News

  1. Home
  2. News
Following Value Across Blockchains: The Intelligence Gap in Modern Banking
News by Eusebiu Voinea

Following Value Across Blockchains: The Intelligence Gap in Modern Banking

Hybrid payment rails have become normal. The information needed to oversee them is still too often fragmented.

 

A recent article by OneSafe on transaction-monitoring gaps in banking across blockchains makes an important point: financial institutions cannot bolt compliance onto blockchain-based services after a product has gone live. Monitoring has to be part of the operating model from the outset.

But treating the problem as a matter of selecting a sufficiently capable platform makes it sound more contained than it is. The real gap is not simply a lack of wallet screening. It is an intelligence gap: the inability to turn data from bank accounts, blockchain transactions, customer records, counterparties and investigations into one coherent, defensible view of risk.

This matters because a modern payment can cross several worlds in minutes. A customer funds an account by bank transfer, receives a blockchain-based unit of value, sends it to a self-hosted wallet, moves it through a bridge, and later redeems it through another provider. Each party may see a legitimate fragment. No party is guaranteed to see the whole story.

For supervisors, investigators and compliance teams, that is the hard part.

A ledger is not an intelligence picture

Public blockchains produce an unusually rich transaction record, but a transaction record is not the same thing as an intelligence picture. An address does not explain who controls it, why value moved, what relationship the parties have, or whether the apparent risk is current, historical or merely inferred.

Traditional transaction monitoring is built around accounts, counterparties and behaviour over time. Those concepts still matter in blockchain-enabled financial services, but they have to be joined with on-chain information: wallet attribution, exposure to known typologies, asset and chain characteristics, bridge activity, and the changing risk associated with a service or entity.

The result should not be a bigger pile of alerts. It should be a better case file.

That distinction is easy to miss. A provider can screen an address at the point of transfer and still fail to answer the questions an investigator or supervisor will later ask: What did the institution know at that moment? Which data supported the risk decision? What rule triggered the alert? Was the customer’s activity consistent with the explanation obtained at onboarding? What changed after the initial review?

Unless those questions can be answered with dated, reproducible evidence, “real-time monitoring” is more of a marketing claim than a control.

The weakest point is often the hand-off

Risk does not neatly remain on one rail. It is created in the seams between them.

A bank may understand a customer and the fiat leg of a payment. A regulated provider may see the on-chain transfer. An analytics provider may identify exposure to a risky cluster. A correspondent, custodian or issuer may hold further relevant information. Yet these observations are commonly held in separate systems, described in incompatible ways and reviewed against different risk appetites.

This fragmentation has practical consequences:

  • A sanctions or high-risk exposure may be identified after the transaction has already passed a point where an intervention is effective.
  • Travel Rule information may be present but incomplete, inconsistent or disconnected from the on-chain event it is meant to contextualise.
  • An alert generated by one party may be impossible for another to interpret because the underlying labels, confidence level and provenance are unavailable.
  • A later investigation may reconstruct the flow of funds but not the decision-making process that allowed, rejected or escalated it.

None of this means that every transfer involving a self-hosted wallet, bridge or indirect exposure is suspicious. It means the institution needs a risk-based way to assess the context rather than treating technical novelty as either automatic suspicion or automatic permission.

Regulation is moving from rule-making to proof of execution

The direction of travel is clear. The FATF’s July 2026 update reports that 83% of surveyed jurisdictions have passed Travel Rule legislation, up from 73% in 2025. Its more important finding is that major gaps remain in putting those rules into practice: risk assessments are not always translated into effective controls; supervisory reach remains uneven; and stablecoins, unhosted wallets, offshore providers and decentralised-finance arrangements continue to create difficult points of exposure.

The key shift: Regulation is no longer only about a firm having a policy. It is about whether the firm can prove that its data, thresholds, escalation process and governance work across both fiat and on-chain activity.

In the EU, Travel Rule guidance requires relevant regulated providers to detect and manage missing or incomplete transfer information. The EU Anti-Money Laundering Authority has likewise emphasised that effective AML/CFT systems must be in place from the first day of authorisation, not retrofitted after a problem occurs.

Indirect exposure is where judgement begins

Direct links to a sanctioned address or a known illicit service call for clear action. Indirect exposure is harder. It is also where monitoring programmes reveal their real maturity.

Industry benchmarking published in 2026 found that indirect-exposure alert thresholds are often 10 to 20 times more lenient than direct-exposure thresholds for categories including ransomware, fraud and sanctioned jurisdictions. The precise thresholds in any one programme should not be copied blindly; each institution’s exposure is different. Still, the underlying question is a useful one: can a firm explain why a particular degree of indirect exposure warrants review, restriction, enhanced due diligence or no action at all?

