Chainalysis: blockchain screening, investigations and risk intelligence

Chainalysis supplies blockchain data and analytical tools to financial institutions, cryptocurrency businesses and investigators. Its financial-institution offering covers digital-asset custody, brokerage, stablecoin payments and tokenization. For an FX broker, the practical connection is a crypto deposit or withdrawal flow, digital-asset service, or exposure to a crypto counterparty. The tools can add evidence to those workflows; they do not operate the broker’s FX execution or client account ledger.[1]

Data Solutions is the more configurable analytical environment. It exposes curated datasets through SQL, Python and no-code tools, with Jupyter notebooks for custom workflows, alerts, dashboards and APIs. It can serve a team building its own exposure analytics or monitoring patterns beyond the standard KYT screens. Its interface also supports bulk exports into the customer’s environment, making the contracted data rights especially relevant.[8]

These offerings answer different questions. VASP Risking adds the service’s legal and operational context and compares exposure with category peers. Its published FAQ describes daily time resolution and automatic notifications when a monitored service’s rating changes. A rating is therefore a configurable risk indicator about a counterparty, rather than a substitute for the broker’s own onboarding approval.[4]

Address Screening supports both a user interface and API integration. The UI alerts users when a risk score changes; an API integration must call again to obtain the updated assessment. Its exposure view is described as network agnostic, while Reactor’s investigative exposure is network and asset specific. That difference matters when carrying a screening result into a detailed transaction investigation.[3]

MSA restrictions cover bulk extraction outside normal functions, caching, dataset combination and AI training. Data Solutions exports still require licensed permissions.[10]

Chainalysis sells through negotiated private offers. Its Crypto Compliance AWS listing expressly says displayed prices are informational and actual prices can change. The published dimensions below are useful evidence of the commercial structure, but do not establish what one analyst seat, API request or screened address costs.[16]

The Data Solutions listing also displays a $1 contract add-on meter without defining a universal unit of delivered service. It should not be interpreted as a $1 screen, seat or API call. The agreed offer determines the quantity and additional usage charged.[18]

The Address Screening FAQ says API rescreens incur no extra cost. That statement needs to be reconciled with the package-specific counting rules above before relying on free repeat screening.[3]

KYT implementation includes configuring the categories, behavioural signals, direct and indirect exposure thresholds that generate alerts. Its custom address lists allow institution-specific intelligence to enter the workflow. Teams can review and manage alerts in bulk, then escalate into Reactor where a transaction needs deeper tracing. This separates detection configuration from the investigative work needed to resolve a case.[2]

Reactor is offered in cloud and on-premises environments. The selection changes how the investigative application is delivered; it does not imply that every other Chainalysis product can be installed on the same basis. Investigators can combine on-chain graphing with annotations and off-chain context, which is important when documenting the reasoning behind an escalation.[6]

Chain, the current blockchain-intelligence agent, is explicitly a beta available to Data Solutions customers through their account team. It can turn natural-language instructions into graphs, reports, dashboards and workflows. Chainalysis says each run records inputs, data sources and actions, and that users determine how much autonomy to allow. Available model choices include Google DeepMind, Anthropic and OpenAI. The product distinguishes dynamic reasoning from the code-based workflows it generates; deterministic execution does not make the underlying evidence infallible.[9]

The processing addendum places the customer in the controller role and Chainalysis in the processor role. Its examples include Reactor graph names and notes, custom addresses, user IDs, alert actions and monitored transactions. It specifies encryption in transit and at rest, least-privilege access and separation of development, test and production. Subprocessor changes require reasonable advance notice and allow objections on reasonable privacy grounds.[13]

Global Services supplies expert coaching, training and organizational enablement alongside the software. Its published scope includes complex investigations, developing intelligence workflows and establishing a center of excellence. This can help an institution build a repeatable analyst process, but the service description does not transfer the institution’s compliance approvals to Chainalysis.[15]

Support v4.1 applies to direct licensees; Silver is the default if the Order omits a tier. The figures are first-response targets, not resolution commitments. The clock starts on receipt through the appropriate written channel; business-hour measures run from the next business-hours interval. Level 1 requires the designated emergency email.[12]

