Scaling Crypto Transaction Monitoring Without Scaling Cost
The Core Problem: Alert Volume Versus Team Capacity
Every crypto compliance function sits somewhere between two failure modes. The first is missing genuine risk because analysts are overwhelmed by volume. The second is spending so much on analyst time and investigation tooling that compliance becomes a drag on growth rather than an enabler of it.
The standard industry response to rising alert volumes has been additive: more analysts, more licences for investigation platforms, more training. Each of those things costs money, and none of them reduces the actual work each alert requires. The cost curve therefore rises roughly in parallel with transaction volume, which is not a sustainable model for any business that expects to grow.
Why the Investigation Layer Is Not the Right Default
Elliptic distinguishes two distinct layers in a crypto compliance architecture. The screening layer detects risk in real time as transactions are processed. The investigation layer provides the forensic depth needed for cases that may end in a Suspicious Activity Report (SAR) filing, a law enforcement referral, or regulatory escalation requiring evidence-grade documentation.
Investigation environments are genuinely powerful, but they are also expensive and require trained specialists. They were designed for depth, not speed. Routing every alert through that layer regardless of its complexity treats a low-risk operational flag with the same resource intensity as a sophisticated obfuscation case. That is the architectural mismatch that drives cost.
The 95-5 Split: What Alert Populations Actually Look Like
Based on Elliptic's experience across thousands of monthly alerts handled by compliance teams at cryptoasset businesses and traditional financial institutions, roughly 95% of alert volume is operational triage. These are alerts that need fast, contextual resolution, a defensible decision with adequate documentation, but not a courtroom-ready evidence pack. Only about 5% of alerts require the depth of forensic investigation the heavyweight layer was built for.
The practical implication is significant. If a compliance team's architecture routes the majority of that 95% through the investigation environment, it is consuming the most expensive resource in the programme for work that could and should be resolved at the screening layer. The ratio of alerts resolved at each layer, more than headcount or tooling spend in isolation, determines the cost profile of the compliance function.
What "Defensible Resolution at the Screening Layer" Requires
For the screening layer to handle the operational majority without pushing cases unnecessarily into investigation, analysts need three things available at the moment an alert is generated: a visualisation of the relevant on-chain fund flows, the existing customer-level context the business already holds on the counterparty, and a plain-language summary of what the risk indicators actually mean.
Without those three elements, even a straightforward alert can feel unresolvable at first review, which prompts escalation not because the case needs investigation but because the reviewer lacks the context to reach a confident decision. That escalation is where cost accumulates.
Architectural Design: Screening and Investigation as One Workflow
Elliptic's published position describes its two products, Lens for screening and Investigator for forensic casework, as two stages of a single workflow rather than two separate tools. The design intent is that the operational 95% of alerts are resolved within Lens, while genuine escalations carry their full context into Investigator automatically. Analysts starting an investigation do not rebuild the picture from scratch; the risk graph and customer context developed during screening travel with the case.
Automatic Risk Graph Surfacing
A key element of the screening layer's design is that the risk graph, a visualisation of on-chain relationships connected to the flagged transaction, is generated automatically when an alert fires. Analysts do not spend time constructing fund-flow diagrams before they can begin interpretation. They start with the picture already in front of them, which means their time goes into judgment rather than assembly. Consistency improves as a by-product: every reviewer working from the same automatically generated graph applies a more uniform analytical standard than teams relying on manually constructed visualisations.
AI-Assisted Summarisation
Elliptic describes an AI-assisted layer within its screening product that reads entity risk data and presents the relevant facts in plain language. The intended effect is that a reviewer absorbs in seconds what would otherwise require several minutes of manual interpretation across multiple data points. For high-volume operations processing thousands of alerts a month, that compression of per-alert time is the mechanism through which the screening layer becomes viable for the operational majority.
When Investigation Is the Right Answer
The architecture is not built on the premise that investigation is unnecessary. It is built on the premise that investigation should be reserved for the cases it was designed for. Elliptic identifies a specific set of scenarios that warrant forensic depth: fund flows routed through bridges and decentralised exchanges using sophisticated obfuscation patterns, cases requiring prosecutorial-quality support for asset recovery, and regulatory escalations where evidence-grade documentation is non-negotiable. Those cases are not resolved at the screening layer, and the architecture does not attempt to force them there.
Compliance, Accounting, and Audit Implications for Firms
For accounting firms, CFOs, and compliance leaders at cryptoasset businesses, the argument Elliptic is making has implications that extend beyond AML tooling selection.
