Pre-Transaction Crypto Compliance: How Far Should You Trace Before Accepting Funds?

Before crediting a crypto deposit, a compliance team must decide whether to accept the funds, request more information, hold the deposit or escalate the case. Effective pre-transaction decision-making in crypto compliance connects the evidence about those funds with the customer’s circumstances, applicable legal requirements and the institution’s acceptance rules.
An identified high-risk link can lead to different outcomes depending on its nature, value and reliability. Missing information can also justify review, even when screening finds no high-risk exposure. Teams need a consistent way to assess these findings, choose an appropriate action and explain the decision to another reviewer.

This guide sets out that process for incoming deposits, from assessing transaction evidence to applying acceptance and escalation rules. Three hypothetical cases show how different findings lead to different decisions and what the supporting record should contain.

How Far Should You Trace Crypto Before Accepting Funds?

There is no universal number of hops that makes a crypto deposit safe to credit. A compliance team should assess whether the available evidence supports a decision under its policy and applicable law, and whether unresolved questions require further tracing, customer information or escalation. The depth of tracing depends on the risk category, exposed value, attribution confidence and customer context.

When the platform can act on that assessment depends on the direction of the transfer:

Global Ledger’s integration with IBM Digital Asset Haven shows the outbound case. This guide concerns the inbound one.

What a Hop Count Can and Cannot Tell You

A hop is an observed transfer step between an attributed source and the screened address, and providers count hops differently. Swaps create extra transfer legs, pooled addresses combine unrelated users’ funds, and bridges can move value out of view. Global Ledger’s scoring follows funds to a stopping point such as an entity, a smart contract or an unhosted wallet, so “depth” depends on where a trace may end.

Global Ledger’s High-Risk Benchmark traced high-risk exposure up to five hops across 99 centralised exchanges between 2021 and 2025. In 2025, the value-weighted average distance was 3.06 hops for sanctions exposure and 1.80 for hacks, according to our sanctions-screening analysis. But these averages don't tell you how far to trace a particular deposit before crediting it.

Distance is one input; our guide to how crypto AML scores reflect exposure and blockchain distance explains how it combines with category and share. A score cannot settle whether the evidence is enough for a particular credit decision.

When Is Tracing Sufficient?

Tracing is sufficient for pre-transaction decision making when the evidence answers the following questions well enough for the applicable rule.

A legal match changes the question

A legally relevant match comes first, and it raises a legal question separate from any historical fund-flow link. For persons subject to US jurisdiction, OFAC states that sanctions obligations are the same for digital and fiat currency, including the duty to block the property of listed persons. Once a match is confirmed, tracing gives way to legal assessment. Platforms under EU, UK or other regimes apply their own rules.

Materiality and attribution confidence

Without a legal match, materiality and confidence carry the assessment. Exposed value, share, path and age show how much of the deposit is connected, and how closely. Confidence depends on the evidence type: a heuristic link deserves less weight than an address published by an authority, while missing data shows only a gap.

Could the next step change the decision?

The decisive question is whether another step could materially change the decision. A further backward hop is worth taking if it could alter the attribution, the exposed amount or the legal position. Once the source is reliably attributed, the open questions often concern the intermediaries: who controls them, whether they keep dealing with the risky source, and how they relate to the customer.

Which rule applies

Finally, the finding has to meet a written rule. The FATF red flag indicators for virtual assets include direct and indirect exposure to known suspicious sources, but FATF notes that a single indicator is not necessarily a basis for suspicion and should be read in context. The rule turns that context into an action.

When to Stop, Continue or Escalate Tracing

Those questions lead to four outcomes, each subject to the institution’s policy and the governing law.

In the fourth row, the record should say whether data sits outside the tool’s coverage or no attributable history exists. Thresholds for the other rows belong in written rules tested on historical alerts; our guide on how to calibrate AML monitoring rules shows how category, value, depth and customer context combine.

How to Decide Whether to Trace Further Before Crediting a Deposit

In practice, the work follows five steps.