The MSA commits to 99% monthly availability, excluding specified maintenance, updates and external failures. Trials, Beta, Launchpad, professional services, test environments and on-premises software are excluded. Trials and Beta permit internal evaluation only, without Support Policy coverage; access may end and data may be deleted without notice.[10]

Academy learning is self-paced and included with a licence, with available tracks depending on the products purchased. Private training delivers live instruction in cohorts of up to 15 or 30. Certifications have verifiable digital badges; the asset-seizure course is restricted to qualified government professionals. Training access therefore needs to match the team’s operational role as well as its product entitlement.[26]

Chainalysis explains that grouping addresses and identifying the entity behind them are separate tasks. Attribution combines blockchain structure with off-chain evidence such as service interaction, seized records, third-party confirmation or open-source intelligence. An exchange-controlled address can represent many users: the operator holding keys and the beneficiary are not necessarily the same person. Its own guidance describes attribution as intelligence whose confidence and supporting evidence must be assessed. A risk label alone therefore does not establish unlawful conduct or complete a broker’s customer-identity verification.[22]

The customer-facing financial-institution proposition is an extension of AML, sanctions and fraud controls into digital assets. The broker or financial institution still determines its own risk appetite, customer decisions and response to alerts. Use by regulators is not a financial-services permission granted to the customer, and the product does not confer authority to seize or freeze an asset.[1]

On exit, the MSA generally requires deletion or return of licensed data. Paid customers may retain normally extracted data for internal diligence files required by law or regulation, with surviving confidentiality and use restrictions.[10]

Personal-data deletion follows a separate rule: the DPA calls for deletion or anonymization after termination, with legal, backup and records-retention exceptions and continued protection where deletion is impracticable. It requires breach notification without undue delay after awareness, rather than publishing a fixed hour count. The March 2026 Privacy Notice covers Chainalysis’s own controller activities, including account, website and Academy information; it expressly excludes processing performed as a service provider.[13][14]

Chainalysis was founded in 2014. Its current leadership page identifies co-founder Jonathan Levin as chief executive, and describes customers across government, exchanges, financial institutions and cybersecurity. The product family has developed around shared blockchain intelligence serving both public-sector investigations and private-sector risk management.[19]

A May 2022 financing announcement reported a $170 million Series F led by GIC, with participating investors including BNY Mellon, Accel and Blackstone. The reported $8.6 billion valuation belongs to that financing event. In January 2025, Chainalysis announced that it had acquired Alterya, expanding its fraud-prevention work across cryptocurrency and traditional payment identifiers.[20][21]

The Order names the supplier; without one, the MSA defaults to Chainalysis Inc.[10]

Operator

Chainalysis entity named in the Order; Chainalysis Inc. by default

Service scope

Blockchain transaction monitoring, wallet and counterparty screening, investigations, fraud intelligence and custom analytics.

Customer types

Financial institutions; Digital-asset businesses; Public-sector investigators; Corporate investigation teams

Delivery

SaaS; API; On premises

Pricing publication

Quote only

Platforms

KYT; Address Screening; VASP Risking; Sentinel; Reactor; Alterya; Data Solutions; Chain agents beta

Integrations

BVNK Layer1; Penlink

Pricing scope

Private offers; AWS displays informational contract dimensions rather than universal unit prices.

Implementation

Configure monitoring and investigation workflows, entitlements and integrations around the selected products.

Support

Tiered direct-licensee support and product-dependent Academy training.

Permissions and regulatory scope

Analytics and risk intelligence support institutional decisions; attribution is not conclusive proof of identity or unlawful conduct.

Provider metadata checked 20 Oct 2026Source 3Source 22Source 16Source 23Source 19Source 1Source 10Source 24Source 6Source 15Source 26

For day-to-day investigations, Data Solutions can identify patterns and prioritized targets, while Reactor follows the detailed flow of funds. The combination is useful when a team needs both portfolio-level monitoring and a documented case narrative. A shared dataset does not remove the need to preserve each alert’s settings, time window and investigative context when interpreting the result.[8]