Chain by Chain
A practical approach to assessing public blockchains for financial crime risk
Over the last few years, I have often seen product teams propose services that use a public blockchain, only for it to be rejected for risk reasons; because anyone can join the network, no single party controls it and the usual contractual safeguards are not available.
That caution is understandable, but it can lead firms to treat all public blockchains as if they present the same risk. This article follows Compliance by Design, in which I described a financial crime engine that I tested with transfers on private and public chains. While that work considered how a firm could control the risk, this article considers how it could assess the risk of an individual chain before deciding whether to use it.
There are good reasons for caution
Public blockchains remove several controls that banks normally expect to have. There may be no operator from which to request information, no legal entity on which to serve a notice, and no contract containing service levels or exit rights. Validators, which are the machines that confirm transactions, may be operated from many countries, while the people behind wallet addresses are generally not identified on the ledger. Taken together, these features make a public network less familiar and less directly controllable than traditional financial infrastructure.
The prudential rules reflect these concerns. The Basel Committee’s standard gives assets on permissionless chains, which anyone can join, a 1250% risk weight and limits a bank’s total exposure to 1% of its core capital. In practice, the risk weight requires capital equal to the full value of the position. The committee concluded that the risks, which included money laundering and terrorist financing alongside operational concerns, could not be reduced sufficiently at the time, although it also noted that technical solutions might develop quickly. Those solutions have continued to develop, but many risk frameworks still use the same broad assumptions about public networks.
Firms already have some exposure
Several papers published over the last year, including responses to the FCA’s recent publications on cryptoasset rules, have argued that keeping regulated firms away from public networks has not removed the underlying activity and may instead have moved more of it to providers with fewer controls. These papers generally treat a public blockchain as infrastructure, in much the same way as the internet, and suggest that regulation should focus on the service a firm operates on that infrastructure and on the customers who use the service.
This distinction matters because firms can encounter public blockchains without choosing to build products on them. Tron carries about 28% of stablecoin supply and therefore appears in payment flows that regulated firms may be asked to receive or screen. A compliance team reviewing incoming funds is already dealing with these networks to some extent, so the practical question is not simply whether the firm uses public blockchains, but whether it has enough information to understand the relevant exposure.
There has also been more institutional involvement in network operations. In a sample of the thirty largest proof-of-stake networks, where validators provide capital to help secure the chain, fifteen had an enterprise validator, and one recent paper identified 49 enterprises carrying out this work. Tempo, a payments chain that reached mainnet in March 2026, includes an anchor validator run by Visa and another run by Standard Chartered’s Zodia Custody. This does not remove the risks, but it means that, for some networks, a financial crime team can identify regulated organisations involved in operating the infrastructure.
The ledger can support financial crime work
On a transparent blockchain, transfers are recorded publicly and remain available for later review. An investigator can therefore examine the transaction history without first requesting records from another bank and waiting for a response. This can allow compliance checks to take place closer to the time of a transaction, rather than relying entirely on a later reconstruction of events.
The reported level of illicit activity should also be considered in context. Illicit addresses received a record $154 billion in 2025, which is a significant amount, but it represented less than one percent of total on-chain volume. Because much of the activity is concentrated, firms may be able to direct controls towards known services, addresses and transaction patterns instead of treating every transaction as presenting the same level of risk.
Responses to the FCA’s recent work on cryptoasset regulation have made a related point: because positions and transactions can be queried in real time, the transparency of these networks is itself a supervisory resource. The same information can support a firm’s financial crime work, although many firms have not yet made full use of it.
Controls are available at several levels
Controls on public blockchains can operate at the asset, network and firm levels, with each level addressing a different part of the risk.
At the asset level, large stablecoin issuers can freeze their tokens on supported networks. BlockSec reported that Tether blacklisted 3,506 Tron addresses and 657 Ethereum addresses during 2025. On Gnosis Chain, the token used to settle card payments is regulated electronic money issued by a named, FCA-authorised firm, which means that the regulatory status of the asset continues to matter when it is used on a public network. Newer token standards, including Solana’s Token-2022, also provide functions such as allow-lists, block-lists and delegation controls.
At the network level, a firm can screen validators in a similar way to other counterparties if it is concerned about paying fees to a sanctioned operator. Commercial services already provide allow-lists and block-lists for network nodes, although using them may add some delay to a transaction. The involvement of regulated or otherwise identifiable operators can also make parts of the validator set easier to assess.
At the firm level, compliance checks can be included in the settlement process instead of being carried out the following day. In the engine described in Compliance by Design, a transfer did not settle until the applicable checks had passed, while a token on a public chain could reject a transfer when the counterparty was not eligible. External vendors supplied information, but the decision remained within a framework controlled by the firm.
