TRM Labs: blockchain intelligence, crypto compliance and investigations

TRM Labs provides blockchain intelligence and investigation software for financial institutions, digital-asset businesses and public agencies. A broker may use the compliance tools when assessing crypto-related deposits, withdrawals, counterparties or payment relationships. The main workflow is to screen exposure, monitor changes and investigate the resulting alerts. Wallet screening, ongoing transaction monitoring and a forensic investigation are separate activities, with different inputs and outputs.[1]

Forensics can trace forwards or backwards through a transaction graph, identify patterns such as peel chains and layering, and add off-chain objects such as locations, financial institutions or physical assets. Its purpose is to help the investigator assemble relationships and a sequence of events. Attribution source and confidence remain relevant when interpreting a graph; a visually connected path is not itself a finding that every participant committed misconduct.[4]

BLOCKINT API supplies address activity, balances, transaction histories and entity/risk context for an organisation’s own applications. Time-bounded queries can retrieve transaction inputs, outputs and assets; entity and exposure information can enrich an existing investigation or compliance screen. This is an intelligence interface, rather than a payment-execution connection.[10]

TRM reports SOC 2 Type II, ISO 27001, ISO 27701 and Cyber Essentials Plus credentials through its Compliance Center, with security evidence available on request. It describes annual penetration testing and geographically distributed infrastructure. The public summary is the starting point for security review; the underlying reports contain the assessed period and scope.[20]

A published G-Cloud 14 schedule provides numerical reference prices for a UK public-sector offering. The 2024 document separates a named-user Forensics licence from a BLOCKINT API package; they are not the low and high ends of one licence price. Both figures exclude VAT. These framework prices do not establish the current negotiated rate for a commercial broker.[14]

The August 2026 private-sector agreement applies to Forensics only. Order Forms set fees; annual advance invoices are due within 30 days. Its default is USD, non-refundable payments and additional taxes. Renewal is automatic for one year, or the existing term if shorter, unless written non-renewal arrives at least 30 days before expiry. TRM may apply a 5% annual increase with 30 days’ notice before expiry.[15]

The G-Cloud listing describes customer-success support for account setup, basic training and escalation, with solutions engineers assisting API implementation. It also distinguishes portable work products from a full platform takeout: graphs can be exported as CSV, SVG, PNG or TRM format, while a complete data-download function is not offered under that listing.[17]

The current Data Processing Addendum covers personal data submitted by a customer for processing on its behalf. TRM acts as processor; the customer may itself be a controller or an authorised processor. The customer supplies the lawful basis and instructions.[18]

Customer data remains customer-owned under the Forensics agreement, subject to broad service/improvement licences, including perpetual rights over blockchain-related inputs.[15]

The October 2026 privacy policy also addresses TRM’s own collection of public, sourced and inferred information across its products, including Ardence. That processing is distinct from handling a customer’s submitted personal data under the DPA. Retention follows the relevant purpose and legal/business requirements, rather than one period applying to every dataset.[19]

The G-Cloud 14 listing describes 24/7 chat, UK telephone support 09:00–17:00 on weekdays, and 99.5% monthly availability with credit conditions in the service arrangement. These are scoped framework disclosures, rather than a universal response or restoration promise for all TRM products.[17]

The public status service separates US, EU and GovCloud components and names Forensics, Wallet Screening, Transaction Monitoring, BLOCKINT and Detect. Customers can subscribe to incident and maintenance notifications by channels including email, SMS, RSS and Slack. The component distinction matters when checking an incident against the actual service and region in use.[21]

Training includes on-demand courses, examinations, live instructor chat and role-specific learning paths. Investigator, compliance and specialist courses serve different roles; completion badges document training, rather than granting financial-services permission.[23]

TRM’s attribution combines public intelligence, clustering, manual review and data partners. The Forensics data description makes provenance and confidence part of interpreting an entity label. A compliance analyst can use that evidence to develop an investigation, but the analytical label is not a court judgment or an independent grant of authority to freeze funds.[24]

