenue agencies each get their own solution material, and public and private sector buying are treated as different problems. More than 600 agencies and institutions in 75 countries use the platform, and TRM Academy trains their teams.