Crypto AML compliance software: from alert to SAR

US financial institutions filed about 4.7 million suspicious activity reports in fiscal 2024, FinCEN says, about 12,870 a day. Behind each one sits a chain of software: a check that identified the customer, a scan that scored the wallet, a rule that raised an alert, and a case file that turned the alert into a report. Crypto AML compliance software is that chain.

Why the work needs machines

Chainalysis counted at least $154 billion received by illicit addresses in 2025, and still put it under 1% of all crypto transaction volume. Stablecoins carried 84% of that illicit flow. An analyst cannot read a million transfers to find the one that matters. Software does the first pass and leaves people the judgment.

The five layers

• Identity verification. The customer uploads an ID and a selfie; the system checks the document, matches the face and screens the name against sanctions and politically exposed persons lists.
• Wallet screening. Before a deposit is credited or a withdrawal leaves, a blockchain analytics service scores the counterparty address: exchange, mixer, darknet market, sanctioned entity, hacked funds. Chainalysis, Elliptic and TRM Labs sell this data.
• Transaction monitoring. Rules and models watch behaviour over time: a new account that receives many small deposits and sends one large withdrawal, or funds that pass through a bridge minutes after a hack.
• Travel Rule messaging. For transfers of $3,000 or more in the US, the system sends sender and recipient details to the other exchange, and checks whether the other side is an institution or a self-hosted wallet.
• Case management and SAR reporting tools. Alerts become cases, analysts add evidence and a narrative, and the tool tracks the deadline and prepares the filing.

The analytics layer is the one most people see in the news. When the Binance hack moved money across 11 blockchains on 29 October, Elliptic and Chainalysis traced the flows within hours, and Tether froze the largest stablecoin wallet 37 minutes after the funds arrived. Our hack timeline shows how fast that screening data reaches exchanges.

From alert to report

A typical case runs like this. Wallet screening flags a deposit that came, two hops back, from an address linked to a sanctioned exchange. The alert opens a case. An analyst checks the customer's profile, the size of the deposit and earlier activity, and decides whether the facts amount to a suspicion. If the transfer involves $2,000 or more and the answer is yes, a money services business must file a SAR within 30 calendar days of first detecting those facts, under 31 CFR 1022.320. It then keeps the report and evidence for five years and cannot tell the customer.

The narrative is the part regulators read most closely: who, what, when, where, and why it looked wrong. Good SAR reporting tools pre-fill the facts from the case, keep the on-chain evidence attached and leave the analyst to write the reasoning. FinCEN accepts filings through its BSA E-Filing System, one at a time or in batches.

“these totals will be higher as we continue to identify more illicit addresses”

— Chainalysis, 2026 Crypto Crime Report, January 2026, as quoted by The Block · theblock.co

That sentence explains why screening is never done once. An address that looks clean today can be labelled next month, so many platforms rescreen past deposits when their data changes.

Choosing a platform

The search terms crypto AML compliance solutions and platforms cover very different products. Five questions sort them:

• Coverage: which chains and tokens it scores. With stablecoins at 84% of illicit volume, Tron and Ethereum stablecoin coverage is the minimum.
• Attribution data: how the vendor labels addresses, and how fast new hacks and sanctions designations appear. In September the Senate counted 846 sanctioned Iranian wallets, 84% on USDT.
• Explainability: whether an examiner can see why the system raised or cleared an alert.
• Audit trail: a record of who decided what, and when, for every case.
• Integration: whether it fits your wallet infrastructure and Travel Rule provider through an API, or needs manual exports.

Small firms often buy screening and Travel Rule as services and keep case management simple. Large exchanges build their own monitoring on top of bought data.

Our count

• 4.7 million SARs a year is about 12,870 a day, and the ten largest filers produce 45% of them, roughly 2.1 million.
• 84% of $154 billion means about $129 billion of illicit flow moved in stablecoins in 2025.
• Under 1% illicit means fewer than $100 in every $10,000 of transfers. Software has to find that $100 without freezing the other $9,900.

If you run compliance at a crypto firm, judge software by the cases it produces: an alert that never becomes a reasoned decision is noise an examiner will ask about. If you are a customer, the delay on a deposit you did not expect is often this chain at work.

This article describes how compliance tools work in general and does not recommend specific vendors. Figures come from FinCEN's FY2024 Year in Review and Chainalysis's 2026 Crypto Crime Report.