The privacy policy expressly says that inclusion in its services does not mean a person is suspected of wrongdoing and that decisions should not rely exclusively on its solutions. TRM’s financial-crime workflow assigns decisions such as clearing, restricting, escalating or reporting activity to the responsible institution and officer.[19][30]

The Forensics agreement requires prior written approval to share outputs—including screenshots and charts—with third parties, courts or regulators; a separate clause addresses legally compelled disclosures.[15]

Ardence’s underlying sources can vary with customer eligibility, jurisdiction and supplemental terms. Its ability to assemble evidence or draft a request does not remove those source-use conditions. This is particularly relevant when an institution wants to move investigative material into an external report.[30]

The private-sector Forensics agreement identifies TRM Labs, Inc., a Delaware corporation, as the contracting company.[15]

TRM announced a USD 70 million Series C financing on 4 February 2026, led by Blockchain Capital, at a stated USD 1 billion valuation. Returning backers named included Citi Ventures, Brevan Howard Digital and Goldman Sachs; Galaxy Ventures joined the round. TRM linked the financing to expansion in blockchain intelligence and AI.[25]

Ardence’s October 2026 launch broadens the product set beyond on-chain tracing into investigations across several information sources. TRM described the platform as available at launch, with findings linked to underlying evidence and a human investigator responsible for conclusions.[9]

Operator

TRM Labs, Inc.

Service scope

Blockchain intelligence, wallet screening, transaction monitoring, forensics and AI-assisted investigations.

Customer types

Financial institutions; Digital-asset businesses; Public agencies

Delivery

SaaS; API; Managed service

Pricing publication

Public and quoted pricing

Platforms

TRM Forensics; Wallet Screening; Transaction Monitoring; Ardence; BLOCKINT API

Integrations

Operational MCP; Documentation MCP; Chainabuse API

Pricing scope

Contract-specific commercial pricing; a dated G-Cloud 14 schedule publishes separate Forensics and BLOCKINT reference charges.

Implementation

Account provisioning and training, with solutions-engineering assistance for API workflows.

Support

Public status notifications, training and scoped support commitments in the applicable service documents.

Permissions and regulatory scope

Intelligence and investigation tools support customer risk decisions; financial actions remain with the responsible institution.

Provider metadata checked 20 Oct 2026Source 26Source 9Source 10Source 12Source 11Source 25Source 17Source 8Source 30Source 1Source 14Source 21Source 15

Ongoing monitoring can find risk changes after an initial screen. Transaction Monitoring retains the triggered rule, severity/category changes, ownership and notes around a case; the analyst can review the history and record closure. A broker therefore needs to distinguish the original transaction-time result from a later re-screening result when reconstructing why an alert appeared.[3]

The September 2026 update describes an account-level velocity rule that totals dollar transaction volume over 24 hours, independently of a risk-category filter. This is a distinct signal from exposure to a particular illicit entity: unusual aggregate activity can warrant review even when the individual counterparties did not trigger that category rule.[27]

Entity Due Diligence can track profile changes and compare a service provider against peers. It combines licensing, KYC and adverse-media context with blockchain activity; cited answers and alerts help the reviewer revisit an existing relationship as information changes. Know Your Asset instead concentrates on the token or stablecoin itself, including holder concentration and flows.[5][6]

Chainabuse is a separate route to reported scam information. The standard API key is limited to 10 calls per month and 50 reports per call; partner access has different limits. Its verification guidance distinguishes trusted contributors, checked reports and confidence indicators. Incorrect reports can be flagged for review, and a report is not guaranteed to be accurate merely because it appears in the dataset.[28][29]

Compliance Advisory offers defined work such as VASP due diligence, product/customer/geographic risk assessments, alert-design blueprints and indirect-exposure analysis. The published free scoping meeting is an introduction to that work, not a statement that the full engagement is free. Separately, Investigation Support describes embedded investigators, hours-based assistance and office-hour case clinics, principally for agency casework.[26][31]

On Forensics expiry or termination, access stops and customers must destroy controlled copies/backups of TRM Reports and associated materials. Continued customer-data access is not guaranteed. Termination for breach or non-payment accelerates remaining fees.[15]