1. Screen the specific transaction: hash, asset, network, sending and deposit addresses, amount and timestamp.
2. Read the attributed exposure: source category, link type, exposed value and share, path, age and attribution basis.
3. Choose the direction of extra work: back along the path, sideways to intermediaries, outwards to the customer or to other data sources.
4. Apply the documented rule: credit, credit with monitoring, request information, hold or refer for legal assessment.
5. Close the case with the evidence attached, including any limitation that remains open.

At step four, customer due diligence carries much of the weight. FATF’s red flags include a large initial deposit inconsistent with the customer profile and refusal to answer source-of-funds enquiries, so the customer’s response is evidence in its own right.

Three Deposits, Three different Decisions

The cases below are hypothetical; their outcomes are options a policy might set, not legal conclusions.

Case A: a direct sanctions match ends in blocking

A new customer deposits 4,000 USDT on Tron from an address published in a sanctions designation, and the exchange is subject to US jurisdiction. The analyst confirms the match against the official list entry and escalates to the MLRO and legal team, who confirm a blocking obligation. Under OFAC FAQ 646, that means denying all parties access to the funds, and OFAC FAQ 49 requires the report within 10 business days.

Case B: indirect exposure resolved by review

A corporate customer deposits 18,000 USDT on Tron, a size its profile supports. About 1,200 USDT, roughly 6.7%, is traceable to a sanctioned exchange through four illustrated legs: exchange wallet to wallet X, X to wallet Y, Y to the customer’s wallet, and on to the deposit address. The other 16,800 USDT came from the customer’s own exchange withdrawals, with no identified high-risk link.

Another backward hop would not change the attribution, so the analyst looks sideways instead. X received funds from the sanctioned exchange once, 14 months earlier, with no later contact. The customer identifies Y as the wallet of an OTC counterparty it has traded with for two years and supplies a trade confirmation matching the 1,200 USDT amount and date.

With the indirect exposure reviewed, the OTC transaction documented and no blocking interest identified by legal review, the MLRO approves credit with enhanced monitoring and a review of the OTC counterparty. Repeated receipts by X or Y from the sanctioned source would have pointed to escalation instead.

Case C: a broken route ends in escalation

A new individual customer deposits 30,000 USDC on Ethereum, well above the activity declared at onboarding. Two hours earlier, the sending wallet received the full amount from a bridge contract, where the KYT trace ends with no identified high-risk exposure.

The analyst first checks whether the gap is only a tool limit. The bridge contract’s events identify the source-chain transaction, but that network sits outside the team’s analytics coverage, and a block explorer shows only a newly created address with no attributable history. The customer declines to explain the origin of the funds.

The funds stay uncredited, and the MLRO considers a suspicious activity report under local requirements and reviews the relationship. The decision rests on the unexplained gap and the customer profile.

What a Defensible Decision Record Contains

The record should show what was known at the moment of decision:

• the transaction hash, asset, network, amount and time of screening;
• the risk report as returned, including categories, exposed value, share and path;
• the attribution basis, separating observed transfers from inferred links;
• where tracing stopped and why;
• the rule version, action, reviewer and any customer information received.

Retention depends on the governing regime. Under 31 CFR § 501.601, covered transaction records must remain available for at least 10 years. Records of blocked property must be kept while the property remains blocked and for at least 10 years after unblocking. The extension took effect on 12 March 2025.

The record also anchors reassessment. If a new designation or attribution touches an address on a credited deposit’s path, the team compares it with the preserved evidence and records the outcome without overwriting the original decision. OFAC’s virtual currency guidance describes historical lookbacks after an address is listed as one way to find such connections.

Conclusion

The three deposits ended differently: a confirmed match triggered blocking, the reviewed intermediary path supported credit with monitoring, and an unexplained bridge route required escalation. The stopping point reflected the evidence available for each decision, including the limits of what the team could verify.

Sound pre-transaction decision-making crypto compliance depends on tested, written rules that state which findings end tracing, extend it or require escalation. With those rules, pre-transaction crypto compliance becomes consistent across analysts and defensible months later.

Global Ledger KYT supports that process with Source and Use of Funds analysis, direct and indirect exposure data, tracing, alerts and exportable case history, while the acceptance decision stays with the institution’s policy.

FAQ