[Paper] SoK: Web3 RegTech for Cryptocurrency VASP AML/CFT Compliance
Source: arXiv - 2512.24888v1
Overview
The paper SoK: Web3 RegTech for Cryptocurrency VASP AML/CFT Compliance maps the emerging landscape of regulatory‑technology (RegTech) tools that are built natively for blockchain. By systematically reviewing both commercial platforms and academic prototypes, the authors show how decentralized ledgers can be turned into a compliance advantage—enabling real‑time risk scoring, cross‑chain transaction tracing, and privacy‑preserving verification that traditional, centralized AML solutions struggle to provide.
Key Contributions
- Three‑tier taxonomy that structures the Web3 RegTech space:
- Regulatory paradigm evolution across ten dimensions (e.g., governance, data sovereignty, enforcement).
- Compliance protocol taxonomy with five verification layers (identity, transaction, smart‑contract, cross‑chain, privacy).
- RegTech lifecycle framework covering preventive, real‑time, and investigative phases.
- Comprehensive dataset: 41 operational commercial platforms + 28 academic prototypes (2015‑2025) collected via a systematic literature review.
- Technical insights on how blockchain‑native properties (immutability, transparency, programmability) enable novel AML/CFT capabilities such as graph‑based money‑laundering detection and on‑chain risk scoring.
- Gap analysis that pinpoints mismatches between academic research (e.g., zero‑knowledge proof‑based privacy checks) and industry adoption (e.g., limited cross‑chain monitoring).
- Best‑practice blueprint for building scalable, privacy‑respecting RegTech architectures that stay true to Web3’s decentralization ethos.
Methodology
- Systematic literature review – Queried major scholarly databases, conference proceedings, and pre‑print servers for works published between 2015 and 2025 that address AML/CFT in the context of cryptocurrencies and decentralized finance (DeFi).
- Commercial platform audit – Examined publicly available documentation, API specs, and demo environments of 41 live RegTech products (e.g., Chainalysis, CipherTrace, TRM Labs).
- Taxonomy construction – Applied grounded‑theory coding to extract recurring themes and organize them into the three taxonomies above.
- Comparative analysis – Mapped each solution onto the taxonomies, quantifying coverage across verification layers, lifecycle phases, and regulatory dimensions.
- Synthesis of findings – Distilled patterns, overlaps, and blind spots into actionable design recommendations and a research agenda.
The approach is deliberately high‑level: rather than diving into low‑level cryptographic proofs, the authors focus on architectural primitives (smart‑contract hooks, on‑chain analytics pipelines, cross‑chain bridges) that developers can recognize and reuse.
Results & Findings
| Aspect | What the study found |
|---|---|
| Transaction graph analysis | 78 % of commercial tools already provide on‑chain graph analytics; academic prototypes push this further with multi‑hop, cross‑chain graph stitching. |
| Real‑time risk assessment | 62 % of platforms support streaming risk scores; only a handful (e.g., Fireblocks AML) integrate on‑chain smart‑contract event triggers. |
| Cross‑chain analytics | Major gap: <30 % of solutions can trace assets across EVM‑compatible chains, let alone non‑EVM networks (Polkadot, Cosmos). |
| Privacy‑preserving verification | Academic work demonstrates zero‑knowledge proof (ZKP)‑based AML checks, but no commercial product has yet deployed them at scale. |
| Scalability | Most platforms rely on off‑chain indexing services (TheGraph, custom ETL pipelines). Scaling to >100 M daily transactions remains an open engineering challenge. |
| Regulatory alignment | The ten‑dimensional paradigm shows that most tools focus on “transaction monitoring” and “sanctions screening,” while “governance transparency” and “user sovereignty” are largely ignored in practice. |
Overall, the paper confirms that Web3‑native RegTech can achieve capabilities impossible in legacy finance (e.g., deterministic on‑chain audit trails), yet adoption is uneven, especially where privacy and cross‑chain interoperability are concerned.
Practical Implications
- Developers building VASPs: Use the taxonomy as a checklist of compliance hooks to embed directly into smart contracts or wallet SDKs (identity attestation, on‑chain risk flags, automated sanctions checks).
- Security/ops teams: Integrate real‑time graph analytics APIs (e.g., Chainalysis KYT) into SIEM pipelines to trigger automated transaction freezes or alerts without waiting for off‑chain investigations.
- DeFi protocol engineers: Address the cross‑chain analytics gap by exposing standardized event schemas (via EIP‑xxxx) that third‑party RegTech can consume, reducing the need for proprietary monitoring layers.
- Privacy‑focused projects: The research‑industry gap signals a market for ZKP‑based AML modules that verify compliance without revealing user balances—a potential differentiator for privacy‑first blockchains.
- Product managers: Apply the lifecycle framework (preventive → real‑time → investigative) to roadmap planning, ensuring compliance is baked in from onboarding (KYC) through post‑transaction forensic tooling.
In short, the paper equips tech teams with a roadmap to embed compliance as a first‑class feature, rather than an after‑thought bolt‑on.
Limitations & Future Work
- Scope of data – The commercial audit relies on publicly disclosed features; proprietary capabilities (e.g., internal risk models) may be under‑represented.
- Rapid ecosystem change – The study’s cut‑off is early 2025; newer protocols (e.g., Layer‑2 rollups, cross‑chain bridges) could shift the landscape dramatically.
- Performance metrics – While architectural patterns are described, quantitative benchmarks (latency, throughput) for each verification layer are missing.
Future directions suggested by the authors include:
- Building open standards for cross‑chain AML event propagation.
- Scaling ZKP‑based compliance checks to high‑throughput environments.
- Creating shared, privacy‑preserving data pools that enable collaborative risk scoring across competing VASPs.
Bottom line: This SoK paper demystifies the “RegTech for Web3” buzzword, delivering a practical taxonomy and a clear set of engineering challenges. For developers, security engineers, and product leaders navigating the AML/CFT minefield in decentralized finance, it offers both a checklist of what’s possible today and a vision of what could be built tomorrow.
Authors
- Qian’ang Mao
- Jiaxin Wang
- Ya Liu
- Li Zhu
- Jiaman Chen
- Jiaqi Yan
Paper Information
- arXiv ID: 2512.24888v1
- Categories: cs.CR, cs.SE
- Published: December 31, 2025
- PDF: Download PDF