That requires more than an address label. It requires calibrated rules, typologies, trained analysts, quality assurance and feedback from completed investigations. It also requires an honest view of the limitations of analytics data. Attribution changes. Entities merge or split. Behaviour that appears suspicious in isolation can be innocuous in context, and the reverse is equally true.

What a stronger monitoring architecture looks like

The answer is not a single global database or unrestricted sharing of personal data. It is a more disciplined approach to interoperability and evidential quality.

A credible architecture should include:

  1. A shared event model. Fiat movements, on-chain transfers, Travel Rule messages, screening results and case actions need durable links to one another. The basic unit is not merely an address or an account; it is a traceable transaction event with context.
  2. Provenance and confidence. Every label, risk score and attribution should carry information about its source, timing, methodology and level of confidence. Analysts need to know what they are relying on, and reviewers need to be able to revisit it.
  3. Governed thresholds. Alert settings should be approved, documented, tested against relevant typologies and reviewed when the firm’s products, counterparties or geographic exposure changes. “Industry standard” is not an adequate rationale on its own.
  4. Evidence-ready case management. A case file should preserve the decision path: what was observed, what information was sought, who decided, what action was taken and why. This is essential both for fair treatment of customers and for effective supervision.
  5. Meaningful public-private cooperation. Information sharing must be lawful and proportionate, but it also needs to be operational. Typologies, indicators and feedback should move quickly enough to improve controls before the next incident, not merely describe the previous one.

These are standards questions as much as technology questions. They go to data definitions, confidence measures, audit trails, investigatory practice and the vocabulary used by banks, regulated providers, analytics firms and authorities.

An open, shared language for blockchain intelligence

This is the gap that the Open Blockchain Intelligence Standards (OBIS) set out to close. OBIS is a global, open and vendor-neutral initiative, promoted and facilitated by Complexity Science Hub, the Blockchain Intelligence Professionals Association (BIPA) and ICI Bucharest. Nobody owns it: its specifications are written by contributors in the open, and public and private sector organisations alike are invited to take part.

Its focus is on precisely the seams described above. Common definitions for transaction events, entities and attribution allow a fiat leg, an on-chain transfer and a case action to be described in the same way by different parties. Requirements for provenance and confidence mean that a label or risk score travels with its source, timing and methodology, so an alert raised by one party can be understood and challenged by another. Reproducible analytical outputs give investigators and supervisors the dated evidence they need to reconstruct not only the flow of funds, but also the decisions taken along the way.

OBIS does not set alert thresholds or replace an institution’s own risk appetite, and it certifies nobody. What it offers is a shared foundation for investigations, attribution, regulatory reporting and supervision, so that the evidence behind a risk decision means the same thing to the bank, the provider, the analytics firm and the authority. The specifications are developed openly, with comments welcome via obistandards.org, ahead of the OBIS Global Launch at the Blockchain Intelligence Forum in Bucharest on 22 April 2027.

Turning analysis into reporting

Standards only help if practitioners know how to apply them. For compliance officers in banks and financial institutions, the most consequential moment is often the decision to file a suspicious transaction or activity report, and the quality of what that report contains.

On 10 December 2026, Diana Pătruț, Project Manager at BIPA, will deliver a full-day course at the Romanian Banking Institute (IBR) dedicated to this question: Reporting of Suspicious Transactions and Activities Involving Cryptoassets (STR/SAR): Best Practices, Challenges and Opportunities. The course covers the essentials of cryptoassets relevant to reporting, risks and red flags, decision criteria for filing, drafting effective STRs and SARs, obfuscation techniques and legal barriers, the use of blockchain analytics, AI and automated monitoring, and cooperation in the European context.

The course runs online on Zoom from 09:00 to 17:00 and carries 7 continuing professional development credits. It is aimed at compliance officers and AML/CFT specialists in banks and financial institutions, as well as supervisory staff and financial investigators. Readers working in these roles are warmly invited to enrol: complete the enrolment form available on the IBR course page and send it to the IBR course coordinator.

From compliance feature to institutional capability

The useful lesson in the current discussion about blockchain-enabled banking is not that every institution should buy the same monitoring tool. It is that institutions supporting the transfer of value across blockchains must decide what evidence they need in order to understand, explain and, where necessary, interrupt a transaction.

Blockchain transparency is valuable, but it is not self-interpreting. The sector will become safer when on-chain observations, customer knowledge and investigative judgement can be connected without losing provenance or context.

For the blockchain intelligence community, this should focus attention on the foundations: interoperable data models, transparent analytical methods, competent practitioners and reviewable evidence. Those are the ingredients that turn monitoring from a compliance checkbox into a reliable institutional capability.

 

Related reading