Elliptic: crypto screening, counterparty intelligence and investigations

Elliptic assesses crypto-asset activity and exposure. For brokers handling digital-asset payments or counterparties, its intelligence supports onboarding, transaction review and investigations. Lens combines wallet and transaction screening with continuous monitoring in one workspace.[1]

Discovery’s counterparty checks can support correspondent relationships and Travel Rule diligence. A VASP profile is an assessment of a crypto business, including its activity and relative risk, rather than verification of every person using its addresses. Its month-to-month comparison makes changes in counterparty behaviour visible alongside the current score.[2]

Continuous Monitoring was announced as available across Elliptic solutions on 1 July 2026. New labels, counterparty intelligence and cluster changes can trigger rescreening against the customer’s own rules. Notifications can depend on score thresholds, score changes or triggered rules, so ongoing observation can be narrower than sending every data update into the review queue.[33]

The AML API supports both a provider-hosted analyst interface and integration into an existing transaction-monitoring system. Batch submission suits higher volumes; synchronous requests return an immediate analysis in the same exchange. The client controls what it submits and when, and can retrieve results, assign cases and maintain notes from its own workflow.[6]

Official SDKs cover Node.js, PHP and Python. Elliptic advises against embedding API keys in browser applications. Manual authentication signs the request with HMAC-SHA256, using a key, secret and millisecond timestamp; the signature also depends on the method, path and payload. A frontend integration therefore needs a backend that protects credentials.[7][8]

Webhooks are self-configured with one destination URL per configuration. Elliptic supports signature verification, not API-key authentication, for these deliveries. The envelope follows CloudEvents; its time field records the delivery attempt, not the underlying screening time. Separate configurations are needed for multiple destinations.[11]

The dedicated Slack integration is separate from the webhook setup: a Slack incoming-webhook URL will not work as a normal Elliptic webhook destination. Slack messages can identify a new screening, a manual rescreen or a Continuous Monitoring risk-score change.[12]

Event payloads retain both analysis and screening identifiers, customer references, previous/current risk scores, triggered rule identifiers and detailed contributions. Keeping those distinctions allows a broker to connect a changed alert to the correct historical screening instead of replacing the evidence behind an earlier decision.[13]

Sumsub documents an integration using the customer’s own Elliptic API key and secret. It requires an Elliptic contract, product access and configured risk settings, followed by activation of the Elliptic rule bundle in Sumsub. Elliptic risk data can then be combined with account events such as password or two-factor-authentication changes. That integration does not make the two subscriptions interchangeable.[32]

The public AWS Marketplace listing offers a private-quote route and two 12-month screening dimensions. These are Marketplace subscription figures, not per-screen charges or a price for every Elliptic product. Additional AWS infrastructure charges may apply. The listing does not quantify the screening allowance represented by one unit.[21]

A separate public trial offers 14 days free after verification. It covers trying screening, monitoring and investigations, but its page does not publish a production deployment commitment or a universal screening allowance. Trial verification and the commercial implementation remain different steps.[26]

The listing’s EULA is the 7 November 2023 AWS Standard Contract. Its provisions apply to subscriptions offered on that basis; agreed amendments and relevant privacy terms take precedence. Material breach generally has a 30-day cure period after written notice.[22]

Implementation needs a stable customer reference and the right analysis direction. Transaction screening distinguishes source-of-funds exposure from destination-of-funds exposure; those are different questions about a payment’s surrounding activity. A supplied customer reference creates a new customer record if no matching one exists.[15]

Risk configuration is part of the operating model. Elliptic’s platform lets teams set thresholds and alerting logic, while the AML API can query risk rules and transfer results into an existing monitoring system. A migration should preserve the configured policy and case references, not only the latest numerical score.[6][33]

The API’s system rescreening runs daily for three days on analyses that returned 4xx or 5xx errors. Continuous Monitoring instead reacts to risk-relevant changes, alongside periodic rescreens at the configured cadence. The two mechanisms serve different purposes: retrying an unsuccessful analysis and refreshing an earlier risk assessment.[10]

Training is available as organisation-only product certification for Lens and Investigator. Elliptic describes six to eight hours of study through video tutorials and scenarios, with no prior experience required. This supports analyst handover and interpreting outputs; it is a training estimate, not an engineering rollout timetable.[25]

The provider reports SOC 2 Type 2 coverage across the five Trust Services Criteria, ISO 27001 information-security certification and ISO 22301 business-continuity certification. Its ISO 9001 quality programme also covers model, AI and machine-learning risk governance. Those public assurances describe control frameworks; the private audit reports and a customer-specific recovery schedule were not available in the inspected material.[24]