Cost Structure and the Compliance Budget
If alert-to-analyst ratios are currently forcing the majority of operational triage through an investigation-grade environment, the compliance cost per transaction is higher than it needs to be. That is a budgeting and resourcing question as much as an operational one. Firms using digital asset accounting software to track transaction volumes already have the data to model what a shift in that routing ratio would mean for analyst capacity and tooling spend. The question worth asking is how many escalations in the last quarter were resolved without producing a SAR or a law enforcement referral, and what that says about where resolution is actually happening.
Audit Trail and Regulatory Defensibility
A recurring concern for compliance functions under regulatory scrutiny is documentation quality. Regulators examining AML programmes expect to see not just that a decision was made but how and on what basis. Elliptic's design captures actions, notes, and risk context as screening decisions are taken, creating an audit trail by default rather than retrospectively. For firms operating under Financial Action Task Force (FATF) guidance, the EU's Anti-Money Laundering Regulation (AMLR), or equivalent national frameworks, that embedded documentation is a direct response to regulatory expectation.
Talent Scarcity and Onboarding Costs
Crypto compliance talent is scarce globally. The time required to bring a new analyst to the standard regulators expect has historically been measured in months, not weeks. If the architecture provides risk context, a pre-built graph, and an AI-generated plain-language summary by default, the gap between a junior and a senior analyst's output narrows. That has direct implications for how firms model their hiring plans and what they budget for training. It also affects the risk profile of onboarding: a new analyst working in an environment that surfaces context automatically is less likely to make a consequential error during the period when they are still building judgment.
Connecting AML Architecture to the Broader Compliance Stack
For firms that use crypto bookkeeping software or broader digital asset accounting software to manage transaction records, the link between that layer and the AML screening layer matters. The customer-level context that makes screening decisions defensible, entity profiles, transaction history, counterparty flags, sits in the accounting and client data the firm already holds. The degree to which that context is automatically available within the screening environment, rather than requiring analysts to switch between systems, is a practical operational question as much as a product one. Firms reviewing their compliance architecture should treat data connectivity between the accounting layer and the AML layer as a core requirement rather than a nice-to-have. For a broader discussion of how crypto accounting software connects to compliance obligations, our crypto compliance reporting pillar covers the full stack.
Firms tracking enforcement patterns should also be aware of how AI-driven blockchain analytics for AML detection is developing, as well as the specific AML red flags compliance teams face with crypto bridge hacks, both of which illustrate where the forensic 5% of alert volume is likely to concentrate.
Frequently Asked Questions
What is the difference between a screening layer and an investigation layer in crypto AML?
The screening layer detects and triages risk in real time as transactions are processed, aiming for fast, defensible resolution of the majority of alerts. The investigation layer provides forensic depth for complex cases that may result in SAR filings, law enforcement referrals, or regulatory escalations requiring evidence-grade documentation. The two serve different purposes and carry different costs.
Why does routing all alerts through investigation tools create a cost problem?
Investigation environments are resource-intensive by design. They require trained specialists and carry higher per-alert costs than a screening tool. When the operational majority of alerts, those that could be resolved with fast contextual review, are pushed through that layer, the compliance cost per transaction is higher than necessary and scales with volume in a way that becomes unsustainable.
What regulators and frameworks govern crypto transaction monitoring documentation?
The Financial Action Task Force (FATF) sets the global standard for virtual asset service provider AML obligations, including record-keeping requirements. At regional level, the EU's Anti-Money Laundering Regulation and the forthcoming AML Authority (AMLA) framework set documentation expectations. National regulators, such as FinCEN in the US and the FCA in the UK, apply their own rules within those frameworks. In each case, firms are expected to demonstrate how and on what basis screening decisions were reached.
How does AI summarisation affect the quality of AML decisions?
AI-assisted summarisation at the screening layer is intended to compress the time an analyst spends assembling and interpreting risk data before reaching a decision. It does not replace analyst judgment; it reduces the manual effort needed to reach the point where judgment can be applied. The regulatory defensibility of the decision still depends on the analyst's assessment, but the quality floor rises when analysts start from a consistent, pre-synthesised risk picture rather than assembling it themselves from raw data.
What should compliance leaders look for when evaluating their current AML architecture?
A useful starting point is examining what proportion of escalations from the screening layer in a given period resulted in a SAR filing or a law enforcement referral. A large gap between escalations and outcomes suggests that cases are being pushed into the investigation environment unnecessarily. Equally worth examining is whether customer-level context is available to reviewers within the screening tool itself or requires switching between systems, and whether screening decisions are documented automatically or retrospectively.
Source: Elliptic
]]>