The regulatory approach is beginning to reflect the distinction between a network and the service built on it. The FCA’s consultation CP25/25 proposes that a cryptoasset firm’s use of a permissionless blockchain should not be treated as an outsourcing arrangement. Since a firm cannot enter into a contract with a protocol, the standard outsourcing framework does not fit easily, and the proposal instead treats the network as infrastructure. For a financial crime team, that framing supports the approach described above, in which the firm’s controls attach to its own service and its customers.
The assessment should focus on the individual chain
These developments do not mean that every public chain is suitable for use by a regulated firm. They do, however, suggest that the assessment should consider which chain is suitable for a particular product instead of treating all public chains as a single category.
Get Soorajmuhammed’s stories in your inbox
Join Medium for free to get updates from this writer.
A standard financial crime risk assessment considers the customer, product, geography and delivery channel. A digital asset service adds the settlement network as a further area for review. Firms have established sources for assessing geographic risk, including sanctions lists and FATF publications, but there is no equivalent common framework for comparing blockchains.
The available evidence is also less complete than it may first appear. Of the three main analytics providers, only TRM publishes a list of the chains it covers, with 189 listed when I last checked. Chainalysis publishes totals that do not agree with one another and does not identify the individual chains, while Elliptic moved its list behind a customer login in June 2026. These coverage statements are not dated, which can make it difficult for a firm to show which networks its provider covered when a particular screening check was completed.
This is important because a screening result is only as reliable as the underlying coverage. A result showing no identified risk may mean that the activity was checked properly, but it may also mean that the provider had limited information about the relevant chain. Without a clear record of coverage, those two outcomes can look the same.
The differences between networks also depend on the intended use. A chain that is suitable for custody may not be suitable for payments. Tempo has a relatively strong accountability profile, but its analytics coverage remains more limited than that of established networks. Hyperliquid holds a large pool of USDC outside Ethereum, although there is no regulated network operator to which an information request can be sent. Monero is designed in a way that prevents the type of tracing described above. A single label does not describe these differences well enough for a product decision.
ChainGauge
I built ChainGauge to provide the assessment framework that I had found difficult to obtain elsewhere. It rates 51 public blockchains for financial crime risk by considering six factors:
- whether transactions on the chain can be traced
- whether analytics providers cover the chain
- how concentrated illicit activity is
- whether assets can be frozen or seized
- whether an identity can be linked to a transfer
- whether there is an organisation that can receive legal requests
Each factor is rated separately so that a strong result in one area does not hide a weakness in another. The six ratings are combined into an overall grade from A to E, with the weighting adjusted for the type of product because custody and payments do not create the same risks. Each rating includes its reasoning and, where available, a source, while changes are published with a date and an explanation. At present, 166 of the 306 factor ratings include a source that a reader can open, and each chain page states its source count before presenting the ratings.
The grades broadly support the argument that chains should be assessed separately. Most of the A and B grades belong to large, transparent networks whose activity can be observed and screened and where an accountable organisation can generally be identified. Most E grades belong to networks that use privacy by default and therefore do not support the same checks, while the chains between those groups may be usable when additional controls are applied.
The assessment will require correction as the networks, available evidence and provider coverage change over time. For that reason, the site includes a feedback form through which a reader can challenge a factor by providing a source, suggest a chain that is not included or report a technical problem without creating an account. The outcome of each review, including cases where I do not make a change, is recorded together with the reason for the decision.
Conclusion
A compliance team considering a new market needs both a way to control the risk and a way to assess it. Tools for both tasks are now available on public blockchains, although their quality and suitability vary by network and product. The engine described in my earlier article was an attempt to address the control question, while ChainGauge is intended to support the assessment question. The site is available at ChainGauge, and the ratings are open to challenge where better evidence is available.
Sooraj Muhammed works on financial crime and digital assets. This is a personal project and the second in a series that began with Compliance by Design. The views are my own and not those of my employer or its clients, and no employer was involved in or reviewed the work. The project is not affiliated with any blockchain, analytics provider or vendor, and nothing in this article is legal, compliance or investment advice. Sources for the figures: the Chainalysis 2026 Crypto Crime Report for the illicit-volume figures; a 2026 paper by Ubyx and stakeFi for the enterprise-validator counts; BlockSec’s report of 30 January 2026 for the blacklisted-address figures; Visa’s press release of 14 April 2026 for the Tempo validator facts; the BCBS cryptoasset standard for the Basel treatment; and vendor websites, checked on 14 August 2026, for the stablecoin share and coverage positions. The FCA’s CP25/25 consultation contains the outsourcing proposal.