The Marketplace screening offer states 24/7 support for Elliptic-defined critical issues and 24/5 model testing, validation and adjustment support. These are coverage hours, without published response or restoration deadlines.[21]

The public status service separates Discovery, Investigator, Lens, Navigator, workspace administration, Continuous Monitoring and individual blockchain components. It provides incident history and update subscriptions. This is useful for distinguishing a chain-specific interruption from an application problem; a single status snapshot is not an uptime record or a contractual SLA.[27]

Elliptic supplies intelligence and configurable risk analysis. Its Ecosystem Monitoring page describes alerts that let the token operator decide whether to freeze or block a recipient; it does not describe Elliptic itself holding the issuer’s freeze authority. Similarly, screening evidence feeds the broker’s compliance decisions rather than granting permission to offer a financial service.[4]

Address attribution also has a specific evidential scope. Sumsub’s integration guide describes Elliptic grouping related addresses that appear to share control, then attributing clusters to known entities. Its blockchain table distinguishes network support from token support. An identified cluster, the individual customer’s identity and coverage of a particular token remain separate questions.[32]

The privacy notice says enabled AI features may process entered data and requires consent for enabling them and for AI processing of voice or image. It describes its AI use as outside automated decision-making. It also allows other specified AI processing under legitimate interests.[23]

Companies House lists Elliptic Enterprises Limited, number 08458210, as an active private company incorporated on 22 March 2013. Its registered office is in London; that address is a legal registration detail. The earlier company name was Bitxchange Ltd.[29]

Elliptic traces its business to 2013 and currently names Dr James Smith as founder and chief executive. Its development has centred on blockchain intelligence for financial institutions, crypto businesses and public-sector investigations.[30]

In May 2026 it announced a closed $120 million Series D led by One Peak, with Nasdaq Ventures, Deutsche Bank and the British Business Bank participating, at a stated $670 million valuation. This was an investment round, not an announcement of acquisition by Nasdaq or Deutsche Bank. The release links the funding to enterprise analytics and AI-enabled compliance development.[31]

Operator

Elliptic Enterprises Limited

Service scope

Crypto wallet/transaction screening, counterparty due diligence, monitoring and investigations.

Customer types

Financial institutions; Crypto businesses; Payment service providers; Government agencies

Delivery

Hosted; API

Pricing publication

Public and quoted pricing

Platforms

Lens; Discovery; Investigator; Data Fabric; Decode; Elliptic copilot

Integrations

AML API; AI API; Node.js/PHP/Python SDKs; Signed webhooks; Slack; Sumsub

Pricing scope

AWS lists annual per-unit screening tiers; private offers establish entitlement and wider product pricing.

Implementation

Backend API or hosted workspace, configured risk rules, customer references and analyst training.

Support

Marketplace screening support states 24/7 critical-issue and 24/5 model-support coverage.

Permissions and regulatory scope

Analytics and decision support; the customer controls risk policy and final compliance action.

Provider metadata checked 20 Oct 2026Source 29Source 30Source 1Source 6Source 21Source 18Source 2Source 3Source 27Source 5Source 19Source 7Source 11Source 12Source 32

Elliptic’s copilot summarises fund-flow graphs, explains exposure, drafts case documentation and suggests next steps. Its product page expressly requires a person to review and approve every AI recommendation before it becomes a case outcome. That control matters more than the general description of automated research: recommendation generation and final disposition have different authority.[18]

Decode serves a different purpose: users ask natural-language questions about entities, addresses or transactions and receive tables, charts or summaries with the query and reasoning shown. Results include attribution and flows and can be exported. The page directs users to verify results before acting; it describes intelligence retrieval, not payment execution.[19]

The public AI API also exposes wallet summaries by screening ID, with JSON or plain-text responses. This lets an integration attach an explanation to a particular screening rather than treating a generated summary as a replacement for the underlying record.[20]

For an AWS SaaS subscription under the linked contract, a written request before termination enables provider extraction within 45 days afterwards, unless another period is agreed. Alternatively, where self-service retrieval/deletion is available, the contract provides a 45-day post-exit window with reasonable assistance. Data must be extractable in a current non-proprietary format. Subsequent deletion is due within a reasonable time, with certification on request; undeletable material remains protected. These are contract-specific exit rights.[22]

Navigator remains named in API documentation and service-status components. Current Lens presents a unified workspace; these naming layers do not establish a universal Navigator shutdown or migration of existing subscriptions.[27][1]