The crypto industry is quietly completing a maturation that could reshape how firms are evaluated for risk and security. A preview of Chainalysis’ upcoming Crypto Compliance Program Benchmark for 2026 shows a widening gap between where firms were five years ago and where they’re headed today. Nearly half of the organizations onboarding this year are operating with alerting standards that would have ranked them among the strictest 10% back in 2020, signaling a notable tightening of compliance baselines across the sector.

Chainalysis notes that the move toward stronger alerting, tighter trigger sensitivities, and higher minimum detection floors signals both a growing appetite for robust risk controls and a response to intensifying regulatory scrutiny and hacker threats. The firm cites broader standardization in direct monitoring—where funds are traced from known illicit sources—while warning that indirect monitoring, which tracks money as it moves through intermediary addresses, remains a weak point for many players in the space. The 2026 snapshot suggests the industry is embracing more aggressive monitoring from the outset, particularly among newer entrants, even as gaps persist in indirect exposure analysis.

Key takeaways

About 47% of crypto firms onboarded in 2026 use alerting standards that would have placed them in the top decile of strictness in 2020, reflecting a rapid compliance upgrade across the industry.
Direct monitoring—tracking funds from known illicit sources—has become more uniform, but indirect monitoring remains uneven, with many firms applying much higher thresholds to intermediary flows.
The industry has evolved from early norms-setting to aggressive, pre-emptive monitoring, with newer entrants launching with stronger controls than their predecessors.
Regulatory pressure and high-profile security incidents continue to push firms to raise their standards, as highlighted by Chainalysis’ data on evolving risk management practices and the broader security backdrop.

Raising the bar: how compliance norms have evolved

Chainalysis’ preview portrays a crypto landscape where the compliance baseline has climbed meaningfully since the early days of the market. In 2020, only a fraction of market participants met what would now be considered top-tier requirements. By 2026, almost half of newly onboarded firms demonstrate alerting configurations that would have placed them among the most stringent peers just a few years prior. This shift reflects a broader industry push toward standardization, driven by regulators, financial institutions, and the pressing need to deter illicit finance and make the ecosystem more legitimate for mainstream use.

The trend is not merely cosmetic. It translates into more consistent monitoring across firms and a more reliable signal framework for investigators, banks, and other counterparties. Yet the Benchmark also underscores a critical asymmetry: while direct exposure is increasingly scrutinized, indirect exposure—where funds traverse multiple intermediary wallets—still requires more rigorous treatment. This becomes especially relevant as funds increasingly move through flows that may not immediately reveal their origin, complicating due diligence and risk scoring.

“This is a sign of rapid ecosystem maturation. Standard compliance configurations today would have been considered industry-leading just five years ago. The industry financial institutions are joining has already built substantial compliance infrastructure, and the bar continues to rise.”

Direct vs. indirect monitoring: closing the risk gap

One of the standout messages from Chainalysis is the persistent gap between direct and indirect monitoring. Direct monitoring benefits from clearer provenance: funds arriving from known illicit sources can trigger alerts at lower thresholds and with greater immediacy. Indirect monitoring, by contrast, must contend with a web of intermediary addresses and mixed flows, which often pushes alert thresholds higher to avoid excessive false positives. Chainalysis notes that for categories such as ransomware operations, fraud shops, scams, and darknet marketplaces, indirect thresholds can be 10 to 20 times higher than direct ones.

The practical consequence is a risk-spotting blind spot that sophisticated malactors could exploit. Firms that close the gap—implementing more rigorous monitoring for indirect exposure—stand to gain greater regulatory defensibility and become more credible counterparties in the eyes of banks, regulators, and institutional clients. In other words, better indirect risk controls translate into tangible commercial and compliance advantages, not merely theoretical improvements in risk culture.

“The data in this chapter point to an industry in transition, one that has professionalized its approach to direct exposure but which may not yet be treating indirect risk with equivalent rigor.”

The broader context: security, regulation, and market implications

The push toward stronger compliance and monitoring standards comes amid heightened cybersecurity threats and regulatory scrutiny. Chainalysis highlights a sobering backdrop: in 2025, North Korean‑affiliated hackers were responsible for an estimated $2 billion in crypto losses. That casualty count—reflecting both theft and trickier attribution—has intensified calls for more resilient controls and better visibility across cross-border flows. For exchanges, wallet providers, and custodians, the implications are clear: stronger alerting, clearer provenance, and more disciplined risk scoring are no longer optional enhancements but core competencies that impact trust, counterparties, and capital flows.

As the industry leans into tighter standards, market participants are watching for how these norms will be codified in ongoing regulatory developments. The Benchmark’s findings suggest that the market is not merely responding to rulemaking but proactively raising internal benchmarks to align with what regulators may eventually require. In practice, this means exchanges and wallets may need to justify lower risk footprints, demonstrate more granular transaction labeling, and publish transparent telemetry on alerting performance and resolution timelines. For users and investors, improved risk signals could translate into more predictable on-ramping experiences and greater confidence in participating at scale.

What to watch next

The full Crypto Compliance Program Benchmark 2026 is expected to delve deeper into how different types of entities—exchange operators, custodians, and non-custodial wallets—compare in their alerting, detection floors, and remediation workflows. Investors will want to monitor whether the indirect monitoring gap narrows meaningfully in the coming year and how regulators may respond to the industry’s demonstrated willingness to professionalize risk controls. The trend toward higher baseline compliance is likely to continue, potentially reshaping partnerships, licensing routes, and the competitive landscape as firms strive to demonstrate credible risk management to traditional financial counterparts.

According to Chainalysis, the ongoing convergence of best practices across the industry indicates more than incremental improvement; it signals a structural shift in how crypto firms are measured for safety and reliability. As newer entrants bring more aggressive monitoring to market and legacy players lift their own thresholds, the overall ecosystem should become more navigable for users and more defensible against illicit activity—while still leaving room for further refinement in indirect exposure controls.

Readers should keep an eye on the forthcoming publication of the full benchmark for granular findings, including sector-by-sector comparisons and regional variations. The next steps will likely illuminate which subsegments are leading the way in closing the indirect risk gap and how regulators interpret these changes in the context of evolving anti-financial-crime frameworks.

Source data and analysis: Chainalysis, Crypto Compliance Program Benchmark 2026 (preview).